# Harun R. Rayhan > Cloud, DevOps, and AWS consultant. I help teams design cloud architecture, automate infrastructure, and ship production systems that stay up. This file indexes the services, writing, and case studies published at https://harun.dev. > > Cite and quote with attribution. Training and retrieval are welcome if you link back. ## Services - [Cloud Architecture](https://harun.dev/services/cloud-architecture): Scalable, secure, and cost-effective cloud architecture design and implementation. - [DevOps](https://harun.dev/services/devops): Modern DevOps practices that streamline development and operations workflows. - [Infrastructure as Code](https://harun.dev/services/infrastructure-as-code): Terraform and IaC tooling for consistent, repeatable, version-controlled infrastructure. - [Serverless Infrastructure](https://harun.dev/services/serverless-infrastructure): Serverless designs that cut operational overhead and cost while scaling on demand. - [Automated Deployment](https://harun.dev/services/automated-deployment): CI/CD pipelines for faster, more reliable software delivery. - [Security Consulting](https://harun.dev/services/security-consulting): Cloud security assessments and hardening across accounts, networks, and workloads. - [Performance Optimization](https://harun.dev/services/performance-optimization): Tuning cloud infrastructure for throughput, latency, and cost efficiency. - [Infrastructure Migration](https://harun.dev/services/infrastructure-migration): Migrations to modern, scalable platforms with minimal downtime. - [MLOps](https://harun.dev/services/mlops): Automated machine learning workflows and the infrastructure that runs them. - [Database Migration](https://harun.dev/services/database-migration): Database moves to cloud platforms with minimal downtime and no data loss. - [Monitoring and Observability](https://harun.dev/services/monitoring-observability): Metrics, logs, and traces that give real insight into infrastructure and apps. - [Database Optimization](https://harun.dev/services/database-optimization): Query, schema, and instance tuning for faster and more reliable databases. - [AWS Cloud](https://harun.dev/services/aws-cloud): AWS consulting across compute, networking, storage, and managed services. - [Multi-Cloud Architecture](https://harun.dev/services/multi-cloud-architecture): Architectures that use the strengths of more than one cloud provider. - [Vibe Scaling](https://harun.dev/services/vibe-scaling): Taking an AI-built app that found real users and making it hold up under real traffic. - [Vibe Code Migration](https://harun.dev/services/vibe-code-migration): Moving an AI-built prototype onto a production language and framework, feature for feature. ## Pages - [About](https://harun.dev/about): Background, experience, and how I work with teams. - [Contact](https://harun.dev/contact): Start a project or ask a question. - [Bio](https://harun.dev/bio): Short bio and links. - [Bio (Bangla)](https://harun.dev/hrr): Bangla bio and links. - [Book a Call](https://harun.dev/book): Book a paid DevOps consultation. - [Products](https://harun.dev/products): Tools and products I build, including Crontinel. - [Case Studies](https://harun.dev/case-studies): Index of client engagements and their outcomes. - [Services](https://harun.dev/services): Index of all consulting services. - [Blog](https://harun.dev/blog): Index of all writing on cloud, DevOps, and AWS. - [Slides](https://harun.dev/slides): Talk decks and presentations. - [Videos](https://harun.dev/videos): Recorded talks and walkthroughs. ## Optional - [Privacy Policy](https://harun.dev/privacy): How data on this site is handled. - [Terms](https://harun.dev/terms): Terms of use for this site. - [Blog RSS Feed](https://harun.dev/blog/feed.xml): Atom feed of blog posts. - [Case Studies RSS Feed](https://harun.dev/case-studies/feed.xml): Atom feed of case studies. - [Sitemap](https://harun.dev/sitemap.xml): XML sitemap of every indexable URL. - [llms-full.txt](https://harun.dev/llms-full.txt): This index with the full text of every post and case study inlined. ## Blog - [Persistence Is Not Permission: Re-Auth RAG Citations on Chat