标签：#aws

Exam Guide: Developer - Associate Technologies And Concepts Cheat Sheet 📘 Cheat Sheet 1 | Services Compute Service What It Does Key Points Lambda Serverless Functions 15 min timeout, 10240 MB memory max, 1000 default concurrency EC2 Virtual Servers Instance profiles for IAM roles, user data for bootstrap ECS/Fargate Container Orchestration Task roles for IAM, Fargate = serverless containers Elastic Beanstalk PaaS Deployment .ebextensions for config, supports rolling/immutable/blue-green Storage & Databases Service What It Does Key Points DynamoDB NoSQL key-value Partition keys, GSI/LSI, query vs scan, DAX for caching S3 Object Storage SSE-S3/SSE-KMS/SSE-C, lifecycle policies, presigned URLs ElastiCache In-memory Cache Redis (complex types, persistence) vs Memcached (simple, multi-threaded) RDS Relational Database RDS Proxy for Lambda connection pooling, read replicas OpenSearch Search & Analytics Full-text search, log analytics API & Integration Service What It Does Key Points API Gateway REST/HTTP/WebSocket APIs Stages, authorizers, caching, request validation, throttling SQS Message Queue Standard (at-least-once) vs FIFO (exactly-once), visibility timeout, DLQ SNS Pub/sub messaging Fanout, filter policies, message attributes EventBridge Event Bus Pattern matching, content-based filtering, multiple targets Kinesis Real-time Streaming Shards, partition keys, parallelization factor Step Functions Workflow Orchestration Standard (long-running) vs Express (high-volume, short) Security Service What It Does Key Points IAM Access Management Policies, roles, least privilege, STS AssumeRole Cognito User Auth User Pools (tokens) vs Identity Pools (AWS credentials) KMS Key Management Envelope encryption, 4 KB limit, key rotation, cross-account Secrets Manager Secret Storage Auto-rotation, $0.40/secret/month SSM Parameter Store Config Storage Standard (free) vs Advanced , SecureString type ACM SSL/TLS Certificates Free public certs, auto-renewal, can't export CI/CD Service Wha

TikTok recently settled its portion of the case with the plaintiff ahead of a jury trial that starts next week in Los Angeles. YouTube has also reached a deal, leaving Meta as the only remaining defendant.

A practical roadmap for students who want to build real AWS skills, create an impressive portfolio, and prepare for cloud engineering careers. Introduction Every year, thousands of students begin learning AWS. They watch training videos, collect certificates, complete online courses, and share digital badges on social media. Yet when internship interviews or entry-level cloud engineering opportunities arrive, many struggle to answer a simple question: "What have you actually built on AWS?" The cloud industry rewards practical experience, not passive learning. AWS itself focuses beginner learning on hands-on experience with foundational services such as Amazon S3, Amazon EC2, Amazon VPC, Amazon RDS, and cloud security because these services power most real-world cloud environments. If you're a student aiming for a career in Cloud Engineering, DevOps, Site Reliability Engineering (SRE), Solutions Architecture, or Platform Engineering, this article provides a practical roadmap that can help you become job-ready. Why Students Should Learn AWS Cloud computing has become the backbone of modern technology. Companies of every size use cloud platforms to: Host applications Store data Deploy AI workloads Build scalable systems Reduce infrastructure costs Improve reliability As a result, companies continue to hire professionals with cloud skills across software engineering, cybersecurity, DevOps, networking, and data engineering domains. AWS offers dedicated learning paths, hands-on labs, certification tracks, and career-focused programs specifically designed to help learners develop these skills. The key question is not: "Which AWS service should I memorize?" The better question is: "Can I design, deploy, secure, and troubleshoot cloud solutions?" The 5 AWS Projects Every Student Should Build Instead of completing another course, build these five projects. Project 1: Host a Static Website Using Amazon S3 What You'll Learn Cloud Storage Static Website Hosting Bucket Policies O

