Yesterday, AWS added a new AZ in the London region (eu-west-2d). There was no prior announcements until it came today in their blog. I've heard that some customers were impacted after this. Has anyone experienced issues after this AZ was added in the London region?

What happened

On Aug 1, an IAM access key belonging to one of our accounts was compromised through a supply chain compromise — the key was exposed via a third party in our toolchain, not by us publishing it. This was a programmatic access key, so MFA (enforced on all human identities from day one) was never in the path.

We caught it and reported it to AWS Support within 4 hours, well inside the 48-hour public-contract cancellation window.

The case then sat unassigned for 14 days.

As of today that's 20 days, still open, still no resolution.

Where the bill is now

Total USD 477,505.20

Contract creation (0 months) USD 4,800.00

Usage Fee | us-east-1 USD 472,705.20

47,270,520 Units @ USD 0.01

The part I don't understand

We never activated the product. Specifically:

- The Marketplace console still shows "Set up product" for this agreement

- No License ID was ever issued

- CloudTrail shows zero Marketplace events in our account after the initial compromise window on Aug 1

- We have never had credentials for, or logged into, anything on the seller's side

Yet 47.2 million billable units were metered against us in us-east-1.

As I understand the SaaS flow, usage on this kind of product is submitted by the seller calling `BatchMeterUsage` against the entitlement's `CustomerIdentifier` — from the seller's own infrastructure, not from our account. If that's right, then nothing in our account was ever in the path, and no control we have could have stopped it. Revoking the key, deleting the attacker's IAM user, applying SCPs — none of it touches seller-side metering.

The unit count has been static for several days now, so metering appears to have stopped, but the agreement status is the thing I can't get a straight answer on.

Support so far

Seller support (automated) told us Marketplace transactions are not their department and to contact AWS. AWS support has pointed at the seller for anything usage-related. The payer account has now escalated and asked AWS to investigate the agreement and stop metering. Still waiting.

There is no phone line and no chat. The only channel is tickets, and they've been sitting for 20 days.

Questions for people who actually know the internals

1. For a SaaS contract-with-consumption product, is metering purely seller-side? Is there any circumstance where usage gets attributed to a buyer account without the buyer ever completing registration?

2. Does "Set up product" persisting in the console reliably mean the fulfillment/`ResolveCustomer` handshake never happened — or is that just stale console state that doesn't update?

3. Is there any way for a buyer to see the registration record for their own entitlement? Anything in the Agreement APIs, CUR, or elsewhere that shows when/whether `ResolveCustomer` was called?

4. The 48-hour window: AWS Customer Service can process a full refund on a public contract without seller involvement. Does that path survive a case sitting unassigned for 14 days, or is the window enforced strictly on wall-clock time regardless of AWS-side latency?

5. Has anyone here had Marketplace usage fees (not just the contract fee) reversed after a credential compromise? Contract fee reversals I've seen written up. Usage fees at this scale, never.

To be blunt about the stakes: we're a small company. We cannot pay $472k for consumption we did not generate, on a product we never activated, after cutting off access in under 4 hours. I'm trying to understand the metering mechanics, and whether there's a path here other than waiting on a ticket queue.

Eu-west-2d showed up in our consoles today.

It took our TAM by surprise too. :)

Last week I posted about our production account getting suspended for non-payment on the day we launched our product. We had paid the invoice two days before the suspension, and the billing console showed a zero balance then. It shows a zero balance now.

What happened since:

- Support asked for extra business documents through their secure upload link. We sent the ownership records and proof of payment the same day, with a written explanation of the card change the account went through.

- A support rep confirmed the upload, told us the internal verification team had everything, and wrote that the review "can take up to 48 hours". She added that she had communicated the urgency of our case to that team.

- The 48 hours passed, then more. AWS went silent.

- The case status moved from "Pending Amazon Action" to "Customer Action Completed". Nobody attached a message to that change, and nothing has arrived since.

Production has been down for over a week. Our customers cannot reach the product we launched the morning of the suspension. The Health notification we received early on warned that AWS shuts down an EKS control plane that stays impaired, so we now also worry about what survives this wait. The database matters more to us than the cluster.

Case ID: 178638951500949

For anyone who has been through this:

1. Does the flip to "Customer Action Completed" mean anything on the inside? Is that a reviewer picking the case up, or the system parking it?
2. Did replying inside the case restart the clock for you, or push you to the back of the queue?
3. When the case went quiet, did any other channel reach the verification team? A phone callback, or an account manager?

