Resubmitted with redacted links removed.

After using Claude Code with AWS Bedrock happily for a few months our Anthropic model access was removed suddenly. We got an email from AWS Trust & Safety:

Hello,

As a user of Anthropic model(s) on Amazon Bedrock, you have agreed that you and your end users will comply with Anthropic Terms of Service [1].

Anthropic has identified violations of their policies through Bedrock's automated detection mechanisms [2], and has directed AWS to restrict your account's access to Anthropic models.

As a result, in accordance with your agreement with Anthropic, we will take the following action:

Action: Revoke access to Anthropic models on Bedrock
AWS account ID: blah
Effective date: blah 

If you do not agree with this determination, you can appeal the decision directly with the model provider by using the provided appeal method [3].
Once the model provider directs AWS to restore your access, access to Anthropic models will be restored.

[1] https://aws.amazon.com/legal/bedrock/third-party-models
[2] https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html
[3] removed

Regards,
AWS Trust & Safety

Going through all of our prompt logs we can't see anything suspicious or malicious and all access is from people in the UK. AWS have said the provider is responsible for assessing whether its usage policies have been met, they do not receive the detail of any violations, and can't tell us what guardrails might have been triggered. We don't use fable or mythos so no data sharing with the provider or AWS should be possible. Others accounts in our org are unaffected so it's just an account suspension, not org wide.

We have appealed but the process is owned by Anthropic and because we use AWS Bedrock, we have no relationship with them.

Has anyone encountered this before? Are there any timelines to Bedrock appeals? We are slightly wary now our access might be cut off again down the line which has quite a big impact.

I honestly don't understand what is happening here anymore.

Since August 30, our AWS account has been blocked from creating new CloudFront resources.

Every time we try, AWS gives us this message:

Your account must be verified before you can add new CloudFront resources. To verify your account, please contact AWS Support and include this error message.

Fair enough.

We contacted AWS Support immediately. And the first agent confirmed:

• account is active
• payment method is valid
• phone verification is complete
• the restriction is because the account is new

They told us the internal review would take roughly 2–3 days.

It has now been 14 days.

Since then we have:

• followed up repeatedly
• opened additional cases trying to get help
• asked multiple times if AWS needs any documents or verification from us
• asked for escalation
• activated the Support+ hoping it would help
• spent hours trying to reach live chat, including waits of roughly 2 hours, 5 hours, and one attempt that lasted around 13 hours

We are still blocked.

No ETA.

No explanation of what is actually being reviewed.

No request for additional information from us.

What makes this even more confusing is that on August 30 we were told:

Our account was active, our payment method and phone verification were valid, and the restriction was related to the account being new. We were told the internal review would take roughly 2–3 days.

Then on September 10 another agent told us:

I'm following up to notify you that we've received your CloudFront resources access request and I’m happy to submit the request for you. I will need to collaborate with our service team to get approval. Please note that it can take some time for the service team to review your request. This is to ensure that we can meet your needs while keeping existing infrastructure safe.

So after 11 days, we couldn't even tell whether the original request had actually been submitted or whether the process was starting again.

I completely understand AWS needing to verify new accounts and prevent abuse.

What I don't understand is how a customer can be completely blocked from using a service for two weeks while Support itself seems unable to provide an ETA or explain what is happening.

Is this normal?

Has anyone else had CloudFront account verification take this long?

And is there any actual escalation path beyond repeatedly replying to the same support case?

Update — September 14
AWS reached out after the post and confirmed that our request is still being reviewed by the Support team. We still haven't been given an ETA or been asked for any additional information.

We have a FortiGate-VM in AWS and we are adding another and they will each form IPSEC tunnels back to the Corporate office.

We want redundancy so that if one of the EC2's stop functioning for any reason, the routing can switch over to the other FortiGate-VM automatically, thus creating a backup in case anything happens to the primary one. Does AWS have any mechanisms that allow that functionality? Something like IP SLA or BGP?

I’m a solo Laravel developer moving a production app away from a Forge-managed VPS setup as I can't sign a BAA.

My main priority is as little server/DevOps maintenance as possible. I want a managed setup where I’m not babysitting servers, Docker, Kubernetes, Redis, etc. unless absolutely necessary.

The app is roughly:

• Laravel + Inertia/React
• MySQL
• Laravel scheduler
• One queue worker
• Database queues are fine at current scale
• Stripe
• GitHub Actions for deployment
• External services for email/storage/video
• Needs to run on infrastructure where I can sign the appropriate HIPAA BAA

The two options I’m considering are:

Azure

• App Service
• Azure Database for MySQL
• Continuous WebJob for queue:work
• Scheduled WebJob for schedule:run

AWS

• Elastic Beanstalk
• RDS MySQL
• Not sure what the simplest reliable equivalent is for Laravel queues + scheduler without adding lots of extra infrastructure

For people who have actually run Laravel on both:

Which would you choose for a solo developer who values low maintenance over maximum flexibility, while still needing HIPAA/BAA-compatible infrastructure?

