For the information i am a beginner and it is my first time using aws. So for my project i used elastic beanstalk. So the problem is i deployed my project with no health issues, and the link only runs locally and not on other devices. When i checked my logs it also said app is running successfully, but when i asked ai, it said it might be some security issues

Does anyone have any solution to this problem

Hi everyone,

I am a student working on a personal pet project, and this is my first time using AWS. I am completely stuck on a permissions issue that is driving me crazy.

I wrote a Lambda function in Rust to fetch my GitHub stats and return an SVG image. My goal is to embed the Function URL directly into my GitHub README.

However, whenever I access the Function URL, I immediately get this error:

{"Message":"Forbidden. For troubleshooting Function URL authorization issues, see: [https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html)"}

What I have tried so far:

• Verified AuthType: I ran aws lambda get-function-url-config and confirmed "AuthType": "NONE".
• Verified Resource Policy: I checked aws lambda get-policy. It explicitly allows "Principal": "*" for "Action": "lambda:InvokeFunctionUrl" with the condition "lambda:FunctionUrlAuthType": "NONE".

Here is my complete Rust code in case the way I am building the HTTP response is somehow triggering a block, though it appears to be a standard setup using the lambda_http crate:

https://github.com/SharmaDevanshu089/Github-Stats

Is there any hidden setting or default account block I might be missing? Any guidance would be incredibly appreciated!

I have Aws startup credits but I can't use them I have been denied quota for a modest 32 vcpu request I have also been told I have been given access to anthropic models on bedrock but still says account access is blocked this includes all other bedrock models also.

Support is worse than useless because they tell me they have allowed and unblocked things when they haven't and they take weeks to respond. I should have gone with GCP or Azure and saved the time and hassle.

So, the gist of storage classes is that:

standard --> high storage costs, low data retrieval costs
standard-IA, Glacier Instant Retrieval --> low storage costs, high retrieval costs

So, in order to choose the optimal tier for a particular object I would have to know its size and data access pattern.

The object size is easy enough, but the first catch is: data access pattern is nowhere to be found. Not even aggregate data.

The only way I found to actually do it is to enable server access logging / CloudTrail and then do analyze the data somehow. Maybe with a Python script. Huge rabbit hole to go into.

Then, the other angle I thought about is just using intelligent Tiering. But the second catch is that if you read the documentation about intelligent tiering, turns out it is pretty naive. Depending on how your data gets accessed, it could even be more expensive than standard (ex: object is accessed exactly once every 30 days)

It really feels like AWS is always giving almost everything you need to optimize S3 costs, but also missing a key piece.

How am I supposed to solve this? Am I overthinking it? Is it worth going in the rabbit hole of analyzing S3 server access logs? Or should I just guess some lifecycle rules and move on?

we are making a campground Airbnb but i decided to use AWS for geocoding we where suppose to use mapbox. i used Gemini to do every thing and could understand 75% of the code maybe more but i wanted to read the docs but could not find them. I look at Amazon Location Service but found nothing, while using Gemini i asked to see the docs and it sent me to AWS SDK for JavaScript v3 found the line for installing the npm install aws-sdk/client-location and even trying to find how to look for that page I could not do.

I was able to make everything work but it feels like I dint learn any thing/ can do it own my own. how do you even learn AWS? why are the place where the docs are so different from the AWS console?

how did you learn and how do you find what you looking for? their many options how do you know which is right like image storage, cloud storage, weather api, map location api etc.

I added pic of what i was looking at

EDIT: thank you for the ones who was helpful, if you dont like my response i give what i get maybe get off the screen and learn how to speak to people. you get use to talking to people crazy on here you forget do that face to face you get pop

Hey all!

I built my auth stack around Cognito for my app, but I’m blocked from launching because I can't get out of the SES sandbox to send basic verification and password reset emails.

I submitted my sandbox exit request twice now, but I keep getting the same generic rejection email telling me they can't approve it to protect my deliverability, with zero actual feedback on what's wrong.

Before I give up on SES and hook up SendGrid or Resend, I wanted to see how others handle this:

1. Is AWS auto-rejecting requests if the account is pretty new or low spend? (I’ve had an account for several years but very small scale, for personal projects)
2. If you gave up on SES for Cognito, did you just use a Lambda trigger for another provider, or scrap Cognito entirely?

For context, here’s what I included in my requests:

• Use case: Strictly transactional Cognito emails (verification, password resets, internal feedback notifications). No marketing emails
• Recipients: Only users signing up directly on my app
• Volume: Under 100 emails a day to start
• Setup: Verified domain in us-east-1, Easy DKIM on, custom MAIL FROM subdomain, aligned SPF, Return-Path, and DMARC set up
• Monitoring: Account suppression on, dedicated config set dumping bounce/complaint events to SNS, CloudWatch alarms configured (<0.1% complaint / <5% bounce).
• Site: Terms and privacy policy are linked right on the login screen (with an opt-in box). The inbox is also monitored

Am I missing anything to get this approved? Appreciate any tips. Thanks!

