I engineer cloud platforms teams can trust.

Three OpenVPN Access Server hosts, one each for development, staging, and production, were running on an end-of-life operating system that could not support the required server upgrade. Replacing them had to preserve public addresses, certificates, configuration, and existing client profiles for approximately 260 user accounts.

Built one parameterized CloudFormation template and two idempotent Systems Manager documents to reproduce, migrate, and reconcile all three environments. Each replacement was validated end to end before cutover, including account counts, certificate authority data, licensing, tunnel connectivity, DNS, and private-network access. The migration also removed public SSH, restricted administration through Session Manager, raised minimum TLS to 1.2, and encrypted storage.

A containerized service received HTTP 403 responses when calling a public regional API. The failure had been escalated as a permissions problem, but an interface VPC endpoint with private DNS enabled was overriding the regional API hostname and routing the request through a policy intended only for selected private APIs.

Delivered an in-place Terraform change through a development-first rollout. The endpoint retained its identifier and no dependent resources were replaced. Validation confirmed both required conditions: the public API resolved publicly and succeeded, while the private APIs continued resolving through the VPC endpoint. The reviewed change was then rolled through the remaining environments.

An internal database operations service had working application code but no production-grade deployment workflow. It needed to run inside an existing AWS environment, support separate API and worker processes, consume a private shared dependency, and reach databases on connected development, staging, and production networks.

Delivered healthy API and worker services behind an internal load balancer, with an auditable multi-source deployment pipeline, scoped IAM, and dedicated logging. The service went live in development and unblocked the downstream UI team within one week.

Reworked a Lambda-backed Alexa currency skill after its generic invocation name competed with other public skills and prevented requests from consistently reaching the correct endpoint. The replacement needed distinctive voice routing, strict development and production isolation, resilient provider handling, and a controlled certification process.

Published Currency Genie to the Alexa Skills Store with country and currency rate lookups, spoken amount conversion, multi-turn sessions, repeat support, and voice-friendly formatting. Added separate development and production Lambda lanes, automated tests, sanitized CloudWatch logging, OIDC-based deployments, and explicit certification and publication controls.

Python CLI that discovers and tags AWS resources for the AWS Migration Acceleration Program (MAP) in multiple customer accounts and regions. I created it to replace the AWS Tag Editor console workflow, which throttles silently after about 28 resources and cannot discover resources with zero existing tags.

Raised single-run tag application success from 16% to 99% on 1,200+ CloudWatch Log Groups using exponential backoff retry. Reached zero-tagged RDS instances, EC2, EBS volumes, and Lambda functions invisible to the Resource Groups Tagging API via service-specific deep discovery in multi-account customer environments.