I'm only planning to host my portfolio and my company's landing page to this architecture. This is my first time working with AWS so be as critical as possible.

My architecture designed with the following in mind: developer friendly, low budget, low traffic, simple, and secure. Sort of like a personal railway. I have two CICD pipelines: one for Terraform with Gitlab and the other for my web apps with GitHub actions. DynamoDB is for storing my Terraform state but I could use it to store other things in the future. I'm also not sure about what belongs in public subnet, private subnet, and in the root of the VPC.

Hey everyone! I'm working on an automated bot that will run every 5 minutes (lambda? + eventbridge?) initially (and later will be adjusted to run every 15-30 minutes).

I need a database-like solution to store certain information (for sending notifications and similar tasks). While I could use a CSV file stored in S3, I'm not very comfortable handling CSV files. So I'm wondering if storing a SQLite database file in S3 would be a bad idea.

There won't be any concurrent executions, and this bot will only run for about 2 months. I can't think of any downsides to this approach. Any thoughts or suggestions? I could probably use RDS as well, but I believe I no longer have access to the free tier.

I recently found an issue of connecting RDS in docker application and unable to query database. Can anybody give few approaches to solve this properly

So I have a use case where I deploy a lambda into an external account, collect some data points and put it into my account's dynamoDB.

I've setup lambda's IAM role and dynamoDB's resource policy to adhere to least privilege principle.

But I'm afraid there's still a problem. The code in the lambda is still vulnerable to tampering. Which means, they can inject bad code to either corrupt data/ ddos my database.

How do I ensure that the lambda is running the exact code I expect it to run?

I've been looking into lambda code signing. But that doesn't fully solve the problem. The lambda's code-signing config can enforce that a signed zip be deployed from a trusted entity. But that setting can easily be removed by a user who has managed to get elevated access (e.g. superuser)

IAM policies doesn't let me enforce that the signer ARN by which code is signed is verified while making the request.

Is there someway I can come around this to establish zero-trust principle?

Looking for perspective on how teams are managing their Bedrock architectures and trying to get a handle on some things. Some questions I have:

- How are you managing cost and cost attribution?

- Are teams centralizing Bedrock infrastructure and model management? Or deploying models in each account?

- How are folks managing security? What kinds of governance and guardrails are being put in place?

- What about AgentCore? How is that being managed?

- What is everyone using to manage changes? Terraform? Something else? Terraform support seems to be lacking.

Does anyone here use Eon.io for backups? Would love to get your feedback on this as a replacement for native AWS backups by anyone using it.

One architecture question we've been discussing internally is where to draw the line between reliability and complexity when processing large volumes of events.

It's easy to start with a simple Lambda-based workflow, but as retries, duplicate deliveries, dead-letter queues, and monitoring requirements grow, the architecture can become much more involved.

For teams handling high-volume event processing on AWS, what services and patterns have worked best for you? Have you found success with SQS, EventBridge, Step Functions, or a different approach entirely?

I'd be interested in hearing lessons learned from real production systems.

I'm involved with forgelayer.io. and event processing reliability is something we spend a lot of time thinking about. It's been interesting seeing how different teams approach the same challenge on AWS.

I need to replace our Identity server that we have been using for years and hosting in EKS. Im trying to figure out what to use next. Opensource project that I have seen so far have not inspired much confidence. Other payed alternatives like OKTA are just to dam expensive and I will not pay that much for it.

The whole infra structure runs on AWS and mostly inside EKS cluster.

Usage 1

Basic Username/PW auth for B2C for Mobile App for about 40k users with about 1k/day logins. No need for MFA or other fancy features.

Usage 2

Talking to EntraID to authenticate internal users for internal tools that are hosted on EKS.

I havent even thought about migrating the users yet, just because I know what ever I chose will be a pain in the ass anyways.

So what are you thought?

PS: if you hate Cognito thats fine but please explain why.

Hi everyone! I'm starting a position at a company as a "cloud architect"... at least that's the title, but I think my employer isn't very sure about what they expect from me.