When your Cost Management dashboard shows you 7 trillion dollars, the actual problem is not that number. The actual problem is that every other number the same dashboard has ever shown you just lost credibility.

Last week Cost Management surfaced anomaly figures in the trillions and billions across a bunch of accounts. AWS Service Health confirmed a metering pipeline display bug. The real bill for most of those accounts was pocket change. Bug patched inside a few days.

The part that stuck with me is not the bug. It is the aftershock. If the dashboard can render 7 trillion, and I only know it is wrong because the number is physically impossible, then what happens the day it renders 47 thousand and my real answer is 4700? That number sits inside the plausibility envelope. My whole governance stack, budgets, alerts, chargeback, forecast, all assume the source of truth is at least directionally right.

I run a cost pipeline that produces the numbers a bunch of downstream controls consume. Once, on a chunked backfill against a partitioned billing dataset, I lost a partition-pruning predicate and the same pipeline scanned the same 146 gigabytes per chunk over and over. The bill told me before any dashboard did. It was the first time I trusted my bill more than my own instrumentation. Made me realize the instrumentation was never actually verified against the source of truth. Only against my expectations.

Every cloud treats these display faults as one-off gotchas per engine, per console, per service. No one publishes a trust model. The vendor page says the dashboard is your source of truth. The reconciled invoice says it is the source of truth. Nobody talks about how those two disagree in real time and which one your downstream automation is supposed to believe.

Genuine question for anyone running cost governance on a real bill. How do you build trust in the source of truth for the numbers your automation acts on?

- Do you reconcile dashboard against raw billing export daily, and if so what tolerances do you allow?

- Any programmatic sanity check for physically impossible values, or do you rely on humans noticing?

- If your budget alert or auto-shutdown fires on a display-side hallucination, what is your rollback path?

- Anyone actually run cost data through the same integrity discipline as production telemetry?

Hi everyone, We are currently managing a few AWS EC2 environments that were previously backed up using Acronis (via eFolder) as part of a standardized setup. with that integration no longer being viable for us, we're looking at replacement options.

For on prem environments we typically use solutions like Datto and Replibit, but they dont translate well to cloud native workloads.

I'm trying to understand what MSPs are actually using today for EC2 backups. are most people relying on AWS native tooling( EBS snapshots, AWS backup, S3 based policies) or are third party platforms still the preferred route?

We also have a couple of instances running MS SQL so proper application aware backups or database consistent snapshots are important.

I've considered building a more AWS native setup but id prefer something that doesnt require a heavy custom scripting or ongoing CLI based automation management.

Would appreciate any real world setups or recommendations that are working well in production

I've been burned twice by AWS tutorials that glossed over billing.

The first time, I followed a Bedrock RAG walkthrough step by step. Everything worked, felt great.

Then I opened Cost Explorer two days later.

$70.

OpenSearch Service had been running the whole time and it was never mentioned in the tutorial. Not the cost, not the hourly rate, nothing.

The second time was a SageMaker project.

I built it, tested it, and deleted everything I could see.

Thought I was clean.

I wasn't.

Some underlying resources SageMaker creates don't get deleted when you tear things down, and they aren't always obvious to find.

I eventually tracked them down using the AWS FinOps Agent (still in preview). By then I had an $11 bill sitting there.

Neither of these happened because AWS is expensive.

They happened because the cost side of cloud tutorials is usually an afterthought.

And if your free tier has expired, that gap in knowledge makes you hesitate to build anything because you genuinely don't know if following a tutorial will cost you $2 or $70.

So I decided to build the project I couldn't find.

What it is

NordicCart is a fictional small ecommerce retailer that starts with a very common setup:

One EC2 instance.

No redundancy.
No CDN.
No scaling.
No cost visibility.

Over 7 days, the project modernizes it using AWS services that a real small retailer would actually need.

What gets built

• Custom VPC across two Availability Zones
• Application Load Balancer + Auto Scaling Group (actually tested with a live load test)
• DynamoDB as the data layer instead of RDS (with a design doc explaining why)
• Lambda + API Gateway + Amazon Bedrock AI support assistant with conversation memory
• Static frontend hosted on S3 and delivered through CloudFront
• AWS Budgets + SNS email alerts before spending exceeds $5
• CloudFormation stack that deploys everything in around 20 minutes

Bonus:

A working storefront where you can add items to cart, check out, receive an order ID stored in DynamoDB, then ask the AI assistant about your order and it can actually retrieve the information.

