Frigga Blogs

On 19 October 2025, at 11:48pm Pacific, a race condition in DynamoDB's DNS automation wiped the DNS records for the service in us-east-1. Two processes ran concurrently. A stale plan check let an older plan overwrite a newer one, cleanup automat…

At 11:20 UTC on 18 November 2025, Cloudflare's core network started failing. Within minutes X, ChatGPT, Spotify and Canva were returning errors, and a decent slice of the internet stopped working. Inside Cloudflare, the first theory was a hyper-…

There is a gap in incident response that gets almost no attention, and it sits in an awkward place. It is not detection. Monitoring is good now. It is not diagnosis either, which is where most of the recent effort has gone and where it has genuinely…

Watch the first two minutes of any investigation and you will notice that almost none of it is investigation. An alert fires for a service. Before anybody can reason about what went wrong, somebody has to establish what the service even is. Which clus…

The thing nobody warns you about with your first few incidents isn't the pressure. It's the tab count. You start with an alert. By minute four you've got Grafana open, a terminal running kubectl , your CI system in another tab, GitHub in…

Somebody asked me a simple question a while back: are any of our databases reachable from the public internet? I said I'd check. Then I sat there for a second realising I didn't actually know how to answer that quickly. Not because the inf…

A node memory alert goes off. The question that follows is always the same, and it's never as easy to answer as it should be. Which workload is doing this? The usual route is kubectl top pods , sorted by hand, one namespace at a time. If you…