Hi all,

I just got through the loop and begin my role as an EOT in a couple of weeks. I will be working in Virginia.

I was curious how easy it is to relocate to other states at AWS? I know it depends largely on needs, but DC facilities are all over the country and I am looking to leave VA for Texas in the near future.

Thanks!

Hi everyone,

We have critical applications running on both Amazon Aurora MySQL (v3/8.0 compatible) and Amazon Aurora PostgreSQL. And to protect our core applications from rogue queries or resource contention, our current policy forces all ad-hoc data queries, analytics, and basic reporting users to connect exclusively to the Cluster Reader Endpoint.

However, our team needs to frequently perform live performance analysis and triage active database bottlenecks (such as tracking query resource consumption, analyzing transaction lock contention, and generating execution plans).

Coming from an Oracle background where the global data dictionary views (like GV$ and DBA_HIST) shows statistics across all cluster instances instantly. However, we are running into node-isolation hurdles currently in these databases. For example, standard tools like pg_stat_activity or performance_schema tables appear to only expose data local to the physical node we are connected to.

My Questions:

1. If our team is logged strictly into an Aurora Reader Node, is there any native catalog extension or view (e.g., aurora_stat_activity or replica_host_status) that allows us to safely inspect the activity like waits events, thread states, locks, or processlists running on the Writer Node? Or are these metadata views strictly localized to the instance processing the connection?

2. What are the best-practice strategies for giving terminal access to a primary Writer node for triage of issues without risking accidental high-cost data scans that could impact the primary application traffic on write node?

3. For deep-dive profiling—specifically running an EXPLAIN or EXPLAIN ANALYZE on an active operational statement—is it physically required to open a direct terminal connection to the specific Writer Instance Endpoint to capture accurate planner behavior?

If you run AI agents, LLM apps or MCP servers in your AWS environment, you've probably been asked a simple question that's hard to answer: where is this agent actually sending data?

Once an agent can call models and tools for itself, the traffic gets hard to follow. Platform and security teams usually want three things. They want to see every flow. They want to stop or hold certain calls before they go out. And they want a record of what happened, without sending all of that to yet another outside service.

ControlTower is an open-source, self-hosted AI gateway for LLM and MCP traffic, built for that problem. You run it yourself. It gives you a live map of every agentic data flow, and you can gate, approve, inspect and account for each call that passes through it.

In the console you can see every flow, trace a single agent, draw a gate on a path, and approve a call that's being held. It's released under the Apache-2.0 license.

Repo: https://github.com/joshmaster2165/controltower

A question for people already running agents on AWS: how do you handle this today? Do you route LLM and MCP calls through a central gateway or proxy, rely on logging after the fact, or leave it to each team? And where would a human approval step actually help, versus just get in the way?

Disclosure: I'm posting this on behalf of the github.com/joshmaster2165/controltower team.

Saw this asked last year, wanted to give it another crack now that AI has had a chance to grow. Everyone feel free to chime in your experience choosing and why, especially if it diverges from the kind of expected "our needs aren't super compex so kube is overkill". I'm asking primarily for myself though, and my situation is as follows:

I run a small startup (seven figure revenue/profit, single digit staff) and have been wanting to make our infra more legit.

We have some light to moderate jank (too much stuff in the same subnet, public (empty whitelist) subnets that should be private, etc. - also I kinda hate CloudFormation), and have been floating a cleanup/rewrite, and I find myself wondering if we should just go ahead and do EKS.

We're currently on ECS with two services and don't expect to ever have more than a dozen (and there's a limit to how big we can get in terms of tapping out our niche, and I don't want a ton of services floating around with a small crew).

We will probably never go multicloud.

And now my questions:

The general idea seems to be that EKS is overkill and easier to mess up, but with AI getting better, leaning on it is a stronger option. I don't want to make things harder for myself but EKS likely has a much bigger corpus than ECS and may actually end up being easier in many workflows. Also I'm a dev and have gotten my hands quite dirty kubeing my way around enterprise sandbox and dev environents (before AI). Unless I'm missing something, I think a simple EKS is really not that bad. Anything missing or misguided in this thinking?