Replay](https://harun.dev/blog/persistence-is-not-permission-rag-citation-reauth-chat-replay): A contractor lost access to a folder in March and could still read the source cards from it in September, because our chat history endpoint served citations that had been authorized once, at write time, and never again. Here's the fix on API Gateway, Lambda, DynamoDB, and pgvector: store citation refs instead of blobs, re-run the live entitlement check on every history read, tombstone what the caller can no longer see, and fail closed on both unknown and denied sessions. - [MCP Went Stateless and Broke My Lambda MCP Server Anyway](https://harun.dev/blog/mcp-stateless-spec-broke-my-lambda-mcp-server): The 2026-07-28 MCP spec deleted the initialize handshake and Mcp-Session-Id, which should have been free for a Lambda server that was already stateless. It wasn't: a CORS allow-list, a missing server/discover, a 404 that should have been a 405, and a notification stream an HTTP API can't hold open all broke behind API Gateway. - [Chunk, Embed, Index: Running RAG Ingestion as a Step Functions State Machine](https://harun.dev/blog/rag-ingestion-pipeline-step-functions-lambda): A re-run of a failed ingestion job left me with duplicate vectors and worse retrieval. Here's the Step Functions state machine I built instead: a Distributed Map over chunks, retries tuned to Bedrock throttling, content-hash idempotency, and a quarantine path for documents that just won't parse. - [When Your App Outgrows the Tool That Built It](https://harun.dev/blog/when-your-app-outgrows-the-tool-that-built-it): A 15-year-old ERP on Zend Framework 1 and an app an AI wrote last week hit the same wall: code that worked yesterday can't carry tomorrow's scale. Here's the migration that turned that pattern into two services. - [AI Endpoints Aren't CRUD: Post-Generate Validation on Lambda + Bedrock + Fastify](https://harun.dev/blog/ai-endpoints-post-generate-validation-lambda-bedrock-fastify): A Bedrock-backed Fastify route on Lambda needs a contract after the model answers, not just before it. Zod on the output, RAG context treated as untrusted data, one repair pass then a 422, idempotent SQS, and the CloudWatch metrics that catch it drifting. - [How I Lock Down Bedrock Access So My Lambda Functions Can't Leak Data Through the LLM](https://harun.dev/blog/lock-down-bedrock-iam-lambda-data-leak): How to scope Bedrock IAM policies per Lambda function, build permission boundaries that block privilege escalation, catch misconfigurations with CloudTrail, and automate guardrails in CI so AI agents can't widen your blast radius. - [Lambda SnapStart with Terraform - Cutting Cold Starts Without the Hacks](https://harun.dev/blog/lambda-snapstart-terraform-cold-starts): How to enable Lambda SnapStart for Java and Python runtimes using Terraform, measure cold start improvements, and compare costs against provisioned concurrency. - [Moving Past Vibe Coding: The Pre-Merge Checklist I Now Run on Every AI-Generated PR](https://harun.dev/blog/pre-merge-checklist-ai-generated-prs): AI agents write code fast. They also write bugs, security holes, and nonsense. Here is the 12-item checklist I run before merging anything an agent touched. - [Running Long AI Workloads on Lambda MicroVMs Without Going Broke](https://harun.dev/blog/lambda-microvm-long-ai-workloads): How to run long AI inference workloads on AWS Lambda MicroVMs with real cost controls, timeout handling, and concurrency management. - [How I Use Step Functions to Orchestrate LLM Workflows Without Chaining Lambdas](https://harun.dev/blog/step-functions-llm-orchestration-replacing-lambda-chains): Lambda chaining for multi-step AI workflows gets messy fast. Failed steps, retries, timeouts, and idle billing. Here is how I replaced manual Lambda chaining with AWS Step Functions for LLM orchestration. - [ECS Fargate Spot + Capacity Providers - Saving 70% on Container Hosting](https://harun.dev/blog/ecs-fargate-spot-capacity-providers): How to use Fargate Spot capacity providers to reduce container costs by up to 70%, with real Terraform configurations and interruption handling strategies. - [Building Bedrock Agents in Production - Knowledge Bases, Action Groups, and