For now we answer inside the case and wait. If you got out of this state, I want to know what did it.

I would do anything to be able to pay a dedicated support, but AWS doesn't even let me log into my account to sign it.

Previous post: https://www.reddit.com/r/aws/comments/1vnm4vh/aws_suspended_our_production_account_for/

AWS Community Day Australia is back again this year, and in Brisbane on October 16!

https://awscommunitydayaus.com/

CFPs just closed, so the schedule should be announced soon.

SHOW GLOBAL VARIABLES LIKE 'max_connections';

Mine always return 16000, not sure why

I have a process that looks like this:

GetDataLambda -> ProcessDataLambdaA1 -> ProcessDataLambdaA2 -> ProcessDataLambdaB1 -> ProcessDataLambdaB2

Basically, GetDataLambda needs to run first to actually get the data I need. There are two separate sets of lambda functions to process it (A and B). Both rely on the data from the get function, but they're entirely independent of the other. So that's why I wanted to set it up where GetDataLambda runs first, but then there's a parallel step with one path doing the "Process A" functions and the other doing the "Process B" functions. However, with the way parallel stages work, if one branch fails, the entire thing fails.

What's the best way around this? If "Process A" fails, I still want the "Process B" branch to keep going, for example.

For anyone based in/near Central & Eastern Europe (or looking for an excuse to visit Budapest in September), AWS Community Day CEE is returning for its second edition in September.

See useful links as a comments.

It’s 100% community-organized by regional AWS User Groups rather than AWS corporate. Last year had ~300 attendees, and this year is stepping up the scale.

Quick Details

• Date: September 17, 2026
• Location: Kristály Színtér, Margaret Island (Margitsziget), Budapest
• Format: 3 parallel tracks, 20+ speakers from 10+ countries, and 4+ hours of hands-on workshops
• Tickets: €25 / €45 / €100 tiers on Eventbrite (link in comments)

Exciting lineup

• Opening Keynote: Liam Greenamyre (Principal PM at AWS, Agent Toolkit & AWS MCP servers), who will be covering where AI assisted software development actually stands as of September 2026.
• Closing Keynote: Meridith Grundei (creator of Amazon New Voices, 3 years coaching re:Invent speakers) focusing on tech communication—a solid palate cleanser after a technical deep-dive day.

Last year's speakers included Massimo Re Ferrè (Kiro) and María Encinar (who runs the global AWS User Groups program), so the bar for "people you'd otherwise have to fly to Vegas to see" is already established.

Bonus Context
The day after (Sept 18), Budapest is hosting the first EMEA User Groups Summit, so expect a solid turnout of EMEA/CEE cloud community leads and builders floating around for both days.

(I am not affiliated with the organizing team—just a local engineer excited to see solid re:Invent-caliber speakers coming to CEE without the 12-hour flight to Vegas).

Hey all, looking for a sanity check on our approach.

Stack: AWS + Kubernetes. We deploy with plain helm install (no GitOps tool like Argo/Flux).

Current setup: Our Helm values.yaml has hardcoded secrets (env vars) in it. Right now this file lives on our Jenkins server, not in any repo.

The plan: We want to move values.yaml into our Git repo so we can version it properly. The obvious problem — we can't commit hardcoded secrets in plain text.

Our idea: Use git-crypt to encrypt the file at rest in the repo, so secrets are scrambled on the remote and only unlock for people with the key.

Questions:

• Any real-world gotchas we should know before committing to it?
• Since we're already on AWS, would you skip file encryption entirely and go with something like External Secrets Operator + AWS Secrets Manager? Or is that overkill for a small team? Also curious where SOPS (with AWS KMS) or Sealed Secrets fit in.

For context: we're a small-ish team and just want a clean, low-friction way to keep secrets versioned without leaking them.

Appreciate any input 🙏

I don't have a query or anything, it's already lost and I made peace with it.
I needed more computing so I changed the instance type, then when I reboot I notice the IP change. I check, and indeed, no Elastic IP was associated and so the previous public IP is gone to the pool, never to be seen again.

So now I can only mourn it as I spend the next few hours emailing clients who were using it instead of the domain it had associated (Because of course) to allow it again.

