Home / AWS
EC2, IAM, S3, EKS and day-2 operations on Amazon Web Services. 146 posts.
Create a private bucket with sensible defaults, upload, download and sync folders, share a single file safely with a presigned URL, and turn on versioning so mistakes can be undone.
Install AWS CLI v2, sign in with IAM Identity Center instead of long-lived keys, use named profiles for several accounts, and always confirm the account and region before you run a change.
Replace dozens of per-project policies with a few attribute-based policies that compare principal tags with resource tags, protect the tags themselves, pass tags from IAM Identity Center, and test the result before rollout.
The IAM building blocks in plain terms, how a policy document is read, how roles are assumed, and a small worked example that gives an EC2 instance read access to one S3 bucket without keys.
Publish an internal service to other VPCs and accounts with PrivateLink instead of peering. Build the NLB-backed endpoint service, approve consumers, set up private DNS with domain verification, and debug the usual connection failures.
Deploy baseline resources (roles, Config rules, alarms, logging) to every account and region with service-managed StackSets, roll out with concurrency and failure tolerance, handle drift and failed instances, and avoid the classic StackSet traps.
Understand metrics, statistics and periods, create a CPU and a status-check alarm that emails you through SNS, test it on purpose, and avoid the beginner settings that make alarms noisy or silent.
An EventBridge rule exists but the Lambda, SQS queue or Step Functions target never runs. Work out whether the event never arrived, didn't match, or failed delivery, then fix it.
Find every pending RDS and Aurora maintenance action, know which ones cause downtime, and apply them in your own window instead of AWS's.
How security groups and network ACLs differ (stateful vs stateless, allow-only vs allow and deny), sensible defaults for web and database tiers, and a step-by-step check when traffic does not get through.
After a bucket policy change, every request (even from AdministratorAccess) returns AccessDenied and the app is down. Use the account root user or the Organizations privileged root action to delete the policy, then rebuild it safely with tests.
Pods cannot resolve service or external names and the whole platform fails at once. Check CoreDNS pods, scheduling and security groups, fix VPC resolver throttling and ndots amplification, and scale DNS so a node loss cannot take it out.
A full root filesystem stops logging, databases and even SSH logins. Get in (or around the OS with a rescue instance), free space safely, grow the EBS volume online, and add alarms so it never fills silently again.
The Application Load Balancer returns 503 because no target passes health checks. Read the health reason codes, separate a broken app from a broken health check or network change, restore traffic, and harden checks so one bad dependency cannot take the site down.
The app fails with "FATAL: sorry, too many clients already" or MySQL error 1040. Get an admin session, kill idle and runaway connections, stop the source of the storm, and put RDS Proxy or proper pooling in front so it does not recur.
How SQS FIFO ordering really works, how to choose message group IDs so throughput scales, deduplication windows and IDs, high-throughput mode, Lambda batch behaviour, and why one poison message can block a whole group.
Design Step Functions workflows that survive throttling and partial failures. Retry with backoff and jitter, catch and compensate, make tasks idempotent, and run large fan-outs with Distributed Map tolerated failure thresholds and redrive.
Copy-paste AWS CLI --filters and JMESPath --query patterns for everyday questions such as which instances are running, which volumes are orphaned and what still allows IMDSv1.
Another account can see your shared bucket, snapshot or AMI but fails with AccessDenied or an instance that terminates at launch. Fix the key policy, the consumer's IAM, grants and the AWS managed key trap.
An admin role still gets AccessDenied. Read the policy type named in the error, walk the IAM evaluation order, decode encoded messages and use CloudTrail and the policy simulator to find the exact deny.
TransactWriteItems calls fail with TransactionCanceledException under load. Read the per-item cancellation reasons, tell conflicts from conditions and throttling, and fix hot items, retries and idempotency.
The console says the EBS volume is attached but the disk is missing, won't mount or the instance won't boot. Map NVMe names to volume IDs and fix each cause.
