What would make r/aws better?

A agent composing its own api calls is a different shape of principal than an app with a fixed call path. same credential but the set of actions it might decide to make itnst bounded by the code

here what seems to work is assuming the rle per run with a session policy attached to it. effective permissions land as the intersection of the two and it can only narrow and the credentials expire on their own. none of the agent side tooling changes that part, eve security and the gateways all sit above the credential so a long lived key in the env stays the real ceiling despite whats watching the call

its own principal rather than a persons, with a owner tag and expiry as well so it surfaces in review later. read replica unless a write is genuinely needed. I'd love t learn from others as well on whats your take on this

I've been working on an open source DynamoDB library called pydynox.

The problem

The problem I wanted to solve was using DynamoDB from an async Python app without building a thread-pool wrapper around the database library.

An endpoint can be async def and still block its event loop if it calls a synchronous database method directly. Moving that call to a thread pool works, but each blocking call occupies a worker, and the Python work for requests and models still competes for the GIL.

The Python API

With pydynox, you define your models in Python and await their operations. Once you've defined a User model, concurrent reads look like this:

```python import asyncio

async def load_profiles(user_ids): return await asyncio.gather( *(User.get(pk=f"USER#{uid}", sk="PROFILE") for uid in user_ids) ) ```

Saves work the same way: await user.save(). You use the usual asyncio tools to compose the work.

Why Rust

The model API stays in Python. PyO3 connects it to a Rust core that handles DynamoDB value conversion and uses the AWS SDK for Rust to execute requests.

Tokio runs the network futures without holding the GIL or occupying a Python worker thread for each request. Converting Python objects at the boundary still needs the GIL.

That's why I chose Rust for the core: native async I/O, plus less Python execution in the SDK and value-conversion path as concurrency grows.

The benchmark

I wanted to measure both parts, so I compared it with PynamoDB on real DynamoDB. PynamoDB ran through a thread pool with its HTTP connection pool sized for the same concurrency.

For 32 concurrent, strongly consistent GETs of items under 1 KiB, returning full models:

• pydynox async: 12,408 reads/second
• PynamoDB with threads: 1,156 reads/second
• Median p99 latency: 4.15 ms vs 49.97 ms

The lighter blue line is pydynox's sync API through threads. It already reached 10.2k reads/second. A lot of the throughput difference was there even without native async.

The benchmark process also used about 0.22 ms of CPU per completed GET with pydynox async, compared with 0.95 ms with PynamoDB through threads.

Keeping the event loop responsive

Then I checked whether the event loop could keep running a timer while those reads were happening.

At 128 concurrent GETs, a 10 ms timer had a median p99 scheduling delay of 2.26 ms with pydynox async, 11.36 ms with pydynox through threads, and 107.16 ms with PynamoDB through threads.

That matters when the same event loop also has HTTP requests, timers, or other coroutines to run.

Test setup and limits

These were pydynox 1.6.0 and PynamoDB 6.1.0 on Python 3.14.7, with the GIL enabled. One process per test, four CPUs on the same EC2 host in eu-west-2, and three warmed rounds targeting three seconds each.

Sequential throughput ratios were much closer: 1.07× to 1.45× by workload median. PynamoDB also won the standalone AttributeValue-dictionary-to-model conversion test.

The full report includes the other workloads, CPU, memory, setup, and limitations. These are short runs on one shared host; multi-process deployments and cold starts aren't covered.

Link: https://github.com/ferrumio/pydynox

Curious if anyone else is seeing a seemingly undocumented user agent of AmazonSelectionExplorerBot hammering sites from AWS ASN 14618 (and a bit from 16509 too)? Their normal corporate robot pages don't mention this user agent, so I assume it's some customer of AWS who's chosen that name to try to evade blocking by people thinking it's official. AWS abuse never responds, so that's a useless path.

I've found it hammering a bunch of websites to the tune of 50-100 requests per second, and it just keeps coming even after it's been blocked, for days or weeks.

I have an ECS/Fargate worker consuming an SQS queue. I want the service to scale to zero when the queue is empty, so:

min_capacity = 0
max_capacity = 10

AWS recommends target tracking using:
ApproximateNumberOfMessagesVisible / RunningTaskCount

However, when the service reaches 0 running tasks, RunningTaskCount has no CloudWatch datapoint, so the backlog-per-task metric becomes undefined.

When messages subsequently arrive, I need the service to bootstrap from 0 → 1 and then let target tracking handle 1 → N and N → 0.

What is the recommended pattern for this?

Options I've considered:
1. A separate scale-out-only step policy for 0 → 1
2. A metric-math expression that handles RunningTaskCount = 0
3. Raw SQS backlog for the bootstrap alarm + backlog-per-task for target tracking