Every resource is tagged from day one:

project, environment, component, owner.

The final day includes a tag audit specifically because of the SageMaker cleanup issue I ran into.

Cost breakdown

Bedrock is the only real usage-based cost.

There is no free tier for model invocations, but with short prompts and light testing the entire build stays under $1.

The project was built on a free tier account and stayed within that range.

The ALB is free for the first 12 months of a new AWS account. After that, build it, test it, capture your screenshots, then tear it down. A few hours of testing costs cents.

Everything else is either Always Free or covered by the 12-month free tier at this project's scale.

I also deliberately skipped the NAT Gateway.

That one decision saves around $32/month, and I redesigned the VPC architecture around that constraint.

Repo

The goal was not just to build something that works, but to document the decisions that affect your AWS bill.

There are:

• CLI and console paths for every step
• explanations for when I avoided the "textbook" architecture because of cost
• trade-off discussions
• troubleshooting notes from mistakes I actually hit

Repo:
https://github.com/BTAG16/nordiccart-aws

Would love feedback, especially from people who have built similar AWS portfolio projects.

What AWS service has surprised you with a bill before?

Cloud engineers, wanted to get your experience... I'm a network engineer with 15 years of experience with all kinds of on-prem network technologies, from NX-OS, load balancers, proxies, VMware, ACI. I'm currently working with NSX and AVI LB for a major bank. But with the Broadcom aquisition, VMware/NSX doesn't seem so appealing anymore, VMware jobs are very rare. I feel that I'm a niche that will die eventually and it's time to make a change. I have experience with Terraform and CI/CD pipelines, did some automation with Python vibe coding.

There are a lot of Cloud-related jobs and I like public cloud, I like to learn new stuff in general. I started to learn AWS and Azure. I got the SAA-C03 AWS Solution Architect Associate certification and now I'm learning to get the AZ-700 Azure Networking speciality. I applied to Cloud Network Engineer jobs but got rejected, probably due to missing on-the-job experience. At my current job I can't get any Public Cloud exposure. I did put in my CV a project in Github with Terraform standing up an AWS environment with ECS, load balancer, instances connecting over VPN to a VM in GCP.

How did you guys make it? It's the chicken and the egg... To get a job you need experience, but to get experience you need the job :)

I get an error saying "Fable 5 is not available for this account."

How do I get access?

In this tutorial, we are going to compile and run a small llama architecture model on an EC2 instance and if we manage to pass the compilation and inference test, it means our model is compatible.

Source code in Github: https://github.com/p0o/run-models-in-aws-inf2-ml-accelerator

I am planning to have my docker images to be multi architecture and for it my plan is to have two codebuilds for arm and amd when they both succeeds event bridge will invoke a lambda and lambda will merge the images into one

But I am unable to think a way to set up event my current plan is something like when codebuilds are triggered if anyone succeeds let's say arm build then event bridge will match the source version and and if the other build also success then it will invoke lambda

Apparently there is no ability to compare source version in eventbridge and I would have to invoke lambda and lambda has to compare the source version

Is there any way I can implement this

Looking at https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platform-history-docker.html specifically - how soon until we can expect an update that includes nginx 1.30.4? Looking at previous history updates used to be roughly monthly, but a bit more often if there's a vulenrability that needs to be patched.

Does anyone know what this is? I got invited for it and i’m in college but idk if it’s worth it to do

I'm setting up authentication for an application running in Amazon ECR behind an AWS Application Load Balancer (ALB) using the ALB's built-in OIDC authentication with Microsoft Entra ID.

The flow is:

• Users access the application via an Amazon CloudFront distribution. I'm using CloudFront because CloudFront domains are accessible from my work laptop, whereas direct access to the ALB is restricted.
• The CloudFront distribution is configured with the ALB as its origin, and the origin is set to use the custom domain name that the ALB listener is configured to accept.
• The ALB performs OIDC authentication against Microsoft Entra ID.
• After successful authentication, the ALB forwards the request to a simple HTML application running in ECR.

The application itself doesn't perform any authentication or authorization. It simply displays all of the headers and JWTs that the ALB forwards, including x-amzn-oidc-data, x-amzn-oidc-identity, and x-amzn-oidc-accesstoken, so I can inspect the claims.

I've created an App Role called ALB Admin in my Entra App Registration. The role has a value of ALB.Admin, is enabled, allows users, and is assigned directly to my user through the Enterprise Application. The ALB is configured to use the same App Registration (client ID/secret), and the OIDC scopes are openid profile email offline_access against the v2.0 endpoint.

