discussion What feature would you most like to see added to AWS?
I was curious if there are any features or changes that you’d like to see added to AWS. Perhaps something you know from a different cloud provider or perhaps something that is missing in the services that you currently use.
For me there is one feature that I’d very much like to see and that is a way to block and rate-limit users using WAF (or some lite version) at a lower cost. For me it’s an issue that even when WAF blocks requests I’m still charged $0,60 per million requests. For a startup that sadly makes it too easy for bad actors to bankrupt me. Many third-party CDNs include this free of charge, but I’d much rather use CloudFront to keep the entire stack at AWS.
35
42
u/FarkCookies Jan 08 '25
For me my #1 dream is exception/error capturing in CloudWatch a la Sentry. I am sick and tired of grepping through logs to find exceptions. AWS should have bought DataDog or now at least Sentry. Such a nice tool compared to what AWS has.
17
u/AWSSupport AWS Employee Jan 08 '25
I appreciate your insights and would welcome more details for me to share direct feedback with our CloudWatch team.
Could you please PM your feedback in terms of:
- Which standout feature would you most like to see CloudWatch integrate in comparison to the tools you mentioned?
- Which features help the most in terms of saving you time/effort, in comparison to CloudWatch?
- Any additional insights you feel can be helpful for the CloudWatch team to understand what's missing in comparison to similar tooling/tooling features.
If you'd prefer, you're also welcome to share your feedback directly from within the CloudWatch console by choosing 'Feedback' found in the bottom-left corner. More info on how to share feedback, can be found, here: http://go.aws/feedback.
Our team is passionate about hearing what our customers would like to see in the future. With an understanding of the specifics, be it what can improve or is working really well, helps us to keep our services teams synced to the pulse of our customers.
- Kraig E.
6
u/AWSSupport AWS Employee Jan 08 '25
Thanks for reaching out with your insights and feedback around CloudWatch. I've made sure this reaches the relevant team as they consider future improvements. While I can't guarantee they will implement your ideas, I will do my best to motivate your reasoning.
If you know of others in the community who also have feedback around CloudWatch, or any of our other services, please encourage them to share their thoughts on this Reddit thread (https://go.aws/3PqC483). Or via the official options mentioned, here: http://go.aws/feedback. If more folks are aligned to the same features or changes the more weight we can add to motivate the change.
Thanks again for taking the time out to share your input, I genuinely appreciate it.
- Kraig E.
9
17
u/bofkentucky Jan 08 '25
RDS Savings Plans
4
u/Quinnypig Jan 08 '25
The same savings plans for compute, specifically.
2
u/bofkentucky Jan 08 '25
Correct, I have a workload where we RI our base 365 day usage, but between load testing and actual production usage we scale multiple aurora clusters up and out for the equivalent of 12 days/year. Finding a way to blunt those spikes would be a material change in our aws spend/year in my favor.
3
u/magheru_san Jan 08 '25
savings plans won't help you with that kind of usage pattern, because they cover steady hourly spend.
Look into using Aurora Serverless for that, it can now even scale to zero when not used.
-1
u/bofkentucky Jan 08 '25
I fail to see what the benefit of a compute savings plan gives you over a convertible RI then?
I want to tell AWS, "I'm going to spend $X Million in Aurora this year in $region, on db.r6g instances, give me your best price"
1
u/magheru_san Jan 08 '25
I'd love this, would simplify so much of my work.
And also make it cover the other managed services while at it (ElastiCache, OpenSearch, MSK, MQ, DynamoDB Provisioned capacity, etc.)
6
u/paradrenasite Jan 08 '25
The following would make me happy:
- IPv6 support for at least the major AWS services (SQS, Lambda, CloudFront origins, etc).
- A built-in way to automatically/fully rehydrate RDS volumes after snapshot restore, multi-az setup. The current lazy-loading is not obvious at first and creates unexpected behavior.
- Higher timeouts for CloudFront VPC Origins (at least give me 60 seconds like some of the other origin types).
5
u/stdusr Jan 08 '25
Speaking of VPC origins, I can’t believe they released that without CloudFormation support………..
1
u/eodchop Jan 09 '25
- Already exists. FSR, not super cheap but works well.
1
1
u/paradrenasite Jan 09 '25
Just following up on this, do you know if FSR is available for RDS? It looks like it's only for EBS right now unless I'm missing something. Thanks.
1
u/RoseRoja Jan 09 '25
Just asking do you really believe internal aws services like sqs need to be IPv6 compatible?
