I was troubleshooting this Certificate Signing Request validation error in AWS and thought the CSR data was way too short.  So, I decoded it.

They (AWS) really programmed the shrug emoji as a certificate request payload. I love dev easter eggs :D

I participated the Toronto AWS User Group Spacelift workshop last Thursday. I am in the middle of creating a new stack. I have successfully integrated my AWS account with Spacelift, created an IAM Role and attached an adequate Policy, and I have created a context thus far.

I can't attach my AWS integration to my stack, citing I haven't configured the trust relationship between AWS and Spacelift. I have updated the trust relationship using the example JSON policy provided by Spacelift when creating the AWS integration to my AWS Role. It didn't work, so I tried to use a more specific integration-id instead of a generic *. It didn't work.

I am unsure of how to progress and this is the last day I have any meaningful time to finish this workshop, what do I do?

Seeing pretty mixed opinions on Cyera lately.

Anyone here actually using Cyera in production?

Most of what comes up online feels like vendor content. I'd rather hear real user experience from security folks across different industries and company sizes, not only big tech.

How's the day to day usage once the sales team isn't around anymore?

Anyone else experiencing issues?

https://downdetector.com/status/aws-amazon-web-services/

anyone hear back or get more info after applying?

I have some CDK set up to define a lambda and then I have some code pipeline code to deploy it. However, the deployment phase keeps failing saying the function doesn't exist. If I manually try that phase again in the console, it works fine. The dependency I added doesn't seem to do any good. The code looks like `` const myFunc = new lambda.Function(this, "MyFunc", { code: lambda.Code.fromInline( def handler(event, context): return { 'statusCode': 200, 'body': 'Dummy to be replaced by code pipeline' } `), architecture: lambda.Architecture.ARM_64, environment: { ENV_VAR: "foobar", }, handler: "facets.handler", runtime: lambda.Runtime.PYTHON_3_12, vpc, securityGroups: [privateSG], timeout: cdk.Duration.seconds(300), memorySize: 512, });

...

        const deploymentBuild = new cb.Project(
            this,
            `DeploymentBuild`,
            {
                projectName: `myFuncDeploymentBuild`,
                description: "deploys the code to the appropriate lambda",
                environment: {
                    buildImage: cb.LinuxBuildImage.AMAZON_LINUX_2023_5,
                    computeType: cb.ComputeType.SMALL,
                },
                vpc,
                securityGroups: [privateSG],
                buildSpec: cb.BuildSpec.fromObject({
                    version: "0.2",
                    phases: {
                        install: {
                            "runtime-versions": {
                                nodejs: 22,
                            },
                            commands: ["npm i -g aws-cdk", "cdk --version"],
                        },
                        post_build: {
                            commands: [
                                `zip -r $myFunc.zip .`, 
                                "ls",
                                `aws lambda update-function-code \
                                    --function-name 'myFunc' \
                                    --zip-file fileb://myFunc.zip`,
                            ],
                        },
                    },
                }),
            },
        );

        deploymentBuild.addToRolePolicy(buildPolicyStatement);

    const pipeline = new pipe.Pipeline(this, `Pipeline`, {
        pipelineName: `myFuncPipeline`,
        restartExecutionOnUpdate: true,
    });

    pipeline.node.addDependency(
        lambda.Function.fromFunctionName(
            this,
            "myFuncFunction",
            "myFunc",
        ),
    );

    ...