Remember Tamagotchis? Those little egg-shaped keychains from the 90s with a pixelated pet that got hungry, got sad, and, if you were a negligent eight-year-old like me, got dead during math class. I've been looking for an excuse to play with the Waveshare ESP32-S3 Touch AMOLED 1.8" , a $30 board with a gorgeous 368×448 AMOLED touchscreen, an accelerometer, a microphone, and a speaker. And I found one: I'm building a Tamagotchi. But with a twist that makes it worth a four-article series The pet's body lives on the device. Its brain lives in AWS. The device renders an adorable pet and captures your taps and shakes. But its hunger, mood, and energy are rows in DynamoDB. It gets hungry overnight because EventBridge Scheduler says so. And, my favorite part (and because it's 2026, we can't not have genAI in a project 🤪), every morning it fetches the AWS news, has Amazon Bedrock rewrite them in its own squeaky personality, and reads them to me out loud through Amazon Polly. A Tamagotchi with a job. In this series, I will walk you through the whole build: This article : the architecture, and connecting the ESP32-S3 to AWS IoT Core (the pet's nervous system). Part 2 : giving it a face: animations and touch with LVGL on the AMOLED. Part 3 : the serverless brain: Lambda, DynamoDB, and a pet that gets hungry while you sleep. Part 4 : Bedrock + Polly: my Tamagotchi reads me the AWS news. ⚠️ Reality check before you get too excited (sorry 😅): this is a hobby project, not a product. You'll need the specific Waveshare board (or the patience to adapt the code to yours), an AWS account, and a USB-C cable. The AWS bill for the whole series is well under a dollar a month, but it is not zero, and neither is the time you'll spend staring at idf.py monitor . Worth it, though. All the code lives in this repository . Each article has its own branch. For this one, git checkout article-1 . Why put a pet's brain in the cloud? Fair question. The original Tamagotchi ran on a chip with less power

I've been working in software for more than 15 years. This is the first piece I've decided to write about the job. I picked this topic because it was a small, real problem that cost me time more than once, until I finally stopped and fixed it properly. Quick disclaimer: this isn't distributed tracing or multi-service observability. It's a targeted fix for one specific problem: correlating logs within a single Step Function execution. If your scenario is different, the problem takes a different shape. What matters here is the reasoning, not the recipe. Quick context for anyone who doesn't work with serverless: AWS Step Functions is an orchestration service. You design a workflow as a state machine (JSON), and each state usually triggers an AWS Lambda (a function that runs on demand, no server to manage). In my case, a request kicks off a state machine execution that passes through several Lambdas in sequence: some do validation, others call external services, and one waits on a callback response before moving on. The fix turned out to be simpler than it sounds: a field Step Functions already offered for free, and I just wasn't using it. A request was processed 120 days ago. The customer calls: "Did you receive my request? I never heard back." You open the AWS Console. The Step Functions execution is already gone. Execution history only sticks around for 90 days, and even within that window, finding one specific execution among thousands is already a hassle. That leaves CloudWatch, with logs from every Lambda in the pipeline. You have one piece of data: the case ID. But every Lambda logged its own way: no standard, no correlation between them. To reconstruct what happened, you have to open each function's logs in the order the workflow probably ran, and piece it together by hand. It wasn't the error itself that hurt. It was the time lost just organizing the logs before you could actually start investigating. The Chaos The pipeline wasn't huge, but it wasn't trivial ei

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . I spent a week deploying a CrewAI agent to AWS Bedrock AgentCore. The SDK wasn't on PyPI. The error messages were 200 OKs. The container crashed without logs. And the naming regex rejected hyphens without telling me why. This is the full debugging trail. Every failure was silent. Every fix required reading source code nobody documented. Table of Contents The Project Failure 1: The SDK That Doesn't Exist on PyPI Failure 2: The 200 OK That Means Failure Failure 3: The Container That Crashed With No Logs Failure 4: The Naming Regex Nobody Documented The Two-Client Split Nobody Mentions What I Learned The project I built a resume-tailoring AI agent with CrewAI and Amazon Bedrock. It takes a job description, analyzes your resume, identifies gaps, and rewrites bullet points to match what the role actually needs. Locally it worked perfectly. CrewAI orchestrates the agents, Bedrock Nova Pro handles the LLM calls, and the output is solid. Deploying it to production was the problem. AWS launched Bedrock AgentCore in June 2026 as a managed runtime for AI agents. You containerize your agent, push the image, and AgentCore handles scaling, memory, and invocation. Sounds simple. It was not simple. Failure 1: The SDK that doesn't exist on PyPI The docs say to install bedrock-agentcore-client . I ran: pip install bedrock-agentcore-client It installed successfully. No errors. That's because there's a placeholder package on PyPI with that name. It installs, imports fail silently, and your container builds successfully with a broken dependency inside. The real SDK lives in AWS's CodeArtifact registry. You need to configure pip to pull from a private index: aws codeartifact login --tool pip \ --domain amazon-agent-runtimes \ --repository agent-runtimes-pypi \ --domain-owner 600427722194 Then install from there. The PyPI package is a trap. Nobody warns you. Hours lost: 3. The error only appears at runtime

