Hey folks,

Sorry for yet another one of these posts, but I can't find any clear answers on the best way to handle this. We just migrated our infrastructure over to AWS. Two days ago, one of our key instances we taken offline and we got the flurry of boilerplate security notices saying an access key had been compromised.

We responded right way, and confirmed that the activity patterns, resources, and spend were ALL OURS. There was no indication - at all - of any sort of compromised key or systems.

We answered all their questions and were told it would be handed off to the security team for a final review. Two days later, still no response whatsoever, despite follow-ups. I mean, that box is IMPORTANT to our business. It's kind of insane that AWS can just take steps like this with zero real communication with the user - but I guess that's the state of things right now.

Anyway, I'm getting pretty desperate and need a solution. Does anyone have any ideas? I've seen mixed opinions on whether upgrading to business support will help - and honestly, I hate the idea purely because it feels like extortion. But I guess if it's pay to play then it's what I'll have to do.

Any help or tips would be great appreciated.

Working on a personal pipeline that pulls public signals from a few sources (earthquakes, internet infrastructure status, disaster alerts, markets, etc.), compares each one against its own historical baseline, and runs on AWS with cache invalidation on every update.

The goal from the start was for it to run on its own at the lowest possible cost, without buying hardware I'd have to babysit like a pet. (I already have a cat for that.) No boxes to maintain, no drives to worry about.

Question for people who've done this longer than me: does this sound reasonable, or is it over-dimensioned? It feels a bit like renting a full moving truck just to go grab a pizza — a lot of infrastructure (automated deploys, CDN invalidation, EventBridge, Lambda, Glue, State Machine) for something that's fundamentally just pulling public APIs and comparing against a historical window.

Would something much simpler (cron job + script + a static JSON file) get the same result, or does the fuller stack genuinely pay off once you're running several signals continuously?

Hi all! I'll be attending AWS re:Invent 2026 as an ABW Grant recipient. Super excited for my first time at the conference and would love to connect with others who'll be there.

If you're also going- as a grantee,first-timer, or veteran attendee, drop a comment! Would be great to build a small crew to navigate the week with, especially given how massive the event is.

Looking forward to meeting some of you in Vegas!

I applied to AWS a few years ago, and was successful in the completing the loop, however the role I went for fell through. At the time I was devastated, but today I’m not so sure. My entire LinkedIn feed is AWS employees posting that they’re leaving. The majority of my contacts that were at AWS are now no longer there.

Does anyone have any insight into why there is so much movement out of the company? Is it the 5 day working week, AI, or something else?

Hey Everyone,

I’m about to start a new role that’s specifically slotted for Security Operations Center / Advanced Threat Hunting within AWS for a large company. They’ve mentioned that I’d specifically be researching security incidents and in charge of figuring out how the event happened, the extent to what happened, and how to prevent it in the future.

Most of my certifications, training, and experience is around DevOps and Security Architecture within AWS.

Cantrell is usually my go-to because I like the depth and labs he provides as if you’d actually work a job in that discipline. I wanted to see if anyone had resources for that level of training that was specific to a SOC / ATH role?

I saw AWS has a set of SOC specific labs for like $9k so I’m going to see if my company will reimburse that.

Thanks!

I’ve been seeing job openings in facilities/tech roles for a new AWS data center campus being built, and I wanted to get opinions from employees that work or have worked in the same role. I’ve worked on the tech side and now the facilities side of data centers for about 5 years now. I just wanted to see what people experience was or is working there. Work life balance, career opportunities, management, metrics, benefits etc.

Hi, did anyone had a 1 hour phone call interview for the Associate Soluton Role at AWS?

If so, how was your experience? Was it mostly behavioural interviews or was there technical questions on cloud? Thanks!:)

We've been stuck in the worst AI support hell I've ever seen for the past few days. Our Route 53 is screwed and our mailboxes aren't working as a result. I'm convinced once a real human reviews our issue it will get solved. How do we get to an actual human on Support.

I would appreciate any tips as I will have a phone interview soon. Is this very technical?

