标签：#aws

AWS has released aws-bench, an open-source benchmark for evaluating AI agents on real AWS tasks such as misconfigurations and infrastructure provisioning. Unlike traditional benchmarks, it uses real resources in disposable AWS accounts, scoring agent performance through automated verifiers. By Gianmarco Nalin

When I became an AWS Community Builder, one of the things I was most excited about was getting the opportunity to experiment with AWS. Let me Introduce .... eventinary.com A Completly free event management software Like most developers, I had a long list of things I wanted to build. AI applications, serverless projects, agents, APIs — there was no shortage of ideas. The AWS credits made it easier to experiment without constantly thinking about the cost of every service I turned on. But after a while, I started asking myself a different question. What if I used those credits to build something that could actually give back to the community? That question eventually led me to Eventinary . I've always enjoyed technical meetups and community events. A meetup may only have a few dozen people in a room, but something interesting happens there. Someone learns about a technology for the first time. Someone meets another developer. Someone gets inspired to build something. Someone gives their first technical talk. The event may last only a few hours, but the impact can last much longer. Then I started looking at what happens behind the scenes. Organizers have to create the event, manage registrations and RSVPs, keep track of attendees, coordinate speakers, prepare schedules, communicate updates, and somehow keep everything organized. For larger events, the number of tools and spreadsheets can grow quickly. I thought, why not build a platform that makes this easier? That became Eventinary. At first, it was just another idea. Then I started building it. As the platform grew, I realized I didn't want to build another simple invitation or RSVP website. I wanted to create a proper digital event platform that could support the entire event experience. Today, Eventinary can help organizers with things like: Event creation and digital event pages RSVP and attendee registration Speaker and session management Event schedules and itineraries Guest and attendee management Event informat

Logitech increased prices by up to 25 percent last year.

Most developers assume running a real web platform on AWS costs a fortune. Mine doesn't. HomeServerLab — a free AWS learning platform with an AI assistant, tutorials, OAuth login, and an Apps Marketplace — runs for less than $1/month in infrastructure costs. Here's exactly how. The stack and what it costs AWS Lambda Every route on the site is handled by a single Lambda function written in Python. No EC2, no always-on server, no idle costs. Lambda charges per invocation and per GB-second of compute — at my traffic levels, it stays well within the free tier and costs virtually nothing beyond it. API Gateway HTTP API The entry point for all requests. HTTP API is significantly cheaper than REST API on AWS — $1 per million requests. At my current traffic, this rounds to zero. DynamoDB Handles rate limiting, user sessions, chat history (with TTL), and OAuth state. On-demand pricing means I pay per read/write, not for provisioned capacity. Again, within free tier at my scale. Amazon Bedrock (Nova Micro) Powers the built-in AI assistant. Nova Micro is one of the cheapest foundation models available on Bedrock — and with a 25 messages/day rate limit per user, costs stay negligible. Cloudflare (Free plan) Sits in front of everything: DNS and proxying, CDN and caching (reduces Lambda invocations), WAF and bot protection, DDoS mitigation, and Cloudflare R2 for the Apps Marketplace (10GB free tier). All of this on the free plan — $0/month. CloudFront (Free tier) Sits between Cloudflare and Lambda as an additional layer. 1TB of data transfer and 10 million requests/month free. More than enough. The real cost The only real cost is Bedrock — and even that is minimal with rate limiting in place. Everything else stays within free tiers at my traffic levels. Total: less than $1/month. The key insight Serverless means you pay for what you use, not for what you reserve. Combined with Cloudflare's free plan absorbing most of the traffic before it even hits AWS, the actual billable usage

The lawsuit alleges that Oura rings are unable to measure any of the physiological signals needed to assess sleep quality or determine sleep stages.