AWS released Loom, an open-source reference platform on AWS Labs for governing AI agents at scale. Built on Strands Agents and Bedrock AgentCore Runtime, it implements RFC 8693 token exchange for identity propagation through delegated actor chains, config-driven deployments without runtime code generation, and mandatory tagging. AWS positions it as an example, not a managed service. By Steef-Jan Wiggers

AWS gives you three ways to run LLM inference in production. I've deployed all three for clients and the decision always comes down to the same variables: volume, team size, and how much you value your weekends. Here's the short version. The three paths Bedrock — Fully managed, pay-per-token. You call an API, you get tokens back. No GPUs, no cold starts, no 3am pages about OOM pods. SageMaker Endpoints - Semi-managed. You bring your model (or a fine-tuned one), deploy it on dedicated instances, and handle autoscaling. Pay per hour whether you're serving requests or not. Self-hosted on EKS — Full control. vLLM or TGI on GPU spot instances with Karpenter. Cheapest per token at scale, most operational overhead. The cost crossover that matters This is the table I keep coming back to with every client: Volume Bedrock (Haiku) SageMaker (g5.xlarge) EKS (g5.xlarge spot) 1K req/day ~$36/mo ✓ ~$1,015/mo ~$674/mo 50K req/day ~$1,800/mo ~$1,015/mo ~$674/mo ✓ 500K req/day ~$18,000/mo ~$6,090/mo ~$2,022/mo ✓ The crossover point where self-hosting beats Bedrock: 10,000–20,000 requests/day . Below that, Bedrock wins on simplicity alone. Above it, you're leaving serious money on the table. The hidden cost nobody models upfront Teams prototype on Bedrock (smart move — it's the fastest path to production). But the cost curve isn't linear. At 10K requests/day it's cheap. At 50K it's "we need to talk to finance." At 500K it's a rearchitecture project. The mistake is not choosing Bedrock at low volume. The mistake is not planning the exit path before you need it. Quick decision framework You should pick... When... Bedrock No ML infra team, <50K req/day, need frontier models (Claude, Llama) SageMaker Fine-tuned models, predictable traffic, need dedicated VPC EKS self-hosted >100K req/day, open-source models, dedicated platform team What I actually recommend Use a hybrid. Most production systems I've deployed use: Bedrock for complex reasoning and customer-facing chat (low volume, high qua

Multipart finalization is not the only retry boundary. Abort can succeed in object storage while the HTTP response is lost, leaving your database convinced the upload is active. Model abort as a state transition, not a button wired directly to an SDK call: active → aborting → aborted └──→ cleanup_pending The endpoint should own an idempotency key and durable intent: await db . transaction ( async tx => { const upload = await tx . lockUpload ( uploadId ); if ( upload . state === " aborted " ) return ; await tx . markAborting ( uploadId , idempotencyKey ); await outbox . enqueue ( " abort-multipart " , { uploadId , storageKey }); }); A worker calls storage. If a retry receives NoSuchUpload , do not blindly fail: reconcile whether the upload was already completed, already aborted, or expired. Only the “already absent because abort succeeded” path may converge to aborted ; completion requires a separate terminal state. Test this sequence: Step Fault Required invariant persist abort intent process dies outbox resumes work storage abort succeeds response is lost retry does not reactivate upload duplicate message delivered twice one terminal state client retries same key same operation result cleanup scan stale active row reconcile before deleting Amazon S3’s AbortMultipartUpload API notes that in-progress part uploads may still succeed around an abort and recommends verifying that parts are gone. That makes a post-abort verification pass part of correctness, not optional housekeeping. Expose abort_requested_at , attempt count, last storage result, and remaining-part count. Alert on age in aborting , then run a lifecycle cleanup policy as a backstop—not as a substitute for application reconciliation.

