DevOps

Secrets Manager charges two ways at once: a flat per-secret-month fee plus a per-API-call fee. Understanding the split is what lets you predict the bill and decide whether to cache.

Four `nslookup` recipes for verifying that the CNAME, MX, and TXT records you published for CloudFront, ACM, SES DKIM, and SES MAIL FROM actually resolve before AWS does.

How AWS Certificate Manager proves you control a domain before issuing a TLS cert: ACM publishes a `_<hash>.domain` CNAME challenge, you copy it to DNS, and renewal stays automatic forever after.

Why DMARC alignment forces you to publish a custom MAIL FROM subdomain in SES, and how to set up the MX + SPF records that prove SES can send on its behalf.

How AWS SES proves you own a sending domain: three CNAME tokens published to your DNS host let SES sign outbound mail with DKIM on your behalf.