I recently worked through a hands-on Amazon S3 practical series covering the features I would actually expect to use while working with AWS storage. Instead of only documenting definitions, this post focuses on what I configured, the commands I used, how I verified the behavior, and what I observed when something went wrong . For the concepts behind these practicals, I have already covered S3 in two detailed sessions: Session 1: AWS S3 Deep Dive — Objects, Encryption, Bucket Policies & Everything In Between Session 2: AWS S3 — Versioning, Static Hosting, CORS, Object Lock & More This post is the practical companion to those two sessions. The concepts are covered there; here I focus on actually building, testing, verifying, and troubleshooting the S3 features. The labs covered: S3 bucket configuration and lifecycle management Bucket policies with IAM, EC2 and HTTPS-only access SSE-KMS encryption with CloudTrail verification Pre-signed URLs AWS CLI s3 sync S3 Versioning and version recovery Static website hosting S3 CORS S3 Object Lock Note: This is a practical write-up, so I have intentionally kept the focus on implementation and verification rather than turning it into a generic S3 theory article. 1. S3 Bucket Configuration and Lifecycle Management Objective Create an S3 bucket with a secure baseline and configure a lifecycle rule that automatically transitions objects to lower-cost storage classes over time. Configuration For the lab: Block Public Access remained enabled. Bucket Versioning was enabled. Lifecycle rule: s3-lab-lifecycle The rule applied to all objects. Current objects transition to: Standard-IA after 30 days Glacier Flexible Retrieval after 90 days The lifecycle flow was: Day 0 ↓ Object uploaded ↓ Day 30 → Standard-IA ↓ Day 90 → Glacier Flexible Retrieval Result The lifecycle rule was successfully created and enabled, and the S3 console confirmed the configured transition periods. What this demonstrates Instead of manually moving old objects, S3 Life

Serverless on AWS isn't "just use Lambda." It's a design philosophy: let AWS manage the infrastructure, pay only for what you use, and build with managed services that scale independently. But the patterns that work in serverless are fundamentally different from traditional architectures — and the anti-patterns are expensive to learn the hard way. This guide covers the patterns that work in production, the anti-patterns that waste money or cause outages, and the decision framework for when serverless is the right (or wrong) choice. The Serverless Building Blocks ┌─────────────────────────────────────────────────────────────────────┐ │ AWS SERVERLESS STACK │ ├─────────────────────────────────────────────────────────────────────┤ │ COMPUTE │ Lambda | Fargate (serverless containers) │ │ API │ API Gateway (REST/HTTP/WebSocket) | AppSync (GraphQL)│ │ ORCHESTRATION │ Step Functions | EventBridge Scheduler │ │ MESSAGING │ SQS | SNS | EventBridge │ │ STORAGE │ S3 | DynamoDB | Aurora Serverless │ │ STREAMING │ Kinesis | DynamoDB Streams | MSK Serverless │ │ AUTH │ Cognito | IAM | Lambda Authorizers │ │ OBSERVABILITY │ CloudWatch | X-Ray | Application Signals │ └─────────────────────────────────────────────────────────────────────┘ Key principle: In serverless, you compose applications from managed services. Lambda is the glue between them — not the application itself. Pattern 1: Synchronous API (Request/Response) The most common serverless pattern: HTTP API backed by Lambda. Client → API Gateway → Lambda → DynamoDB / Aurora Serverless │ Response ← ─ ─ ─ ─ ─ ─ ┘ Best Practices API Gateway HTTP API (not REST API) — cheaper, faster, simpler for most cases One Lambda per route (single responsibility) — not a monolith Lambda Keep Lambda warm — use Provisioned Concurrency for latency-sensitive endpoints DynamoDB for simple access patterns — scales with traffic, no connection pooling Aurora Serverless v2 for complex queries — but use RDS Proxy to manage connections When to Choose H

Security researchers at Wiz recently examined S3-compatible object storage services across six popular neoclouds, revealing significant security gaps compared to Amazon S3. While S3 has become the de facto standard for object storage, most services lack several of AWS's security protections. By Renato Losio