Guardrails](https://harun.dev/blog/bedrock-agents-production-knowledge-bases): How to build a production-ready Bedrock Agent with S3 knowledge bases, Lambda action groups, and guardrails, all configured with Terraform. - [AWS WAF + CloudFront for a Solo Dev - Rate Limiting, Bot Control, and IP Blocking](https://harun.dev/blog/aws-waf-cloudfront-solo-dev): How to set up AWS WAF in front of CloudFront for a solo-built application, with rate limiting, bot control, and IP block rules, all managed with Terraform. - [How I Migrated a Lambda AI App to Bedrock’s OpenAI-Compatible APIs Without Rewriting Everything](https://harun.dev/blog/migrated-lambda-ai-app-to-bedrock-openai-compatible-apis-without-rewriting-everything): A practical migration story about moving a Lambda AI app from a custom OpenAI-style integration to Amazon Bedrock without rewriting the whole codebase - [How I Add LLM Observability to a Real AWS App with Langfuse, Lambda, and CloudWatch](https://harun.dev/blog/llm-observability-langfuse-lambda-cloudwatch): How I connect Langfuse, Lambda, and CloudWatch so I can trace prompt behavior, cost, retries, and failures in a production AWS app - [How I Review Terraform and Lambda PRs with AI Before They Merge](https://harun.dev/blog/production-ai-code-review-for-terraform-and-lambda-prs): How I use AI as a first-pass reviewer for Terraform and Lambda pull requests, while keeping human judgment on the risky parts - [How I Make AI Coding Agents Safe in a Real AWS Codebase](https://harun.dev/blog/how-i-make-ai-coding-agents-safe-in-a-real-aws-codebase): The guardrails, permissions, and review flow I use so coding agents can help without touching the wrong AWS resources - [Serverless AI Inference Endpoints with AWS Bedrock and Lambda](https://harun.dev/blog/serverless-ai-inference-endpoints-with-aws-bedrock-and-lambda): I've been building AI APIs for the last year and most of them don't need a GPU server. Seriously. The majority of my inference workloads are just "take this prompt, send it to a model, return the resu - [5 AWS Mistakes That Are Quietly Draining Your Bank Account](https://harun.dev/blog/5-aws-mistakes-quietly-draining-your-bank-account): A client messaged me in a panic last month. Their AWS bill had crossed $3,000 and they had no idea why. They assumed that's just what AWS costs at their scale. A serverless SaaS, decent traffic, nothi - [Multi-Agent Claude Code Routines for AWS DevOps](https://harun.dev/blog/multi-agent-claude-code-aws-devops-routines): One Claude Code Session Isn't Enough Anymore I love a single Claude Code session. It's where most of my real work happens, plan in one pane, code in the other, terminal humming along. But here's the t - [Serverless Laravel Containers with ECS Fargate, App Runner, and Terraform](https://harun.dev/blog/serverless-laravel-containers-with-ecs-fargate-app-runner-and-terraform): When Lambda Isn't Enough In Part 1 of this series I walked through deploying Laravel to AWS Lambda with Bref and Terraform. That setup covers most of what Laravel apps actually need. API endpoints, we - [Building a Multi-Tenant Billing System on AWS Lambda with Stripe](https://harun.dev/blog/multi-tenant-billing-aws-lambda-stripe): In the last post I walked through the multi-tenant auth layer running in front of my Fastify API on AWS Lambda. JWT tokens, hashed API keys, tenant context decorated onto every request. That solved th - [Deploying an MCP Server on AWS Lambda](https://harun.dev/blog/deploying-an-mcp-server-on-aws-lambda): I wanted Claude to be able to query my SaaS's data directly from the chat window. Not through some copy-paste workflow. Not by uploading CSVs. I wanted to type "show me the top 10 users by activity th - [How I Set Up CI/CD for AWS Lambda and Terraform with GitHub Actions](https://harun.dev/blog/github-actions-lambda-terraform-cicd): For years I deployed Lambda functions by zipping the dist folder on my laptop and running aws lambda update-function-code from a terminal. It worked. It also failed at 11pm on a Friday when I forgot t - [Serverless Laravel on AWS Lambda with Bref and Terraform](https://harun.dev/blog/serverless-laravel-on-aws-lambda-with-bref-and-terraform): Why