Why we replaced a shared bearer token with Cognito's client-credentials flow, so each service has its own identity and each endpoint requires a specific scope. Covers resource servers, custom scopes, token validation, and a couple of ALB rule gotchas.
The per-pipeline Terraform module that plugs into the platform, with two task definitions per pipeline, Cloud Map registration so the daemon can find each code server, four IAM roles, and secrets handling.
The long-lived half of our Dagster deployment on AWS ECS: the daemon, read-only and admin webservers behind a Cognito-authenticated ALB, and the Terraform that ties them together. Most of the post is about networking, security groups, service discovery, and IAM, which is where most of my time went. Written for anyone running Dagster without Dagster+.