Aws

In 2022 I swapped the cryptographic library under DynamoDB’s TLS termination from OpenSSL 1.0.2 to AWS-LC and deployed it to every AWS region with zero downtime, on a database serving hundreds of billions of requests an hour. Median handshake time dropped 12–35% by region, and FIPS endpoints dropped as much as 80%. This is the internal ops-win announcement rewritten for the public, including what made it hard — modifying Nginx source against a new crypto API, a legacy build system, Amazon’s deployment machinery, and cryptography where mistakes are quiet — and the two ways the rollout bit back.

At Amazon I designed, built, tested, and deployed public phone-number APIs for Amazon Connect — in Java, globally, to support Connect users provisioning numbers for their contact centers. A phone number looks like a string; in Connect it’s a cloud resource with an ARN, tags, an asynchronous provisioning workflow, and a quota rule that stops you from churning numbers. This is a tour of the API surface and the design decisions you can read in the contract itself.