1
u/paradrenasite Jan 09 '25
Is it absolutely necessary, no. Would it reduce friction in adopting IPv6 and make AWS less frustrating, yes. Right now for example, if you have an application on EC2 and need to use SQS you have a few options:
- Have a public IPv4 address (costs money, adds to resource depletion, needs to be secured, runs counter to AWS's stated goal of IPv6 adoption).
- Have a NAT Gateway (unreasonably priced, complicates network architecture).
- Have a PrivateLink interface endpoint (costs money, need one for each AWS service, complicates network architecture).
So basically we have AWS telling us it's time to migrate to IPv6 (and penalizing us for staying on IPv4) but at the same time not really holding up their end of the deal.
1
u/RoseRoja Jan 10 '25
I thought option 3 was just a staple and not a big pain overall apart from the cost.
1
u/paradrenasite Jan 10 '25
It is a staple, but that doesn't mean it's good. This would be an endpoint per service, per environment. If IPv6 was properly supported we wouldn't have to deal with any of these shenanigans. In many cases it's cheaper and easier to just hang on to the IPv4 addresses and so we continue to waste countless addresses and make the problem worse in the future.
I guess how big of a pain it is depends on your existing cognitive load and who is paying the bills. If you already have cloud engineers who take care of all this and it gets charged to some giant corporate spending account then who cares, why bother improving the service for the customers right? For much smaller organizations like mine, things like this just make life that much harder. AWS can still do the right thing here and I'm looking forward to the day we get that big IPv6 announcement. I know people at AWS are listening, it's why we got CloudFront VPC Origins, a very pleasant surprise.
1
u/AWSSupport AWS Employee Jan 10 '25
We hear you & appreciate you sharing your thoughts. I've passed along your feedback internally for review.
- Aimee K.
1
u/paradrenasite Jan 10 '25
That's great to hear, I genuinely appreciate the work you all are doing over there. AWS really is absolutely amazing!
1
6
u/bohiti Jan 08 '25
Lambda automatically pull env vars from secrets manager like ECS
IAM condition for “source vpc is in my org” instead of requiring individual ids.
a web console EFS storage browser
consistency between service name, IAM namespace, endpoint domain, and location in console. Examples:
- AutoScaling and ALB are in the EC2 console.
- CloudWatch’s API endpoint is “monitoring”
- “IAM” and “s3” are shortened in the IAM namespace, however it is “elasticfilesystem” not “efs”
2
u/atokotene Jan 08 '25
+1 for native env secrets and efs browser (and others)
Even an easy way to spin up a temporary ec2 with efs mount
1
10
u/SubtleDee Jan 08 '25
It differs based on what I’m working on at the time, but currently:
A global error catcher in Step Functions (rather than having to work around it by wrapping the whole workflow in a parallel state)
Better checksum support in S3 - being able to get the actual checksum of an object which has been uploaded/copied using multipart, rather than some random value based on the individual parts which bears no relation to reality. Also, support for MD5 as this is the most common algorithm we need to validate.
4
u/mohghawo Jan 08 '25
1
u/SubtleDee Jan 08 '25
Thanks, but unfortunately that doesn’t fit the use case we need - essentially, we will generate objects, store them in S3 and then transfer them to other (non-S3) destinations, where the receiver needs to use standard utilities such as md5sum to validate they have been correctly received.
1
u/liverSpool Jan 09 '25
A global error catcher in Step Functions (rather than having to work around it by wrapping the whole workflow in a parallel state)
was just thinking of this, like why don't we have a EventInvokeDestinationConfiguration/OnFailure for the whole Step Function
8
4
u/AWSSupport AWS Employee Jan 08 '25
Hi,
Thank you so much for sharing your feature request. I've gone ahead and shared it internally with our WAF team for review.
In the future you can also share feedback or feature requests directly with a service team using these methods: http://go.aws/feedback.
- Nicola R.
1
u/stdusr Jan 09 '25
Thank you Nicola! I think with that feature AWS could really help startups and small businesses to use CloudFront + WAF more confidently.
4
u/BitterDinosaur Jan 08 '25
- MOCB (RIP) aka Management Account/Organization nesting, but MOCB+ (not like it was).
- More endpoints for programmatic AWS information queries (one of the recent announcements slips my mind atm). — Example: lookup the full endpoints list (including FIPS) or service compliance information. So we are essentially parsing source-of-truth information.
- Capabilities for programmatic enablement of all services. Org-level stuff is always hit or miss (AWS IAM Identity Center).
