On June 10, 2026 AWS GA’d M9g/M9gd on Graviton5 — up to 25% more compute vs M8g, 35% faster for web and ML per AWS. Field guide: M9g vs M9gd, canary checklist, RI traps, and agentic-AI fit.
Your landing zone set up the org, OUs, and baseline SCPs — then most teams stall, duplicating resources per account and wiring brittle cross-account role chains. Since re:Invent 2024 the toolkit changed: RCPs bound what can be done TO a resource (even by external principals), declarative policies enforce EC2/VPC/EBS config state that survives new APIs, and one Route 53 Profile can push DNS to up to 5,000 VPCs. Here is the mechanism-by-job decision matrix and a rollout order that avoids lockouts.
A composite mid-market manufacturer exited a colo of 150 workloads and ~400 TB in 21 months across 8 waves, with 47 minutes of unplanned cutover downtime (industry median per Gartner: ~4 hours per major cutover). The single-wave alternative bid came in at ~$4.8M; the wave-based program ran ~$2.1M. Here is how the wave plan, dependency cutoff, and rollback layer fit together against a hard landlord deadline.
The EU Data Act drops cloud switching and egress charges to zero by January 12, 2027—and AWS already waives data-transfer-out for customers leaving. So why is exit still expensive? Because the real cost is re-platform time (~$113k in our model), not the ~$4,400 egress line. Here is how to make an AWS workload defensibly reversible.
A stack of ALB + EC2 + RDS Multi-AZ + S3 composes to ~99.83% availability—so promising customers 99.9% is a check you cannot cash. This guide does the composition math, converts it to an error budget (99.9% = 43.2 min/month), and shows why AWS service credits never fund your SLA penalties.
Barclays says ~86% of CIOs plan to move some workloads back; IDC says only ~8-9% fully repatriate. Both are true—the trend is per-workload placement, not multi-cloud-by-default. This guide gives you a scored matrix to decide AWS-first vs multi-cloud and prices the daily tax of "just in case" portability.
A CCoE that only publishes standards decks fails within two quarters. This 2026 operating model ties platform RFCs, delegated-admin guardrails, Well-Architected reviews, and FinOps chargeback—benchmarked on a 14-account estate that cut deploy exceptions from 23/month to 6 in 90 days.
MAP Mobilize should not start with more than five failed controls in Platform or Security. This 47-point readiness checklist (People, Platform, Security, FinOps) is the auditable artifact we attach to Assess-phase business cases—aligned to CAF 3.0 and the Migration Lens, not generic cloud maturity fluff.
A first-person, opinionated 2026 AWS learning path. Built around 6 phases, anchored to a 3-month full-time benchmark, and explicit about which cert (Cloud Practitioner) to skip and why.
CAF 3.0 organizes six perspectives and 47 capabilities—up from 31 in CAF 2.0—plus four phases (Envision, Align, Launch, Scale). Here is how to connect those workshops to Control Tower, MAP, and Well-Architected without treating the framework as a slide deck.
Global Accelerator charges about $0.025 per provisioned accelerator per hour—even while disabled—and adds Data Transfer-Premium on top of normal data transfer. Two static Anycast IPv4 addresses (or four addresses in dual-stack: two IPv4 and two IPv6) front ALBs, NLBs, EC2, or EIPs across Regions; that pricing model changes whether you beat CloudFront or Route 53 latency records alone.
May 2026 guidance with a reproducible scaffold—9 artefact files, 0 Terraform-managed creates at plan baseline, and third-party comparisons refreshed Apr 24 and May 4, 2026.