An e-commerce alert is not complete when an API accepts a message. It is complete when the application records a terminal delivery state, suppresses an invalid recipient, or escalates through a separately governed channel. Short answer: use a dedicated SMS API for a small critical-alert worker when template ownership and direct status control matter; keep AWS SNS when SMS belongs inside an existing cloud messaging stack, and prefer a callback-capable provider when escalation must begin in under a minute. That choice creates work. A direct API keeps the send path narrow, but polling, retries, dead-letter handling, and country-specific fallback rules remain application responsibilities. For critical alerts, those responsibilities need the same idempotency and audit discipline as a ledger entry: one intent, one durable identifier, and an append-only record of every state observation. No provider turns carrier delivery into exactly-once delivery. Implement the template control plane in Node.js Start with the contract, not the vendor. The application owns an immutable alert intent containing the business event ID, recipient, template version, jurisdiction, and escalation deadline. Template ownership is the decision axis: if compliance reviewers must approve and reproduce the exact text that was sent, keep the canonical template version in the application and treat a provider template ID as deployment metadata. If a provider must own localization or regulatory registration, record that provider template ID beside the application version rather than letting it become invisible configuration. A useful state machine separates accepted from a terminal delivery result. Persist the provider message ID after the initial send, schedule periodic status reads, and append each observation with its timestamp and request ID. A retry after HTTP 429 is transport recovery, not permission to create a second alert; honor Retry-After , use exponential backoff, and preserve the same idempote

Short version: An Application or Network Load Balancer costs ~$0.0225/hour, about $16/month, just to exist , plus capacity units. Classic Load Balancers run ~$18/month. Load balancers outlive the services behind them: the app gets torn down, the ALB keeps billing. Here's how to find load balancers with no real traffic or no healthy targets, and remove them safely. Why idle load balancers linger The hourly base charge is fixed - an ALB with zero requests bills the same ~$16/month as a busy one. Load balancers are usually created early (with an app or an IaC module) and deleted last, if ever. A handful of abandoned ALBs from old environments is real, recurring money. Step 1 - List load balancers and their traffic aws elbv2 describe-load-balancers \ --query 'LoadBalancers[].{Name:LoadBalancerName,Type:Type,ARN:LoadBalancerArn}' \ --output table For an ALB, check request volume over the last 7 days (the metric dimension is the tail of the ARN, e.g. app/my-alb/50dc6c495c0c9188 ): aws cloudwatch get-metric-statistics \ --namespace AWS/ApplicationELB \ --metric-name RequestCount \ --dimensions Name = LoadBalancer,Value = app/my-alb/50dc6c495c0c9188 \ --start-time " $( date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ ) " \ --end-time " $( date -u +%Y-%m-%dT%H:%M:%SZ ) " \ --period 86400 --statistics Sum \ --query 'Datapoints[].Sum' Near-zero request counts over a week is a strong idle signal. (For NLBs, use the AWS/NetworkELB namespace and ActiveFlowCount .) Step 2 - Check for empty or unhealthy target groups A load balancer with no healthy targets is doing nothing useful: for tg in $( aws elbv2 describe-target-groups \ --load-balancer-arn <lb-arn> \ --query 'TargetGroups[].TargetGroupArn' --output text ) ; do echo "== $tg ==" aws elbv2 describe-target-health --target-group-arn " $tg " \ --query 'TargetHealthDescriptions[].TargetHealth.State' --output text done Empty output (no targets) or all unhealthy alongside near-zero requests is a confident "delete me." Step 3 - Delete saf

En el post anterior exploramos qué es un Data Lake y por qué son tan importantes en el ecosistema de datos actual. Ahora es momento de ensuciarnos las manos y ver exactamente qué servicios de AWS necesitamos para construir un Data Lake completamente serverless y cómo orquestarlos. Los Servicios Fundamentales Un Data Lake serverless en AWS se construye sobre cinco pilares fundamentales que trabajan en conjunto para crear una solución escalable y costo-eficiente: Storage Procesamiento Catalogo Seguridad Explotación Amazon S3 - El Corazón del Storage S3 no es solo nuestro sistema de archivos, es la piedra angular del Data Lake. Aquí almacenamos tanto los datos crudos como los procesados, y su organización es crucial para el rendimiento y los costos. Estructura de carpetas de un data lake estandar: data-lake-bucket/ ├── raw/ # Datos sin procesar │ ├── year=2024/ │ ├── month=12/ │ └── day=15/ ├── processed/ # Datos transformados │ ├── bronze/ # Limpieza básica │ ├── year=2024/ │ ├── month=12/ │ └── day=15/ │ ├── silver/ # Transformaciones de negocio │ ├── year=2024/ │ ├── month=12/ │ └── day=15/ │ └── gold/ # Datos listos para consumo │ ├── year=2024/ │ ├── month=12/ │ └── day=15/ └── athena-results/ # Resultados de queries Notarás que todo el data lake se encuentra en un mismo bucket, esto es lo más recomendable ya que S3 tiene un límite de 100 bucket que podemos crear por cuenta (no importa la región, ya que S3 es un servicio global) Configuraciones clave en S3: Versionado habilitado para auditoría y rollback Lifecycle policies para optimizar costos (Standard → IA → Glacier) Server-side encryption con KMS para seguridad si es necesario. Cross-region replication para disaster recovery AWS Glue - El Motor de Transformación Glue es suite de servicios de data serverless que maneja tanto el descubrimiento de esquemas como las transformaciones de datos. Componentes principales: Glue Jobs : Herramienta predilecta para ejecutar ETLs, nos permite procesar y transformar los dato

