ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Cloud & infrastructure · #aws
Amazon S3 Block Public Access (BPA) provides a centralized control to prevent the accidental exposure of data by overriding bucket policies and Access Control Lists (ACLs). This feature operates at both the account level and the individual bucket level, utilizing four distinct settings: BlockPublicAcls , IgnorePublicAcls , BlockPublicPolicy , and RestrictPub
Use the actual caller, bucket and operation to separate missing allows from explicit denies, endpoint restrictions and KMS access.
A performance change should improve the measured workload without sacrificing correctness or wasting capacity. Which measurements and bottlenecks should be considered first?
<h2>Symptom</h2> <p>When an Amazon EC2 T2, T3, or T4g instance shows CPUCreditBalance near zero during peak hours while CPUUtilization stays at the instance baseline, the goal is to determine whether the workload is being throttled to baseline CPU performance because credits are exhausted, and whether that pattern justifies resizing to a fi
A fictional application reads most objects under an allowed prefix. A newer object returns AccessDenied. The newer object uses a different customer-managed KMS key. The bucket policy appears unchanged. Which evidence would distinguish S3 access from encryption-key access?
The same intended role can read an object from an approved diagnostic session, while a service running through an S3 VPC endpoint receives 403. The team has checked the role and bucket policy but has not reviewed the endpoint policy. How should the differing request paths be compared?
Goal Determine how AWS Lambda behaves when a function’s reserved concurrency setting exceeds the account‑level concurrency limit. Constraints Default account limit is 1,000 concurrent executions (can be increased via support). Maximum reserved concurrency per function is 1,000. Reserved concurrency is persistent across deployments and does not trigger automa
Configuration must be available to the application without exposing credentials in source control, logs or browser code. What belongs in the runtime and which access controls matter?
Symptom When using CodeDeploy blue/green deployments with an Application Load Balancer, traffic shifts from the original fleet to the replacement fleet after the BeforeAllowTraffic lifecycle hook completes. The deployment then enters a configurable termination wait period (default five minutes, maximum one hour) before the original instances are terminated.