Retransmits, DNS timeouts or dropped connections on busy EC2 instances while CPU and bandwidth graphs look fine. Read the ENA allowance counters, find which limit you hit and fix it with sizing, connection tracking changes or caching.
Big jobs get 503 Slow Down from S3, or KMS ThrottlingException on encrypted buckets. Find the hot prefixes, understand how S3 scales per prefix, enable S3 Bucket Keys and tune SDK retries.
Traffic through an AWS Transit Gateway and a firewall VPC drops at random or not at all. Check associations and propagations, find blackhole routes, enable appliance mode and use Route Analyzer to prove the path.
Amazon Linux 2 is past its end-of-life date. Find every AL2 instance, AMI and launch template, understand what's different in Amazon Linux 2023, and rebuild rather than upgrade in place.
Lambda runtime deprecations, EKS end of support and Amazon Linux 2 end of life are all announced months ahead through AWS Health. Route those events to the owning team automatically, use the organisation view, and track each notice to closure.
Reach private EC2 instances over SSH or RDP through an EC2 Instance Connect Endpoint, and fix the security group, IAM and key problems behind failed tunnels.
Get an EC2 instance out of stopping or shutting-down, read the state reason when a start bounces back to stopped, and fix the KMS, capacity and volume causes.
EKS automatically upgrades control planes after extended support ends, without a notice, and leaves nodes and add-ons behind. Check which clusters are on 1.31 to 1.34, plan the upgrade path, and run it before the dates rather than reacting afterwards.
python3.10 is deprecated on 31 October 2026 and dotnet8 on 10 November 2026, while nodejs20.x and provided.al2 already are. List every affected function across accounts and regions, upgrade with versions and aliases, and know the create/update block dates.
CVE-2026-109618 and CVE-2026-109619 let a single unauthenticated request take over PHP web servers, and Amazon's honeypots saw an exploitation attempt days before disclosure. Use SSM Inventory and Run Command to find and patch PHP at fleet scale, rebuild container images, and narrow exposure while you work.
Put RDS Proxy in front of an RDS or Aurora database to absorb connection storms, fix unhealthy targets, and find and remove the session pinning that stops multiplexing.
Turn on Route 53 Resolver query logging for a VPC, send it to CloudWatch Logs, and use Logs Insights to find NXDOMAIN storms, unexpected domains and which instance asked.
API Gateway errors come from the gateway itself (auth, throttling, mapping) or from the integration (Lambda errors, timeouts). Turn on access logs with the error fields, match the status to the cause, then fix the right layer.
Use AWS Config to list non-compliant resources per rule and account, query them with advanced queries, and attach SSM Automation remediation, manual first and automatic once proven.
Get a CloudFormation stack out of UPDATE_ROLLBACK_FAILED, DELETE_FAILED or a long IN_PROGRESS state without deleting production resources.
With the Amazon VPC CNI every pod takes a VPC IP. When subnets or per-node ENI slots run out, pods hang with "failed to assign an IP address". Check subnet free IPs and max-pods, then use prefix delegation or secondary CIDRs.
Diagnose a failed Secrets Manager rotation step by step, clear a stuck AWSPENDING version safely, and make sure applications are still using a working password.
Run shell or PowerShell commands on many instances at once with SSM Run Command. Target by tag, limit concurrency and errors, send output to S3, and check results per instance, with no SSH or RDP needed.
Send VPC Flow Logs to S3, define an Athena table with partition projection, and use ready-made queries to find rejected connections, top talkers, unexpected internet traffic and what talked to a given IP.
The front door of an AWS workload decides its security controls, failover and much of its latency. Choose by protocol, global vs regional reach and API management needs, combine services in proven layers, and settle WAF placement, origin protection, timeouts and certificates during design.
A design guide for metrics, logs and traces across AWS accounts. Decide what CloudWatch covers natively, where Amazon Managed Service for Prometheus and Grafana fit, standardise instrumentation on OpenTelemetry, centralise across accounts, and set retention, cost and ownership rules from the start.