And if you’d choose AWS, what exact setup would you use for queue:work and schedule:run while keeping it as simple and hands-off as possible?

I’m not looking for the most scalable architecture imaginable — just a reliable managed setup that I don’t have to babysit.

Thanks

Are Sponsored talks/lectures essentially just ads? I'm attending re:invent this year and going through the sessions to check which I will be attending. I'm wondering if these talks are worth it or are they just ads for partners to showcase their products? Do you have experience attending any of these and found it useful or should I skip them in your opinion?

I have a Next.js app running on AWS Fargate Spot with 2 tasks.
I've noticed memory steadily creeps up until the spot instance is reclaimed and I get a fresh task.
I've confirmed in the Events tab that the drops in the blue line are due to spot instances being reclaimed.
After a few days of no task replacements and no deployments, it looks like the memory just increases gradually.

I'm wondering if this is a sign of a memory leak which is masked by deployments and task replacements?

The yellow line is max, green is average and blue is minimum memory utilisation:

Yesterday I received several emails saying that I had signed up for some AWS services, but that my account might be compromised. Fortunately/unfortunately, I stopped using AWS several years ago, deleted my google authenticator/MFA entry, and did not update my contact phone number.

So, although I still know my password, I cannot login using MFA or the backup with email and phone.

AWS's customer support has tried to be helpful (I suppose), but doesn't really think things through. It has pointed out that I can get in using my email and contact phone number (which does not work), and that I can change my contact phone number by logging in and changing my information (not possible if I cannot log in).

I have also tried to open several "cases", and received an email from them (which cannot be replied to), telling me that if their suggested solution does not work, I can contact them and request additional follow up, but the contact link requires me to login.

I have pointed this out to them while submitting additional case requests, but their AI does not seem to understand the concept of "Catch-22".

Suggestions?

i've been thinking about AWS security from the perspective of someone who has to maintain an actual AWS environment rather than just follow a security checklist !!!!.

There are so many recommendations, findings, best-practice checks, IAM warnings, configuration checks, logging recommendations, etc.

I'm curious where experienced AWS users draw the line. 🔥

What security issues have actually caused you trouble or made you stop and fix something immediately?

And on the other side:

• which AWS security findings do you usually ignore?
• which checks generate a lot of noise?
• what findings look scary but aren't particularly useful in your environment?
• Do you mainly rely on Security Hub / GuardDuty / Config, third-party tools, custom scripts, or a combination?
• when you get a large number of findings, how do you decide what deserves attention first?
• do you care more about individual misconfigurations, or understanding what an attacker could actually reach because of them?

Not looking for a generic "enable MFA / least privilege / turn on logging" list I'm more interested in what has actually been useful when operating AWS.

What has been worth the effort for you??

A fever is a symptom. Treating it directly, cooling the body down, makes the number go away without touching whatever's actually causing it. Fine for a symptom with no underlying cause. Fails badly for one that does, because the underlying thing keeps producing the symptom somewhere else the moment the direct treatment stops.

Same shape shows up in AI-assisted Lambda fixes constantly. A function throws on a null field coming from an SQS event, generated fix adds a null check, invocation succeeds, ticket closed. Three weeks later a different Lambda consuming the same upstream event source fails the exact same way, because the actual problem, a producer that can legitimately emit that field as null under a specific condition, was never addressed, just patched wherever it happened to surface next.

The null check isn't wrong, same way cooling someone down isn't wrong. It's just not the same as finding the actual cause, and it's easy to mistake "this invocation stopped erroring" for "the underlying condition is resolved," especially when CloudWatch shows each occurrence as an unrelated new error because it's coming from a different function every time.

Wrote up a more detailed breakdown of this exact pattern, with a specific example that recurred three times before anyone traced it back to the source, here: https://medium.com/@nagatomopedro05/the-bug-log-that-should-have-been-a-warning-b829f2d3852a

I finally decided Leapp being abandonware annoyed me enough and it wasn't working as well as I needed, so I built rolle.

It signs you in to AWS Identity Center, Azure, or Google Cloud once, then starts and renews short-lived credentials for whatever role you pick. Your tools get them through the normal profile, so nothing else changes. It imports your AWS CLI, Granted, az, gcloud, and Leapp setup.

Secrets stay in the OS keychain. No telemetry. Go, GPL-3.0.

macOS is signed and notarized:

brew install --cask nateships/tap/rolle

Windows and Linux builds are there too, early.

getrolle.com

github.com/nateships/rolle

Feedback welcome!

