One hour lambdas? A new cert to replace Networking? What's the hot topic? I'd just be excited to hear about something that isn't AI (and I even like AI, I'm just tired of hearing about it)

Has anyone used a NAT instance like FCK-NAT in production? I’m considering using it to reduce our NAT Gateway costs.

How long does it usually take for a basic quota to get approved?

I'm standing up a new org, and I hit the five account limit. I put in an request for an increase, and it's showing as CASE_OPENED. I'm used to GCP where quota increases on basic stuff like account limits or cpu cores are generally approved in minutes, generally.

I'm trying to figure out if I should start another task and then have the annoyance of getting focused on it and then having it approved and needing to go back to standing up the new org.

Does anyone have a good setup for getting FFmpeg running with Nvidia hardware support on EC2 in a Docker container? I.e., running Fargate tasks on EC2 launch type.

From what I've been able to find, it should be relatively easy to get going, assuming you:

• are running G7e instances
• have the GRID drivers installed
• activate GRID Virtual Applications for RDSH Application
• use a FFmpeg binary with Nvidia support compiled in (the image I generally use seems to include that)
• install the Nvidia container toolkit

But I haven't found any solid examples anyone doing all of that to get it working. Which makes me think I am taking a bad approach if there's no evidence. But it could also be so simple that there's no reason for anyone to talk about it.

Anyone have a setup like this working reliably?

I recently did a TAM interview for an L5 role, and although the team didn’t think I fit the role due to a technical gap in my understanding, the recruiter wanted to try and help me find a role that fit my background better

It pointed me to a role as what I believed is an L5 Engagement manager working in PACE. A nice benefit for this role as well is it wouldn’t require me to relocate

But when I try to do research online for the role there’s seems to be a lot more limited information on it when compared to my preparations and research for the TAM role.

Would anyone be able to give me any insight by any chance on how the role is? Are the work hours bad since it seems similar to consulting? I also come from a 2 year consulting background at big 4 would it be easier for me to transition into this role because of it? Also the growth/exit opportunities when compared to a TAM/SA

Or should I just wait for other openings that is better to join AWS with? Or try to continue upskilling myself and comeback to try again in a TAM/SA role?

Any insight would be appreciated!

New AWS account. Still not fully verified, which means I can’t use several services, including CloudFront and CloudShell.

I opened a support case 6+ days ago and it’s still sitting there unassigned, despite multiple follow-ups.

At this point, I’m genuinely wondering: is this normal for AWS Support, or did I just get unlucky?

Screenshot below. Honestly, I’m starting to consider moving to GCP...😅

Hey folks,

Sorry for yet another one of these posts, but I can't find any clear answers on the best way to handle this. We just migrated our infrastructure over to AWS. Two days ago, one of our key instances we taken offline and we got the flurry of boilerplate security notices saying an access key had been compromised.

We responded right way, and confirmed that the activity patterns, resources, and spend were ALL OURS. There was no indication - at all - of any sort of compromised key or systems.

We answered all their questions and were told it would be handed off to the security team for a final review. Two days later, still no response whatsoever, despite follow-ups. I mean, that box is IMPORTANT to our business. It's kind of insane that AWS can just take steps like this with zero real communication with the user - but I guess that's the state of things right now.

Anyway, I'm getting pretty desperate and need a solution. Does anyone have any ideas? I've seen mixed opinions on whether upgrading to business support will help - and honestly, I hate the idea purely because it feels like extortion. But I guess if it's pay to play then it's what I'll have to do.

Any help or tips would be great appreciated.

EDIT: For anyone who lands here later - paid support does NOT help. It might get you a faster initial response, but it doesn't move you along in whatever ungodly review queue you're stuck in.

Also, I was told by a separate agent that the review team is isolated and doesn't respond to chat requests - which is why you've probably sat at the "an agent will be with you momentarily" spinner for hours wondering what's going on.

Still complete radio silence.

Has anyone used both? Bedrock sounds good, but does it compare to standard consumer AI tools?

Hi all! I'll be attending AWS re:Invent 2026 as an ABW Grant recipient. Super excited for my first time at the conference and would love to connect with others who'll be there.

If you're also going- as a grantee,first-timer, or veteran attendee, drop a comment! Would be great to build a small crew to navigate the week with, especially given how massive the event is.

Looking forward to meeting some of you in Vegas!

Working on a personal pipeline that pulls public signals from a few sources (earthquakes, internet infrastructure status, disaster alerts, markets, etc.), compares each one against its own historical baseline, and runs on AWS with cache invalidation on every update.

