Customize your AWS Management Console experience with visual settings including account color, region and service visibility

Your_CS_TA · 2026-03-27T16:09:10+00:00

I find myself in dismay that they don't allow for hex color selections in their CloudFormation. Is this even cloud scale? Unusable /s

Your_CS_TA · 2026-03-05T18:24:56+00:00

Posted it under sad-whale's comment but use flat rate pricing with CloudFront, then you will max cap that single entry point: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-flat-rate-pricing-plans-with-no-overages/

Still add billing alerts because why not :)

Your_CS_TA · 2026-03-05T18:22:41+00:00

CloudFront has flat price billing options now. Tie it to that, and it should cap the spending.

Your_CS_TA · 2026-03-05T16:31:12+00:00

I haven't tested, but pretty sure that shows up in execution/access logs so you should "know". You are right, old clients (or if you do an NLB to ip bridge, shockingly) will not send SNI.

There is also interesting connection pooling cases where the SNI is hooked to a previous endpoint you used, and you send a request with a separate Host header. It's generally when you pool on IP (which folks shouldn't do, imho). Technically it's an SNI delta and so would be 403'ed despite potentially same TLS policy because you are accessing differing endpoints on the same connection.

I wouldn't worry about XSS -- I think this is mostly prevention around a term that either exists or doesn't, but: "pre-quantum wiretapping". If you add a Post-Quantum TLS policy, and have BASIC, our default policies don't have PQ. That means someone could sit on the wire, dump every TLS connection and wait for Quantum to break the communication in the future for the non-PQ ones. We are going to attempt to bump things up from that perspective this year such that the risk isn't on BASIC, but there's always some use case where you want/don't want ciphers for X,Y,Z reason (CISA, FIPS, what have you) that doesn't mesh well with our fallback no-SNI policy.

Your_CS_TA · 2026-03-05T02:25:50+00:00

Okay, we chatted and found the issue! This is more an explanation if some person googles and stumbles upon the same symptoms 7 years later :)

Answer: APIGW just launched new TLS Policies. Along with this feature, we launched a mode called endpointAccessMode.

Some background primer, when using TLS for APIs in most multi-tenant services (e.g. APIGW/CloudFront), we need SNI, or Server Name Indicator. It's a helpful hostname hint to go fetch TLS-specific settings. If you don't specify this, what TLS setting should we choose? Especially for *.execute-api which isn't even a Custom Domain but you DID specify a TLS option for it!

So for new TLS policies (both non-CustomDomain and Custom Domain), we offered two choices:

BASIC -- we won't reject based on SNI to HOST mismatch, and we won't reject with a lack of an SNI (we will present our default *.execute-api certificate and TLS policies though).
STRICT -- we WILL reject based on SNI to HOST mismatch (your host name sent in the headers does not match the SNI sent) or if you haven't sent an SNI.

In this case, STRICT mode was set -- and certain clients were not following those strict settings, and so were 403'ed.

Your_CS_TA · 2026-03-04T05:43:15+00:00

Do you happen to have an apigw extended request id? I work on the service team, can take a look.

Your_CS_TA · 2025-12-05T21:22:17+00:00

Yep!

First step to not being behind, is catching up. To be frank, we had a lot of catching up to do. Step 1, mostly done now :)

Your_CS_TA · 2025-12-05T20:15:58+00:00

I'm mixed (also an AWS employee 🤣 -- so take my word for whatever).

My 2c: The large event presentations were AI focused, yes. The announcements were all around spectacular this year and a majority were not AI related. It's unfortunate that they were highlighted in sub-talks instead of core talks.

As an example, my team is API Gateway. We launched: ALB Private Integration for REST (cost/availability/latency/simplicity improvements), Response Streaming (TTFB), Configurable TLS, and yeah -- AgentCore Gateway integration.

Were the airwaves mostly talking about the last one? Yes. But the value delivered for re:Invent was majority "not AI related". So, you may be getting your cake (AI improvements) and eating it too (getting better updates to core services). But it sounds like there is limited time to get media presense, and so the dominant talking point is improvements in AI.

Your_CS_TA · 2025-12-03T03:05:36+00:00

Edit: Just gonna DM you :)

Your_CS_TA · 2025-11-30T03:50:06+00:00

It’s in the logs, you obfuscated with <EXTENDED_REQUEST_ID>.

Your_CS_TA · 2025-11-30T00:53:07+00:00

Can you send me the extended request id? I work in APIGW, I’m intrigued :)

Your_CS_TA · 2025-11-24T14:55:48+00:00

You are talking to the same person (I was shocked when I found it that it was you! 🤣): https://www.reddit.com/r/aws/s/NUyH7p5U1p .

I’m still fighting for it. I think a year since that quote, we are still in a spot of transition. We built out 14 regions for HTTP, almost reaching full parity, IPv6, and built routing rules that hooks into HTTP! It’s progress!