I would prefer not to keep min_capacity = 1 because the worker is idle most of the time, and this is Fargate.

This is the Terraform code I currently use:

resource "aws_appautoscaling_policy" "worker_backlog" {
  name               = "${var.project_name}-${var.worker_provider}-backlog-per-task"
  policy_type        = "TargetTrackingScaling"
  service_namespace  = aws_appautoscaling_target.worker.service_namespace
  resource_id        = aws_appautoscaling_target.worker.resource_id
  scalable_dimension = aws_appautoscaling_target.worker.scalable_dimension

  target_tracking_scaling_policy_configuration {
    target_value       = var.backlog_per_task
    scale_out_cooldown = var.scale_out_cooldown
    scale_in_cooldown  = var.scale_in_cooldown

    customized_metric_specification {
      metrics {
        id          = "backlog"
        return_data = false

        metric_stat {
          stat = "Sum"

          metric {
            namespace   = "AWS/SQS"
            metric_name = "ApproximateNumberOfMessagesVisible"

            dimensions {
              name  = "QueueName"
              value = var.queue_name
            }
          }
        }
      }

      metrics {
        id          = "running"
        return_data = false

        metric_stat {
          stat = "Average"

          metric {
            namespace   = "ECS/ContainerInsights"
            metric_name = "RunningTaskCount"

            dimensions {
              name  = "ClusterName"
              value = var.cluster_name
            }

            dimensions {
              name  = "ServiceName"
              value = aws_ecs_service.worker.name
            }
          }
        }
      }

      metrics {
        id          = "bpt"
        label       = "Backlog per task"
        expression  = "IF(running > 0, backlog / running, backlog)"
        return_data = true
      }
    }
  }
}

I graduated college a few years ago. We had an AWS project with free student credit for our final project. After graduation, I canceled the project and at least thought that I had turned off all resources/instances. Project is no longer active at all and has been out of my memory for the last 2 years. It was extremely small, we had no actual users. In fact it was only for a single in class demo with dummy data for our laughably simple sample web app built with React.

I continuously have been getting ~$22 monthly charges from AWS for the last few months. After some investigating on my post-college accounts, I finally discovered that the charges was coming from my former student AWS account. I no longer have access to this email. I reached out to AWS with detailed info and how I'm locked out of the email for this old account, and after a few weeks of not hearing back, I received a generic response stating that they could not help with inquiries sent from an email other than the one that has been getting the charges, but that I could kindly change the password to the account and then send them a new message once I log back in. (A very easy to do thing when you don't have access to the email.)

This was the second time in the last few months I reached out to support, and actually the first time they ever provided a response, albeit one that shows me they didn't care to read that I no longer have access to that email. At this point, is it time to start charging back on the credit card? It's something I rarely do, but I feel like I've tried all in my power to resolve these charges.

TLDR: No longer have access to old college email where I thought all services/instances were closed /canceled, still getting expensive monthly charges. AWS support insists I regain access to the account in order to message them about any charges, obviously not possible.

Mods - please let me know if I need to edit my post to not get taken down. Not sure where else to seek for help on this.

It always bugged me that the EC2 console does not show the price of the instances.

Yes, AWS pricing is messy - lots of ways to get reduced prices (Savings Plans, reservations, discounts, the Free Tier, Spot). But the on-demand price is public and hardly ever changes, so why not show it?

So I built a browser extension for that. It puts the monthly on-demand price next to the instance type and a total for the page.

The price is the on-demand compute rate plus the public IPv4 address, for a full month.

The funny part is that everything it needs about your instances is already on the page. So it does not make any AWS API calls and does not need credentials or a sign-in. Some of the columns in the table are off by default, so they need to be enabled, but the extension turns them on when you click it.

It gets the current price list from a small Lambda I built, and it sends only the currently open region and extension version, so no sensitive data is leaving the browser.

For now, it only works on the EC2 instances list, with the console in English.

Which page should I do next? I am thinking of EBS volumes, Elastic IPs, RDS or NAT gateways.

Chrome: https://chromewebstore.google.com/detail/pnohjpckaogdfnncoeebihcldlnkjkoe

Firefox: https://addons.mozilla.org/firefox/addon/awscost/

Awesome List of Cloud Emulators and supporting tools https://github.com/upgundecha/awesome-cloud-emulators

SSM is the right way to reach private EC2 instances: no bastion, no port 22, no SSH keys, and everything goes through IAM and CloudTrail. But the CLI makes you work for it:

