https://chris-zeng.pages.dev/tags/dynamodb/ Recent content in Dynamodb on Chris Zeng https://chris-zeng.pages.dev/img/headshot.jpg https://chris-zeng.pages.dev/img/headshot.jpg Hugo en-us Wed, 05 Aug 2026 00:00:00 +0000 https://chris-zeng.pages.dev/posts/dynamodb-tls-aws-lc/ Wed, 05 Aug 2026 00:00:00 +0000 https://chris-zeng.pages.dev/posts/dynamodb-tls-aws-lc/ In 2022 I swapped the cryptographic library under DynamoDB’s TLS termination from OpenSSL 1.0.2 to AWS-LC and deployed it to every AWS region with zero downtime, on a database serving hundreds of billions of requests an hour. Median handshake time dropped 12–35% by region, and FIPS endpoints dropped as much as 80%. This is the internal ops-win announcement rewritten for the public, including what made it hard — modifying Nginx source against a new crypto API, a legacy build system, Amazon’s deployment machinery, and cryptography where mistakes are quiet — and the two ways the rollout bit back.