Cross-posted from the Runsite blog . You put a few hundred gigabytes of images on object storage, glance at the pricing page, and the numbers look friendly: storage is a couple of dollars a month, basically a rounding error. Then the first real invoice arrives and it's a hundred and something. Nothing about how much you're storing changed. The line that blew up isn't storage at all. It's egress — the charge for data leaving the bucket — and it's the part of the bill nobody shops on. Why the storage bill blows up after the first invoice The pricing page wasn't lying to you. Object storage genuinely is cheap to sit on. On AWS S3 , standard storage runs about $0.023 per GB per month at the time of writing, so a hundred gigabytes of assets costs you around two dollars and change to keep. That's the number you compare when you're choosing where to put your files. The number you don't compare is egress: the fee for moving data out of the provider's network. It doesn't show up when you upload, and it doesn't show up while the files just sit there. It shows up every time someone downloads something — roughly $0.09 per GB to the internet once you're past a small free allowance (about the first 100 GB a month on AWS). Individually those are tiny fractions of a cent. The trouble is you're not billed once. You're billed per download, and a popular file gets downloaded a lot. Where egress hides Egress is data transfer out: every byte that leaves the provider's network. The reason it surprises people is that it isn't a single line you can point at. It's a multiplier that quietly attaches itself to things you'd never think of as "downloading": Serving assets to users. Every image, video, PDF, or download your app hands to a visitor is egress. One 4 MB hero image on a page that gets a million views a month is four terabytes of transfer out, from a single file. CDN origin pulls. Putting a CDN in front of your bucket helps, but it isn't free. Every cache miss means the CDN fetches th

I got an AWS question and implemented it to make sure that the option is correct. A critical financial application runs on RDS for PostgreSQL. The requirements are tight: 1-second RPO, 60-second RTO, and database credentials rotated every 30 days without taking the application offline. Two independent problems. Two independent solutions. Prerequisites Check these before running terraform apply : RDS Proxy availability RDS Proxy is not available on all instance types. It requires instances with at least 2 vCPUs. db.t3.micro is not supported. db.t3.medium and above work. Terraform executor permissions The IAM principal running Terraform needs, at minimum: rds:CreateDBInstance rds:CreateDBProxy rds:CreateDBProxyTargetGroup rds:RegisterDBProxyTargets rds:ModifyDBInstance iam:CreateRole iam:AttachRolePolicy iam:PutRolePolicy iam:PassRole secretsmanager:CreateSecret secretsmanager:PutSecretValue secretsmanager:RotateSecret lambda:CreateFunction lambda:AddPermission ec2:CreateSecurityGroup ec2:AuthorizeSecurityGroupIngress ec2:CreateDBSubnetGroup AdministratorAccess on the account covers all of these. Lock it down after the initial setup. VPC requirements RDS Proxy runs inside your VPC. You need at least two private subnets in different Availability Zones. The rotation Lambda also runs inside the VPC so it can reach the RDS instance directly during the credential update step. The problem Database failure recovery RPO of 1 second means almost no data loss is acceptable. RTO of 60 seconds means the application must resume within a minute of a failure. A standard single-instance RDS setup fails both requirements: there is no automatic failover, and restoring from a backup takes far longer than 60 seconds. Credential rotation Rotating credentials on a schedule sounds simple until you factor in application downtime. If you update a password and the application still holds connections authenticated with the old one, those connections fail. The rotation mechanism needs to handle

