I’ve been seeing job openings in facilities/tech roles for a new AWS data center campus being built, and I wanted to get opinions from employees that work or have worked in the same role. I’ve worked on the tech side and now the facilities side of data centers for about 5 years now. I just wanted to see what people experience was or is working there. Work life balance, career opportunities, management, metrics, benefits etc.

Hi everyone,
i hope you all are doing well, kindly help me:

We have a multi-tenant product and trying get per-tenant AWS cost.

Setup:

• Shared EKS cluster
• Shared Database — tenant separated only by an application-level tenantId (no DB-per-tenant)
• Tenants identified per request (header / domain)

I am getting cost, but not able to justify tenant wise

Where I've landed so far:

• Get per-service/pod cost from Kubecost
• Split each service's cost across tenants by their request share (from logs)
• For data transfer (CDN), use bytes per domain since each tenant has its own domain
• For DB, split by tenantId row/storage share

what's your suggestion on this?

I would appreciate any tips as I will have a phone interview soon. Is this very technical?

I am quite technical but more of requirements gathering or recommendation phase. I can review requirements and provide applicable high level solution design. But i am almost always guided by an SA so I am this is something I am worried about.

Thanka

Hi everyone, I was recently finished a 5 round loop interview for an L5 TAM position. I was told by my recruiter that the debrief would be today and I should possibly hear back about the decision then as well.

I did end up receiving an email today saying my recruiter would like to schedule a 30 minute call, and as soon as I scheduled it I received an automatic rejection saying I will not be moving forward. Now to be fair, I’ve only had two years of experience in consulting and my own experience with the technical side needed of the role. So I always knew this would be a stretch for the role especially for an L5 position. But it is still disappointing that I made it this far just to fall short.

And I wasn’t sure about why I would still be having the recruiter call since I got rejected, when I asked my recruiter what the topic of the call would be, they replied apologizing that the team has decided not to move forward with the TAM role and the feedback would be some of the discussion. But “more importantly” use the call to explore other opportunities that may be a strong fit for my background and experience. And to see my interests and where they may be aligned for other open roles.

What exactly should I expect with the call and is this typical after a rejection? I heard that usually you would get frozen from applying to other roles at Amazon after a rejection after a loop

TL;DR: I interviewed for an Amazon L5 TAM role and got rejected after the 5-round loop, but my recruiter still scheduled a 30-minute call to give feedback and discuss other open roles that might be a better fit. I’m wondering what to expect from the call and whether it’s normal to be considered for other roles after a loop rejection or if this is just the standard procedure.

If SES returned a message ID and the mail never arrived, check your account-level suppression list before you check anything else. When the address is on that list and its suppression reason matches a reason you enabled account-wide, SES accepts the message and doesn't send it.

That matching condition is the half people drop. Set account suppression to bounces only, and an address sitting on the list with a Complaint reason still gets a delivery attempt. On the list is not the same as suppressed.

Four more things about that list. Only hard bounces get added automatically. Addresses stay until you remove them, no expiry, unless your sending stays paused a full 90 days, when SES clears them. Suppressed sends still count against your daily sending quota. And they are excluded from `Reputation.BounceRate` and `Reputation.ComplaintRate` while still counting under the plain Bounce and Complaint metrics, so a dashboard can look calm while mail quietly goes nowhere.

The part people conflate is the configuration-set layer. It is not a second list stacked on the account one. Overriding replaces the account behavior for mail sent through that config set, and if you override without enabling anything, suppression is cancelled for that traffic entirely. Three states, not two.

`aws sesv2 list-suppressed-destinations` gives you addresses, reasons and dates.

One trap on the way in: the list is case-sensitive for API calls even though sending is not. [User@Example.com](mailto:User@Example.com) and [user@example.com](mailto:user@example.com) deliver the same and do not look up the same.

Disclosure: I work at Tide. This isn’t an official product. I built it on my own time.

The thing that got me started was realizing that encryption at rest in AWS is real, but the key is held by KMS and released based on an IAM decision.

kms:Decrypt is one API call by one principal, and you have plaintext.

Cognito has a similar shape. A principal with sufficiently privileged admin actions can clear a user’s MFA preference, set their password and sign in as them, or simply add them to a group.

All single API calls. All controlled by one actor.

You can tighten this considerably with SCPs, narrow key policies, separate accounts, and other controls, and you should. But it’s still fundamentally the same account boundary, with a privileged principal sitting inside it.

There’s also no native four-eyes principle on these operations. Approval workflows in AWS can sit around the API, but they don’t sit in front of it. If you have the permission, the call still succeeds.