Some commands you can walk back. Terminating an EC2 instance is not one of them. Day 14 paired a recoverable problem, a web server knocked over by a rogue process, with an unrecoverable one, deleting a server on purpose, and the contrast is the whole lesson. One Linux task, one AWS task. Track down the process blocking Apache and restore the service, then terminate an EC2 instance and confirm it is gone. The tasks come from the KodeKloud Engineer platform. httpd: diagnose in order, then restore When httpd will not start, resist the urge to guess. Work in order. Start with what the service itself reports: # What does httpd think is wrong systemctl status httpd systemctl start httpd The status output usually names the problem, and a failed bind on the port is the classic one. Before assuming a rogue process, check that httpd's own config is sane, because a wrong port or hostname produces the same "won't start" symptom: # Check the configured listen port and server name grep -i listen /etc/httpd/conf/httpd.conf vi /etc/httpd/conf/httpd.conf # Fix the ServerName directive if it is wrong: ServerName hostname:<port> If the config is fine and the port is genuinely taken, then you go hunting for the process holding it: # Find the PID on the conflicting port sudo su - yum install -y net-tools netstat -tulpn # Clear it, then bring httpd back kill -9 <PID> systemctl enable httpd systemctl start httpd systemctl status httpd kill -9 is SIGKILL, the instant, no-cleanup kill. It is the right tool when a process is wedged and ignoring a polite request, but as a default habit, it is worth trying a plain kill first. The order that matters here is diagnostic: config before process, gentle signal before forceful one. Rushing to kill -9 at the first sign of trouble is how you mask the real cause instead of fixing it. Terminating EC2: the command with no undo Day 9 was about protecting an instance from termination. Day 14 is the other side of that lever, actually terminating one, on purp

Rds challenge lab devto post 🗄️🐬 aws #rds #database #tutorial Build Your DB Server and Interact With Your DB INTRO Did a hands-on AWS challenge lab on Amazon RDS. Task: spin up a managed database, connect from a Linux server, and run real SQL — create tables, insert data, join across tables. No hand-holding here, just requirements to figure out myself. Here's the walkthrough. SCENARIO Service: Amazon RDS Role: Cloud/DB Admin Goal: Launch RDS under set constraints, connect via EC2, run SQL (create, insert, select, join) ARCHITECTURE LinuxServer (EC2) sits in the Lab VPC — this is the client RDS instance (Aurora or MySQL) in the same VPC Security group lets LinuxServer talk to RDS Flow: LinuxServer -> MySQL client (port 3306) -> RDS -> tables STEP 1: LAUNCH THE RDS INSTANCE Constraints for this lab: Engine: Aurora (Provisioned) or MySQL — no serverless Template: Dev/Test or Free tier No standby instance (single-AZ only) Instance size: db.t3.micro to db.t3.medium Storage: gp2, up to 100 GB — no Provisioned IOPS Network: Lab VPC Security group must allow LinuxServer access MySQL only: turn off Enhanced Monitoring On-Demand only These limits keep costs in check — Provisioned IOPS and Multi-AZ are the fastest ways to blow up an RDS bill. Noted the master username, password, and endpoint — needed next. STEP 2: CONNECT TO THE LINUX SERVER Downloaded the PEM key, grabbed the LinuxServer address, connected over SSH: chmod 400 labsuser.pem ssh -i labsuser.pem ec2-user@<LinuxServer-address> This box is just the SQL client — it needs network access to RDS, nothing more. STEP 3: INSTALL MYSQL CLIENT AND CONNECT On the LinuxServer: sudo yum install mysql -y Connect using the master credentials from Step 1: mysql -h <rds-endpoint> -u <master-username> -p If it hangs, it's almost always the security group — check port 3306 inbound. STEP 4: CREATE THE RESTART TABLE CREATE DATABASE lab_db ; USE lab_db ; CREATE TABLE RESTART ( StudentID INT , StudentName VARCHAR ( 100 ), RestartCity VA