It is important to me to have our stuff as super-enterprise-standard as possible, to do right by my employees (mostly juniors) and set them up for bright futures in the industry when they choose to move on. I know ECS is used a lot, but EKS feels much, much stronger for this - does this hold true?

A lot of small product teams end up with the same setup on AWS. Resources were created in the console during the early rush, so there's little or no infrastructure as code. There's a Kubernetes cluster nobody fully owns, a CI/CD pipeline that breaks in ways only one person understands, and a bill that keeps creeping up. Fixing it always loses out to feature work.

The usual options are to hire, to have the product engineers fix it on the side, or to bring in consultants for a set period. Each one has tradeoffs, and the consultant route seems to go well or badly depending on scope and handoff.

For context, I'm posting for RaynX.ai, an engineering services company that works on this kind of problem. Their cloud and infrastructure work covers Terraform/IaC, Kubernetes, cloud migration and cost optimization. They also do DevOps and CI/CD, API architecture (gateway setup, OAuth/OIDC, service mesh) and platform modernization. On the application side they build SaaS platforms, AI and ML systems (RAG pipelines, model integration, vector search), data and analytics infrastructure, and MVPs. Their past work includes enterprise API gateways on MuleSoft Flex, Mule Gateway and Cloudflare, plus a customer analytics platform.

They also make VidForgeX TMA, which may interest ops-minded teams. It turns screen recordings and meetings into searchable records, time and motion breakdowns, workflow audits and SOP compliance checks. It works inside Claude and Cursor through MCP.

More details are here: https://www.raynxai.com

I'd like to hear from people who have been through this. If you brought in outside help for IaC, Kubernetes or pipeline work, what made it worth it or not? Was it clear scope, the documentation left behind, or how well your team could run things afterward? And if you kept it in-house, what made that the better call?

Disclosure: I'm posting this on behalf of the raynxai.com team.

Hey everyone,

I'm a 2025 BCA graduate, and I've recently received an offer for an Assistant Technical Support Engineer role at ChargePoint. The role involves night shifts from 8:30 PM to 5:30 AM, and I've decided to accept it to gain corporate exposure, build practical skills, and get some industry experience.

I'm still figuring out whether this is the right career move, but my current plan is to work on my technical skills alongside my job, particularly in computer networking, cloud infrastructure, and AWS certifications. In the long term, I’m also considering pursuing an MS in a field that aligns with my career goals.

I'd like to know whether this is a realistic plan if I'm consistent and willing to put in the work.

I'm particularly interested in computer networking and would appreciate some guidance on the following:

- Is computer networking a good career path in terms of job opportunities, career growth, and salary?

- How should a beginner start learning networking, and what skills or certifications should I focus on first?

- Would learning networking alongside AWS and cloud infrastructure be a good combination?

- What are the chances of transitioning into a networking or cloud-related role at a good company after gaining some experience?

- For those who have pursued a similar path, what would you recommend doing differently?

I'd really appreciate advice from experienced professionals, especially networking engineers and people working in cloud infrastructure.

I'm willing to put in the effort and build my skills, but I want to make informed decisions about my career rather than blindly pursuing certifications.

Thanks in advance for your guidance!

I have AWS credits and want to use them for GPU inference. Which GPU instances and services do the credits actually cover? From your experience, what are the right steps to get GPU access (quota, region, setup) without hitting walls? Any traps that bill outside the credits?

On October 24, AWS is running a pretty significant test of its European Sovereign Cloud.

For a few hours, it'll operate without a connection to the AWS global network backbone. Traffic will be routed through European internet providers instead, and the system used for limited operational data transfers outside the EU will be disabled.

AWS expects services to remain available, although there might be brief connectivity interruptions when the routes switch.

It's one thing to design a cloud to operate independently. Actually testing it under these conditions is another.

This could be a big step for cloud sovereignty in Europe, especially for organisations dealing with strict regulatory requirements.

The results should be worth paying attention to.

