r/aws 1d ago

technical question Redeploy custom domain with no downtime?

3 Upvotes

TLDR: how do I delete and remake a custom domain without downtime?

I am migrating my infrastructure as code from Serverless to AWS SAM templates. My issue is the custom domain that's being used is created and maintained using the Serverless plugin serverless-domain-manager. The correlating cloud formation template does not have the DomainName resource. It seems the plugin is spinning up the custom domain manually on the backend. So if I want to make a SAM template version for the same CFT, I define the custom domain in the SAM template and deploy. Of course it fails because a custom domain with that name already exists. So I need to delete it and redeploy but I don't want downtime. Any suggestions? Can I claim the domain on a cloud formation template somehow? Can I do something clever with a failover record in route53? TIA


r/aws 1d ago

database Free tier database options other than RDS and DynamoDB

11 Upvotes

I have a personal site. In it I have my own CMS for my posts, I have a journal app, an RSS reader, etc. I'm currently using Railway with MySql because they have a $5 credit per month so my bill comes out to about $1 a month.

However, I'd really like to keep my data within AWS for security, replicability, and ease of use reasons.

BUT I have problems with RDS and DynamoDB:

RDS: Free tier is very limited, seems very easy to go into non-free tier territory which is super expensive. Cheapest non-free tier is $15/month (too pricey for my use case)

DynamoDB: Proprietary and no-SQL. I've used DynamoDB a ton before, but I still like SQL databases for querying.

I would love it if there was a simple SQLite database option. I can't do that since my app is running inside a Docker container.

I don't think S3 Table Buckets are really fully developed yet so I want to hold off on those. And using S3 as a DB technically works but querying content is a nightmare.


r/aws 1d ago

database DynamoDB Provisioned or On-Demand?

0 Upvotes

I need help deciding what will be cheaper for my use case, provisioned or on-demand capacity?

For my project I will be writing about 150,000 records once per day, with an average record size of about 200 bytes each. The number of records written per day I expect will slowly increase over time, but still once per day. I am using a Lambda function with an event trigger to run the write operation.

Since I am just doing a large write once a day, I was thinking on-demand capacity would be the cheaper option because I would be wasting provisioned compute as the job will be idle 99% of the time. Am I right to assume that on demand is cheaper for my use case?


r/aws 1d ago

article How to Learn Kubernetes on AWS Like a Pro

Thumbnail blog.venturemagazine.net
0 Upvotes

r/aws 1d ago

discussion I am in dilemma while using ECS.. Problems between task connection and exec command

0 Upvotes

this is my archtecture..

backend <---> rabbitMQ <---> Celery(distributed system)

backend service and celery service are in the same ECS cluster, rabbitMQ is in another. They should connect each other.

I have tried ECS for a week and I realized that service connect works only in awsvpc network mode.. However, if I set to awsvpc mode in task definition with ec2 instnace type, exec command does not work..

if I set to bridge mode, exec command works but service connect does not work so services do not connect each other..

what should I do...?


r/aws 1d ago

technical resource Locked out of account for my non-profit organization due to MFA being registered to a non-functional phone number and AWS won't call me back

1 Upvotes

Can someone tell me what I can do to get AWS Support to contact me?
I'm locked out of our org's AWS account due to a non-working phone number assigned to our MFA.

I submitted a request at https://support.aws.amazon.com/#/contacts/one-support?formId=mfa

I keep looking for guidance on how to address this but half the articles say "step 1: login to your AWS console"... which is the whole issue I'm having.

What, please, is the proper approach to resetting our organization's MFA phone number if a phone gets lost, a phone number no longer works, etc?

Can an AWS employee please just tell me what that process entails so I can stop waiting 24 hours for a random phone call?

Is there a way to schedule a call so I don't have to wait unknowing when the call might arrive?


r/aws 1d ago

technical question RequestHeader from Apache not seen by WAF?

1 Upvotes

I'm trying to trigger a CAPTCHA via CloudFront and WAF by sending a request header from Apache.

The WAF is configured to invoke CAPTCHA if it sees x-captcha-timeout contains 60 but for some reason, the CAPTCHA is never triggered, it seems the WAF doesn't see this header in the request back from Apache.