Bref Instead of Vapor Laravel Vapor is the official serverless deployment tool for Laravel. It works. I've used it on two client projects. But it costs $399 per year just for the subscription, and - [Building a Multi-Tenant SaaS Auth Layer on AWS Lambda with Fastify](https://harun.dev/blog/multi-tenant-saas-auth-lambda-fastify): I have a production SaaS running on AWS Lambda with Fastify. Single tenant, single customer, everything working great. Then the second customer signed up. That's when things got interesting. Suddenly - [Deploying a Laravel Application to Amazon EC2 Using Terraform](https://harun.dev/blog/deploying-a-laravel-application-to-amazon-ec2-using-terraform): Not everything needs to be serverless. I know, I know. I literally write about Lambda and API Gateway all the time. But look, sometimes you just need a single EC2 instance running your Laravel app and - [Building a Production RAG Pipeline on AWS Lambda and pgvector](https://harun.dev/blog/building-a-production-rag-pipeline-on-aws-lambda-pgvector): I was knee-deep in building my SaaS when users started asking questions I couldn't answer from the UI alone. My app had a solid backend, Lambda functions, Fastify, PostgreSQL on RDS. I wrote about tha - [Claude Code for AWS Infrastructure: My Agentic DevOps Workflow with Terraform](https://harun.dev/blog/claude-code-for-aws-infrastructure-agentic-devops-workflow-with-terraform): Every AI Demo Ignores Infrastructure Every AI coding tool tutorial follows the same script. They show you editing a React component, refactoring a Python function, or generating a REST endpoint. Cool. - [Everything New in Laravel 13: The Complete Guide](https://harun.dev/blog/everything-new-in-laravel-13): Laravel 13 dropped on March 17, 2026, and I've spent the last two days digging through every commit, PR, and doc page. There's a lot to unpack here. This isn't one of those "minor version bump" releas - [Running OpenClaw on Amazon EC2 with Claude and Telegram](https://harun.dev/blog/running-openclaw-on-amazon-ec2-with-claude-and-telegram): I stumbled on OpenClaw a few weeks ago and immediately wanted to try it. The pitch is straightforward: it's an open-source AI gateway that connects LLMs to messaging platforms like Telegram, Discord, - [Running AI Background Jobs Serverlessly with SQS + Lambda + Bedrock](https://harun.dev/blog/running-ai-background-jobs-serverlessly-with-sqs-lambda-bedrock): Queue document analysis, summarization, and classification with SQS. Process them with Lambda and Bedrock. No servers, no polling, no wasted spend. - [Real-Time AI Chat with Lambda + API Gateway WebSockets](https://harun.dev/blog/real-time-ai-chat-with-lambda-api-gateway-websockets): Stream LLM responses over WebSockets with a fully serverless backend. No EC2, no containers. Just Lambda, Bedrock, and DynamoDB. - [How I Architected a Fully Serverless SaaS on AWS Lambda with Fastify](https://harun.dev/blog/how-i-architected-a-fully-serverless-saas-on-aws-lambda-with-fastify): I recently built a multi-tenant SaaS API from scratch. The product uses AI models under the hood and re-trains them regularly on new data. The requirements were pretty clear: low operational overhead, - [How to Use AWS SageMaker for HIPAA-Compliant Data: A Complete Guide](https://harun.dev/blog/how-to-use-aws-sagemaker-for-hipaa-compliant-data-a-complete-guide): Healthcare organizations are increasingly turning to machine learning to improve patient outcomes, reduce costs, and enhance operational efficiency. However, when working with protected health information (PHI), compliance with the Health Insurance P... - [Deploy Laravel Application to Amazon EC2 Instance](https://harun.dev/blog/deploy-laravel-application-to-amazon-ec2-instance): Everyone loves to deploy their applications to the Amazon EC2 instance. It's easy to deploy and maintain. This tutorial will launch a Laravel application to an EC2 instance. What is EC2? Amazon Elastic Compute Cloud (EC2) is one of the first offering... - [How to Start Learning AWS Cloud ☁️ and Get Certified 🚀](https://harun.dev/blog/how-to-start-learning-aws-cloud-and-get-certified): Hi 👋I recently passed the last and final AWS certifications. I am