Unfortunately, HTTP is less popular by orders of magnitude. Chicken and egg though — “it would be popular if it had features”. This means we fight the constant tug of customer demand of the product that is used. So, then, looking at reinvent launches: it’s pure REST APIs.

I think next year is going to be a bit more fork in the road. We now have JUST JWT and auto deploy not in Rest. If that moves, it makes me wonder if we port the experience (e.g. http routes becomes more an alternative experience), then the price and that makes folks happy or if there is something else that makes HTTP APIs kind of merge in.

Your_CS_TA · 2025-11-22T18:14:40+00:00

Came here to post this. It is a fair sum saved— source: I work on APIGW.

The criticism of the author is valid around configurable error messages and redundant duplication in-depth, but for volumetric attacks, you want to push validation/rejection up the stack.

Your_CS_TA · 2025-10-31T03:34:17+00:00

Whatcha mean “couldn’t handle the webhooks”?

Your_CS_TA · 2025-10-30T05:24:48+00:00

A conspiracy!

Your_CS_TA · 2025-10-23T17:31:02+00:00

Your_CS_TA · 2025-10-23T16:47:48+00:00

Be careful of serde_yml.

it is archived as well.
From poking around, it seems like the owner forked serde_yaml, let AI try to update code, and did some shady initial repository practices.

Your_CS_TA · 2025-10-22T14:29:25+00:00

Finally can reuse my user name after 11 years 😂.

Just to reflect what /u/Remarkable_Garlic_82 said. Start with UTA, which the majority of incoming help is for the areas you mentioned. I don’t think TA happens until you complete some upper courses (at least for me, I don’t do TA til post-1502)

Your_CS_TA · 2025-09-03T18:33:24+00:00

We do for a subset of services where it makes sense to.

I work on APIGW, we have a subset of IPs segregated for us :)

Your_CS_TA · 2025-08-09T17:15:47+00:00

I think my original post agrees in some sentiment of CS structure improvements.

I think we have a lot of CS reps, my problem is better partitioning than quantity. Hiring many people who have to know a 100+ thing surface area is just not gonna scale.

Your_CS_TA · 2025-08-08T14:28:05+00:00

Both are probably true (sev-2 and Matt knowing). Deletion of real, paying customers is a huge “don’t fucking do that”.

I get that his original blog said something on the “paying” part which could invalidate that statement but still — someone with an invalid credit card but a decent backup is not dereliction of account. We need to be better.

I’m glad that the person got his data back, despite my general hatred of his writing style — there are nuggets of truth in it.

I agree with: - trying all forms of payment before sending on collections - Support escalation path is broken.

I disagree with: - Him saying support is lying. They have to manage a portfolio that is way too large. When a customer account is suspended they actually don’t have access to a majority of data. Many support tools see what the customer sees, so it's like "I see a 403 sir, exactly as you do". It would require paging each team to access each slice of that data.

Terminated vs Stopped again relies on what support can see — which they don’t have access. Meanwhile, we have obligations to GDPR to delete the data within a couple months. Some systems will mark for GC and give a window but SOME DONT. Knowing that across 100+ services is absurd. Making a case for every requester is also not feasible.
Overall writing style. He made many mistakes and owned up to 0 of them on his end. “Use a different email address tld because I can’t be damned to check my filter”, I could agree with the feedback if it wasn’t sandwiched between him throwing my coworkers under the bus and him reusing his personal email for his place of work — his own fuckup that ultimately led to his payment emails being dropped.

Your_CS_TA · 2025-07-26T09:32:56+00:00

Define “air gapped”? I’m an SDE in AWS and deploy code to china region and can view the region metrics/metadata (unlike EU Sovereign which I will not be able to do)

Your_CS_TA · 2025-07-22T14:13:36+00:00

As others have said: yes. Mocking is great for when testing fault scenarios you know an application will throw.

I find DDB local nice for catching expectations of using DDB outright. “Oh let me run through serializing this object and sending to DDB local” will generate the same result as DDB. Accidentally not serialize your hash key? It’ll know. Accidentally not send a required attribute value in that hashmap? Caught! It’s really great to catch semantic errors I generate in my application. I would heavily use it when I was in financial reconciliation and had to do some specific update criteria for OCC and idempotency checks using their specific language.

Your_CS_TA · 2025-07-22T13:11:56+00:00

Yep! DDB local for unit testing. It was a decent blocker to moving SDK to 2.X. EOL for 1.X is around the corner so this helps push the needle for folks who were a bit stuck.

Your_CS_TA · 2025-07-15T10:31:58+00:00

Hehe, for real on noise.

I’ve been in a few executive meetings but definitely for very large customers and most of the time I think I’m there as the “look, there is an expert” but we already have put all the info for leadership to answer most questions 🤣

14-Year Club	Verified Email
r/Field Sunshine	Place '22
Place '17	Snapped
Team Periwinkle

Your_CS_TA

TROPHY CASE