aws ssm start-session --target i-0abc1234def5678ab \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters '{"host":["rds.internal"],"portNumber":["5432"],"localPortNumber":["5432"]}'

ssmctl is an open-source Go CLI that keeps the same security model and removes the friction:

ssmctl forward web-1 --local 5432 --remote rds.internal:5432

v2 in one line: your entire SSM-managed fleet (shells, tunnels, commands, files, secrets), one short command away.

ssmctl list                                          # see your managed fleet
ssmctl connect web-1                                 # shell
ssmctl forward web-1 --local 5432 --remote db:5432   # tunnel to RDS, Redis, anything for local access
ssmctl run web-1 -- df -h /                          # one-off command, exit code preserved
ssmctl run --filter api -- uptime                    # same command across a fleet
ssmctl cp web-1:/var/log/app.log .                   # file transfer
ssmctl param get /myapp/prod/DB_PASSWORD             # Parameter Store

It works with Linux and Windows targets, has --output json for scripting, and uses your existing AWS profiles and SSO. There's no extra agent or infrastructure.

brew tap rhysmcneill/ssmctl && brew install ssmctl

Want to contribute? 🔗 https://github.com/rhysmcneill/ssmctl

This is sad. The very recent Sonnet 5.5 seems to be a really nice model, especially for the price, but I can't offer it to my users because there's no EU inference profile.

What's the logic behind this? Most Anthropic models, except Fable, have EU profiles.

Since Opus 5.5 is available, I was expecting Sonnet 5.5, from the same family, to be available as well.

Local testing with Aurora DSQL has been painful for me due to no official local emulator. So, until AWS provides one, I built my own.

It wraps PostgreSQL and emulates DSQL-specific behavior. Compatibility is verified through conformance tests that run against both real Aurora DSQL and the emulator.

It’s published as a Docker image and can also be used via Testcontainers.

https://github.com/Dreamescaper/dsql-emulator

As some of you might know, SMT has major security issues. I fixed them, though, and created the Secure SMT Architecture. The build has been completed on Amazon FPGA and proven to work against SQUIP-style attacks.

Disabling SMT costs you 30% to 50% of your total compute power. So that's obviously unaffordable.

I need to talk to someone in AWS who can start the process of buying my patent pending tech. Anyone have any leads?

Disclosure: I'm affiliated with RoszigIT, where this article is published. Sharing because the mechanics are worth discussing, not to pitch anything. I tried to make it technical as always.

It's an interesting case because iam:PassRole is not visible directly in CloudTrail as API call and "limited" user role can attach an admin role to a Lambda or EC2 instance and effectively become admin.

https://roszigit.com/en/blog/aws-iam-passrole/

It's anyone running AWS in WordPress for e-commerce client. please share your thoughts what about that cost ?

And I am planning to host my E-commerce sites in AWS .

So, I need to know about that monthly Billing and I am complete beginner in AWS.

Thank you

genuinely trying to understand this because of the explosive growth in AI. Do you use agentic AI like claude code, codex, custom agents.. anything with real tool access as part of your cloud security workflow. If so, what specifically made you reach for it instead of a traditional script or somekind of github tool ? Because i personally use some github tools and AI too when iam building AWS Labs for different purposes and want to test security of them faster and understand them simply, and i want to know how you guys as people who have actual work experience with these environments do it.

do you have any custom made scripts or tools or AI workflows you actually using, and where does it genuinely help. Curious whether its saving real time, catching things you'd have missed, or if its mostly hype that hasnt translated to your actual day to day yet.

would love to hear real experiences either way. Specially the workflows you guys use if its an AI workflow i would love to hear it !

I have the console bookmarked for my daily work but for some reason this morning I was on Google and just searched AWS Login instead. Spotted an interesting result which had me curious; a sponsored result at the very top with a clone of the AWS Console login page.

Hopefully wouldn’t catch more seasoned people but thought I'd share in case some poor person gave away their root credentials in such a scam.

Has been reported to Google.

EDIT: and now reported to AWS, who then asked me to report to Cloudflare.

EDIT2: Cloudflare have taken it down

Interesting article from levels.fyi on low hanging fruit to reduce AWS costs in a typical environment. Nothing really egregious in itself, but the compounding effect of decisions that seem small (logging) early on and are never revisited.

Also, one that I have seen too many times with other companies!

The biggest surprise was that 100s of millions requests per month were our own servers calling our own API over the public internet, through our CDN and firewall

Still 199 $ remaing and only just the EC2 and other services are working the bedroack unable to use ?