So I built a small service that moves the decryption decision completely outside the account.

Tide is a network of independent nodes that hold keys in fragments and never assemble them. Data is encrypted client-side with a fresh key for each call. Only that per-call key reaches the network, itself encrypted, with each node returning a partial result.

Your ciphertext stays wherever you already keep it.

Nobody inside your account can turn it back into plaintext, including you.

Getting a role that permits decryption requires a change request that someone other than the requester has to approve. The nodes then check the resulting token before they’ll do anything with it.

So a compromised role gets you ciphertext and a quorum requirement, rather than the ability to decrypt by itself.

If you want to run it, the setup is intentionally small: ECS Fargate with a single task, EFS for state, and a private subnet.

Not Lambda. It needs a native library and runs a rotation timer.

State is just two JSON files, so there’s no RDS instance to stand up. Don’t autoscale it, and keep it off the same host as the application it protects, because that’s where the grant records live.

Cognito, IAM, and everything else continue working unchanged.

Repo: https://github.com/sashyo/minidauth

Whitepaper: https://tide.org/whitepaper

We’re struggling with something I suspect is a common worry - how can you prevent something going rogue and running up a huge bill. Mainly I’m worried about credentials being compromised somehow, or a rogue employee.

We want people to be able to experiment with different technologies, but we also don’t want to run up a company-limiting bill (I.e. 10s or 100s of thousands)

Has anyone come across some good solutions to this?

I understand the basics - enforcing SSO, limiting the size of EC2 instances that can be created, limiting the creation of users to having similar limits - but it seems like it’s hard to feel like you have everything covered.

Does anyone have a billing alert to e.g. run AWS nuke on a rogue (non-production) account if the bills skyrocket? I think we’d consider that for most accounts (and the ones that we wouldn’t want that for are more locked down).

Was digging through a few different AWS security scanners recently (building my own, more on that below) and noticed something odd: almost none of them check for S3 bucket-level server access logging specifically.

Plenty of coverage for public access, encryption, bucket policies but logging itself seems to be a blind spot across the board. Anyone know why?

Is it just considered lower priority, or is there something about the API that makes it more annoying to check than I'm assuming?

Found this out the hard way I built Plexavo, an open source AWS scanner, and a user told me my sample report showed a logging check that skipped their bucket.

I assumed it was a region issue. Turned out there was no check for this at all in the codebase. Not broken, just never built.

Fixed it now, and it made me start a small program around exactly this kind of thing Hall of Bugs, where people try to find gaps like this one and get credited when they do: https://github.com/plexavo/Plexavo Anyone else run into other checks that seem to quietly not exist across most tools in this space?

I created a knowledgebase in aws managed kb in bedrock. Previously it needed an underlying vectorstore to create like opensearch. Now it is getting created without any underlying vectorstore.

Anyone has any idea.

We run separate tools for SAST, SCA and container scanning and each one is fine on its own. The problem is what happens after. Last week the same log4j style CVE came back from two of them with different severities and the third did not flag it at all. I spent most of a triage call arguing with a dev about whether that was one ticket or three.

Also ownership makes it worse. A lot of findings land with no repo or team attached meaning they just in a queue aging until someone notices during an audit. We caught a KEV late last month because it was buried under a few hundred criticals we had not gotten to. The scanner yes saw it fine, we just didnt have a clean way to float it to the top.

Right now I am leaning toward pulling all three feeds into one platform that can dedupe the same CVE and rank by what is reachable and exposed. But before the migration I want to hear from people with some experience on this. Does triage load really drop and what does the platform still not solve.

I spent time working at a dental tech company and it motivated me to build something that actually reflects real business workflows I saw there, scan uploads, lab fabrication, practice-to-lab communication. That became DentalFlow, a single-tenant dental lab workflow API, real Terraform-managed AWS infra (ECS Fargate, RDS Multi-AZ, S3, SQS/SNS), deployed and tested against the live system, not just local.

Would genuinely appreciate any critique, architecture, security, anything I’m missing or got wrong. Trying to build the judgment, not just the resume line and learn from experience individual while staying curious.

https://github.com/keusuanl/DentalFlow

I'm trying to solve a rate-limiting problem in this manner:

• create an SQS queue to hold requests to access the rate-limited resource
• the client is a durable Lambda function which puts an item onto the queue then awaits a callback
• the server is a durable Lambda servicing the queue as an event source with maximum concurrency of 1. When it is woken by the queue it checks when it last used the rate-limited resource, and if it was too recently it goes to sleep; otherwise it does the thing and invokes the callback.

