Aws

In 2022 I swapped the cryptographic library under DynamoDB’s TLS termination from OpenSSL 1.0.2 to AWS-LC and deployed it to every AWS region with zero downtime, on a database serving hundreds of billions of requests an hour. Median handshake time dropped 12–35% by region, and FIPS endpoints dropped as much as 80%. This is the internal ops-win announcement rewritten for the public, including what the integration required — modifying Nginx source against a new crypto API, a legacy build system, Amazon’s deployment machinery, and cryptographic correctness requirements — and the two problems the rollout surfaced.

At Amazon I designed, built, tested, and deployed public phone-number APIs for Amazon Connect, in Java, released globally, for Connect users provisioning numbers for their contact centers. In Connect a phone number is a cloud resource with an ARN, tags, an asynchronous provisioning workflow, and a quota rule limiting how often numbers can be claimed and released. This post covers the API surface and the design decisions encoded in the contract.