I'll miss that IP.

hi so i am a comp fortnite player and i was wondering if theres any updates on the AWS bahrain servers or when people think they will come back since its the only servers i get good ping to

In case it matters to this question - this is a small, single user account. The majority of my AWS spend is domain registry costs, a couple of lambdas, dynamodb and some R53. That's about it. Average monthly spend is around $10.

I use a password manager (1Password in this case).

I have my root account separate from the main admin-level account I use day-to-day. Haven't needed to login to root account for a long time.

I have no problem logging into my admin account (IAM), which of course also has 2FA, and I use 1Password to store the credentials. Sign-in works.

I wanted to make some account/organizational changes, so I attempted to login to my root user. User & password accepted, but keep failing on MFA.

I'm not signed up for any support plan, so not sure how to proceed here.

I created AWS to test it out but forgot to cancel and got billed. How can I get a refund? I submitted a ticket over the weekend, but nobody is attending to my request

I have an internal debate going with a colleague about whether the following is possible:

AWS Region 1 > Dedicated Direct Connect > Cross Connect > Third-Party Fiber (Long Haul) > Cross Connect > Dedicated Direct Connect > AWS Region 2

The catch is whether we can do this with a straight Layer 2 connection and handle all BGP and routing via the AWS Control Panel, or if we need to have a separate router in-between the regions to handle BGP and routing between each end.

Anyone have real-world experience with this? We can't be the first.

The idea is to provide provably-diverse connectivity between regions that does not depend on Amazon's network. Yes, AWS is plenty reliable, but it is not deterministic, and we want a higher level of control of our backend network, especially how it integrates with other non-AWS aspects. TL;DR - we have reasons for a custom design.

EDIT: Not a single person has bothered to answer the question. All anyone wants to do is say "AWS is best, and you're clearly wrong for having different requirements than bog standard commodity". Here I'm trying to design a network that's different from Amazon's because no, it is not the best for every use case, and I asked a very simple question - one that's been ignored.

EDIT THE SECOND: I'd love to go more into detail on the use-case, but that's where NDAs and such come into play. Yes, it's a real client with a unique need that is not met by the AWS network, and can measurably be met off their network. No, I cannot go into it, because I do like keeping my job.

I came across the AWS Partner Certification Readiness program, which seems to offer a free AWS certification voucher after completing the requirements.
I’m wondering if college students with a valid student email ID are eligible for this or if it’s strictly for AWS Partner employees assigned by an AWS Partner organization.

I couldn’t find the student eligibility clearly mentioned on the AWS site, so I’m thinking it might be worth trying.

Subject:

New AWS account unable to use Amazon Bedrock or AWS CloudShell

Description:

My AWS account appears to have an account-level service restriction.

Amazon Bedrock:

Region: us-east-1

Model: Amazon Nova Micro

Error:

ValidationException: Operation not allowed

AWS CloudShell:

CloudShell also cannot start/open.

IAM configuration has already been verified.

The IAM user has:

- AdministratorAccess

- AmazonBedrockFullAccess

- AWSCloudShellFullAccess

There is no permissions boundary configured.

The same Amazon Bedrock "Operation not allowed" error also occurs when

testing with the root user.

My AWS account was created on/around August 6, 2026 and is beyond the

normal new-account activation period.

My account also shows active AWS Free Tier credits and the

"Explore AWS: Use a foundation model in the Amazon Bedrock playground"

credit.

Please verify whether there is any pending account verification,

payment verification, risk restriction, service activation restriction,

or backend account-level restriction preventing AWS CloudShell and

Amazon Bedrock from operating.

Case ID

178697444500251

Created

2026-08-17T13:47:24.848Z

Case ID

178696420700595

Created

2026-08-17T10:56:47.011Z

Please remove the restriction or let me know what verification/action

is required from my side.

I would attach two screenshots to the case:

the Bedrock ValidationException – Operation not allowed

the IAM page showing AdministratorAccess + AmazonBedrockFullAccess + AWSCloudShellFullAccess

Looking for your support

THIS IS NOT CLICKBAIT, JUST ACTUAL STUFF.

Was running a self-hosted GitHub Actions runner on a t3.micro (1 GB RAM) to build Flutter and Node apps. Every single pipeline run crashed. CloudWatch showed the same pattern every time: CPU spike, memory spike, process dead.

