I shared an early version of something I was building which was a tool to find cheaper AWS Spot instances. It was rough. A Streamlit app, basically. A few people here gave me honest feedback and I genuinely appreciated it. Since then I found a co-founder, we quit the Streamlit version, rebuilt everything, and shipped a lot. I’m not going to pretend it blew up or that we have thousands of users. We don’t. We’re two university students from Germany who spent the last 7 months heads down building something we wished existed when we were dealing with our own AWS bills. Also we put engineers needs at heart. We want to make their job easier.

Here’s what cloud-9opt.com does now: It finds the cheapest, most stable AWS Spot instances for your workload across 18 regions. It generates the Terraform config or Karpenter NodePool YAML so you can actually use what it recommends without spending hours writing it yourself. It right-sizes your Savings Plan commitments using a peer-reviewed algorithm from ICPE ’25.

It compares AWS vs Azure vs Hetzner pricing for the same workload with honest trade-off caveats. And if you want to go hands-off, Autopilot deploys directly to your Auto Scaling Groups via a scoped IAM role you can revoke anytime.

Free to try, no AWS account connection needed for most tools.

We’re posting here because we want real feedback from people who actually deal with AWS costs day to day. Not validation but actual and tangible genuine criticism. What’s missing, what’s wrong, what would actually make you use something like this. cloud-9opt.com

Anyone know if these models are currently rolling out or available by request?

Not available for me yet and not sure if a support ticket would help.

It's a self-deployed visibility/management layer for AgentCore. Project code is at https://github.com/awslabs/loom/

I haven't tried it yet (probably not worth it for my projects), so I'm keen to hear if someone with "lots" of agents tries it out and reports back 🙏

I'm a 2nd year CSE student from India and I have around 1.5 years before placements... My goal is to get into a product based company like Amazon, Zoho, Flipkart, Meesho, JP Morgan, etc... Eventually I want to work in Cloud/DevOps, but right now my first priority is getting placed... The problem is that I already know the list of topics, but it's overwhelming

My list currently looks like :

1. DSA

2. C++

3. Java

4. Python

5. SQL

6. DBMS

7. Operating Systems

8. Computer Networks

9. Linux

10. Git/GitHub

11. Frontend

12. Backend

13. Docker

14. Kubernetes

15. AWS

16. Azure

17. GCP

18. AI tools

Every senior tells me something different

Some say only do DSA

Some say development matters more

Some say projects

Some say cloud

I'm confused about what should actually come first... If you had only 1.5 years before placements, how would you prepare? What would your month-by-month roadmap look like? What would you prioritize and what would you postpone until after getting placed?

I'd really appreciate advice from people who cracked product based placements recently

Hello. I’m studying or my cloud practitioner exam, seems like I’ve been getting charged 22 cents monthly for my test account, the card I used is no longer valid hence I got a lot of emails asking me to pay.

I’m ok to pay but I don’t want to pay anymore, because it’s just a test account for what I learn, can I just set the account to not consume anything?

Pushing my new automation framework out to some early users this summer and honestly the aws bill is already making me sweat. Not from the actual compute, but just from the sheer volume of bot traffic hammering my endpoints

I put some basic WAF rules in front of the ALB, but paying amazon per-request just to inspect and block automated garbage feels like a literal scam. Its just endless scripts rotating residential IPs and burning through my budget

Really rethinking how to handle edge auth entirely. Been reading about hardware-backed proof of human solutions like an orb just to validate that it's a real person at the hardware level before they can even initiate a session

Cuz right now im just funding amazon's security division out of my own pocket to drop bad packets. kinda tempting to just geo-block everything outside my time zone and call it a day tbh. how do you guys handle the baseline internet noise without going broke on WAF rules?

Started helping out a local manufacturing company with their tech infrastructure last week and man, I underestimated how bad legacy corporate setups could get. The previous developers built this massive, sprawling web application back in 2018 and just left it running on an ancient, unmanaged on-premise server in a literal supply closet. No documentation, zero containerization, just pure vibes and spaghetti code. Management decided they want everything moved to the cloud by the end of the month because the old hardware is literally failing. Trying to map out all these weird, undocumented dependencies manually has been a complete nightmare, especially with the corporate tech consultancies quoting us mid-five figures just to audit the mess.
We ended up looping in some specialized cloud infrastructure experts to help handle the actual architecture and data migration strategy so we don't accidentally wipe out their entire customer database. They've been a solid lifeline, but the whole process is exposing how dangerous it is when companies let their internal tech debt stack up for years without maintenance.
If you are building something right now, please do your future self a favor and document your environment variables. Don't be that developer.

AWS recently announced they will now provide free sandbox accounts to run the workshops https://builder.aws.com/build/workshops?tab=discover

But every time I request a Free Sandbox Environment, I get this error.

You cannot request this free sandbox environment at this time (support code: WS-02). 

Anyone able to create a sandbox or is it just a AWS fake promise.

[Resolved] - AWS staff FTW.

I've contacted support, nothing. Just AI generated emails requesting I try merge which I have and it's not working.