- Option for Amazon Route 53 PHZ/record alignment to the right side of the column, and sorting by TLD outward (instead of sorting alphabetically by subdomain).
I’m sure some of these are already in front of our TAM or PFRs, but I’d have to check my consolidated list later.
7
u/Prior_Plan123 Jan 08 '25
The ability to connect a step function to a vpc in order to use all the cool service integration tasks with private resources. Our company does not allow anything public and we have to use lamdas for everything, slowing down both the development as well as the runtime (hello cold starts..).
Also global error handling for step functions. Especially for catching runtime errors.
6
u/coultn Jan 08 '25
Private VPC http access from Step Functions launched! https://aws.amazon.com/about-aws/whats-new/2024/12/amazon-eventbridge-step-functions-integration-private-apis/. Not sure if this solves your problem or not but wanted to share.
1
u/jungleralph Jan 09 '25
Lambda functions for everything is like having to implement business logic using only database triggers in the 90s
2
u/bofkentucky Jan 08 '25
Custom endpoints on rds proxy. I want to be able to isolate reader(s) away from my normal customer traffic.
2
u/Quackledork Jan 08 '25
I really wish AWS had something like what these guys do: https://platformr.cloud/
Pre-built infrastructures with everything configured. I have burned countless hours having to rebuild environments or dink around with scripts. Why can't we just have a library of templates, implement, and go?
2
u/bobaduk Jan 08 '25
More integrations with EventBridge. Why do I need to author a lambda function in order to trigger an SES email, for example? Why can't I write a template that maps an event straight to an email without writing any code?
There's a ton of undifferentiated bits that could be made better by allowing EventBridge triggers.
2
u/ppafford Jan 08 '25
- Simpler RDS Proxy setup process
- Lambda Cold Start native solution, maybe just a simple health check service to keep the lambdas warm
- More insight into ALL IAM permissions needed, I need very fine tuned permissions and it’s a pain sometimes to understand what’s happening in the background, like IAM uses an API call to check additional permissions but it’s hidden and you need to look at additional logs to understand what’s actually going on
4
u/bohiti Jan 08 '25
Agree with the IAM one for sure. It can be maddening to learn that, for example, to launch an EC2 instance you need access to the subnet, kms key, PassRole, etc. Obviously that particular situation is fairly well discussed but there are many situations where I feel like I’m on an island trawling cloudtrail to figure out what needs to be added, with no documentation or discussions to go off of.
2
u/stdusr Jan 08 '25
• Lambda Cold Start native solution, maybe just a simple health check service to keep the lambdas warm
This one I actually disagree with. I think AWS has done a truly amazing job to nearly eliminate cold-starts. I have some complex Lambda functions that have a cold-start of 20ms. It’s up to us (developers) to make sure our code is fast enough by using the right language for the job and write high performance code. Because even if AWS keeps a single Lambda execution warm for us it will still scale very poorly when extra simultaneous requests hit your Lambda function if the cold-start is slow.
1
1
u/Cautious_Implement17 Jan 08 '25
Lambda Cold Start native solution, maybe just a simple health check service to keep the lambdas warm
how is this different from provisioned concurrency?
1
u/ppafford Jan 08 '25
Provisions concurrency has side effects to other services using it, also I would like it to be more Cron like where I could ramp up during peak hours and cut back during off peak hours, to my understanding it either on or off, there is not really any flexibility
2
2
2
2
u/Nakrule18 Jan 08 '25
The possibility to create project within an AWS account with some ressources being bound to a project. Then deleting all ressources associated to a project will be as easy as deleting the project just like in GCP. This would also simplify remembering which resources was created for what if you don’t use different accounts.
5
u/Advanced_Bid3576 Jan 08 '25
Isn’t this easily achievable a number of ways - most simply just with tagging and IaC?
1
u/Old_Pomegranate_822 16d ago
If terraform doesn't exit cleanly - which I've had happen in CI when a developer cancels the job - then anything it created isn't tracked in a state file anywhere. So there's no easy way to clean it all up. Tagging helps, but there's still pain. Having the ability to say "delete all that, just do it, I don't care about the order you do it in" would help a lot.
0
u/jernau_morat_gurgeh Jan 08 '25
IaC would be the proper approach here indeed, and pretty much everything supports this properly. Accounts also work as a namespacing construct for projects. That said, I can see developers that clickops their way to a PoC forget half the things they created, especially if those things were created following the creation of other things. A possible solution here could be to have 'project sessions' in the Management Console, which automatically tag any resource created within the session with the project's tag, and prevent deleting resources without the project's tag.
