AI code review bot IAM done right: GitHub App tokens, scoped Bedrock InvokeModel, Secrets Manager, and ephemeral jobs that see a PR diff — not monorepo admin PATs.
OpenSearch vs pgvector vs S3 Vectors for code RAG on AWS: filtered ANN, pgvector iterative scans, OpenSearch hybrid search with RRF, S3 Vectors metadata pre-filtering, freshness and recall evaluation.
Build an AWS Lambda coding agent sandbox: ephemeral tool Lambdas, tiny IAM, deny-by-default networking, and structured results — so agents can run tests without owning the account.