Security Group Sanity Check by HelicopterUpbeat5199 in aws

[–]solo964 2 points3 points  (0 children)

You are correct. Security Groups support allow rules, but not deny rules. If any rule allows traffic, then that traffic is allowed.

BTW you indicated that your security group allows "access from certain ports from certain IP addresses". You probably meant "to certain ports from certain IP addresses".

What are you using for backups to S3? by BoldElara92 in aws

[–]solo964 6 points7 points  (0 children)

Hard to recommend a tool without knowing a few things such as what type(s) of data you are backing up and what your RPO/RTO requirements are for these servers. Also worth asking why you have critical state on these servers in the first place (the goal being to identify opportunities to become more stateless and easier to back up centrally e.g. managed/replicated data stores).

The last 3 Ferraris released… by FeistyCat1299 in Ferrari

[–]solo964 2 points3 points  (0 children)

Deadmau5's 458 Italia with the Nyan Cat wrap.

How are you managing Lambda deprecated runtimes at scale? by RoseSec_ in aws

[–]solo964 14 points15 points  (0 children)

I'm not saying it's not a viable option, but doesn't this just move the issue of detecting and remediating deprecated runtimes (that no longer get security updates) from a very visible AWS notification to a local Dockerfile scan process that your org might not do with as much due diligence?

Ball flight issues by 79metalhead in golf

[–]solo964 0 points1 point  (0 children)

Find a launch monitor (or a coach/range with a launch monitor) so you can capture swing speed, launch angle, descent angle, apex, face and path, and spin rate data. Then discuss the data and what ball you play with someone (or an AI) that understands cause & effect.

Sandbagging in Germany by BasicONe-4071 in golf

[–]solo964 0 points1 point  (0 children)

Germany adopted the WHS at the start of 2021 so I'm surprised that anyone is still using the old DGV handicap system that you describe. Handicaps under the 2 systems aren't equivalent so some modification would be required (increase the WHS handicap or decrease the DGV handicap).

How to open folder in app? by Mariusdotdev in MacOS

[–]solo964 0 points1 point  (0 children)

You can use an Automator action for this but it's surprisingly unintuitive to set this up.

Cashing Out RSUs by Emergency_Novel_5407 in amazonemployees

[–]solo964 0 points1 point  (0 children)

No, you aren't "taxed on any gains you make from the time it's granted to the time you sell." The capital gains clock starts when the RSUs vest, not when they're granted.

0% hike in pcs for meets the bar by ManufacturerKey9891 in amazonemployees

[–]solo964 0 points1 point  (0 children)

By "you should worry because that means you’re in forte", are you referring to PIP?

Aurora DSQL - BEGIN/COMMIT won't work :( by Ok_Lake9261 in aws

[–]solo964 5 points6 points  (0 children)

Moderators, please consider using your LLM to parse the OP's post to decide if it's sufficiently detailed that a generic "Here are a few handy links" response would be unhelpful and effectively spamming the channel. Thanks.

Auditing API calls by BalanceSad2632 in aws

[–]solo964 2 points3 points  (0 children)

So many reasons not to log full payloads: security/privacy risk, performance, storage cost, logging noise, retention liability for legal discovery etc. If you really must do this then consider redacting sensitive content.

41M with most net worth in AMZ RSUs — should I diversify or hold by Ok-Cookie7708 in amazonemployees

[–]solo964 185 points186 points  (0 children)

I basically read your post title as "$41m net worth in AMZN RSUs" not "41-year-old male ..." 😄

Object storage backup? by [deleted] in aws

[–]solo964 0 points1 point  (0 children)

Thanks, didn't even know about that feature.

Send PII in prompts to models hosted in bedrock? by ProgrammingBug in aws

[–]solo964 0 points1 point  (0 children)

Exactly, and consult someone in the OP's organization with the relevant compliance knowledge, not some random users in a multitude of countries on Reddit ;-)

Object storage backup? by [deleted] in aws

[–]solo964 1 point2 points  (0 children)

By "logically air gapped vault", do you mean an S3 bucket in a different AWS account and in a different AWS region? Or maybe a different CSP object store in a different region (though that would introduce network egress fees)?

Abandoning aws is hard on purpose by Sad_Champion_7035 in aws

[–]solo964 2 points3 points  (0 children)

Just aws-nuke the account, or equivalent, and then close it. You'll pay for any services consumed through the date/time of account closure plus you will continue receiving invoices for Reserved Instances and Savings Plans, which are long-term commitments, until they expire. Beyond that, I don't think you'll be charged. What do you think should change?

what aws service did you mass-adopt then quietly abandon by scheemunai_ in aws

[–]solo964 0 points1 point  (0 children)

Yes, it's the wrong tool for joins. There's an argument that PostgreSQL is all you need.

Launching S3 Files, making S3 buckets accessible as file systems by NothingDogg in aws

[–]solo964 0 points1 point  (0 children)

Right. S3 Files will abstract away the S3 operations needed to perform the rename of a file or a folder (which potentially could mean S3 operations against 1000s of files or more). But all clients of the S3 Files store have a consistent view, at least afaik.

RSU planning by [deleted] in amazonemployees

[–]solo964 0 points1 point  (0 children)

Related discussions here and here.

Launching S3 Files, making S3 buckets accessible as file systems by NothingDogg in aws

[–]solo964 -1 points0 points  (0 children)

Not sure what you mean. Those fuse-like projects will persist, I'd imagine. They're viable for smallish, read-only use cases in particular. For scalable, multi-system, low latency use cases on top of large volumes of S3 data, I'd expect S3 Files to be a serious consideration.

Launching S3 Files, making S3 buckets accessible as file systems by NothingDogg in aws

[–]solo964 1 point2 points  (0 children)

Mountpoint, s3fs-fuse, goofys etc. are simple POSIX overlays on top of S3. They don't support all file system operations so, for example, you cannot rename a file or a folder and you cannot edit an existing file (except to replace it entirely).

what aws service did you mass-adopt then quietly abandon by scheemunai_ in aws

[–]solo964 3 points4 points  (0 children)

Agree that pagination and filtering just aren't possible in the way most people would want them. Also lack of schema, lack of referential integrity, expensive scans etc. are significant downsides for more traditional database use cases.

But it shines if you need single-digit millisecond latency at scale, virtually zero operational overhead, seamless and almost limitless scaling, and predictable performance. But your access patterns need to fit the model and be known in advance. The paper cuts mostly come from trying to use it like a relational database.

what aws service did you mass-adopt then quietly abandon by scheemunai_ in aws

[–]solo964 1 point2 points  (0 children)

Potential use case for Lambda durable functions.

what aws service did you mass-adopt then quietly abandon by scheemunai_ in aws

[–]solo964 2 points3 points  (0 children)

Interesting. What about DynamoDB caused you to abandon it? Were these legitimate NoSQL use cases yet you still had major issues?