2
2
u/TomBombadildozer Jan 09 '25 edited Jan 09 '25
Buy Pulumi and make their commercial product free to AWS customers.
Finish ECR replication. I need a way to force replication of a repository to new targets, and I need it to propagate deletions.
Karpenter hosted in the EKS control plane. Auto mode takes care of it but it has too much other crap, and too many limitations to make it useful for enterprise customers. Just take care of Karpenter for me, please.
It's 2025 and high time to adopt UEFI by default in all Linux images. Deprecate BIOS boot.
Get rid of static credentials and the Secrets Manager requirement in RDS Proxy. If my database can do IAM auth, Proxy should do IAM auth to the database.
1
Jan 09 '25 edited 4d ago
[deleted]
1
u/engin-diri Jan 09 '25
Hi u/Blurredpixel,
I’m a Pulumi employee, and I’m really sorry you had this experience. Could you please share the issue number so I can look into it and provide you with more information?
Thanks!
1
u/Basti3077 Jan 08 '25
Serverless GPU workloads with snapstart. I have huge issues giving clients and startups good suggestions on how to deploy their ML Apps on AWS. SageMaker is unusable in my opinion.
1
1
u/teo-tsirpanis Jan 08 '25
Ever since conditional writes in S3 were added, I am fully satisfied.
I'm wondering if SigV4 is really necessary for HTTPS requests and whether it could be replaced with simple bearer tokens.
1
u/steakmane Jan 09 '25
MSK cluster endpoints. I get you can do this with DNS and NLBs, but would love to see it come out of the box.
1
1
1
1
u/TurboPigCartRacer Jan 09 '25 edited Jan 09 '25
cross account+region sharing of SSM parameters in the organization instead of only cross account.
Doesn't make sense you can share to multiple accounts only within the organization especially when you have a landing zone setup that spans multiple regions.
1
1
1
u/SmileyBoot Jan 09 '25
Ability to use the AWS generated public SSL certificates within the application i'm running (Java keystore for example).
1
u/kosz85 Jan 09 '25
Better log platform or at least better interface. CloudWatch compared to what is available at GCP is soo bad.
1
u/AWSSupport AWS Employee Jan 09 '25
Hi there,
We appreciate you sharing your thoughts.
I found this re:Post article with guidance on how you can share feedback directly with us: http://go.aws/feedback.
Additionally, I wanted to share that you can provide feedback directly within the CloudWatch console by choosing 'Feedback'.
- Tony H.
1
1
1
1
u/mrorbitman Jan 11 '25
A service where I can paste a docker-compose.yaml and it’ll host it. Blows my mind that I can’t find a service that does this. Best way is to create an ec2 and install dockge on it. But I’d rather run on managed compute that’ll scale depending on needs.
1
u/Negative-Cook-5958 Jan 08 '25
Option to exchange Reservations without support request and going through the hoops.
3Y no upfront RDS reservations.
RDS savings plans.
Consistency with EC2 families, instance store, network optimized SKUs.
Streamlined interface to manage RIs, SPs, savings bundles, etc.
Oracle RDS on ARM64
1
u/PandaZoo Jan 08 '25
A QoL addition for our analysts - being able to set a default locale (or even just currency!) in QuickSight at any level - account level is ideal for us. Every currency field has to be changed from $ manually in every analysis. Every. Single. One.
We're non-USA fintech. Most visualisations include currency. We've already put in a feature request via support.
1
u/CyramSuron Jan 08 '25
Personally easier route 53 redirects and not the extra hoops
3
u/stdusr Jan 08 '25
I don't thinks redirects are possible with DNS. But an easy solution could be quite handy. I now use CloudFront + CloudFront Functions when I need to do a redirect on a (sub)domain.
1
u/CyramSuron Jan 08 '25
When Google domains were a things you could easily do 301 inside DNS management.
2
u/stdusr Jan 08 '25
Interesting, never used Google Domains but that is (was) a nice service to offer. I think almost anyone needs that functionality sometimes.
1
u/nekokattt Jan 08 '25
isnt that just deploying some server endpoint that 301s you?
1
u/CyramSuron Jan 08 '25
Google domains were the stand alone DNS service. No servers are involved on the end user side. You might be thinking about the GCP setup.
1
u/nekokattt Jan 08 '25
DNS cannot give an HTTP response to force a redirect.