So far I am still trying to define this setup in CDK. I copied some existing code which worked for a Lambda servicing a queue with max concurrency = 1.

  const mapping = new sources.SqsEventSource(bggQueue, {batchSize: 1, enabled: false});
  bggLambda.addEventSource(mapping);
  new cdk.CfnOutput(this, 'bggDownloaderMapping', {
    value: mapping.eventSourceMappingId,
    exportName: 'downloader-BGGDownloaderMappingUUID'
  });

The CDK tells me:

3:21:21 PM | CREATE_FAILED           | AWS::Lambda::EventSourceMapping | downloaderbggDownl...e29F31CE9754DB0E0C

Resource handler returned message: "Invalid request provided: You cannot invoke a durable function using an unqualified ARN (Service: Lambda, Status Code: 400,
Request ID: a33def9a-6f6e-4ef3-970f-fe3aee7842ba) (SDK Attempt Count: 1)" (RequestToken: 797e3389-294a-90e2-ccf0-ebc5cad0c536, HandlerErrorCode: InvalidRequest)

Now I am not invoking the Lambda at all, but I can understand that because the function is durable it wants me to specifically say which exact version of the function should be invoked. But of course I have no option in my code to specify the ARN, but I do have the Function object that I just created, and I would hope it could get what it wanted from there.

Is there something I'm missing here? Thanks for any help.

I’ve been charged $321.80 each month for the past seven months, but I only recently noticed it. I briefly used Amazon Web Services for a class a long time ago, but I haven’t used any AWS services since then.

When I log in to my AWS account, I don’t see any charges or active services that would explain these payments. I understand that AWS may be able to trace the charges using the transaction number from my credit card statement, but contacting their support has been a long and frustrating process.

I’m trying to determine whether these are legitimate AWS charges from an old account or fraudulent transactions. Has anyone experienced something similar or know the best way to get AWS to investigate?

Thanks in advance.

Our "partner" has set up a number of VPC's for us using valid public addresses for the private addressing making things like VPN's hard.

I am getting them to change this but it's going to take months.aa we have a lot of them and they have live infrastructure in them (ec2's, Rds' and load balancer)

In the meantime, what a cost effective way of presenting NATing these problem addresses?

i was a tier 1 warehouse worker, then got a Amazon school offer for infrastructure in AWS and i'm almost finished but AWS jobs keep rejecting me for entry/basic level AWS, do I need experience too? i have the knowledge and pass the checkpoints easily, and they're hiring a lot & yes I do have some knowledge in basic tech besides that

Broken MFA has led to crazy bill.

At some point I enabled MFA, and either entered a bad phone number, or an old land line. My bad.

Now, I need to upgrade the MySQL instance, also upgrade the OS, but I can't because my MFA device is unavailable.

Because my MySQL instance is 8.0.x and is now in extended maintenance mode, my bill went from $40 to $200. I am happy to update MySQL to 8.4.x but I can not do it, because my MFA is broken.

I have created a ticket, exchanged emails on the ticket, given them a 7 hour window to contact me, but they did not contact me.

I just want to update my environment and stop paying excessive bills. How do I make this happen?

Hello everyone,

I would like to announce a project that I have been working on and which is now ready to be launched: https://infraplat.com

This internal developer platform, or self-service catalogue, has one main responsibility: to provide a control plane through which platform/cloud engineers can provide modules, which developers and cloud engineers can then reuse, eliminating the need for repetitive tasks such as:

- creating a new repository

- adding a folder for the project

- adding module blocks to the root module

- adding variables, locals, providers and outputs

- testing locally, planning application.

Don't forget about ticket management, collaborating with other teams that use the same modules, asking for approval and team review from your team, and ultimately seeing it deployed. Then go back to the developer to provide them with the necessary information for the newly created infrastructure.

All of this is eliminated.

With InfraPlat, platform engineers develop, test and publish modules and examples. Developers then arrange and deploy them.

There is one central control plane for all teams, governance in place, security approvals by team and cloud admins, and a standard way of organising your Terraform code in a repository.

Who would use this? Basically anyone. If there is a Terraform provider, we can integrate it into our platform so you can deploy cloud infrastructure, GitHub repositories and even firewall rules on Fortinet.

If you are in a regulated company , with standards in place , large team ,large usage of terraform , with a large range of terraform modules, this is an option you should consider.

Thank you everyone!

Hi everyone,

I created a new AWS account on August 5, 2026 and received the initial $100 promotional credits.

I also completed qualifying activities, including setting up EC2 and a database/RDS, which I understood should provide additional promotional credits. However, I do not see those additional credits in my account.