A design guide for backups across many AWS accounts. Define backup tiers, enforce them with Organizations backup policies and tags, protect recovery points with vault lock and cross-account or logically air-gapped copies, prove recoverability with automated restore testing and report compliance centrally.
A design guide for picking a database service per workload on AWS. Decide the data model and access patterns first, then the engine and service, compare operational and resilience characteristics, and plan HA, DR, network and identity with the choice instead of after it.
A design guide for deciding where a workload runs on AWS. Start from the workload shape and the team that will operate it, walk a decision path, compare what you still manage on each option, and avoid the classic traps such as EKS for a team of three or Lambda for long-running jobs.
A design guide for matching data to AWS storage services. Decide by access protocol, sharing model and performance, then look at features such as snapshots, replication and identity integration. Includes common workload mappings and the traps that cause slow apps or surprise bills.
A design guide for how container images reach production on AWS. Structure ECR repositories and access, curate base images through pull-through cache, scan with Amazon Inspector enhanced scanning, make tags immutable, sign images and verify signatures at deploy time on EKS and ECS.
Launches, migrations and DR failovers often fail on quotas or capacity rather than on code. Separate adjustable quotas from fixed limits and physical capacity, inventory what your design depends on, monitor usage with alarms, pre-request increases through quota templates for new accounts, and reserve capacity where it truly matters.
AWS Organizations offers several kinds of guardrails that work at different points. Map each control objective to the right mechanism - SCPs for what principals may do, RCPs for who may access resources, declarative policies for service configuration, proactive hooks at deploy time and detective rules after the fact - then roll them out safely and handle exceptions.
Multi-AZ on paper often fails in practice because recovery depends on launching new capacity or calling control-plane APIs during the event. Design for static stability - pre-provisioned capacity, data planes that keep working, health checks that detect partial failures - and practise moving traffic away from an impaired zone.
A design guide for connecting data centres and offices to AWS. Choose between VPN and Direct Connect by bandwidth, latency consistency and cost, pick a resiliency model that matches the business impact, decide on gateways and routing, and plan encryption, monitoring and failover tests.
A practical guide to reviewing an existing AWS workload against the six Well-Architected pillars. Scope the workload, gather evidence before the session, use the WA Tool and relevant lenses, rate risks with the people who operate it, and turn findings into an improvement plan tracked with milestones.
A design guide for where secrets and configuration live, how keys are structured, and who can use them. Choose Secrets Manager vs Parameter Store per item, decide between AWS managed and customer managed KMS keys, structure keys per workload and data class, write key policies that separate admins from users, and plan rotation and multi-region needs.
AWS offers several messaging services that overlap at first glance. Decide by whether you're queueing work, fanning out notifications, routing events between systems or processing ordered streams, then check ordering, replay, throughput and failure handling. Includes common combinations.
Every workload that calls AWS APIs needs an identity, and long-lived access keys are the wrong answer almost everywhere. Map each compute type to its native role mechanism, choose between EKS Pod Identity and IRSA, use IAM Roles Anywhere for servers outside AWS, and scope permissions with boundaries, conditions and session tags.
CloudWatch Logs bills for ingestion and storage, and the defaults keep everything forever. Find the log groups that ingest the most, set retention everywhere, lower log levels at the source, use the Infrequent Access log class where its limits are acceptable, and send bulk vended logs to S3.
NAT Gateways charge per GB processed, and much of that traffic is to AWS services like S3, ECR and DynamoDB. Find what flows through the NAT, add free gateway endpoints for S3 and DynamoDB, weigh interface endpoints for chatty services, and fix cross-AZ NAT paths.
DynamoDB bills for reads, writes, storage and every index. Choose on-demand or provisioned with auto scaling from real traffic, switch storage-heavy tables to Standard-IA, expire data with TTL, trim GSI projections and item sizes, and cache hot reads.