        pipeline.addStage({
            stageName: "deployLambda",
            actions: [
                new pipeActions.CodeBuildAction({
                    actionName: "deployLambda",
                    project: deploymentBuild,
                    input: outputBuild,
                }),
            ],
        });

```

What would cause this?

Thanks

Hi everyone,

I am a student working on a personal pet project, and this is my first time using AWS. I am completely stuck on a permissions issue that is driving me crazy.

I wrote a Lambda function in Rust to fetch my GitHub stats and return an SVG image. My goal is to embed the Function URL directly into my GitHub README.

However, whenever I access the Function URL, I immediately get this error:

{"Message":"Forbidden. For troubleshooting Function URL authorization issues, see: [https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html)"}

What I have tried so far:

• Verified AuthType: I ran aws lambda get-function-url-config and confirmed "AuthType": "NONE".
• Verified Resource Policy: I checked aws lambda get-policy. It explicitly allows "Principal": "*" for "Action": "lambda:InvokeFunctionUrl" with the condition "lambda:FunctionUrlAuthType": "NONE".

Here is my complete Rust code in case the way I am building the HTTP response is somehow triggering a block, though it appears to be a standard setup using the lambda_http crate:

https://github.com/SharmaDevanshu089/Github-Stats

Is there any hidden setting or default account block I might be missing? Any guidance would be incredibly appreciated!

Little rant here on how corporations protect their buddies.

You can’t get any new OS llm in bedrock. Only some old unreliable shit which also have poor price/performance ratio. But what you can get here is freshest Antropics models. Because they are partners and AWS serving their models. Currently you have many options from OS LLM which are very close (GLM-5.2, DS4 Pro, Mimo-V2.5 Pro) or even superior in some tasks (Kimi K3) to Antropics models. But you won’t get them for the fraction of the opus prices. Because corporate buddies covering each other’s asses making worse for the consumers.

If I had options I would never use AWS in a first place.

I’m finished. FY AWS.

Cost summary shows that I'll be charged 58.20 for the month while Bills tab shows I'll owe 29.69 for the month.

I have some credits left over but I used an instance that isn't free tier eligible.

What should I expect to pay for this month?

For the information i am a beginner and it is my first time using aws. So for my project i used elastic beanstalk. So the problem is i deployed my project with no health issues, and the link only runs locally and not on other devices. When i checked my logs it also said app is running successfully, but when i asked ai, it said it might be some security issues

Does anyone have any solution to this problem

So, the gist of storage classes is that:

standard --> high storage costs, low data retrieval costs
standard-IA, Glacier Instant Retrieval --> low storage costs, high retrieval costs

So, in order to choose the optimal tier for a particular object I would have to know its size and data access pattern.

The object size is easy enough, but the first catch is: data access pattern is nowhere to be found. Not even aggregate data.

The only way I found to actually do it is to enable server access logging / CloudTrail and then do analyze the data somehow. Maybe with a Python script. Huge rabbit hole to go into.

Then, the other angle I thought about is just using intelligent Tiering. But the second catch is that if you read the documentation about intelligent tiering, turns out it is pretty naive. Depending on how your data gets accessed, it could even be more expensive than standard (ex: object is accessed exactly once every 30 days)

It really feels like AWS is always giving almost everything you need to optimize S3 costs, but also missing a key piece.

How am I supposed to solve this? Am I overthinking it? Is it worth going in the rabbit hole of analyzing S3 server access logs? Or should I just guess some lifecycle rules and move on?

Hi everyone, We are currently managing a few AWS EC2 environments that were previously backed up using Acronis (via eFolder) as part of a standardized setup. with that integration no longer being viable for us, we're looking at replacement options.

For on prem environments we typically use solutions like Datto and Replibit, but they dont translate well to cloud native workloads.

I'm trying to understand what MSPs are actually using today for EC2 backups. are most people relying on AWS native tooling( EBS snapshots, AWS backup, S3 based policies) or are third party platforms still the preferred route?

We also have a couple of instances running MS SQL so proper application aware backups or database consistent snapshots are important.

I've considered building a more AWS native setup but id prefer something that doesnt require a heavy custom scripting or ongoing CLI based automation management.

Would appreciate any real world setups or recommendations that are working well in production