now fully AWS certified with all 12 certifications under my belt. Software engineers from all different levels frequently asked me how I learned AWS and how they should get started. O... - [First 3 things I always do after creating a new AWS account](https://harun.dev/blog/first-3-things-i-always-do-after-creating-a-new-aws-account): As part of my job, I create AWS accounts frequently. I do lots of things depending on account needs before starting to use it. I found 3 common things I do with all of the new AWS accounts. I made a checklist. Nowadays I do these 3 things first and t... - [Install Cloud Watch Agent in Amazon Lightsail instance for Monitoring, Logging & Debugging](https://harun.dev/blog/install-cloud-watch-agent-in-amazon-lightsail-instance-for-monitoring-logging-and-debugging): Use the Cloud Watch agent to send logging and debugging to Cloud Watch. You can check logs without logging into instances. It's accessible even after the instance is terminated. Life is far from perfect, and so does Amazon Lightsail instances. It can... - [Connect Redis/Elasticache to application in Amazon Lightsail instance](https://harun.dev/blog/connect-redis-elasticache-to-application-in-amazon-lightsail-instance): You can create Redis/Elasticache even though Amazon Lightsail doesn't offer it. You can create an Elasticache for Redis cluster in AWS and connect using VPC Peering. Prerequisites An Amazon Lightsail instance. To create a new instance follow Deploy... - [Add Lightsail Load Balancer to Application hosted in Amazon Lightsail instance(s)](https://harun.dev/blog/add-lightsail-load-balancer-to-application-hosted-in-amazon-lightsail-instances): Lightsail offers Load Balancer. It's very easy to provision one and attach one or multiple instances to it. Let's create one and attach instances to it. Prerequisites You need one or more Amazon Lightsail instances to attach to the load balancer in ... - [Add Database to Application hosted in Amazon Lightsail](https://harun.dev/blog/add-database-to-application-hosted-in-amazon-lightsail): Amazon Lightsail offers dedicated Databases. You can make use of it instead of an on-instance database. It's easy, managed, secure, and most importantly it's not tied to the instance. So, your database will be safe even if instance crashes. In "Deplo... - [Deploy Laravel Application to Amazon Lightsail](https://harun.dev/blog/deploy-laravel-application-to-amazon-lightsail): Amazon Lightsail is a fixed monthly priced VPS service offered by AWS. Once you install the OS of your choice, you can run almost any application. In this application, I'm showing how to deploy one of my favorite backend frameworks called Laravel. Wh... - [Snapshot and Restore of Amazon Lightsail Instance to Lightsail/EC2](https://harun.dev/blog/snapshot-restore-of-lightsail-instance-to-lightsail-ec2): Taking regular backup/snapshots of a production application is important. It is one of the main requirements of a disaster recovery(DR) plan. But snapshots are not only for DR, you can use them to move/clone instances to different regions or availabi... - [Add (Cloudfront) CDN Distribution to WordPress Application hosted on Amazon Lightsail](https://harun.dev/blog/add-cloudfront-cdn-distribution-to-wordpress-application-hosted-on-amazon-lightsail): It's not very hard to add CDN Distribution to a WordPress app hosted on Amazon Lightsail. But if you are new, it can be cumbersome. This article is to demonstrate how to do it easily. Why Should I use CDN distribution? You might hear about Content D... - [Deploy WordPress App to Amazon Lightsail](https://harun.dev/blog/deploy-wordpress-app-to-amazon-lightsail): Introduction AWS Lightsail can be the easiest entry to the AWS Cloud. It has fixed monthly pricing unlike most other services, so you don't have to worry about a huge monthly bill. Lightsail is really great for small to medium apps. It has out-of-th... ## Case Studies - [Polaris](https://harun.dev/case-studies/polaris): The ERP ran on Zend Framework 1, a PHP framework roughly 15 years old. It couldn't scale, had lost community and vendor support, was hard to hire for, and carried security and compliance gaps while feature work slowed to a crawl.