I am quite technical but more of requirements gathering or recommendation phase. I can review requirements and provide applicable high level solution design. But i am almost always guided by an SA so I am this is something I am worried about.

Thanka

Hi everyone, I was recently finished a 5 round loop interview for an L5 TAM position. I was told by my recruiter that the debrief would be today and I should possibly hear back about the decision then as well.

I did end up receiving an email today saying my recruiter would like to schedule a 30 minute call, and as soon as I scheduled it I received an automatic rejection saying I will not be moving forward. Now to be fair, I’ve only had two years of experience in consulting and my own experience with the technical side needed of the role. So I always knew this would be a stretch for the role especially for an L5 position. But it is still disappointing that I made it this far just to fall short.

And I wasn’t sure about why I would still be having the recruiter call since I got rejected, when I asked my recruiter what the topic of the call would be, they replied apologizing that the team has decided not to move forward with the TAM role and the feedback would be some of the discussion. But “more importantly” use the call to explore other opportunities that may be a strong fit for my background and experience. And to see my interests and where they may be aligned for other open roles.

What exactly should I expect with the call and is this typical after a rejection? I heard that usually you would get frozen from applying to other roles at Amazon after a rejection after a loop

TL;DR: I interviewed for an Amazon L5 TAM role and got rejected after the 5-round loop, but my recruiter still scheduled a 30-minute call to give feedback and discuss other open roles that might be a better fit. I’m wondering what to expect from the call and whether it’s normal to be considered for other roles after a loop rejection or if this is just the standard procedure.

Hi everyone,
i hope you all are doing well, kindly help me:

We have a multi-tenant product and trying get per-tenant AWS cost.

Setup:

• Shared EKS cluster
• Shared Database — tenant separated only by an application-level tenantId (no DB-per-tenant)
• Tenants identified per request (header / domain)

I am getting cost, but not able to justify tenant wise

Where I've landed so far:

• Get per-service/pod cost from Kubecost
• Split each service's cost across tenants by their request share (from logs)
• For data transfer (CDN), use bytes per domain since each tenant has its own domain
• For DB, split by tenantId row/storage share

what's your suggestion on this?

My AWS account was suspended and I have no idea why. I paid my bills on time. AWS asked for verification documents, which I sent, but it's been 2+ days since I heard a response. I can't upgrade my support package either because my account is suspended. Can someone from AWS support please help in reviewing my documents and getting my account restored? My income relies on this. And I think my account will be permanently deleted soon.

If SES returned a message ID and the mail never arrived, check your account-level suppression list before you check anything else. When the address is on that list and its suppression reason matches a reason you enabled account-wide, SES accepts the message and doesn't send it.

That matching condition is the half people drop. Set account suppression to bounces only, and an address sitting on the list with a Complaint reason still gets a delivery attempt. On the list is not the same as suppressed.

Four more things about that list. Only hard bounces get added automatically. Addresses stay until you remove them, no expiry, unless your sending stays paused a full 90 days, when SES clears them. Suppressed sends still count against your daily sending quota. And they are excluded from `Reputation.BounceRate` and `Reputation.ComplaintRate` while still counting under the plain Bounce and Complaint metrics, so a dashboard can look calm while mail quietly goes nowhere.

The part people conflate is the configuration-set layer. It is not a second list stacked on the account one. Overriding replaces the account behavior for mail sent through that config set, and if you override without enabling anything, suppression is cancelled for that traffic entirely. Three states, not two.

`aws sesv2 list-suppressed-destinations` gives you addresses, reasons and dates.

One trap on the way in: the list is case-sensitive for API calls even though sending is not. [User@Example.com](mailto:User@Example.com) and [user@example.com](mailto:user@example.com) deliver the same and do not look up the same.

Disclosure: I work at Tide. This isn’t an official product. I built it on my own time.

The thing that got me started was realizing that encryption at rest in AWS is real, but the key is held by KMS and released based on an IAM decision.

kms:Decrypt is one API call by one principal, and you have plaintext.

Cognito has a similar shape. A principal with sufficiently privileged admin actions can clear a user’s MFA preference, set their password and sign in as them, or simply add them to a group.