Introduction I did something stupid. I built a superhero-themed Nuxt app, connected it to an Anthropic model through Amazon Bedrock , and gave it a tool that deletes files from my computer. In fact, if I wasn't careful, it could have deleted all my files! The first time I tried it, I didn't use any sort of approval mechanism. And as you expected it just deleted things. Then I looked into how my coding agent works, and I learned about tool approvals. I learned that AI SDK 7 has a tool approval at the model-call level. It works by pausing for an approval, showing an approval window, and then deleting it. I then put Kiro CLI behind the same interface using Agent Client Protocol (ACP). Watch the full video on YouTube . Prerequisites You need: Node.js 22 or later. AI SDK 7 requires Node.js 22 and uses ECMAScript modules (ESM). npm 11 or another package manager that works with Nuxt 4. AWS credentials available through the standard provider chain. Access to an Amazon Bedrock model in your AWS Region. The AWS CLI if you want to list the inference profiles available to your account. An authenticated Kiro CLI installation for the optional ACP section. Step 1: Create the Nuxt app Create the project and install the versions used in the recorded demo: npx nuxi@latest init nuxt-agent-approval cd nuxt-agent-approval npm install \ nuxt@4.5.2 \ vue@3.5.41 \ ai@7.0.66 \ @ai-sdk/vue@4.0.66 \ @ai-sdk/amazon-bedrock@5.0.57 \ @aws-sdk/credential-providers@3.1111.0 \ @nuxt/ui@4.10.0 \ zod@4.4.3 npm install -D @iconify-json/lucide@1.2.123 Register Nuxt UI and expose the Amazon Bedrock settings through server-side runtime config: // nuxt.config.ts export default defineNuxtConfig ({ modules : [ ' @nuxt/ui ' ], css : [ ' ~/assets/css/main.css ' ], runtimeConfig : { awsRegion : process . env . AWS_REGION ?? ' us-west-2 ' , bedrockModelId : process . env . NUXT_BEDROCK_MODEL_ID } }) Add the two Nuxt UI imports: /* app/assets/css/main.css */ @import "tailwindcss" ; @import "@nuxt/ui" ; You can c

By: Pierre Le Clezio, Lead Product Manager – GitGuardian; Nic Gumina, Senior Security Consultant – AWS; Manu Chandrasekhar, Senior DevOps Consultant – AWS; Dan Parlin, Security Consultant – AWS This article was originally published at AWS blogs . The rise of AI coding assistants and Model Context Protocol (MCP) servers has accelerated the secret management challenge as developers increasingly share configuration files and context with AI tools that inadvertently expose sensitive credentials. API keys, access tokens, and credentials end up in Git repositories and CI/CD logs. Organizations lack answers to critical questions. They don't know which vaulted secrets have been exposed in code, whether developers have shared credentials through AI tool configurations, how many duplicate credentials exist across accounts, or how many orphaned secrets remain that no application uses. The visibility gap leads to: Credential exposure : Hardcoded secrets in version control systems create attack vectors that persist even after rotation Secret sprawl : Duplicate credentials across accounts expand your attack surface Compliance gaps : Inability to track secret lifecycles undermines audit requirements Remediation delays : Without correlation between secret inventory and code exposure, security teams lack the context to prioritize and act quickly With multi-account AWS architectures, the need for unified visibility becomes critical. Organizations need more than just a vault. They need visibility across the entire secret lifecycle, from developer workstations to production environments. GitGuardian and AWS Secrets Manager GitGuardian is an AWS Partner specializing in non-human identity (NHI) security, which focuses on protecting machine credentials such as API keys, service accounts, tokens, and secrets management. GitGuardian can be integrated with code repositories, container registries, package registries, documentation platforms, and messaging channels. GitGuardian's integration w