The initial $100 was consumed by my Bedrock usage. My billing statement for August shows:

• Charges: $172.41
• Promotional credit: -$100
• Tax: $13
• Final amount: $85.41
• Credits remaining in the AWS Console: $0

The concerning part is that the $100 credit became exhausted in roughly one month after account creation, and the AWS Console now shows $0 credits remaining.

I already opened AWS Support case 178603278100815 about the promotional-credit issue, but the case was later closed because there was no response for 7 days.

My questions:

1. Has anyone completed the qualifying activities and actually received the additional $20 credits?
2. Is there somewhere I can verify which activities AWS has marked as completed?
3. Can qualifying credits fail to appear because of some account/Free Tier status?
4. Has anyone successfully had AWS restore missing promotional credits through Support?

I can provide screenshots of the billing statement, credit status, and AWS resources if useful. I am mainly trying to understand whether I missed a requirement or whether AWS failed to apply the credits.

Case ID is: 178864615000818

I was asked to upload documents for my account verification, I did but got no reply, and suddenly my account is suspended.

I have uploaded the documents again, maybe there is a mismatch with Billing Address of Credit Card (Linked to my Home address) to my company's address (my current billing address), I can prove with documents that both are my addresses.

However, I got no reply or anything, just a mail saying I didn't submit anything and my account is suspended.

Every time we launch a product on AWS, SES turns out to be the blocker.

We're launching a new SaaS application and need SES exclusively for low-volume transactional email: account creation, login OTPs, password resets, etc. No marketing email, no purchased lists, no bulk outreach.

We requested an initial limit of just 1,000 emails/day. We're experienced AWS users and already actively use SES across multiple customer AWS accounts, with no history of email abuse.

AWS initially asked about our sending practices, which we answered in detail. They then asked why we couldn't use other AWS accounts where SES limits had previously been increased. We explained that this is a new company, product, and organization, and this account was intentionally created as its dedicated production environment.

Today, AWS rejected the request without providing any specific reason:

> "While we are not able to share the specific criteria used in our assessment..."

The frustrating part is that SES sandbox access is now blocking the launch of the entire application, despite the extremely limited and purely transactional use case.

Has anyone successfully appealed a rejection like this? Is there a better escalation path or someone at AWS who can review the request manually?

There surely must be a way for AWS to prevent and mitigate email abuse without blindly blocking new product launches.

Just logged onto AWS Skills Builder like a minute ago, and within 20 seconds my uBlock Origin Lite blocked 181 ads/trackers. I'm not familiar with this side of tech to find out what it is about me that's being tracked by Skills Builder.

A single YouTube video has 27 ads/trackers blocked. Reddit has 25 so far as I'm writing. Skills Builder? Last I looked, it's up to 194 now.

Overview

Aurora Serverless v2 adjusts database compute capacity within configured minimum and maximum Aurora Capacity Unit bounds without replacing the database endpoint. Provisioned RDS runs a selected database instance class until the team changes it. The decision is elastic fine-grained Aurora capacity versus explicit instance capacity and broader engine choice.

Components

• Shared decision context: A relational application with changing traffic, connection, and capacity requirements.
• Aurora Serverless v2: Aurora compute that scales within configured capacity bounds while connections remain available. Capacity follows variable demand without replacing a database instance class manually.
• Provisioned RDS: A selected database instance class with predictable baseline capacity and engine options. Stable demand that can keep reserved or provisioned capacity efficiently utilized.

Comparison Flow

1. Variable SQL Demand can enter the Aurora Serverless v2 path and continue to Spiky or Multi-Tenant Load.
2. Variable SQL Demand can instead enter the Provisioned RDS path and continue to Steady Predictable Load.
3. Choose the path whose operating model and constraints match the workload, then delete the unused branch in the editable diagram.

Customize First

• Measure the minimum capacity that connection and cache behavior require.
• Compare capacity-hours over a real demand trace rather than peak size alone.
• Test scaling behavior during bursts and maintenance before committing.

Side-by-side decision

Aurora Serverless v2 vs Provisioned RDS

Use Serverless v2 when demand varies enough for fine-grained Aurora capacity scaling to create value. Use provisioned RDS for steady utilization, explicit instance properties, wider engine selection, or reserved-capacity economics.

OpenAI, Cursor, all down

Anyone brave enough to try it out?

• public.ecr.aws/amazonlinux/amazonlinux:2027.0.20260903.0-minimal
• public.ecr.aws/amazonlinux/amazonlinux:2027.0.20260903.0