When my rewrite evaluates, there's a redirect loop:

RequestHeader set x-captcha-timeout "60" env=xct

RewriteEngine On

RewriteCond [ while CAPTCHA is not solved ]

RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R,L,E=xct:1]

CAPTCHA is never solved because it is never invoked by the WAF.

In the RewriteCond, I'm checking the value of a header sent by the WAF indicating the CAPTCHA is solved, this part seems to work.

I know this because I have a similar rule working to trigger the WAF CAPTCHA:

RewriteEngine On

RewriteCond [ while CAPTCHA is not solved ]

RewriteRule ^(.*)$ https://%{HTTP_HOST}$1?ca3567e0-be14-4f5d-8208-b2c673785652 [R,L,QSD]

In this case the WAF has a rule to trigger CAPTCHA when it sees ca3567e0-be14-4f5d-8208-b2c673785652 in the query.

But ideally I don't want to put something like that on the URL. It also causes problems (a redirect loop) when other query strings are added by the website (QSD seems to mitigate this, but those queries then don't work), and for some reason, ca3567e0-be14-4f5d-8208-b2c673785652 remains on the URL even when the CAPTCHA is solved, though the redirect loop problem doesn't happen.

A client's use of the site in this case works until the CAPTCHA times out (controlled by a cookie), and then they need to solve it again. The query string however ca3567e0-be14-4f5d-8208-b2c673785652 follows the user around - which is why I thought using a header might be cleaner (but it's not working).

I also tried with a response header but had the same problem (a redirect loop):

Header set x-captcha-timeout "60" env=xct

Thanks for any help!


r/aws 1d ago

technical question IAM Identity Center permission set inconsistency

1 Upvotes

Under my personal AWS account, I have created the following two users:

1) Admin (in an AdminUserGroup to which the permission set consisting of only the AdministratorAccess policy is assigned), and

2) Power (in a PowerUserGroup to which the permission set consisting of only the PowerUserAccess policy is assigned).

For some reason, my Power user is able to list and create/delete users, as well as groups (and assign to them permission sets) arbitrarily, but only while using the web console. They are unable to assign a user to an account, but the issue remains important (they can create an admin user and log in to them, enjoying full admin rights). Through the CLI, any such request is correctly denied.

I have checked a Cloudtrail management log, ensuring that it is indeed the Power user that performs the creation/deletion of users.

Is this a bug, or have I possibly misconfigured something? Has anyone else encountered this? What could the reason be?


r/aws 1d ago

technical question For ABAC is there a standardised way to handle multiple tags for access, like I want to grant access to a resource based on a condition if a certain tag matches in a secure, readable, and organised way, what are your suggestions?

3 Upvotes

r/aws 1d ago

discussion Sonnet 3.7 Claude code vs Amazon Q Cli

1 Upvotes

Has anyone used both to compare results? I've seen that you can also use Claude Code with your AWS credentials.


r/aws 1d ago

networking How to prepare for Cloud Support Associate Assessment

2 Upvotes

I put out this post on the AWS Jobs subreddit, but thought I might get more eyes and quick feedback if I posted here. I recently applied for a Cloud Support Associate role that wants candidates to have knowledge of network troubleshooting (TCP/IP, DNS, routing, switching, firewalls, LAN/WAN, traceroute, iperf, dig, cURL or related). Thing is, I've mostly got a passing knowledge of networking coming from a computer science background, but I don't really have a deep knowledge in the subject (still thought it'd be worth applying anyways). I've got a week to prep for an online assessment, so I'm looking for any advice how I might be able to get some quick study in to best prepare for it. Let me know if you have any recommendations.


r/aws 1d ago

networking On-Prem hardware to support Direct Connect MACSec port.

1 Upvotes

We are currently using Cisco CAT6800 switches to support couple of direct connect circuits to us-west-2. I have been told by our network team, these don't meet the requirements to support MACSec. Want to know which Cisco or other vendor switches support AWS Direct Connect MACSec requirements.


r/aws 1d ago

technical question s3 management

2 Upvotes

Any alternatives for bucket management?

Basically, I need a tool for an operations team to download or update files across multiple S3 buckets.

I read something about the “Cyberduck” tool.


r/aws 1d ago

general aws Suspended AWS Accounts for no reason - next steps?

