Sandro Volpicella

Master Amazon S3 in One Page | AWS Fundamentals Object storage essentials from storage classes to lifecycle policies - everything on one page.

For buckets with millions of tiny files (<128KB).
Because the monitoring fee per object will eat up your savings.

But for logs, media, and backups?
It is the best default setting in AWS.

We broke down all the storage classes in this infographic:
awsfundamentals.com/infographic...

If you suddenly need to read that file?
It opens instantly.
And you pay 𝐙𝐞𝐫𝐨 retrieval fees.

This is the killer feature.
With standard Glacier, reading your own backup is a hassle.
With Intelligent Tiering, you don't even notice it happened.

The only time I don't use it?

The fear of needing the data back.

Here is why it is different:
You get the cost savings of archive storage, but the performance of S3 Standard.

If your data sits there for 90 days?
AWS moves it to the Archive Instant Access tier.
You save ~68% on storage.

Everyone tells you to move old data to Glacier to save money.
But they usually forget to mention the pain.

• Retrieval fees hurt.
• Waiting 5-12 hours for data sucks.

That is why I prefer 𝐒𝟑 𝐈𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐭-𝐓𝐢𝐞𝐫𝐢𝐧𝐠.

It solves the biggest problem with archiving:

AWS Fundamentals Newsletter Learn AWS skills that actually work in production. Join 10k+ engineers mastering real-world cloud architecture

Most of these take 5 minutes to set up.
But they save you weeks of headaches later.

Join 11,000+ devs learning real-world AWS: awsfundamentals.com/newsletter

8. 𝐓𝐮𝐫𝐧 𝐨𝐧 𝟐𝐅𝐀. This should be non-negotiable for every maintainer.
9. 𝐔𝐬𝐞 𝐠𝐫𝐚𝐧𝐮𝐥𝐚𝐫 𝐭𝐨𝐤𝐞𝐧𝐬. Don't use your personal token for CI/CD. Use automation tokens.
10. 𝐖𝐚𝐭𝐜𝐡 𝐨𝐮𝐭 𝐟𝐨𝐫 𝐭𝐲𝐩𝐨𝐬. `react` is not `rceact`. Typosquatting is real.

6. 𝐏𝐫𝐨𝐭𝐞𝐜𝐭 𝐲𝐨𝐮𝐫 𝐬𝐮𝐩𝐩𝐥𝐲 𝐜𝐡𝐚𝐢𝐧. Consider a local proxy like Verdaccio to control what comes in.
7. 𝐃𝐨𝐧'𝐭 𝐥𝐞𝐚𝐤 𝐯𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐢𝐞𝐬. If you find a bug, report it privately. Don't put it on Twitter.

4. 𝐂𝐡𝐞𝐜𝐤 𝐲𝐨𝐮𝐫 𝐩𝐫𝐨𝐣𝐞𝐜𝐭 𝐡𝐞𝐚𝐥𝐭𝐡. `npm outdated` and `npm doctor` are built-in tools. Use them.
5. 𝐒𝐜𝐚𝐧 𝐟𝐨𝐫 𝐯𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐢𝐞𝐬. Make `npm audit` part of your CI pipeline.

2. 𝐋𝐨𝐜𝐤 𝐲𝐨𝐮𝐫 𝐝𝐞𝐩𝐞𝐧𝐝𝐞𝐧𝐜𝐢𝐞𝐬. Don't just install. Use `npm ci` or `yarn install --frozen-lockfile` to ensure everyone uses the exact same version.
3. 𝐁𝐥𝐨𝐜𝐤 𝐦𝐚𝐥𝐢𝐜𝐢𝐨𝐮𝐬 𝐬𝐜𝐫𝐢𝐩𝐭𝐬. Attackers love post-install hooks. Add `--ignore-scripts` to your install commands.

1. 𝐒𝐭𝐨𝐩 𝐩𝐮𝐛𝐥𝐢𝐬𝐡𝐢𝐧𝐠 𝐬𝐞𝐜𝐫𝐞𝐭𝐬. It happens faster than you think. Use `.npmignore` and always dry-run before publishing.

We pull in thousands of dependencies. We trust them blindly.
That is a mistake. 💣

OWASP just released their top 10 security practices for NPM.
I went through them so you don't have to.