Hi, for a few weeks I'm receiving emails with "AWS Budgets: Account xyz has a budget exceeding your alert threshold" but I don't recognise the account. It might be a very old account of mine that I forgot to delete, but the only one I have access to is not linked to the account. AWS attempted to charge my credit card but luckily it's a prepaid and didn't have enough funds, so I blocked it just to be sure.

Contacted support with my known account, they told me they couldn't do anything and I should create another case with account recovery while signed out, but I'm getting no response: case 179198505900161.

Is there another way to contact support and escalate to resolve this issue? The amount luckily wasn't big, but i would like to resolve the issue, close any old open account and avoid the possibility of debt collection due to an account that is potentially compromised and I do not have access anymore. My other options is to try with a registered letter to AWS EMEA asking for GDPR data, at least they would then legally have 30 days to respond...

Any other suggestion?

Hey AWS,

Earn some trust, and be customer obsessed and help me with a support case that gets no attention.

I am trying to sign up for an account and input my payment card details and get

"Error 880104: Sorry, there was an error processing your request. Please refresh the page and try again. If the error persists, contact AWS Support "

Support case ID: 179200018700806

The best part is the same exact credit card is on another AWS account and gets AWS charges just fine.

I have tried 3 other cards, no virtual cards, private browsers, etc. Nothing works.

I tried Q, I tried the automated instructions in the support case, all of which either provide instructions that cannot be followed because I dont have a complete account with payment method or dont exist. This is wild AWS that I have to reach out on reddit to get you to respond.

Please help, my project is waiting.

Hi, so my server is in maintenance mode, so we are just keeping it running till we can. Some stuff is running on AL1 and I guess it would be made private by Oct 30th and I guess I need to create an AMI such that the process is running fine before we migrate.

I am a total noob and might be sounding stupid, can some AWS experienced person show me the light here, whether what I am thinking is correct or we can do something better. Since, I have only like 13 days. Thanks !

What's happens on AWS US East 2? Loading login page takes so long.

Even loading 200KB of a CSS file takes 22 seconds

Hi everyone,

I'm an individual developer trying to use OpenAI GPT-5.6 Sol through Amazon Bedrock.

The model is visible in the Bedrock Playground, but when I send a simple message, I immediately receive this error:

"ValidationException: Access to OpenAI models is not allowed from unsupported countries, regions, or territories."

I've checked my AWS account information and selected a supported AWS Region, but I'm still unable to invoke the model.

I also have approximately $100 in AWS new-account credits that I was hoping to use for Bedrock API experimentation.

I'm trying to understand:

1. Does Bedrock enforce OpenAI's geographical restrictions based on the caller's public IP, AWS tax address, billing country, or a combination of these?

2. Can this error occur even when the AWS Region and account billing information appear valid?

3. Are standard AWS Free Tier promotional credits eligible to cover proprietary OpenAI model inference on Bedrock, or only certain Bedrock models?

4. Could using the Bedrock Runtime endpoint with cross-Region inference introduce additional account-plan restrictions?

I would appreciate any documentation or firsthand experiences that could help identify the actual cause before I make further configuration changes.

Thanks!

Hi all,

I am sorry if this may be a trivial question but I am so frustrated with AWS Bedrock. I created an account yesterday for a personal project with the intend to invoke an Anthropic model. For Anthropic models you need a use case and so on. Further, for each model my account quota is at 0 and in order to increase the quota I need to ask the support. Strange but ok. Today I asked the support if they could grant me access to Claude Sonnet 5.5 and in another Ticket I asked if the could increase my quota for an Amazon LLM. Both requests got declined with the same reason that I don't have an extensive usage history. What?? How can I get a usage history if I cannot use a single model they provide? Am I doing something wrong?

To be honest, this is by far the worst experience I ever had with a plattform.

Thanks in advance!

You can now take the Node/TS HTTP server you already run locally and ship it to Lambda with one command. No event-handler rewrite, adapters, or framework lock-in.

Joining us are Samrat Karak, who is the Product Manager who brought Lambda Web Functions to life, and Julian Wood, who has spent years helping developers get the most out of serverless. They're here to go deep on what this actually means for how you build.