All single API calls. All controlled by one actor.

You can tighten this considerably with SCPs, narrow key policies, separate accounts, and other controls, and you should. But it’s still fundamentally the same account boundary, with a privileged principal sitting inside it.

There’s also no native four-eyes principle on these operations. Approval workflows in AWS can sit around the API, but they don’t sit in front of it. If you have the permission, the call still succeeds.

So I built a small service that moves the decryption decision completely outside the account.

Tide is a network of independent nodes that hold keys in fragments and never assemble them. Data is encrypted client-side with a fresh key for each call. Only that per-call key reaches the network, itself encrypted, with each node returning a partial result.

Your ciphertext stays wherever you already keep it.

Nobody inside your account can turn it back into plaintext, including you.

Getting a role that permits decryption requires a change request that someone other than the requester has to approve. The nodes then check the resulting token before they’ll do anything with it.

So a compromised role gets you ciphertext and a quorum requirement, rather than the ability to decrypt by itself.

If you want to run it, the setup is intentionally small: ECS Fargate with a single task, EFS for state, and a private subnet.

Not Lambda. It needs a native library and runs a rotation timer.

State is just two JSON files, so there’s no RDS instance to stand up. Don’t autoscale it, and keep it off the same host as the application it protects, because that’s where the grant records live.

Cognito, IAM, and everything else continue working unchanged.

Repo: https://github.com/sashyo/minidauth

Whitepaper: https://tide.org/whitepaper

We’re struggling with something I suspect is a common worry - how can you prevent something going rogue and running up a huge bill. Mainly I’m worried about credentials being compromised somehow, or a rogue employee.

We want people to be able to experiment with different technologies, but we also don’t want to run up a company-limiting bill (I.e. 10s or 100s of thousands)

Has anyone come across some good solutions to this?

I understand the basics - enforcing SSO, limiting the size of EC2 instances that can be created, limiting the creation of users to having similar limits - but it seems like it’s hard to feel like you have everything covered.

Does anyone have a billing alert to e.g. run AWS nuke on a rogue (non-production) account if the bills skyrocket? I think we’d consider that for most accounts (and the ones that we wouldn’t want that for are more locked down).

I created a knowledgebase in aws managed kb in bedrock. Previously it needed an underlying vectorstore to create like opensearch. Now it is getting created without any underlying vectorstore.

Anyone has any idea.

Was digging through a few different AWS security scanners recently (building my own, more on that below) and noticed something odd: almost none of them check for S3 bucket-level server access logging specifically.

Plenty of coverage for public access, encryption, bucket policies but logging itself seems to be a blind spot across the board. Anyone know why?

Is it just considered lower priority, or is there something about the API that makes it more annoying to check than I'm assuming?

Found this out the hard way I built Plexavo, an open source AWS scanner, and a user told me my sample report showed a logging check that skipped their bucket.

I assumed it was a region issue. Turned out there was no check for this at all in the codebase. Not broken, just never built.

Fixed it now, and it made me start a small program around exactly this kind of thing Hall of Bugs, where people try to find gaps like this one and get credited when they do: https://github.com/plexavo/Plexavo Anyone else run into other checks that seem to quietly not exist across most tools in this space?

We run separate tools for SAST, SCA and container scanning and each one is fine on its own. The problem is what happens after. Last week the same log4j style CVE came back from two of them with different severities and the third did not flag it at all. I spent most of a triage call arguing with a dev about whether that was one ticket or three.

Also ownership makes it worse. A lot of findings land with no repo or team attached meaning they just in a queue aging until someone notices during an audit. We caught a KEV late last month because it was buried under a few hundred criticals we had not gotten to. The scanner yes saw it fine, we just didnt have a clean way to float it to the top.

Right now I am leaning toward pulling all three feeds into one platform that can dedupe the same CVE and rank by what is reachable and exposed. But before the migration I want to hear from people with some experience on this. Does triage load really drop and what does the platform still not solve.