Originally published at blog.whynext.app . It started as an ordinary cleanup problem. Users upload media files (recordings and images) through presigned URLs. The server issues an upload URL, the client uploads straight to S3, then calls a commit API to say "register this key as a real asset." The problem is what happens when someone gets a presign but never commits. The app crashes, the network drops, the user leaves the screen, and the bucket is left with an object that isn't registered anywhere. I wanted a lifecycle rule to clean these up, but there was no way to write one. Committed and uncommitted objects were mixed under the same prefix, so any rule that says "delete old things" would delete real assets too. A daily upload quota kept the pile from growing fast, but the fact remained: there was no path to reclaim the space. The design: what isn't committed lives in tmp The backbone of the fix is key namespace separation. presign issues a temporary key under the tmp/ prefix. When commit passes validation (existence check via HEAD, Content-Type, size limit), it promotes the object to its final key with CopyObject and deletes the tmp original. Objects whose commit never arrives stay in tmp/ , and a lifecycle rule expires them after 7 days. Now the lifecycle rule only has to look at tmp/ . Real assets are outside its blast radius from the start. The clients didn't need to change. I read all three upload flows to confirm this: every one of them uses the key returned in the commit response for its follow-up calls, so the server can change the key shape without them noticing. Commits for old-format keys already in flight at deploy time still go through the existing path. One trap here. This bucket has versioning enabled. On a versioned bucket, expiration doesn't delete an object. It only adds a delete marker, and the original bytes stay behind as a noncurrent version. Without a paired noncurrent_version_expiration (1 day), the cleanup runs and not a single byte is rec

AWS has recently introduced CloudFormation express mode, a deployment option that can reduce infrastructure deployment times by marking stack operations complete once resource configuration is applied, rather than waiting for full resource stabilization. By Renato Losio

Recap. Part 1 framed the supervision problem. Part 2 architected the four-model system on AWS and counted the hardware. Part 3 put the gate on the page in fifteen lines of PyTorch. Now the question that decides whether any of it mattered: does the gate actually earn its keep - and what would it cost to know? This is the close. A verification design, the stability instrumentation that separates a real evaluation from a lucky one, and the FinOps reality that is the reason this whole series is a blueprint instead of a benchmark. SDAR makes two claims, not one It's tempting to reduce the paper to a single number. The reported gains over plain GRPO are real and worth stating - their numbers, not mine : roughly +9.4% on ALFWorld, +7.0% on Search-QA, +10.2% on WebShop accuracy. But the headline percentage is the less interesting claim. The one that matters is the second: SDAR avoids the training instability that naive GRPO+OPSD falls into . The whole point of the gate Part 3 was to keep the teacher's noisy rejections from destabilizing training. So a verification that only measures final task success has tested half the paper. You have to measure stability too - and most reproductions don't. That two-pronged claim dictates the experiment. The verification: three arms, not two You cannot prove SDAR's thesis with a before/after. You need three training runs, identical except for the supervision: Arm What it is What it proves A. GRPO Plain agentic RL, no teacher The baseline the +9.4% is measured against B. Naive GRPO+OPSD Teacher distillation, no gate The instability SDAR claims to fix C. SDAR Gated distillation Part 3 Beats A on score and beats B on stability Drop arm B and you can show SDAR beats GRPO, but you've quietly deleted the paper's actual contribution - there's no evidence the gate did anything a plain teacher wouldn't. Arm B is the expensive arm nobody wants to run and the one that makes the result credible. Metrics that actually test the claim Metric What it mea

An error with the cloud computing giant’s billing operation caused some customers’ monthly bills to rise from a few cents to billions of dollars.