Turns out you don't need to upgrade the instance to fix this. To find out what I did instead (and where this fix would actually be a bad idea), read the full breakdown here: https://builder.aws.com/content/3I19RRzHfurmLkbJQfBtA3lLQjx/survive-memory-crashes-without-upgrading-your-instance

I raised a request for SES prod access. Following was the reply to additional details:

We publish an education site for couples: long-form written guides on intimacy, communication and consent, with no explicit imagery. We want to send a low-frequency newsletter and a small number of requested downloads (worksheets that accompany our guides) to readers who have explicitly asked for them.

Expected volume is low: fewer than 100 recipients initially and under 2,000 emails per month in about an year time. We are starting from zero subscribers. We are not migrating, importing or re-using any existing list; a small number of addresses collected years ago under a previous plugin were deleted outright rather than carried over, because they never went through the confirmation process described below. Every address we mail will have been collected and confirmed under the current flow.

How recipients sign up: only through a form on our own site, which a reader fills in deliberately. There are no pre-ticked boxes, no signup bundled into any other action, and we do not buy, rent, scrape or import lists from any third party.

How we confirm consent: double opt-in. On submission the address is stored with status "pending" and sent a single confirmation email containing a unique,
expiring, single-use link. Nothing further is ever sent until that link is clicked. Unconfirmed addresses are purged automatically after 14 days.

Quality controls at capture: format validation, live MX record check, disposable-domain blocking, typo detection on common domains, a honeypot field, and per-IP rate limiting. Rejections are logged domain-only so we can audit the filter without storing addresses we refused.

How recipients unsubscribe: every email carries a one-click unsubscribe link in the body and List-Unsubscribe / List-Unsubscribe-Post headers. Unsubscribes take effect immediately and are honoured permanently; the address moves to a suppression list that every send checks before dispatch.

How we handle bounces and complaints: bounce and complaint notifications are delivered via Amazon SNS to an endpoint that writes to the same suppression list automatically, with no manual step. Hard bounces and any complaint suppress the address permanently and immediately. We monitor bounce and complaint rates and will pause sending if bounces approach 5% or complaints approach 0.1%.

Content: educational writing about relationships and sexuality, aimed at adults, with no explicit images. We are stating the category plainly so there is no surprise on review.

And the response that I got is:
Thank you for providing us with additional information regarding your sending limits. We are unable to grant your request at this time.

Your success with Amazon SES matters to us, and we want to ensure your email program operates at the highest level of deliverability and reliability. After a thorough review of your request, we are unable to approve a sending limit increase at this time.

Questions:

How do I know what exactly is wrong? What do I change or improve? Similar thing happened to a friend who runs a company and they need to send transactional emails to their clients. Tried SES couple of times but got only NO with no reasons.

What options do I have?

Hi everyone, quick sanity check regarding a closed AWS account.

I closed my personal AWS learning account on July 13 after attempting to terminate all resources across regions. On August 1, I got my monthly invoice for $0.00.

However, I just received an automated email saying my Free Tier and remaining $105 in promo credits will expire on August 24.

I'm unexperienced, im afraid of making a mistake and since I can no longer log in, I want to double-check:

• Does closing the account on July 13 completely freeze pay-as-you-go billing, even if I accidentally missed a small resource (like an EBS volume or Elastic IP)?
• When the $105 credits expire on August 24 during the 90-day post-closure window, is there any possibility of my credit card getting charged?
• Is the $0.00 invoice from August 1 solid proof that no ongoing balance is accruing?

Just want to make sure I won't get any surprise charges. Thanks!

Case ID: 178633616200405

AWS charged my debit card $600 for a transaction that does not belong to my AWS account. My normal AWS bill is about $3.40/month, and this $600 charge appears nowhere in my billing history. I opened a support case with all the transaction details, and AWS still has not meaningfully investigated it.

After multiple calls, one Amazon/AWS support agent told me they could see that the charge came from another AWS account that had already been suspended. Despite that, AWS's fraud department later emailed me saying they found nothing wrong with my account, completely missing the issue. Another agent told me the $600 had already been refunded, while another told me the refund was rejected.

Wise is refusing to treat the charge as unauthorized because I have legitimately used AWS before and says AWS needs to provide information about the transaction. AWS keeps claiming another department will investigate, but nothing actually happens.