Snapshot storage creeps up from scripts that never delete, AMIs nobody uses and backup plans with the same long retention everywhere. Inventory snapshots by source and age, automate lifecycle with Data Lifecycle Manager or AWS Backup, move long-term copies to the archive tier, clean orphans safely and keep Recycle Bin as a safety net.
EKS clusters waste money when pods over-request, nodes never consolidate and spot is used with too few instance types. Measure requests vs usage, tune Karpenter NodePools for consolidation and disruption budgets, diversify spot across families and sizes, use Graviton where images support it, and protect critical workloads.
Cache clusters are usually sized once and kept forever. Measure memory, CPU and network against node limits, fix TTL and key bloat, consider Valkey, data tiering nodes for large mostly-cold datasets and serverless for variable load, then right-size node type and shard/replica counts.
Noisy CloudWatch alarms train people to ignore pages. Measure which alarms flap and which lead to action, fix evaluation settings and missing-data handling, use anomaly detection for metrics with daily patterns, combine symptoms with composite alarms and suppress dependent alarms during known outages.
Data transfer charges hide inside EC2, RDS and other service lines. Query the Cost and Usage Report by usage type to see which kind of transfer costs most, trace it to resources and flows, and fix the common causes - chatty cross-AZ tiers, needless cross-region copies and egress that should come from a CDN.
A low cache hit ratio means origin load and egress you didn't need to pay for. Find what misses, trim the cache key with managed cache policies, send cache headers from the origin, add Origin Shield for multi-region viewers, enable compression and normalise requests with CloudFront Functions.
Lambda cost is duration × memory, and CPU scales with memory, so the cheapest setting is often not the smallest. Measure with Power Tuning, move to arm64 where dependencies allow, reduce init time, use SnapStart or provisioned concurrency only where cold starts matter, and trim invocations you don't need.
Every load balancer has an hourly charge plus capacity units, and many accounts have dozens with little or no traffic. Find idle ones, consolidate small apps behind shared ALBs with host-based rules, pick ALB vs NLB deliberately, and tune target group settings that affect deployments and errors.
Database instances are sized for launch-day fears and rarely revisited. Measure CPU, memory and I/O over weeks, move to current Graviton classes, pick Aurora Standard vs I/O-Optimized from your I/O share of spend, use Serverless v2 for variable load, and clean up snapshots and idle replicas.
S3 bills grow from data nobody reads, old versions and forgotten multipart uploads. Use Storage Lens to find the big and cold buckets, pick between Intelligent-Tiering and explicit lifecycle transitions, expire noncurrent versions and incomplete uploads, and avoid small-object and minimum-duration traps.
Development and test environments are typically used about a third of the week but run all of it. Tag resources with a schedule, stop EC2, RDS, Aurora, EKS node groups, ECS services and Redshift automatically, give teams an override, and report savings.
Auto Scaling groups often run with a high fixed minimum because scale-out is too slow to trust. Make instances ready faster, use target tracking on the right metric, add predictive scaling for daily patterns, keep warm pools for slow-booting apps, and mix on-demand and spot across instance types.
Copy-paste CloudWatch Logs Insights queries for error spikes, slow Lambda invocations, rejected VPC flows and CloudTrail AccessDenied, plus running them from the CLI.
Instance missing from Fleet Manager or Session Manager won't connect? Check the agent, IAM role, endpoints, IMDS and proxy in order, with ssm-cli diagnostics.
Stop an EC2 Auto Scaling group that keeps replacing instances. Read scaling activities, find whether ELB health checks, a short grace period, a bad launch template or user data is the cause, freeze replacements and roll back.
Respond to leaked IAM access keys or a compromised role. Deactivate keys, revoke active sessions, find what the attacker did with CloudTrail, clean up created resources and stop long-lived keys from coming back.