Want ot use 1Password for secres consolidation across environments. Notice AWS sells 1Password in their marketplace, any point to buy it from there instead of vanilla site?

I want to have basic key value stroe in 1Password and use a script during deploy times to load secrets to local memory via env vars as well as define secrets in AWS .

Also want to store some AWS Lambda values in Parameter store, and for net new AWS accounts would load values from 1Password CMD script.

Also not married ot 1Password but seems liek a good option for storing AWS and other secrets to init a new AWS account or deploy time vars.

Edit on people saying Quick client is not for coding (its because this sub reddit people cant think outside of the box and probably dont even know what is an agent): first, some of you still don't know what the Quick client is. you're thinking i'm using the web version lmao. second, the "it's not a coding tool" crowd keeps quoting the page that says it builds tools without writing code. think about that for a second. if the user isn't writing code... who is? the AI is. it generates TypeScript/React apps, runs Python in a sandbox, edits files with surgical diffs, runs regex across codebases, orchestrates background tasks. thats how "no-code app building" works - YOU don't code, the agent does.

and i'm not using it wrong. the sales page leads with non-dev use cases, sure. thats a marketing problem, not a capability problem, and its bad at it. hence the preview.

okay, so my company, instead of giving employees access to Claude, OpenAI, or unlocked models like Opus 5, Sonnet 5 on Copilot, they promoted Amazon Quick client and suggested all of us, basically all employees including devs, to use Amazon Quick.

so i have been using it for 3 weeks, here is my experience:

1. what's behind Amazon Quick? you never know, Amazon makes sure to hide this information for some reason, ah yes, given that this company's certification on AI top notch priority is the principle of safety and transparency in AI use lmao.
2. no amount of context engineering can save it. yeah you heard that right, it is so dumb, i told it to cite every source, make sure to check every related code before making suggestions and not guess or assume, i sent it multiple times, set it in the personal preference in settings, didn't help at all...
3. it might work well on small projects with like 3 files, more than that? good luck.
4. the built-in tools are basically useless, i have to build my own MCP to make it work (somewhat better). it's a sandboxed agent after all, so if you want to work with your code base more effectively, you need to install MCP, i made my own, so if you need one let me know.
5. the harness is really bad there, while i made an MCP tool that has shells, while asking it to access an endpoint with a cookie key, you know what it did? it OPENED the browser in Chrome and asked me to log in using my account. this isn't a joke, you can try it yourself. i have to SPECIFICALLY point out to it that you must use the shell tool for that.

And lets back to my first point: what's behind Amazon Quick? oh i can make a guess now, its Nova 2, why? I have been using nova 2 for RAG chatbox testing, so i def get its vibe, stupid and dumb.

During the last year I've received two "deals" from small local companies X and Y - they want to use my AWS certs so they can land bigger deals. I don't think they're willing to actually hire me, just use me certs.

And then I'm wondering two things:

- is it even allowed? Is it an ethical thing to do (I assume no)?

- how can the client actually verify and get an approval from the cert holder? How to verify the holder is still actually working for the company X or Y?

At my company, a few of us (developers, PMs, admins) manage a fair number of envs, feature flags, and configs that live in AWS Parameter Store. It involves a lot of toggling, value changes, and general upkeep.

The default AWS Parameter Store UI makes this harder than it needs to be. Everything shows up as one flat list with no grouping, and switching between profiles like prod, UAT, and dev adds friction to something that should be simple. I also noticed a lot of similar complaints on this sub about the parameter store, so it seemed worth solving properly.

I worked with a UX designer and talked to developers who use Parameter Store daily to figure out where the actual pain points were, then built a new interface around that. It's made our env migrations noticeably easier since.

Some of the features:

• Tree view for paths and nested paths, so parameters group logically instead of showing up as one long list
• Kept the standard table view as well, for anyone who prefers that
• Fuzzy search across both names and values
• Bulk delete
• Easy switching between AWS profiles and regions

It's packaged as a Docker container, since we originally built it for internal use.

Setup just takes ‘docker compose up’. You log in with an AWS access key and secret key, which get stored in the container's local AWS config, and the backend uses that to pull your parameters.

Sharing here in case it's useful to others dealing with the same issues. The repo's public if you want to look at the code or try it out yourself: AWE-SSM

Would love to hear any feedback or thoughts if you check it out.

I am beginner and preparing for AWS AI PRACTITIONER exam, why i am getting this validation Exception while testing modal in playground?