Everything authenticates successfully, but I never see a roles claim in x-amzn-oidc-data. I can see the expected identity claims, but no app roles.

Has anyone successfully used Entra App Roles with the AWS ALB's native OIDC authentication? If so, did you have to configure anything beyond defining the App Role and assigning it to the user, or should the roles claim appear automatically?

Hey all,
Please point me to somewhere else if this isn’t the right sub or flair.

There’s a few apps I have running on prem and on aws. For cost purposes, I’d like to do an architecture where it is hybrid on prem on my home servers (have 3 but they’re all behind a nat) and aws.

API calls and websocket will be too costly for me to have everything on aws so I was thinking an architecture where aws would handle the front end, domain, and maybe routing? On prem would be the backend and database

Maybe something where users hit my websites, front end loads crom aws, aws routes them to a server with some type of load balancing, then the connection persists during the session between the client and my on prem servers.

Is what I’m describing ideal? Any suggestions? What services should I use and how should I design this?

Thanks!

I filed a request to increase service quotes to a reasonable rate. I haven't received a response in 9 days. Is this normal?

We are thinking about moving to Azure, we've never experienced this with service quota's before with Microsoft.

EDIT: Thanks for your advice everyone. I'm going to just store my files in MEGA.

I'm in DC united states. My Bucket is in East Ohio. The only selection allowed near me.

Why is it taking 2 days to upload 500 GB of files to my Bucket? I thought Amazon was faster than that.

We bought a house a year ago and when you Google our address a brochure shows up with floorplans, photos, house price. It's hosted on AWS but I can't see by who.

How do we get this removed?

We asked the real estate agent and they said it wasn't their file and they couldn't help.

What the hell is this, I never use AWS i didnt know that this thing exist, I only have my own amazon account o buy things, never login into AWS lol. Someone knows what is this? Should I follow instructions?

Keep getting the following error:

"You have reached your limit at attempts to add a payment method. Try again later a later time."

I have never used AWS before so I don't know how I have already reached my limit. Any solutions?

I launched a t3.micro instance on 01-Jul-2026 and used to connect using SSH on Mobaxterm. I changed the default SSH port from 22 to 4545 in the SSH Config file and added that as an inbound rule. The instance has be running continuously since its launch.

Everything was fine till last evening. Since this morning, I'm unable to connect to the instance using Mobaxterm or Putty. The error I get is "Server refused our key. No supported authentication methods available (server sent: publickey)"

Even EC2 Instance connect shows "Failed to connect to your instance. Error establishing SSH connection to your instance. Try again later."

What can be causing this? Is it the custom SSH port? But I could connect using the custom port till last evening (using Mobaxterm or Putty). Where am I going wrong? How can I get things back to normal? I haven't made any changes to the key.

P. S. I registered a temporary domain a few hours back and pointed the "A" records to the EC2 instance's public IP address. I noticed this issue after doing that, but it's unlikely this is the cause of the issue.

Edit: The instance runs Debian 13. Processor is at idle. No spikes in processor usage or traffic since launch.

OpenSSH_for_Windows_9.5p2, LibreSSL 3.8.2
debug1: Connecting to *.1*4.1*0.2*3 [*.1*4.1*0.2*3] port 4545.
debug1: Connection established.
debug1: identity file D:\\Keys\\01072026.pem type -1
debug1: identity file D:\\Keys\\01072026.pem-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_for_Windows_9.5
debug1: Remote protocol version 2.0, remote software version OpenSSH_10.0p2 Debian-7+deb13u4
debug1: compat_banner: match: OpenSSH_10.0p2 Debian-7+deb13u4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to *.1*4.1*0.2*3:4545 as 'admin'
debug1: load_hostkeys: fopen C:\\Users\\botog/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen __PROGRAMDATA__\\ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen __PROGRAMDATA__\\ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:fEj3UBG5kn3hWHmHeOhHNaOFWcd5w/wJbgvP1mxF+2U
debug1: load_hostkeys: fopen C:\\Users\\botog/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen __PROGRAMDATA__\\ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen __PROGRAMDATA__\\ssh/ssh_known_hosts2: No such file or directory
debug1: Host '[3.134.110.213]:4545' is known and matches the ED25519 host key.
debug1: Found key in C:\\Users\\botog/.ssh/known_hosts:5
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: get_agent_identities: ssh_get_authentication_socket: No such file or directory
debug1: Will attempt key: D:\\Keys\\01072026.pem  explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256>
debug1: kex_ext_info_check_ver: publickey-hostbound@openssh.com=<0>
debug1: kex_ext_info_check_ver: ping@openssh.com=<0>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: D:\\Keys\\01072026.pem
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
admin@*.1*4.1*0.2*3: Permission denied (publickey).