Treat a sudden AWS cost spike as an incident. Find the service, account and usage type with Cost Explorer from the CLI, check the usual suspects (NAT data processing, logs, GPU instances, loops), stop the spend and add anomaly detection and budget actions.
Troubleshoot a Direct Connect outage from the physical connection up through the virtual interface, BGP session, advertised prefixes and the Direct Connect or transit gateway, and confirm VPN failover works.
Contain a compromised EC2 instance without destroying evidence. Isolate with a forensic security group, detach from Auto Scaling and load balancers, revoke the instance role's credentials, snapshot volumes and decide when to rebuild.
Stop DynamoDB throttling that is failing user requests. Tell table-level from partition-level throttling, find hot keys with Contributor Insights, apply quick relief (on-demand, capacity, GSI fixes) and redesign the key so it doesn't come back.
Fix applications that freeze on Amazon EFS. Check burst credit balance and PercentIOLimit, switch throughput mode, verify mount targets and security groups, and recover hung NFS mounts without rebooting everything.
Restore service when unrelated Lambda functions throttle because one function consumed the account's concurrency. Find the culprit, cap it with reserved concurrency, protect critical functions and fix the trigger that caused the spike.
Restore HTTPS on ALB, CloudFront or API Gateway when an ACM certificate expires. Understand why managed renewal failed (DNS validation records, imported certificates, CAA), issue a replacement fast and alert before it happens again.
Restore access to EBS, S3, RDS and Secrets Manager data when a customer managed KMS key is disabled or pending deletion. Cancel the deletion, re-enable the key, find who did it and stop it happening again.
Get back into an EC2 instance when the SSH key is lost, sshd is misconfigured or the Windows Administrator password is unknown. Try Session Manager, EC2 Instance Connect and the serial console first, then the rescue-volume method and SSM automation runbooks.
Regain kubectl access to Amazon EKS after a bad aws-auth ConfigMap edit, a deleted admin role or a creator who left. Use EKS access entries to grant admin from IAM, fix aws-auth, and avoid the single point of failure next time.
Recover an RDS instance or Aurora cluster after deletion or a destructive change. Restore to a point in time, from retained automated backups or a final snapshot, use Aurora Backtrack where enabled, and swap endpoints with minimal app change.
Recover S3 data after an accidental delete or bad overwrite. Remove delete markers in bulk, restore earlier versions, fall back to replicas or AWS Backup, and stop the next incident with Object Lock and MFA delete.
Handle an SQS incident where messages pile up and land in the DLQ. Read the queue metrics, separate poison messages from a broken consumer, fix visibility timeout and batch settings, and redrive the DLQ without duplicating work.
Make AWS cost a managed programme rather than a monthly surprise. Cost allocation tags, waste removal, rightsizing with Compute Optimizer, scheduling, storage tiers, then Savings Plans and Reserved Instances at the right coverage, with budgets to keep it there.
Adopt existing AWS resources into Infrastructure as Code without recreating them. Use Terraform import blocks with generated config, CloudFormation resource import or IaC generator, reach a no-change plan and add drift detection.
Replace per-account IAM users and long-lived access keys with IAM Identity Center, federated to your identity provider. Design permission sets, move people account by account, switch the CLI to SSO profiles and delete the old users.
Move EBS volumes from gp2 to gp3 live with Elastic Volumes. Find gp2 volumes across regions, set IOPS and throughput so performance doesn't drop, convert in batches, and update launch templates and IaC so gp2 doesn't come back.
Replatform a web application from EC2 instances to Amazon ECS on Fargate. Containerise, push to ECR, define tasks with secrets and IAM roles, run behind an ALB with autoscaling and shift traffic with weighted target groups.
Plan and run a Graviton migration for better price-performance. Check software compatibility, build multi-arch container images, move managed services first, benchmark, and roll out with mixed-architecture node pools and Auto Scaling groups.
Move HDFS data and Spark/Hive jobs from an on-premises Hadoop cluster to Amazon EMR and S3. Separate storage from compute, copy data with DistCp or DataSync, move the Hive metastore to Glue Data Catalog and run jobs on transient or serverless compute.