Apple filed a trade secrets lawsuit against OpenAI last Friday, and it’s not messing around. The complaint alleges a pattern of misconduct reaching all the way up to OpenAI’s chief hardware officer and claims more than 400 former Apple employees now work at the company. OpenAI’s response so far has been carefully hedged, and the timing couldn’t be worse with the company reportedly eyeing an IPO […]

If someone asked me ten years ago what it takes to break into cloud, I would have said "get certified and hope someone gives you a chance." I was wrong. And I watched dozens of freshers follow that exact advice, collect a certification, then sit in interviews unable to explain why they chose one architecture over another. The problem was never knowledge. It was proof. Proof that you can gather requirements from a confused client, design something that works, and actually build it with your own hands. AWS just launched something that helps close that gap. And two of these credentials cost nothing. Table of Contents What AWS SimuLearn Badges Actually Are Why This Matters More Than Another Certification The 12 Badges Available Right Now The Free Starting Path I Would Follow Today The LinkedIn Advantage Nobody Is Talking About For Career Switchers: Your Existing Skills Are the Cheat Code My Honest Take After 10 Years in Cloud What AWS SimuLearn Badges Actually Are SimuLearn is not another video course. Not another multiple-choice exam. You sit in a simulated client meeting powered by generative AI. A virtual customer explains their business problem. You ask questions, uncover requirements, handle objections, and propose an architecture. The AI evaluates your communication, your technical accuracy, and your decision-making in real time. Then you build the solution. In a live AWS environment. Not a sandbox with three buttons. The real console. After that, an automated validation confirms your solution actually works. Complete every assignment in a learning plan, and AWS issues you a badge through Credly. Automatically. No exam booking. No proctored test. Just demonstrated capability across the full workflow. Each badge represents the entire journey: customer conversations, architecture design, hands-on building, and validated outcomes. Not a single quiz. Not one lab. The whole thing. Why This Matters More Than Another Certification I hold 7 AWS certifications. Let me tell

Some Amazon customers logged on Friday to a surprise bill estimate claiming that they owed the tech and cloud giant billions in fees.

When building Cypress automation that interacts with AWS services, the first step is verifying that your test framework can successfully authenticate and communicate with your AWS account. In this article, you'll learn how to connect Cypress to AWS and perform a simple authentication test using AWS Security Token Service (STS) and the GetCallerIdentity API. This approach helps confirm that: AWS credentials are correctly configured. Cypress can invoke AWS SDK operations through Node.js tasks. The automation environment is connected to the expected AWS account. Establishing this connection first provides a solid foundation before automating interactions with services such as AWS Lambda, Amazon S3, Amazon DynamoDB, Amazon SNS, or Amazon SQS. Prerequisites Before getting started, ensure you have: Node.js installed A Cypress project Valid AWS credentials: AWS Access Key ID AWS Secret Access Key AWS Session Token (if using temporary credentials) AWS Region Note:If you're running Cypress in an AWS environment (such as AWS CodeBuild, an EC2 instance with an IAM role, or GitHub Actions using OpenID Connect), you may not need to provide credentials manually. The AWS SDK can automatically retrieve credentials from the execution environment. Step 1: Install the AWS SDK Install the AWS STS client package: npm install @aws-sdk/client-sts For this connectivity test, we only need the AWS Security Token Service (STS) client. The package provides: STSClient – Creates a client for communicating with AWS STS. GetCallerIdentityCommand – Returns details about the authenticated AWS identity associated with the configured credentials. Step 2: Configure AWS Credentials For local development, create or update your cypress.env.json file. { "AWS_ACCESS_KEY_ID" : "" , "AWS_SECRET_ACCESS_KEY" : "" , "AWS_SESSION_TOKEN" : "" , "AWS_REGION" : "" } Populate the file with your AWS credentials. Example: { "AWS_ACCESS_KEY_ID" : "your-access-key" , "AWS_SECRET_ACCESS_KEY" : "your-secret-key" , "AWS_SES

Amazon Web Services has recently introduced AWS Continuum, a new integrated security platform to automate the discovery, enforcement, and remediation of security issues across codebases, dependencies, and applications. AWS Continuum launches with four agentic capabilities, aiming at the entire vulnerability lifecycle: penetration testing, code review, threat modelling, and code vulnerabilities. By Gianmarco Nalin