Here is what you need to change in your workflow:

Master AppSync in One Page | AWS Fundamentals GraphQL on AWS - schemas, resolvers, and real-time subscriptions in one visual guide.

AppSync has great SDKs that handle offline data synchronization automatically.

Stop the back-and-forth. Let the frontend drive.

Grab our full visual guide here
awsfundamentals.com/infographic...

You can cache specific fields or full queries. No need to spin up a separate Redis instance.

🔐 𝐅𝐢𝐧𝐞-𝐆𝐫𝐚𝐢𝐧𝐞𝐝 𝐀𝐜𝐜𝐞𝐬𝐬
Control who sees what. You can use @auth directives to lock down specific fields based on user groups.

📱 𝐎𝐟𝐟𝐥𝐢𝐧𝐞 𝐒𝐮𝐩𝐩𝐨𝐫𝐭

Two weeks later, the endpoint is updated. 🐢

This friction kills velocity.

AppSync removes the bottleneck entirely.
It lets the frontend query exactly what they need, when they need it.

Here is why developers love it

🛠️ 𝐁𝐮𝐢𝐥𝐭-𝐢𝐧 𝐂𝐚𝐜𝐡𝐢𝐧𝐠

Sometimes you need to give frontend developers the ability to choose their own data.
And if you want to build that in a serverless way you need to use AppSync!

We have all been there.
The frontend asks for one more field.
The backend team puts it on the backlog.

I see Opus is debugging in the same way I do: make the background red and figure out why there is so much fricking space at the top 😬

In the /spec command & CLAUDE MD I often define how the feedback process looks like. Sometimes I also add it to the spec (e.g. check abc in the DB or deploy and build it until this works).

I LOVE that 🥰

Sometimes claude jumps back into plan mode after the /clear if it sees it is a huge feature. I'll let it do it and then verify it.

4. I read it, sometimes but rarely need to update it - copy path
5. /clear
6. Implement spec now

Currently, I don't use any ralph loop because this workflow works insanely good for me.

I only do this for whole features or fixes where I'm not sure about the issues.

My current claude-code workflow:

1. cc (alias for alias cc='claude --dangerously-skip-permissions')
2. /spec <idea of the feature> - give all context needed, interviews me with all important things, lots of depth.
3. Specfile is created in Markdown (not JSON/YML -> MD)

"yes - go ahead" / "no - simple data transformations which are in the session can be kept in there"

I love that!

It just makes the work with an agent more natural like I would work with a colleague as well.

e.g.:
"hey I implemented the /me api but saw that we are mixing business logic from the API package which should be in the core package, should I refactor that?"

One nugget I really took from the podcast of Steinberger & Friedman is this prompt: With everything you have seen right now, is there anything to improve.

In the image is the exact prompt I'm using and I really like the results.

- Backup of openclaw

Mainly reminders, but lets see what else I will find! 😊

- Daily workbook diary
- AWS Costs Summary
- Hourly tracking of projects
- Morning Briefing with Emails/Calendar
- Some gym-related stuff which is not that good yet
- Daily Shopify SaaS digest (what happened yesterday in Mantle & Posthog)
- Tuesday YouTube Publishing Checklist

But I love to have the ability to have crons with AI now. This was a huge missing factor for me. I tried setting it up myself (e.g. with GitHub runners) but I do like this setup.

Also interesting: I find myself using it like I imagined Siri should behave.

𝐔𝐬𝐞-𝐂𝐚𝐬𝐞𝐬:

I also change the header and make sure on my PI that this is actually coming from my tunnel. Additionally I check the HMAC signature of course as well.

Honestly, yes this is mainly playing at the moment.

𝐖𝐞𝐛𝐡𝐨𝐨𝐤𝐬:
Thats quite interesting! Thanks to Jannik for the idea!
I run a CloudFlare tunnel where I get webhooks (notion for example).
CloudFlare is making sure I won't get DDOSed.

I created an own repo with the skill OpenClaw with links to the docs and some information about my setup and my preferences (e.g. use TS if possible).

𝐃𝐍𝐒:
In Tailscale I use my pi-hole as DNS, simply to block ads also from my phone.
Main intention: Watch tennis also on mobile 😊

I also have SSH running and most of my openclaw setup is happening through Claude Code from my Mac.
Actually i rarely develop anything within OpenClaw I do all of that from CC through SSH.