Run a wave-based lift-and-shift to EC2 with AWS Application Migration Service. Install replication agents, set launch templates, run test launches, cut over with minimal downtime and finalise, plus the post-migration clean-up most teams forget.
Replace long-lived AWS access keys stored in CI secrets with short-lived role credentials via OpenID Connect. Create the identity provider, write a tight trust policy per repo and environment, update pipelines and delete the keys.
Retire the 'cron box' by moving scheduled jobs to EventBridge Scheduler with Lambda, ECS tasks or Step Functions. Inventory crontabs, choose a target per job, add retries, dead-letter queues and failure alerts the old server never had.
Replace jump boxes and inbound port 22/3389 with AWS Systems Manager Session Manager. Set up instance roles and VPC endpoints, enable session logging, use port forwarding for databases and RDP, and close the old ports.
Move workloads from kops, kubeadm or Rancher clusters on EC2 to Amazon EKS. Build the target cluster with IaC, translate add-ons and IAM, autoscale nodes with Karpenter, migrate namespaces with blue/green and retire the old control plane.
Move databases you run yourself on EC2 into RDS or Aurora. Choose between native dump/restore, native replication and AWS DMS with CDC, prepare parameters and users, rehearse, cut over with a short write freeze and keep a rollback path.
Get EC2 Windows instances off Windows Server 2012 R2 and 2016. Choose between rebuild and in-place upgrade, run the AWS automation runbook that upgrades a copy of the instance, validate and swap, and report on remaining old versions.
Migrate SMB file shares to Amazon FSx for Windows File Server. Size and join FSx to Active Directory, copy data with DataSync while preserving NTFS permissions, cut over with DFS Namespaces and set up backups and shadow copies.
Map each EC2 launch error, from InsufficientInstanceCapacity and VcpuLimitExceeded to instances that terminate straight after pending, to its cause and fix.
Commands and queries to find who changed a security group, IAM role, bucket or instance, from CloudTrail event history to Athena and AWS Config history.
Separate load balancer errors from target errors using CloudWatch metrics and access logs, then fix health checks, keep-alive timeouts and capacity.
How Aurora's shared storage and replicas give fast failover, how to set promotion tiers, which endpoints to use for writes and reads, and how to test failovers safely.
Handle an RDS instance in storage-full state, find what consumed the space, grow the volume and enable storage autoscaling so it doesn't happen again.
Add a secondary region to an Aurora cluster, monitor replication lag, run a planned switchover with no data loss and an unplanned failover with minimal loss, and reconnect applications.
Pick the right AWS disaster recovery strategy per application from RTO, RPO and cost, with the AWS services that implement each one and the failover steps they require.
Use AWS Elastic Disaster Recovery to replicate EC2 or on-premises servers to a DR region, configure launch settings, run non-disruptive drills, perform recovery and fail back.
Centralise human access with IAM Identity Center, design permission sets per role, remove long-lived keys, protect root users and keep an audited emergency access path.
Tell timeouts from throttles using CloudWatch metrics and logs, then fix them with the right timeout, memory, concurrency and VPC settings.
Structure AWS Organizations with Control Tower, decide the OU and account model, apply preventive and detective controls, and vend new accounts consistently.
Centralise audit logs and security findings across all accounts and regions with delegated administrators, then route the findings that matter to the operations team.
Plan non-overlapping CIDRs with IPAM, build multi-AZ VPCs, connect them through Transit Gateway with route table segmentation, and centralise internet egress and DNS.
Use tunnel status, VPN logs and the customer gateway config to fix IKE mismatches, DPD flapping, BGP issues and missing routes.
Enforce a tag schema with tag policies, activate cost allocation tags, set budgets and Cost Anomaly Detection per account, and run a short monthly savings review.