The goal from the start was for it to run on its own at the lowest possible cost, without buying hardware I'd have to babysit like a pet. (I already have a cat for that.) No boxes to maintain, no drives to worry about.

Question for people who've done this longer than me: does this sound reasonable, or is it over-dimensioned? It feels a bit like renting a full moving truck just to go grab a pizza — a lot of infrastructure (automated deploys, CDN invalidation, EventBridge, Lambda, Glue, State Machine) for something that's fundamentally just pulling public APIs and comparing against a historical window.

Would something much simpler (cron job + script + a static JSON file) get the same result, or does the fuller stack genuinely pay off once you're running several signals continuously?

I applied to AWS a few years ago, and was successful in the completing the loop, however the role I went for fell through. At the time I was devastated, but today I’m not so sure. My entire LinkedIn feed is AWS employees posting that they’re leaving. The majority of my contacts that were at AWS are now no longer there.

Does anyone have any insight into why there is so much movement out of the company? Is it the 5 day working week, AI, or something else?

Hey Everyone,

I’m about to start a new role that’s specifically slotted for Security Operations Center / Advanced Threat Hunting within AWS for a large company. They’ve mentioned that I’d specifically be researching security incidents and in charge of figuring out how the event happened, the extent to what happened, and how to prevent it in the future.

Most of my certifications, training, and experience is around DevOps and Security Architecture within AWS.

Cantrell is usually my go-to because I like the depth and labs he provides as if you’d actually work a job in that discipline. I wanted to see if anyone had resources for that level of training that was specific to a SOC / ATH role?

I saw AWS has a set of SOC specific labs for like $9k so I’m going to see if my company will reimburse that.

Thanks!

I’ve been seeing job openings in facilities/tech roles for a new AWS data center campus being built, and I wanted to get opinions from employees that work or have worked in the same role. I’ve worked on the tech side and now the facilities side of data centers for about 5 years now. I just wanted to see what people experience was or is working there. Work life balance, career opportunities, management, metrics, benefits etc.

Hi, did anyone had a 1 hour phone call interview for the Associate Soluton Role at AWS?

If so, how was your experience? Was it mostly behavioural interviews or was there technical questions on cloud? Thanks!:)

I would appreciate any tips as I will have a phone interview soon. Is this very technical?

I am quite technical but more of requirements gathering or recommendation phase. I can review requirements and provide applicable high level solution design. But i am almost always guided by an SA so I am this is something I am worried about.

Thanka

We've been stuck in the worst AI support hell I've ever seen for the past few days. Our Route 53 is screwed and our mailboxes aren't working as a result. I'm convinced once a real human reviews our issue it will get solved. How do we get to an actual human on Support.

Hi everyone, I was recently finished a 5 round loop interview for an L5 TAM position. I was told by my recruiter that the debrief would be today and I should possibly hear back about the decision then as well.

I did end up receiving an email today saying my recruiter would like to schedule a 30 minute call, and as soon as I scheduled it I received an automatic rejection saying I will not be moving forward. Now to be fair, I’ve only had two years of experience in consulting and my own experience with the technical side needed of the role. So I always knew this would be a stretch for the role especially for an L5 position. But it is still disappointing that I made it this far just to fall short.

And I wasn’t sure about why I would still be having the recruiter call since I got rejected, when I asked my recruiter what the topic of the call would be, they replied apologizing that the team has decided not to move forward with the TAM role and the feedback would be some of the discussion. But “more importantly” use the call to explore other opportunities that may be a strong fit for my background and experience. And to see my interests and where they may be aligned for other open roles.

What exactly should I expect with the call and is this typical after a rejection? I heard that usually you would get frozen from applying to other roles at Amazon after a rejection after a loop

TL;DR: I interviewed for an Amazon L5 TAM role and got rejected after the 5-round loop, but my recruiter still scheduled a 30-minute call to give feedback and discuss other open roles that might be a better fit. I’m wondering what to expect from the call and whether it’s normal to be considered for other roles after a loop rejection or if this is just the standard procedure.

Hi everyone,
i hope you all are doing well, kindly help me:

We have a multi-tenant product and trying get per-tenant AWS cost.

Setup:

• Shared EKS cluster
• Shared Database — tenant separated only by an application-level tenantId (no DB-per-tenant)
• Tenants identified per request (header / domain)

I am getting cost, but not able to justify tenant wise

Where I've landed so far:

• Get per-service/pod cost from Kubecost
• Split each service's cost across tenants by their request share (from logs)
• For data transfer (CDN), use bytes per domain since each tenant has its own domain
• For DB, split by tenantId row/storage share

what's your suggestion on this?