✓ Human-authored analysis; AI used for formatting and proofreading. Kelsey Hightower gave a talk at PlatformCon 2026 that was about the arc of a career, from running commands in SharePoint to writing Go tools that play music on your terminal. The stories has an architecture principle that applies to how security verification should work. Solve the problem once, encode the solution as a reusable artifact, and never solve that problem again. The Jira loop He joined a company where deployments were driven by Jira tickets. Someone opens a ticket with deployment parameters. An engineer would read the ticket, copy the parameters, run the commands, paste the output back into the ticket, close it, and wait for the next one. Every hour, another ticket. Same process, commands and manual steps. The engineer became the loop. He wrote a Puppet manifest that watches the tickets, extracts the parameters, runs the deployment, posts the output, and closes the ticket. The loop ran once as automation and then it was over. No engineer in the loop or ticket waiting for a human. The problem was solved, permanently, by encoding the solution into a reusable artifact. Doing a repetitive manual process faster is not the right thing to do. Eliminate the loop by recognizing the abstraction hiding in the repetition and encoding it into an artifact that makes the manual steps unnecessary. The substrate This is the pattern that runs through every transition he describes. It's missed by most people when they talk about automation. System administrators ran deploy.sh manually. Docker didn't automate typing apt-get install . Docker recognized that "application + dependencies + environment" was a repeatable unit. The container image became the substrate. Deployment stopped being a sequence of commands and became a declaration. The commands didn't get faster. They became unnecessary. Operators placed workloads on servers manually. Kubernetes didn't automate SSH-ing into machines to check available mem

This tutorial walks through building an MCP server in Rust with rmcp , the official Model Context Protocol Rust SDK. The example is a real one: a devops agent that manages AWS EC2 G5g instances — Graviton2 boxes with NVIDIA T4G GPUs — serving Gemma 4 under vLLM. It launches instances, drives them over SSM, and health-checks the model. There's an existing Python version, so at the end we can put the two side by side. Follow along and you'll have a working, registerable MCP server. 🦀 Why Rust for this? Worth answering properly, because the weak version of the argument is easy to make and easy to demolish — and the real one is better anyway. Start with what it isn't: these tools are I/O bound. Every one is an AWS API call — describe_instances , send_command , polling SSM — so 100–500 ms of network per call. The caller's language contributes nothing measurable there. Anyone selling you a Rust rewrite on raw speed for this workload is selling something. Three claims that don't hold, so nobody has to make them in the comments: Claim Why it fails "462 ms startup is slow" stdio servers spawn once per session , not per call "Rust is faster" the work is network round-trips to AWS "smaller supply chain" 241 crates vs 34 Python packages — it's worse What actually justifies it, for this codebase: 1. It's a fleet, not a server. This monorepo has 16 rigs , each with its own MCP server. That changes the units: All loaded together 🐍 Python 🦀 Rust Resident memory 16 × 83 MB ≈ 1.33 GB 16 × 12 MB ≈ 192 MB Session startup 16 × 462 ms ≈ 7.4 s 16 × 2.5 ms ≈ 40 ms A gigabyte of resident Python to expose sixteen tool lists is a real cost. 2. No shared interpreter. These rigs install system-wide — no virtualenvs, by policy — so all sixteen share one Python. Sixteen servers with independently drifting boto3 and mcp pins in one interpreter is a standing conflict risk. A static binary has no such coupling; each rig pins whatever it likes in its own Cargo.lock . 3. The schema can't drift from th

This tutorial walks through building an MCP server in Rust with rmcp , the official Model Context Protocol Rust SDK. The example is a real one: a devops agent that manages AWS EC2 G5g instances — Graviton2 boxes with NVIDIA T4G GPUs — serving Gemma 4 under vLLM. It launches instances, drives them over SSM, and health-checks the model. There's an existing Python version, so at the end we can put the two side by side. Follow along and you'll have a working, registerable MCP server. 🦀 Why Rust for this? Worth answering properly, because the weak version of the argument is easy to make and easy to demolish — and the real one is better anyway. Start with what it isn't: these tools are I/O bound. Every one is an AWS API call — describe_instances , send_command , polling SSM — so 100–500 ms of network per call. The caller's language contributes nothing measurable there. Anyone selling you a Rust rewrite on raw speed for this workload is selling something. Three claims that don't hold, so nobody has to make them in the comments: Claim Why it fails "462 ms startup is slow" stdio servers spawn once per session , not per call "Rust is faster" the work is network round-trips to AWS "smaller supply chain" 241 crates vs 34 Python packages — it's worse What actually justifies it, for this codebase: 1. It's a fleet, not a server. This monorepo has 16 rigs , each with its own MCP server. That changes the units: All loaded together 🐍 Python 🦀 Rust Resident memory 16 × 83 MB ≈ 1.33 GB 16 × 12 MB ≈ 192 MB Session startup 16 × 462 ms ≈ 7.4 s 16 × 2.5 ms ≈ 40 ms A gigabyte of resident Python to expose sixteen tool lists is a real cost. 2. No shared interpreter. These rigs install system-wide — no virtualenvs, by policy — so all sixteen share one Python. Sixteen servers with independently drifting boto3 and mcp pins in one interpreter is a standing conflict risk. A static binary has no such coupling; each rig pins whatever it likes in its own Cargo.lock . 3. The schema can't drift from th