Diagnose CloudFront errors by origin type, fixing S3 Origin Access Control, custom origin TLS and host headers, WAF blocks and stale error caching.
Get memory, disk and log data flowing again by checking the agent status, its config, the IAM role, endpoint access and the namespace you're looking in.
The error message tells you which layer is broken. Here's how to check each one, from security groups and route tables to sshd, keys and EC2 Instance Connect.
Map ECS stopped reasons and exit codes to their causes, including image pulls, secrets, health checks, OOM kills and load balancer health, and fix each one.
Build a production EKS cluster with eksctl, private API access, access entries instead of aws-auth, managed node groups across three AZs, EKS Pod Identity, core add-ons and upgrade hygiene.
Fix nodes that launch but never appear in kubectl get nodes, by checking the node role mapping or access entries, endpoint reachability, bootstrap and the VPC CNI.
Configure replication groups with automatic failover across AZs, choose cluster mode, test failover and make clients reconnect cleanly, with notes on backups and Global Datastore for DR.
Increase an EBS volume online with modify-volume, then grow the partition and filesystem on Linux (ext4, XFS, LVM) and Windows, with a snapshot first.
Node, pod, storage and load balancer settings that keep EKS applications serving through node failures, upgrades and an AZ outage, including EBS volume zoning and Karpenter disruption controls.
Check routes, the NAT gateway's own subnet, NACLs and port allocation errors when private instances can't reach the internet or AWS APIs.
When EBS volumes won't attach, instances won't start or S3 and RDS reads fail with KMS errors, check the key policy, grants, key state and cross-account setup.
Build a self-healing EC2 web tier across three AZs with a launch template, ELB health checks, instance refresh and capacity planning for losing an AZ.
Scan, install and report on OS patches across tagged EC2 fleets with AWS-RunPatchBaseline, and fix the instances that never show up as managed.
Configure a Single-AZ RDS instance properly with storage autoscaling, parameter groups, backups and PITR, encryption, IAM auth, Performance Insights and maintenance windows, and know when to move to Multi-AZ.
Use database load, wait events and top SQL in Performance Insights (or Database Insights) to find what's driving CPU, then fix it or scale.
Compare Multi-AZ DB instance (one standby) with Multi-AZ DB cluster (two readable standbys), understand failover times, test failover and make applications reconnect correctly.
Find the right recovery point, restore EC2, EBS, RDS or S3 data from the console or CLI, and handle the networking and naming issues afterwards.
Configure primary/secondary failover records with health checks, choose TTLs and health check settings, add manual failover control, and test the switch end to end.
Fix names that resolve publicly instead of privately, or not at all, by checking zone-VPC associations, VPC DNS attributes, overlapping zones and Resolver endpoints.
Go through Block Public Access, bucket policy, IAM, object ownership, KMS keys, VPC endpoint policies and SCPs to find which layer denies an S3 request.
Settings every production S3 bucket should have, from account-level Block Public Access and ownership controls to encryption, TLS-only policies, versioning, lifecycle and access logging.
Replicate S3 data to a DR region with CRR, use Replication Time Control for a predictable RPO, backfill existing objects with Batch Replication, and switch applications with Multi-Region Access Points.
Concurrency, timeouts, retries, DLQs, throttling, versions and aliases, observability and backups for a serverless API that runs in one region.
Find out whether you're hitting the volume's limits, the instance's EBS bandwidth or burst credits, then fix it with an online gp3 change.
A checklist for a single production EC2 instance that is secure, patchable, recoverable and monitored, plus the auto-recovery settings that limit downtime from host failures.
Prove where a connection breaks between instances, subnets, peered VPCs or Transit Gateway attachments, using Reachability Analyzer and VPC Flow Logs instead of guesswork.
A failed system check is AWS's problem and an instance check is yours. Here's how to tell them apart and recover each one.
Find out who is calling, which policy layer denied the call and why, using STS, CloudTrail, the policy simulator and encoded-message decoding.
No posts in this category yet.