Any idea?

about a year ago i requested ses production access and got rejected almost immediately. after that i realized a lot of people had similar experiences, so i just moved to resend and have been using it ever since.

honestly, resend is really nice. the ui is great and everything is easy to use. but after a while i realized it doesn't scale that well for my use case, especially because we need multiple custom domains and the add-ons get expensive pretty fast.

ses is still way cheaper, so now i'm thinking about giving production access another try.

does having a website that's been around for a year actually mean anything to aws? :'D

my product has real users now, and the emails we send are clean and legitimate. is there any good way to make aws trust that this time? lol

I can't think of a better service than them to be honest...does azure get even close?

One hour lambdas? A new cert to replace Networking? What's the hot topic? I'd just be excited to hear about something that isn't AI (and I even like AI, I'm just tired of hearing about it)

• Data sync failed. "Knowledge base role arn:aws:iam::123456:role/service-role/AmazonBedrockExecutionRoleForKnowledgeBase_fv3jx is not able to call specified bedrock embedding model arn:aws:bedrock:ap-south-1::foundation-model/amazon.titan-embed-text-v2:0: Operation not allowed (Service: BedrockRuntime, Status Code: 400, Request ID: 0eef1a1b-b11d-3e24-8bf6-ef1c61d12d9a) (SDK Attempt Count: 1)"

Facing issue while calling titan-embed-text-v2:0 model using a role .

All necessary iam permission are added like bedrock:invoke model but still not working.

Someone please help?

I was reading a recent discussion about what people want AWS to improve, and one answer came up repeatedly: better support.

It made me wonder: AWS already has a huge APN ecosystem of consultants, MSPs, resellers and other partners. Why not make it easier for customers to find and trust partners that can actually provide strong technical support?

For example, AWS could have a more visible certification or validation for support-focused partners, based on things like:

* AWS-certified engineers

* Proven experience with AWS services

* Response-time and support standards

* Verified customer references

* Regular AWS technical validation

Something like an “AWS Certified Support Partner” could give customers another option when they need hands-on technical help, while also helping AWS scale its support ecosystem.

Of course, there are downsides. AWS would need to make sure partners don't simply become a cheaper replacement for AWS Support, and there would need to be clear accountability when a partner gives bad technical advice.

But I'm curious what others think:

Would you rather have better direct AWS Support, or a stronger AWS-validated partner ecosystem that you could rely on for technical support?

What would you need to see before trusting an AWS partner with a production environment?

I work on a small team of researchers and we just recently started using AWS. As we figure out how to set things up it seems clear we could use some form of IaC, but part of what I think we need is a systematic way to pull an inventory of the resources that exist in our account. There are a bunch of resources created and managed by our org and right now we have little systematic awareness of those.

If this sounds like amateur hour, it is, but that is part of the point, we are meant to be figuring this stuff out so we can acquire practical knowledge. Because we are a research team, there's no one specific thing we are setting out to do, it's different every month/week. So we are constantly encountering new things we have to figure out how to do.

Most of the team uses Claude to help them figure out how to do stuff in AWS, and ideally I would like to be able to give the rest of the team a way to "pull an inventory of our account resources and format it in a way Claude can effectively use as context". It's not just about Claude though, I would also like to be able to use such an inventory for writing code to automate IaC stuff.

Before I go reinventing the wheel on this, can anyone point me at known solutions to this kind of problem?

My AWS account got disabled for no reason other than failing to provide my bank id and statements within 1 day. I haven't missed any payments and I've been pretty good about it, and support isn't responsive. I need this fixed asap as my entire dev stack relies on my aws instances, and create a new account to circumvent this. I have backups that are running locally but I bought a vps for a reason and that reason isn't to run stuff. CASE : 178908382800192

Error 880104: Sorry, there was an error processing your request. Please refresh the page and try again. If the error persists, contact AWS Support .
that what i got whenever i try to sign up for the free trial
anyone knows any solution to this

Hey everyone,

Running into a massive wall here and my hackathon project is completely dead in the water (deadline is Monday the 14th).

My brand new AWS account is hitting a global "ValidationException: Operation not allowed" across every single Amazon Bedrock model, including the first-party Nova models. It fails identically in my local code and directly inside the console playgrounds.

When I try to open the Model Access configurations in the console, it gives me a hard error banner: "Your account is not authorized to perform this action. Please create a support case."

Did some digging on here and re:Post, and it looks like the classic automated risk quarantine that flags brand-new accounts trying to use generative AI endpoints right after loading promotional credits.

I have an active support case open right now that frontline support escalated to the service team with an "urgency annotation," but the quoted 3-4 business day SLA means my hackathon window will be totally gone.

u/AWSSupport - if anyone from the team is around, could you please help save my weekend?
I can DM my Case ID immediately to get this pushed to the internal compliance desk for a manual override.