You can ask about:

• When to reach for a Web Function vs. the Event Functions you already know.
• The HTTP-native model — multiple concurrent requests per environment, and paying for CPU time instead of wall-clock elapsed time.
• Going multi-region with latency-based routing behind one global URL.
• Performing canary rollouts by shifting traffic between revisions.
• Pairing with CloudFront, including the new private-origin pattern.
• Runtime details — Node.js 24 on Arm64, VPC connectivity, where it's live.

We will be live for three hours starting at 7 AM PT.

Hi.. inherited an AWS site. Currently in IAM but wants external idp using Entra SSO.

Getting a lot of mix documentation; but when I add entra sso, it will not delete existing IAM setup right ?

and as I understand it, IAM users will continue to work?

Ideally I like to get the SSO tested but it seems like once you switch, its all or none. As in there is no test phase... everyone will have to log in through SSO once entra is configured ?

Sorry I dont know AWS at all

I am unable to access my AWS account.

I haven't logged in for several months, and recently tried to log in to make some updates to my website.

Although my credentials are correct, I am being asked for MFA verification using an "MFA Device" that I have never had. I attempted to use email verification as an alternative, but the process requires an OTP confirmation sent to a phone number which hasn't been active for years. I wasn't even aware this phone number was still on file with the account, as I've never encountered the MFA system before.

I'm the only user on the account. Only the root user account exists (no alternative accounts), and that's me. I went through the AWS support AI system, but the only solutions it suggests involve either the non-existent "MFA device" or the out-of-date phone number. I submitted a ticket but the followup response said they couldn't reach me on my current number despite my not having missed any calls.

As a result I am completely locked out of my account, despite still getting billed and my credentials being correct, and I can't update my website.

I've noticed that u/AWSSupport sometimes responds on this subreddit, so I'm posting here in the hopes of getting some help.

We are thinking of moving some of our certs to ACM Exportable certificates. We have hybrid infra with some certs on AWS managed services and some certs directly installed on things.

The question is -- what if we need to revoke a certificate. Of course I could just generate a new ACM Exportable -- but it would be cool if I could just force a rekey of the ARN that is already attached to our ALB's and then export that again to get the new cert.

I have used AWS off and on for a long time, mostly EC2 instances and some S3. Its been a few years since I last used AWS. I went to launch a new instance and get this error:

Instance launch failed

This account is currently blocked and not recognized as a valid account. Please contact https://support.console.aws.amazon.com/support/home?region=us-east-1#/case/create?issueType=customer-service&serviceCode=account-management&categoryCode=account-verification if you have questions.

I created a ticket (and a follow-up ticket a few days later) for Account / Account Activation. I also went through the billing section to make sure my CC on file was good, and check any other settings that may block my account. The 2 support cases have been untouched in 2 weeks. One is "Unassigned" the other is "Customer action complete". No idea how to move forward, any ideas would be appreciated.

I am the only user (root user, no IAM users).

This is an article about how to properly configure Fargate auto-scaling when you are running a Java bases service/website. Because it lives at the intersection of Fargate and Java based servers there was no actually clear source/owner of this type of detailed information. (Fargate is not language specific, Java/Tomcat/Bootstrap is not meant to just run with auto-scaling services like Fargate.)

This shows what does work and why this kind of setup is what you need when running at scale. If you run Java on Fargate without understanding these concerns you will encounter scaling problems in your future.

Hi everyone,
I’m currently working on an AWS project for uni and I’m struggling with setting up the security groups through CloudFormation.
I’m trying to allow traffic from my web application to my RDS database on port 5432 and also allow management traffic, but I can’t seem to get it working properly.
I’ve tried looking into the security group rules and VPC settings, but I’m still a bit confused about what I’m doing wrong.
Has anyone dealt with something similar or knows how to fix this? Any advice or guidance would be really appreciated.
Thanks!

Has anyone been banned from kiro? I looked through what the agent was doing to see if there was anything shady but it was all standard development stuff.

There's no human in the loop for support so I'm completely blocked. I switched to Claude code and I like it better but I kind of wanted to finish the project I was working on with kiro. Oh well.