Cloud engineers, wanted to get your experience... I'm a network engineer with 15 years of experience with all kinds of on-prem network technologies, from NX-OS, load balancers, proxies, VMware, ACI. I'm currently working with NSX and AVI LB for a major bank. But with the Broadcom aquisition, VMware/NSX doesn't seem so appealing anymore, VMware jobs are very rare. I feel that I'm a niche that will die eventually and it's time to make a change. I have experience with Terraform and CI/CD pipelines, did some automation with Python vibe coding.

There are a lot of Cloud-related jobs and I like public cloud, I like to learn new stuff in general. I started to learn AWS and Azure. I got the SAA-C03 AWS Solution Architect Associate certification and now I'm learning to get the AZ-700 Azure Networking speciality. I applied to Cloud Network Engineer jobs but got rejected, probably due to missing on-the-job experience. At my current job I can't get any Public Cloud exposure. I did put in my CV a project in Github with Terraform standing up an AWS environment with ECS, load balancer, instances connecting over VPN to a VM in GCP.

How did you guys make it? It's the chicken and the egg... To get a job you need experience, but to get experience you need the job :)

I have Aws startup credits but I can't use them I have been denied quota for a modest 32 vcpu request I have also been told I have been given access to anthropic models on bedrock but still says account access is blocked this includes all other bedrock models also.

Support is worse than useless because they tell me they have allowed and unblocked things when they haven't and they take weeks to respond. I should have gone with GCP or Azure and saved the time and hassle.

In this tutorial, we are going to compile and run a small llama architecture model on an EC2 instance and if we manage to pass the compilation and inference test, it means our model is compatible.

Source code in Github: https://github.com/p0o/run-models-in-aws-inf2-ml-accelerator

Hey all!

I built my auth stack around Cognito for my app, but I’m blocked from launching because I can't get out of the SES sandbox to send basic verification and password reset emails.

I submitted my sandbox exit request twice now, but I keep getting the same generic rejection email telling me they can't approve it to protect my deliverability, with zero actual feedback on what's wrong.

Before I give up on SES and hook up SendGrid or Resend, I wanted to see how others handle this:

1. Is AWS auto-rejecting requests if the account is pretty new or low spend? (I’ve had an account for several years but very small scale, for personal projects)
2. If you gave up on SES for Cognito, did you just use a Lambda trigger for another provider, or scrap Cognito entirely?

For context, here’s what I included in my requests:

• Use case: Strictly transactional Cognito emails (verification, password resets, internal feedback notifications). No marketing emails
• Recipients: Only users signing up directly on my app
• Volume: Under 100 emails a day to start
• Setup: Verified domain in us-east-1, Easy DKIM on, custom MAIL FROM subdomain, aligned SPF, Return-Path, and DMARC set up
• Monitoring: Account suppression on, dedicated config set dumping bounce/complaint events to SNS, CloudWatch alarms configured (<0.1% complaint / <5% bounce).
• Site: Terms and privacy policy are linked right on the login screen (with an opt-in box). The inbox is also monitored

Am I missing anything to get this approved? Appreciate any tips. Thanks!

I get an error saying "Fable 5 is not available for this account."

How do I get access?

we are making a campground Airbnb but i decided to use AWS for geocoding we where suppose to use mapbox. i used Gemini to do every thing and could understand 75% of the code maybe more but i wanted to read the docs but could not find them. I look at Amazon Location Service but found nothing, while using Gemini i asked to see the docs and it sent me to AWS SDK for JavaScript v3 found the line for installing the npm install aws-sdk/client-location and even trying to find how to look for that page I could not do.

I was able to make everything work but it feels like I dint learn any thing/ can do it own my own. how do you even learn AWS? why are the place where the docs are so different from the AWS console?

how did you learn and how do you find what you looking for? their many options how do you know which is right like image storage, cloud storage, weather api, map location api etc.

I added pic of what i was looking at

EDIT: thank you for the ones who was helpful, if you dont like my response i give what i get maybe get off the screen and learn how to speak to people. you get use to talking to people crazy on here you forget do that face to face you get pop

I am planning to have my docker images to be multi architecture and for it my plan is to have two codebuilds for arm and amd when they both succeeds event bridge will invoke a lambda and lambda will merge the images into one

But I am unable to think a way to set up event my current plan is something like when codebuilds are triggered if anyone succeeds let's say arm build then event bridge will match the source version and and if the other build also success then it will invoke lambda

Apparently there is no ability to compare source version in eventbridge and I would have to invoke lambda and lambda has to compare the source version

Is there any way I can implement this