Today I did something I've wanted to do for a while — I took an app running on my own laptop and put it "live" on the internet using AWS. It sounds scary when you read about it online, but once I actually did it, it was just a bunch of small, simple steps, one after another. This post is me writing down everything I did, in plain, easy words, so that if you're a beginner like me, you can follow along without getting confused by fancy tech terms. What is AWS, in simple words? AWS (Amazon Web Services) is basically Amazon renting out computers over the internet. Instead of buying your own physical server and keeping it running 24/7 at home, you "rent" a computer from Amazon. That computer runs your app, and anyone with the internet can visit it. The specific service I used is called EC2 . Think of EC2 as one virtual computer that lives in Amazon's data center, and you get to control it like it's your own. Step 1: Set up IAM first Before touching any servers, I went to IAM (Identity and Access Management). This is AWS's way of managing "who is allowed to do what" in your account. In simple words: instead of using your main AWS login for everything (which is risky), IAM lets you create a separate user with its own permissions. It's like giving someone a spare key instead of your master key. I set this up first so my account stays safer. Step 2: Launch an EC2 instance Next, I went to the EC2 section and launched a new instance (a fancy word for "a virtual computer"). During this step, AWS also lets you create a .pem file — this is basically a secret key file. It's like a digital key to a lock. Only someone with this file can get into the server. I downloaded it and kept it safe, because if you lose it, you can't easily get back in. Step 3: Login to the server using SSH Once the server (EC2 instance) was ready, I needed a way to "log in" to it from my own laptop. For that, I used something called SSH, along with the .pem key file I downloaded earlier. In simple words: SSH

Built 2026-08-15 against us.amazon.nova-lite-v1:0 via the Bedrock Converse API. FastAPI on Python 3.13, deployed to an Amazon Lightsail container service ( nano , scale 1) in us-east-1 . Scored against the live deployment, not localhost: 20/20 on the fixture set, median 880 ms per scan. Live: Dog or Not: Lite · Source: github.com/xbill9/dog-or-not-lite · Built for the AWS Weekend Challenge: Build a Creative App . TL;DR Make the model fill in a schema instead of writing a sentence. The Converse API's toolConfig plus toolChoice forces a named function call, so is_dog arrives as a boolean because it was declared as one. Every image comes back in the same shape — including the ambiguous ones, which is exactly where free-text output gets creative and a string-matching parser gets it wrong. The app is a webcam scanner that tells you whether the thing you are holding up is a dog. One HTML page, one POST /api/scan , one model call, no build step, no framework. The whole backend is 285 lines. Three AWS specifics are worth the price of admission: Lightsail container services have no IAM task role. There is nothing to attach a policy to, so the container needs a real access key as an environment variable. The mitigation is scope, not secrecy. A cross-region inference profile is authorized against every region it routes to. With the policy pinned to us-east-1 , a call made to us-east-1 was denied naming us-west-2 . Measured, not inferred. --platform linux/amd64 is not optional. An arm64 image builds, pushes and deploys cleanly, then crash-loops with an exec format error that never mentions architecture. And a mock mode that answers every scan locally is what made the frontend free to build — no credentials, no model access, no bill. 1. The shape: one route, one call The classification rule is the only opinionated part. is_dog is true only for a living domestic dog: a wolf is not a dog , nor is a coyote, fox, plush toy, bronze statue, cartoon, or person in a costume. That is a c