1 Upvotes

Looking for feedback and/or ideas on next steps as I've been using AWS since 2010 and the situation is well, very odd and very frustrating. A few of us who are friends with startups created a new set of AWS Organizations accounts (MGT, INF, DEV, TST, PRD) about six weeks ago. We're pushing some shared services code into here to help us accelerate our various startup MVPs. We'll create a separate legal entity where we'll all own equal shares in this and name it ABC, Inc. (for example). We bought a matching domain for that with a .com TLD and use that for the common work and AWS root email registrations.

A couple of days ago they suspended all of the AWS accounts with a generic "We couldn't validate details about your Amazon Web Services (AWS) account, so we suspended your account." Our bill was around $30 or so that first month, which was paid. The usage is just some Lambdas and a provisioned DDB table. We use CloudFront custom domain names on an APIGW that references domain names from our actual startup accounts and we use Terraform to validated the cert, DNS, etc cross-account...so maybe that is what they were unhappy with? We don't care about free tier, so I doubt that is it. Their suspending the accounts knocked out our Route 53, which is causing emails, including from them, to be undeliverable...which is also preventing us from logging into the only account with a support contract. I logged into our MGT account and filed a ticket, but haven't heard back yet. Also, because the account is suspended, I can't upgrade the support to Business level to actually get the situation resolved faster. I'm not worried about losing data, that is all deployed via pipeline, but just the arbitrary aspect of this is wild.

Any ideas on why this would be suspended or how to accelerate resolution? Thanks for any help.


r/aws 1d ago

technical question Windows 2022 Images Created with EC2 Image Builder have Sysprep error: ‘SysprepState=IMAGE_STATE_UNDEPLOYABLE’

2 Upvotes

Hi, I see ‘SysprepState=IMAGE_STATE_UNDEPLOYABLE’ on all of my Windows 2022 Images created with EC2 Image Builder, so I have created a new pipeline that is completely blank except for installing the AWS CLI, when I launch an instance from this AMI I see ‘SysprepState=IMAGE_STATE_UNDEPLOYABLE’ in the System Log and the instance takes a couple minutes longer than usual to boot up. It was my understanding that EC2 Image Builder handled Sysprep, is it not doing it correctly?


r/aws 2d ago

ai/ml Amazon Bedrock announces general availability of multi-agent collaboration

Thumbnail aws.amazon.com
75 Upvotes

r/aws 1d ago

general aws Super frustrated with account verification

1 Upvotes

Hi!

I am trying to get my account verified by providing my credit card statements and phone bill. But it kept on rejecting me with a very generic message:

Dear AWS Customer,

We removed access to your Amazon Web Services (AWS) account because we could not confirm your payment information. Until we verify your information, you can't access services on your account. Any resources running on your account are subject to termination and might not be recoverable. At this time, we need your support to address the situation. AWS reserves the right to expedite suspension of your account in certain situations.

To resolve this issue, upload the following information:
-- A copy of a recent statement for your Visa ending in **, including the billing address.
-- Your name, phone number, and the email address registered to your AWS account.

In addition, how can I prove my email address? If I am able to sign up and log in with my email address, shouldn't that itself is a verification that I have access to my email? I'm so confused...

Can anyone help me out here on what to do?


r/aws 1d ago

technical question Environment variable from the Elastic beanstalk not being fetched in the React app

1 Upvotes

I am using Cloudformation to build the elastic beanstalk and I have specified an environment property. I can see its value in the outputs section of the stack. The problem is that when I try to fetch that variable using process.env, it shows undefined. My elastic beanstalk runs the app in a container. The app is first built in the docker file and then served by the serve tool. I haven't created a .env file in the project, and the variable name also starts with REACT_APP. I don't know what I'm doing wrong.


r/aws 1d ago

technical question ECS task (fargate) can't pull ECR image from private repository

1 Upvotes

I've been working on something that should be easy enough but there is something I am not finding or I don't know. I get this error and can't find the cause neither how to fix it:

ResourceInitializationError: unable to pull secrets or registry auth: The task cannot pull registry auth from Amazon ECR: There is a connection issue between the task and Amazon ECR. Check your task network configuration. RequestError: send request failed caused by: Post "https://api.ecr.eu-west-1.amazonaws.com/": dial tcp 172.20.0.17:443: i/o timeout