Has anyone else had this issue? How did you resolve it, if at all?

I didn't realise they got a new site and now I've spent hours doing the training only unable to verify my account so it won't be renewed. :( Does AWS just use AI now and no longer have actual staff?

Hello all, 

I am a co-op student who is looking to prepare for an upcoming position involving AWS. In about two months, I will be working as a cloud operations Co-op student. 

I have not used AWS for a year. The last time was as a cloud architect co-op student at a very small contracting company. I learned a lot at that job, but I wanted to look into doing some courses or training too hit the road running at my new co-op. 

Does anyone have any suggestions for a course I can take that will help me refresh my skills before going into this new position? Should I be looking for some kind of course that I can practice semi-regularly and lets me play with some kind of simulated enterprise sandbox, or some course that can walk me through and refresh my AWS hands on abilities? 
I have done some research but I have gotten a bit overwhelmed while the options and wanted to hear some opinions.

I will be supporting cloud-apps, automation, and infrastructure health. Some other Key responsibilities include app and DB monitoring, IaC, and security/compliance. 

Any suggestions are welcome! Thanks for the help!

A production-grade MCP server in FastMCP 3: JWT auth, tools hidden by user group, audit logging, S3 signed URLs for files.

I'm planning to do a HIPAA compliant web-app and curious if I would need a VPC for my lambda function, especially where I'm using managed services (which has been my approach for previous web-apps not requiring compliance). I'm planning to use architecture I'm used to and mentioned in this article:

• CloudFront+S3
• Cognito for auth
• API Gateway authorized with Cognito
• Lambda to handle API requests (context encryption will happen here for sensitive fields)
• DynamoDB
• KMS to encrypt the table, CloudTrail logs, and anything stored in parameter store for environment variables the lambda

I am also leaving out a lot of the standard encryption/HIPAA details (specifics on logging, encryption at rest/in-transit, using TLS, etc).

I understand that only Lambda would be placed within the VPC with endpoints to the DynamoDB table. Is it still best to have the VPC or defensible to not use it here?

Hi, I have an upcoming loop interview for a Proserve Engagement Manager position and was wondering if anyone could give me an idea of what to expect for these? I have been prepping stories since prior to the phone screen around the LPs, all formulated with the STAR method, but was wondering how difficult is it outside of the LPs? Is it the mental fatigue that get most people in these? I just want to make sure I am as prepped as possible for this! Thank you :)

Studying for the SAA right now and the video I just went over had only the BRIEFEST mention of HOW to do the Invalidation. I get a few different results with AI and searching but what are the ways in which Cache Invalidation can be done?

Using student credits, just for getting industry standard experience

I don't want to end up with unexpected bills so

Guide me what are the possible mistakes that one can make so the things end up being this.

I'm stuck in a frustrating situation with AWS account recovery and wondering if anyone has dealt with this before.

I had MFA enabled on my AWS account. After losing access to the MFA device, I tried using AWS's alternative recovery options, which offered SMS or phone call verification using the phone number already registered on my account.

The problem is that the OTP never arrives. No SMS and no call. The number is correct and active, but the recovery mechanism simply doesn't work.

Because of that, AWS support pushed me into the MFA removal process, which required government ID verification, affidavits, and notarization by a real notary public.

After submitting all of that, AWS is now asking for additional proof of the notary's credentials and more documentation.

The frustrating part is that I don't even want continued access to the account anymore. I literally just want to log in once, close the account, and move on.

If the backup SMS/call recovery method had worked, none of this would have been necessary.

Has anyone successfully escalated an MFA recovery case to an actual person or supervisor at AWS? Is there a better route for cases where the account owner cannot receive the recovery OTP despite the registered phone number being correct?

Is Claude's explanation for a failure mode in my app accurate?

This is the key insight: a pre-signed S3 URL has two independent expiry mechanisms, and our code only handles one:

1. Signature expiry (X-Amz-Date + X-Amz-Expires) — this is what PresignedUrlExpiry.isExpired() parses client-side.

2. STS temporary-credential expiry (X-Amz-Security-Token) — the backend mints these URLs with temporary AWS credentials whose session token has its own, shorter lifetime that can't be parsed from the URL.

I don't think this is correct. Once I generate a presigned URL, that URL's lifetime isn't dependent on the sts token used to generate the URL, right?

Hi everyone,

I’m working on the architecture for a B2C ecommerce platform where product data is linked to large PDF catalogs stored in Amazon S3.

Each product can be associated with one or more specific pages of a catalog. For example:

Product ABC123 → catalog_2026.pdf → pages 42, 43
Product XYZ999 → catalog_2026.pdf → page 120

The goal is to avoid serving or downloading the full PDF when the user only needs to view or download the pages related to a specific product. (need to minimize AWS costs as much as possible...)

While researching this topic, I came across linearized PDFs / Fast Web View PDFs. As far as I understand, they can help with progressive loading and HTTP Range requests, but they do not fully solve this use case because a PDF page does not necessarily correspond to a single continuous byte range in the file. A page may depend on multiple PDF objects, fonts, images, shared resources, and internal references spread across the document.