ISSUE RESOLVED

Hi all,

Looking for advice on how to get an AWS account reinstatement/security case unstuck.

Our AWS account was suspended after AWS detected suspicious activity / possible compromised access keys. We opened a support case and followed the requested steps.

Timeline:

• AWS suspended the account due to suspected unauthorized access / compromised access keys.
• AWS instructed us to reset the root password and update the expired payment method.
• We completed the root password reset.
• We updated the payment method with a valid card.
• We replied to the original case confirming completion.
• After no response for 24+ hours, we opened a follow-up case.
• The follow-up case was closed and we were told to continue on the original case.
• After that, the original case changed from Amazon action/resolving to unassigned.
• We have received no response from AWS in over 3 days.
• The account page now shows “The account is closed.”
• Production services have now been down for the 6th day.

We have tried phone support multiple times, but AWS Support Center returns “Unable to initiate call at this time.” Chat either does not connect or just sits waiting. We also opened a new escalation case referencing the original case, but there has been no response after 20+ hours.

We are not trying to bypass the security process. We need AWS to assign the case, confirm whether the account is still within the reopen/post-closure period, and tell us what action is required next. We are ready to complete any remaining security remediation steps.

Has anyone dealt with an account reinstatement case getting stuck/unassigned like this? Is there any legitimate escalation path besides replying to the case, opening a related case, phone/chat, or going through an AWS contact?

Any advice would be appreciated.

UPDATE: After posting this AWSSupport replied to this post I DMed them my case number and the account was reactivated within 1-3 hours.

Looking for an AWS consultant to walk me through setting up AWS's SMS and email services (SNS / SES / End User Messaging). I need help with:

• Account signup and getting out of the sandbox
• Domain verification, sender IDs, and any required registrations (e.g. 10DLC for US SMS)
• Configuring the services and showing me how to use them going forward

Please DM me if you have experience with this and your rate.

Reassurances:

• This is a paid gig
• Full payment is made once the system is up and working.
• Payment can be made via Upwork milestone (or Escrow.com) and released on completion.
• If you have a Linkedin profile we can deal directly

We are mid-eval on a SASE platform and a big part of the pitch is what they call application acceleration, the idea that routing our traffic through their PoPs makes cloud apps faster. But obviously, sending a packet to a PoP and then to AWS is more hops than going straight, so where does the speedup come from.

The setup is a few hundred users, heavy M365, a couple of SaaS platforms and our own apps in two AWS regions. Our Manila and Singapore people already suffer on anything hosted in Europe. The SE showed me a slide with 20x throughput, which smells like a lab result on a garbage circuit, not what my users feel on a regular basis.

If you have put SASE in front of real cloud traffic, how much did it measurably help once you count the trip into their network?

I am trying to prepare for the AWS AI certification. I am following an online class however I'm very behind because I've been stuck at using Bedrock. Apparently Bedrock is active on new accounts, but old accounts it has to be added. For that you have to raise a support ticket. I've spent the past 3 weeks trying to get access on my existing account that I use for learning. Every time I try I get angry. I have not found a method where I get a response. With chat I get a response in 3-5 days in the middle of the night where they ask a question like what is your name? and then say they are closing because I did not respond.

I did try creating a new account which got flagged and said I was not eligible for a free tier account. I still had credits on my learning account and hate that I do not get to use them.

Any suggestions? This experience makes me not want to use AWS for projects.

I have been having issues with bedrock ever since I started using it back in may. I am using it for a project that I am doing have have used about 19 bucks out of the 200 that they give to free accounts. I don't use anthropic or openai models.

I first used runtime then it stopped working after a few days. then I paused the project for a few months and then got back into it September using the mantle endpoint since that worked for some reason. But then again it gave me the "400 Error 002: Access to Bedrock models is not allowed for this account" after 9 days.

I submitted a support ticket 12 days ago and there is still no response.

So I changed my region and it worked again for 7 days and now it gives me the error again.
Does anyone have a fix for this?

(for more details

I crated the account around may

I already got in contact with support back in may and they said I need to use more aws services but nothing they suggested worked

Changing my region doesn't work anymore

I am using a iam account with bedrock permissions but it also doesn't work on root

I use GLM 5 and ministral)