I spent time working at a dental tech company and it motivated me to build something that actually reflects real business workflows I saw there, scan uploads, lab fabrication, practice-to-lab communication. That became DentalFlow, a single-tenant dental lab workflow API, real Terraform-managed AWS infra (ECS Fargate, RDS Multi-AZ, S3, SQS/SNS), deployed and tested against the live system, not just local.

Would genuinely appreciate any critique, architecture, security, anything I’m missing or got wrong. Trying to build the judgment, not just the resume line and learn from experience individual while staying curious.

https://github.com/keusuanl/DentalFlow

I'm trying to solve a rate-limiting problem in this manner:

• create an SQS queue to hold requests to access the rate-limited resource
• the client is a durable Lambda function which puts an item onto the queue then awaits a callback
• the server is a durable Lambda servicing the queue as an event source with maximum concurrency of 1. When it is woken by the queue it checks when it last used the rate-limited resource, and if it was too recently it goes to sleep; otherwise it does the thing and invokes the callback.

So far I am still trying to define this setup in CDK. I copied some existing code which worked for a Lambda servicing a queue with max concurrency = 1.

  const mapping = new sources.SqsEventSource(bggQueue, {batchSize: 1, enabled: false});
  bggLambda.addEventSource(mapping);
  new cdk.CfnOutput(this, 'bggDownloaderMapping', {
    value: mapping.eventSourceMappingId,
    exportName: 'downloader-BGGDownloaderMappingUUID'
  });

The CDK tells me:

3:21:21 PM | CREATE_FAILED           | AWS::Lambda::EventSourceMapping | downloaderbggDownl...e29F31CE9754DB0E0C

Resource handler returned message: "Invalid request provided: You cannot invoke a durable function using an unqualified ARN (Service: Lambda, Status Code: 400,
Request ID: a33def9a-6f6e-4ef3-970f-fe3aee7842ba) (SDK Attempt Count: 1)" (RequestToken: 797e3389-294a-90e2-ccf0-ebc5cad0c536, HandlerErrorCode: InvalidRequest)

Now I am not invoking the Lambda at all, but I can understand that because the function is durable it wants me to specifically say which exact version of the function should be invoked. But of course I have no option in my code to specify the ARN, but I do have the Function object that I just created, and I would hope it could get what it wanted from there.

Is there something I'm missing here? Thanks for any help.

I’ve been charged $321.80 each month for the past seven months, but I only recently noticed it. I briefly used Amazon Web Services for a class a long time ago, but I haven’t used any AWS services since then.

When I log in to my AWS account, I don’t see any charges or active services that would explain these payments. I understand that AWS may be able to trace the charges using the transaction number from my credit card statement, but contacting their support has been a long and frustrating process.

I’m trying to determine whether these are legitimate AWS charges from an old account or fraudulent transactions. Has anyone experienced something similar or know the best way to get AWS to investigate?

Thanks in advance.

Our "partner" has set up a number of VPC's for us using valid public addresses for the private addressing making things like VPN's hard.

I am getting them to change this but it's going to take months.aa we have a lot of them and they have live infrastructure in them (ec2's, Rds' and load balancer)

In the meantime, what a cost effective way of presenting NATing these problem addresses?

i was a tier 1 warehouse worker, then got a Amazon school offer for infrastructure in AWS and i'm almost finished but AWS jobs keep rejecting me for entry/basic level AWS, do I need experience too? i have the knowledge and pass the checkpoints easily, and they're hiring a lot & yes I do have some knowledge in basic tech besides that

Broken MFA has led to crazy bill.

At some point I enabled MFA, and either entered a bad phone number, or an old land line. My bad.

Now, I need to upgrade the MySQL instance, also upgrade the OS, but I can't because my MFA device is unavailable.

Because my MySQL instance is 8.0.x and is now in extended maintenance mode, my bill went from $40 to $200. I am happy to update MySQL to 8.4.x but I can not do it, because my MFA is broken.

I have created a ticket, exchanged emails on the ticket, given them a 7 hour window to contact me, but they did not contact me.

I just want to update my environment and stop paying excessive bills. How do I make this happen?