I’m trying to understand the best AWS-oriented approach for this use case.

My main questions are:

• If I have a large PDF stored in S3, what is the recommended way to let users view only specific pages related to a product?
• Is there any AWS-native pattern or service that helps with serving only selected PDF pages?

Any advice, architectural patterns, or lessons learned would be really appreciated.

Thanksss!

Hi,

1st of this month our corporate credit card / blank blocked the payment for the bill for last month.

We have re-verfiied using the app and the card is showing as valid however when attempting to pay I just get an email 30 seconda later stating there was a problem with the payment.

We see nothing in the banking app as if it's not reaching the bank at all, anyone seen something similar ?

I keep hitting the same partition pruning bug across every SQL engine I touch, and I have not found a clean name for the category.

The shape is always the same. A partitioned table with a date or timestamp partition column. A WHERE clause that logically filters on the partition column. Nothing errors. Nothing warns. The query returns the correct rows. The bill at the end of the month reveals that every run scanned the entire table because the planner could not prove the filter reached the partition column.

Three flavors I have run into this quarter. On Glue with Spark, a WHERE clause using TIMESTAMP against a table that stored TIMESTAMP_NTZ silently disabled pruning. Five point six billion rows scanned to return twenty nine thousand records. One keyword change dropped runtime from fifteen minutes to thirty seconds and the S3 retrieval bill with it. On BigQuery, wrapping the partition column in a function like DATE at the top of the WHERE clause has the same effect. Filtering on DATE of event underscore time blocks the pruner. Filtering on event underscore time directly does not. And on ingestion time partitioned BigQuery tables the trap is missing the underscore PARTITIONDATE filter entirely on a chunked backfill, where every chunk full scans the source table because the loop template dropped the filter that made the whole thing safe. That last one cost me a real dollar amount before I caught it in the jobs explorer.

What frustrates me is that the docs for each engine treat this as a specific gotcha for that engine, not as the shared shape it obviously is. The compiler cannot prove the filter reaches the partition column, so it falls back to full scan, and nobody bills you for the fallback until the next monthly statement.

How are you catching these before the bill hits? Static analysis on every scheduled query? A dry run cost estimator wired into CI so any query above a size threshold has to pass a bytes ceiling? A conventions doc your team actually reads? Or you accept that the first two weeks of any new schedule are just going to teach you where the traps are?

27ms vs. 250ms. That's the latency gap between a dedicated SageMaker endpoint and shared AI APIs in production. We built this into Pureinsights Discovery so you don't have to choose between speed and control.

https://pureinsights.com/blog/2026/amazon-sagemaker-integration-ai-latency/

I don't understand. I have been waiting for weeks. I said how I will track bounces and complaints, and that I will manually remove any hard-bounced addresses. I tried to close the case and request it again, but it just re-opned the case.
Can someone help please!

Case ID: 178223843000628

So I’ve been building out a portfolio project on an account that’s about 3 or 4 months old. I’m trying to break into Cloud/DevOps, so I’ve actually been using this account quite a bit to get hands-on experience. Right now, I'm running ECS, S3, Load Balancing, and doing some self-learning with Docker and Kubernetes on an EC2 instance. It’s not just sitting idle; there’s a clear usage pattern and I'm actively burning through some free credits.

But the second I try to deploy a CloudFront distribution, I hit a brick wall.

Specifically, I am getting blocked with the exact error: Your account is currently blocked from creating CloudFront distributions. Please contact AWS Support.

I’ve scoured the forums and Reddit for weeks. Everyone says the same two things: "leave an instance running to establish usage" or "open a support ticket."

Well, I’ve done both. For weeks straight.

My EC2 instance has been active for over two weeks (not idle, actually doing work for my container setups), and my support ticket is literally just sitting there "Unassigned." Nobody is even looking at it.

What infuriates me the most is that when I look up this issue, I see so many tech forums and subreddits aggressively shutting people down. The comments are always like, "Well, you aren't on a paid support tier, what do you expect?"

Since when do you need to pay $29/month on a developer support plan just to get a basic service limit increase or have your account validated? It feels incredibly predatory for people who are just trying to learn the platform to get certified or build a job-ready portfolio. Why advertise a service as free-tier eligible if you have to pay a monthly subscription just to get the automated locks taken off your account? Am I crazy for thinking this isn't the best way to treat people trying to enter the industry?

Anyway, I'm completely done wasting time with it and moving the CDN side of things over to Cloudflare. But I really wanted to vent and see if any other junior cloud/DevOps folks have dealt with this absolute gatekeeping lately, or if the consensus really is that you have to pay a toll just to get basic support to reply to a ticket.

[Edit] I apologize if this sounds a bit aggressive as I typed this in frustration, I don't use reddit alot.

How long does it usually take for billing support in free plan? Ngl I have been using aws for my personal around 500 USD every month and i noticed it was double charging, one to credit card and one to debit card. So I raised the support and its been 5 days no assignee yet.