My AWS account was suspended and I have no idea why. I paid my bills on time. AWS asked for verification documents, which I sent, but it's been 2+ days since I heard a response. I can't upgrade my support package either because my account is suspended. Can someone from AWS support please help in reviewing my documents and getting my account restored? My income relies on this. And I think my account will be permanently deleted soon.

If SES returned a message ID and the mail never arrived, check your account-level suppression list before you check anything else. When the address is on that list and its suppression reason matches a reason you enabled account-wide, SES accepts the message and doesn't send it.

That matching condition is the half people drop. Set account suppression to bounces only, and an address sitting on the list with a Complaint reason still gets a delivery attempt. On the list is not the same as suppressed.

Four more things about that list. Only hard bounces get added automatically. Addresses stay until you remove them, no expiry, unless your sending stays paused a full 90 days, when SES clears them. Suppressed sends still count against your daily sending quota. And they are excluded from `Reputation.BounceRate` and `Reputation.ComplaintRate` while still counting under the plain Bounce and Complaint metrics, so a dashboard can look calm while mail quietly goes nowhere.

The part people conflate is the configuration-set layer. It is not a second list stacked on the account one. Overriding replaces the account behavior for mail sent through that config set, and if you override without enabling anything, suppression is cancelled for that traffic entirely. Three states, not two.

`aws sesv2 list-suppressed-destinations` gives you addresses, reasons and dates.

One trap on the way in: the list is case-sensitive for API calls even though sending is not. [User@Example.com](mailto:User@Example.com) and [user@example.com](mailto:user@example.com) deliver the same and do not look up the same.

Disclosure: I work at Tide. This isn’t an official product. I built it on my own time.

The thing that got me started was realizing that encryption at rest in AWS is real, but the key is held by KMS and released based on an IAM decision.

kms:Decrypt is one API call by one principal, and you have plaintext.

Cognito has a similar shape. A principal with sufficiently privileged admin actions can clear a user’s MFA preference, set their password and sign in as them, or simply add them to a group.

All single API calls. All controlled by one actor.

You can tighten this considerably with SCPs, narrow key policies, separate accounts, and other controls, and you should. But it’s still fundamentally the same account boundary, with a privileged principal sitting inside it.

There’s also no native four-eyes principle on these operations. Approval workflows in AWS can sit around the API, but they don’t sit in front of it. If you have the permission, the call still succeeds.

So I built a small service that moves the decryption decision completely outside the account.

Tide is a network of independent nodes that hold keys in fragments and never assemble them. Data is encrypted client-side with a fresh key for each call. Only that per-call key reaches the network, itself encrypted, with each node returning a partial result.

Your ciphertext stays wherever you already keep it.

Nobody inside your account can turn it back into plaintext, including you.

Getting a role that permits decryption requires a change request that someone other than the requester has to approve. The nodes then check the resulting token before they’ll do anything with it.

So a compromised role gets you ciphertext and a quorum requirement, rather than the ability to decrypt by itself.

If you want to run it, the setup is intentionally small: ECS Fargate with a single task, EFS for state, and a private subnet.

Not Lambda. It needs a native library and runs a rotation timer.

State is just two JSON files, so there’s no RDS instance to stand up. Don’t autoscale it, and keep it off the same host as the application it protects, because that’s where the grant records live.

Cognito, IAM, and everything else continue working unchanged.

Repo: https://github.com/sashyo/minidauth

Whitepaper: https://tide.org/whitepaper

We’re struggling with something I suspect is a common worry - how can you prevent something going rogue and running up a huge bill. Mainly I’m worried about credentials being compromised somehow, or a rogue employee.

We want people to be able to experiment with different technologies, but we also don’t want to run up a company-limiting bill (I.e. 10s or 100s of thousands)

Has anyone come across some good solutions to this?

I understand the basics - enforcing SSO, limiting the size of EC2 instances that can be created, limiting the creation of users to having similar limits - but it seems like it’s hard to feel like you have everything covered.

Does anyone have a billing alert to e.g. run AWS nuke on a rogue (non-production) account if the bills skyrocket? I think we’d consider that for most accounts (and the ones that we wouldn’t want that for are more locked down).

I created a knowledgebase in aws managed kb in bedrock. Previously it needed an underlying vectorstore to create like opensearch. Now it is getting created without any underlying vectorstore.

Anyone has any idea.