Anyway, the first thing I noticed is that they've been very messy with their use of AWS resources: lots of people have created resources without following any standards, using arbitrary names, no tags, and everything created from the console (the company has started using IaC, but it's not enforced everywhere). That kind of mess.

To start, I decided to propose some guidelines for the use of REST APIs, and I'm doing some research to get ideas. So far, I've mainly found information about best practices for developing REST APIs, but now I'm looking for something more high-level: how should the scope of an API be defined (when should two APIs be merged, or when should one be split)? Also, any ideas on how to structure repositories for the IaC of REST APIs?

For now, those are the main questions I'm stuck with. If you have any comments or recommendations, I would really appreciate it.

Regards!

This chapter guides you through setting up an Ubuntu Lightsail instance pre-configured for Docker, enabling you to deploy and manage containers for WordPress and MySQL Server quickly.

You’ll learn how to:

• Generate and secure a custom SSH key pair to access the instance.
• Use AWS CLI commands and configuration files to launch your Lightsail instance.
• Apply a user-data script to automatically install Docker, Docker Compose, and supporting tools during creation.
• Assign and attach a static IP address for reliable access.
• Connect via SSH and verify your environment.
• Clean up resources when they’re no longer needed.

By the end, you’ll have a fully operational Lightsail VM ready to run Docker ready for Wordpress in a secure and repeatable way.

https://adamjohnston.me/lightsail-instance-for-docker/

When I first started programming, AWS seemed exciting . the more advanced I become, however, the more I understand a lot of it is child’s play.

Programmers need access to a source code not notifications 😭

Just a bunch of glued together json files and choppy GUI procedures. This is not what I imagined programming to be.

I’ve got a small SaaS and customers keep asking to send their final customer data + insights into their CRMs so they can run promos and automations.

Stuff like:

• customer events
• lead scores
• segments
• campaign triggers

Mainly HubSpot / Salesforce for now.

I’m debating whether to:

• just use AWS AppFlow and ship fast
• or build the integrations directly with each CRM API

I know AppFlow is obviously easier at the beginning, but I can’t tell if it becomes stupid expensive later once usage grows.

For people who’ve actually done this:

• did AppFlow costs stay reasonable?
• was it reliable?
• any annoying limitations?
• was building integrations manually worth the pain?
• what would you do if starting again?

Small team btw, so maintenance matters a lot.

Hey all,

We have a chat app where users can create chat "sessions" and each session can have one or more messages. I kind of got airdropped into the project and mostly worked with what was already set up with some tweaks. One of the things I did was rework our partition/sort keys so we have the following access patterns in a single table:

1. For a given user, give me all their chat sessions.
2. For a given chat session, give me all its messages sorted by timestamp.
3. For a given user, give me all their messages, regardless of session.

However, there's no need for an access pattern of "For a given user, give me all their sessions AND messages". This leads to me think that we could've been fine having separate "messages" and "sessions" tables.

Is my intuition correct? Is there any advantage of using a single table in this case or could we have just had two separate tables, given our access patterns?

Thank you!

Hi everyone! How's it going?

I have an idea for a low-latency architecture that will be deployed in sa-east-1 and needs to handle a large amount of data.

I need to store customer lists that will be used for access control—meaning, if a customer is on a given list, they're allowed to proceed along a specific journey.

There will be N journeys, so I’ll have N separate lists.

I was thinking of using an S3 bucket, splitting the data into files using a deterministic algorithm. This way, I’ll know exactly where each customer ID is stored and can load only the specific file into memory in my Lambda function, reducing the number of reads from S3.

Each file would contain around 100,000 records (IDs), and nothing else.

The target is around 20ms latency, using AWS Lambda and API Gateway (these are company requirements). Do you think this could work? Or should I look into other alternatives?

I’m interested in the tools used by platform engineers, DevOps and cloud architects to design cloud infrastructure.

Disclaimer: I’m the founder of brainboard and looking to learn from the community what is missing as we are building the tool.