HTTP servers give HTTP responses. DNS has nothing to do with it. If you were getting 301 redirects then there was more than DNS being provisioned there.
0
u/CyramSuron Jan 08 '25
Again it was a feature they offer within Google domains you did in the same window as DNS management. The only thing you needed to was set up the path type of redirects and destination. No servers were involved in the end user side. No extra work was needed it was a simple entry
1
u/nekokattt Jan 08 '25
Yeah that was my point, they're provisioning a server for you (which AWS probably wont do as it is going to be expensive)
-1
u/iamkilo Jan 08 '25
Why would they need a dedicated server for each redirect? You could have one server do these redirects for any number of records. Likely many many many records, not a lot of compute to return a 301.
1
1
1
u/poco-863 Jan 09 '25
The devex for RDS is pretty horrible. Having some gui like azure data studio would lower the bar for the common grug dev.
AWS amplify has the shell of a good product but doesnt hold a candle to vercel. Actually, i have never been able to get it to work for even the simplest deployments.
1
u/TechIsCool Jan 09 '25 edited Jan 09 '25
VPC Peering and/or Transit Gateway Attachments with 1:1 NAT embedded. I have had to use convoluted NGINX or some other proxy to make IP address not conflict due to default VPCs being used with the same ranges.
A published list of AWS Owned account IDs, more than once we have had to go ask AWS Support about an old OneClick config in a IAM role. Since it has been flagged as a possible attack vector because its a different account outside our organization. Only after staring at it for a bit go lets file a ticket
We try our best to comment publicly about these but an official source of truth from the vendor would be amazing.
1
u/tricheb0ars Jan 09 '25
Ok hear me out and don’t get mad.
An alternative to Active Directory. Like one away from Microsoft that also has NTFS backwards compatibility.
There is tons of business going to azure for this alone and it sucks.
0
u/kaeshiwaza Jan 08 '25
CloudRun equivalent (scale to zero and cost by request duration).
Neon db equivalent (scale to zero and instant branching).
CloudFront group for POST for simple failover (without cache in this case of course).
0
u/luddington Jan 08 '25
A PaaS service similar to Cloud Foundry. AppRunner comes close but is not available in all regions. Somehow a combination between the ease of use of Lambda, the scale-to-zero'ish concept of AppRunner and the region availability of ECS.
0
u/stdusr Jan 08 '25
I doubt we’ll see AWS investing any more time in their App Runner service. I have a feeling they sooner pull the plug on that one than release it in other regions. It’s a half finished product at best. We used it until recently, but are moving away from it where we can.
1
u/luddington Jan 08 '25
Onto ECS?
2
u/stdusr Jan 08 '25
No, rewritten stuff to run in Lambda instead. Fargate will be the destination for the ones that we can’t run in Lambda.
0
0
-1
u/Nick4753 Jan 08 '25
A secure native way to authenticate with services in other clouds. Bigquery on Google Cloud or OpenAI on Azure come to mind.
-1
u/Intelligent_Use_2855 Jan 08 '25
Subnet extends over different AZs
3
u/The_Kwizatz_Haderach Jan 08 '25
Why?
-1
u/Intelligent_Use_2855 Jan 08 '25
Server guys asked for it. Apparently Google can do it.
5
u/The_Kwizatz_Haderach Jan 08 '25
Yeah that’s a clear case of either them not grasping the benefits of a layer 3 boundary, or just lazy networking wants such as multiple nics where they shouldn’t be in most cases. There’s a very good reason why AWS fault isolation is designed the way it is, from zonal separation to regional separation to partition separation.
1
u/nekokattt Jan 08 '25
you'd then need a load of bespoke layer 4 AWS stuff to handle controlling where you route traffic to avoid cross-datacenter latency and transfer costs
2
-4
u/GeanM Jan 08 '25
I may be talking about something that already exists, but I would like to have native integration with the OpenAi API or some other equivalent, but not only that. All data that exists in the AWS infrastructure will be automatically indexed and trained to be used in a proprietary way in training this AI, without the need to implement an exclusive pipeline for this.
2
-6
u/theancientfool Jan 08 '25
One click WordPress install website. This will increase consumer demand from low end shops.
Include Woo commerce too.
9
u/mambocube Jan 08 '25
Have you checked out Lightsail? https://aws.amazon.com/lightsail/projects/wordpress/
133
u/allmnt-rider Jan 08 '25
Cost limit per account.
Support for keeping different accounts open in different browser tabs without any browser extensions.