By default, user-defined tags on an AWS ECS Service are not propagated to its Tasks, which can impact cost allocation. This can be fixed by setting the propagate_tags parameter.

When using DuckDB with AWS SSO, credential errors can occur when accessing S3. A shell function that wraps duckdb with aws configure export-credentials provides a seamless workaround.

Use a combination of AWS CLI commands like get-shard-iterator and get-records to fetch raw, Base64-encoded data from a Kinesis Data Stream for debugging.

When Amazon Data Firehose uses a Lambda for transformation, high data volume can exceed the AWS Lambda concurrent execution limit, causing processing delays. The most effective solution is to increase Firehose’s buffer size to reduce the number of Lambda invocations.

CloudFront has an undocumented burst limit on invalidation requests that can cause “Rate exceeded” errors even under normal usage.

Amazon ECS Exec lets you securely interact with your running ECS containers (get a shell or run single commands) using SSM Session Manager.

Crypteia is an AWS Lambda extension for any runtime to preload SSM Parameters as secure environment variables at function startup.

iamlive can automatically generate least privilege IAM policies based on the permissions used during Terraform execution.

Legacy CloudFront Standard Logs (a.k.a access logs) are based on W3C Extended Log File format. These logs can be parsed into JSON format using a Python script.

Terraform 1.11 introduces S3-native state locking, eliminating the need for DynamoDB-based locks.

Use S3 Gateway VPC Endpoints to reduce network costs when pulling private ECR images in ECS Fargate tasks deployed in private subnets.

CloudWatch Logs Insights can automatically parse JSON in the @message field.