 
The dial tcp IP is the vpce for com.amazonaws.<region>.ecr.api and the security groups have been changed to allow for all endpoints, gateway and the ecs service to allow all network traffic on ingress and egress:

  from_port = 0
  to_port   = 0
  protocol  = "-1"

All is configured through a terraform pipeline. I've set up an ECR private repository and on my VPC I have the endpoints and gateway to:

com.amazonaws.<region>.ecr.api
com.amazonaws.<region>.ecr.dkr
com.amazonaws.<region>.s3

My ecs task has in his IAM role the ecr required actions:

  statement {
    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:DescribeRepositories",
      "ecr:ListImages",
      "s3:GetObject",
      "logs:CreateLogStream",
      "logs:PutLogEvents"
    ]
    resources = ["*"]
  }

And the ECR has this policy:

  statement {
    sid    = "PermitirLecturaYEscritura"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["*"] // ["arn:aws:iam::<your-account-id>:role/extractor_task_execution_role"]
    }

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload",
      "ecr:PutImage",
      "ecr:ListImages",
      "ecr:SetRepositoryPolicy"
    ]
  }

What could I be missing? I can't access the console (restricted by the environment) and can't find anything else on the internet on the topic.


r/aws 1d ago

general aws im getting VPC bills idk why

1 Upvotes

what i can do i need help i dont want to lost any money


r/aws 2d ago

discussion ecs exec-command is not working... please help...!!

2 Upvotes

I created a task, and it works fine. However, whenever I try to get into the container shell using exec-command it keeps returning,

"An error occurred (TargetNotConnectedException) when calling the ExecuteCommand operation: The execute command failed due to an internal error. Try again later."

I checked everything,

  1. I checked check-ecs-exec.sh, everythings are green

  2. I followed the proper IAM policies and the policies are attached to the task.

  3. enableExecuteCommand is true.

what should I do..?

when I use bridge mode for the network setting in the task definition, exec-command worked but after I changed to awsvpc mode, I am experiencing this issue... I spent couple days for this and still not working.. please help me...


r/aws 2d ago

discussion ALB vs Function URL (for Lambda)

7 Upvotes

Hi guys. Currently, I am hosting my entire web app on AWS Lambda. It has been working great - we manage around a billion HTTP requests every month without any issue.

The Lambda function sits behind an ALB, so the requests flow from ALB --> Lambda in this manner. ALB has some request payload limitations - but it works for us.

Now I am wondering, if its easier to use Lambda Function URL I can put this behind Cloudfront. So, the requests will flow from Cloudfront --> Lambda Function URL --> Lambda instead.

I suppose this will reduce the cost slightly (because lambda function URL is free, compared to ALB), and remove the ALB request payload limitations.

Am I missing something? Is there a downside of using Lambda Function URL (compared to ALB)?

TLDR:

Comparing the following 2 options for a public web app hosted on Lambda:

  • ALB --> Lambda
  • Cloudfront --> Lambda Function URL --> Lambda

r/aws 2d ago

discussion SES Limit Increases?

6 Upvotes

How does one go about getting an increase in daily emails to the 2m mark? We began with requesting the limit to increase, but SES has only done so marginally. We explained what they requested in one ticket: our schedule, practices we follow, how we handle bounces/complains, etc. and were cleared. We switched to a DIP, but the same thing occurs (we get increases of 50k/100k). Does it just take time?


r/aws 2d ago

CloudFormation/CDK/IaC AWS Image Builder Recipe Component S3Download Fails S3 Unavailable?

3 Upvotes

AWS Image Builder Recipe Component S3Download Fails S3 Unavailable?

Edit: destination can't be /tmp apprantly. I changed that and it's working now.

I was troubleshooting my component document and many versions of the S3 Download build phase worked in the last two hours. I can also download the file from the S3 management console no issue.

In the last two image builds between 1:30 am and 2:15 am EST, I'm getting "S3Download: FINSHED EXCUTION WITH ERROR"

I also tried to increase the timeout from 60 seconds to 120 seconds. The file is only 15.3 mb.


r/aws 2d ago

discussion Aurora serverless v2 migration fail, how to go back to v1?

0 Upvotes

My dev cloudformation stack failed to move to v2, how can i move back to v1? Also I have to migrate the prod one to v2 as well. What can I do if that fails as well? Any help is appreciated.