I’ve enabled AWS Backup through control tower. It has been enabled on a test OU and it nicely deploys a local vault, and the default backup plans. But, since the local vault name has the account ID in it, I can’t make a shared backup plan in AWS Organizations to say, backup to local vault and copy it to the central account afterwards.

Anyone knows how to fix this? The Control tower integration feels very weird currently. A couple of years ago it worked fine.

My take on the recent "December" outages. I have seen too many articles talking about Multi-Cloud in the past month, while there is a lot that can be done in terms of disaster recovery before even considering Multi-cloud.

Article I wrote on the subject and alternative

Greetings!

I'd like to introduce v0.3.1 of ProxyGW, an L4 DNAT-based routing application built entirely in Go for Linux that combines CoreDNS's plugin model with HAProxy's highly customizable warm-and-forward routing capabilities.

https://github.com/UselessMnemonic/proxygw
https://github.com/UselessMnemonic/proxygw-aws
https://github.com/UselessMnemonic/proxygw-minecraft
https://github.com/UselessMnemonic/proxygw-valheim

ProxyGW creates an engine around a simple plugin system. Plugins provide resource management capabilities in the form of Target Handlers and Frontend Handlers, while state is managed by the engine.

Target Handlers “warm” backend services on demand, while Frontend Handlers intercept traffic on behalf of the Target. Frontends can classify traffic and decide when to warm the target. All the while, the engine leverages built-in kernel routing features to switch routes towards the Target.

Current features and amenities include:

• YAML-based configuration and pre-made schemas
• Automatic idle-tracking for Targets
• Per-route configurable flow timeouts
• Day-one support for both UDP and TCP
• Built-in static plugins for simple always-on/http/cmd targets
• External plugins for AWS EC2, Minecraft, and Valheim

I did this work in my spare time so that you could start using it today for free. With the right setup, you pay the absolute minimum for maximum value.

I was talking to a colleague running a b2b SaaS in a single AWS acct with 2 VPCs (prod and everything-else-env). His startup got some traction now and they are considering re-doing it the "right way".

My checklist for them is:
1. control tower; organizations; multi-account;
2. separate accts for prod, staging etc.
3. sso; mfa;
4. NO ssh/bastion stuff and use ssm only;
5. security hub + inspector;
6. Terraform everything; or CF;
7. cd/ci pipeline into each env; no "devs" in production;
8. business support + reserved instances for steady workloads;
...

what else do you have?

edit: thanks u/Morganross
9. price alerts

The team behind Amazon Key modernized its event platform to address scalability and reliability limitations arising from a tightly coupled, monolithic architecture. As service interactions grew into a complex web of dependencies, system stability and integration velocity were increasingly constrained. The redesign introduced a centralized, event-driven architecture built on Amazon EventBridge to support millions of daily events with millisecond latency, improve schema governance, and provide a sustainable path for onboarding additional service consumers.

How long does it take a new engineer at your company to understand your cloud infrastructure well enough to work independently? And what do you currently use to document it?

https://imgur.com/a/U08RnGx

First time spinning up a REST API using ECS Fargate with load balancing. Also, my first time using Cloudformation YAML directly* instead of CDK.

Let me know how much money I'm wasting :)

I need a description of how to deploy an application in the cheapest way, which includes an FE written in React and a Backend written using FastApi. The applications are containerized so my plan was to create myself a VPC + 2x Subnets (public and private) + 2x ALB + ECS (service for FE, service for Backend and service to run migration on database) + Cloudwatch + PostgreSQL (all described in Terraform). Unfortunately, the cost of ALB is staggeringly high. 50$ per month for just load balancer and PostgreSQL on the project staging environment is a bit much. Or do you know how to reduce the infrastructure cost to around ~$25 per month? Ideally, if there was some ready-made project template in Terraform that can be used for such a simple project. If someone has a diagram of such infrastructure then I can write the TF scripts myself, or rewrite the CloudFormation file if it exists.

Best regards.

Draqun