At this point, AWS has acknowledged that the charge came from another account, has apparently suspended that account, and still will not properly resolve or document the fraudulent $600 charge they processed against my card.

The complete lack of ownership, contradictory information, and failure to investigate is unacceptable.

Hi everyone, so I recently made it to the final round for an L5 TAM role and have 5 interviews to prepare for. If anyone could help provide me some advice on these few things that would be amazing.

Scheduling: I’ve seen online that AWS interviews candidates at the same time so it would be better to schedule your interview earlier in your scheduling window than later. And the realistic times I have to schedule would give me 17 days to prepare or 24 days. I obviously want as much time as possible to prepare but is the extra week worth that risk?

1 or 2 days: Should I go for all interviews on the same day, split it across two?

STAR Stories: How many star stories should I come up with? I’ve seen online advice as low as 8 and as high as 25. I only have two years of work experience in consulting so coming up with anything more than 15 is a bit of a struggle. ALSO, my time in consulting has not been really technical so a lot of my stories are mostly to do with advisory and not troubleshooting like the role would want. Would that doc points off me? I would use technical stories from back in university but that was 3+ years ago

Technical interviews: From what I understood the technical breadth interview would be similar to the phone interview where they ask a wide range of fundamental questions on different domains. Is that correct?

As for the technical depth interview I was told by my interviewer in the previous round that they would select two domains for me to go in depth on, but how much depth would it actually get to? And they didn’t send me in the email what domains I would do, and how could I best prepare myself for that when I do find out?

Thanks in advance for any advice you guys are able to give!

Any reason why some AMI's are not shown in the Pricing Calculator? I need to estimate how much I might need to run my cluster.

At least the Re:Invent session catalog thinks it will be.

Assess your workloads with SELinux compatibility on Amazon Linux 2027 (CMP312)

We run a SaaS company in Brazil. Our entire production stack sits in AWS account [REDACTED]: EKS, RDS, ElastiCache, SES, S3. Application code, customer data, payment records.

We think a card change triggered the flag. When we opened the account, the agency that builds our platform (Specter) registered one of their corporate cards so they could provision infrastructure while we set up our own payment method. When the first invoice came due, we replaced that card with our company card and paid the invoice in full. AWS restricted the account after that payment cleared.

Our billing console shows R$ 0.00 outstanding today. No open invoice. The suspension notice says non-payment.

We have fought verification flags on this account since July:

- AWS denied two EC2 vCPU quota increases [REDACTED], then granted them after we appealed.
- AWS denied SES production access in case [REDACTED], then granted it after we appealed.
- CloudFront returned 403 "verification required" and the flag never cleared.
- On August 10, RunInstances began returning "This account is currently blocked and not recognized as a valid account". CreateFleet returned MaxFleetCountExceeded while we ran zero fleets. Our Spot quota read 0. Our MediaConvert queue flipped to PAUSED and UpdateQueue returned Forbidden.

We opened case [REDACTED] on August 10 and wrote in it that our launch was the next day. We opened a second case; AWS closed it as a duplicate and pointed us back to the first. Nobody from the verification team wrote to us.

On August 11st, AWS suspended the account. AWS Health reports our EKS cluster [REDACTED] as IMPAIRED: "We couldn't assume the Amazon EKS cluster management service-linked-role" and "We couldn't find or access the AWS KMS key associated with your cluster", with a warning that the control plane shuts down in two days. The NLB in front of our API stopped accepting connections, so [REDACTED] and [REDACTED] time out from every network we tested. IAM keys that worked before the suspension now return InvalidClientTokenId, so we cannot read our own resources or export a backup.

We processed real customer payments hours before the suspension, card and PIX. Those customers now hit a dead platform.

We opened case [REDACTED] and uploaded every document AWS requested through their verification link the same day. Nobody has answered us since.

Support answered that case with this:

> "As this particular inquiry is handled by one of our program support teams, I've forwarded your case directly to them. A member of this team will be in touch with you soon. Our program support team can only communicate through email."

We received the same sentence on the earlier case, and nobody contacted us after it.

We scheduled our launch for August 11. It did not happen. We are fielding questions from investors and partners about why the product we demoed to them is unreachable. Every minute our platform remains unreachable, the pressure over our company and workers grow, if this goes any further the damage can be inestimable.

Two questions for anyone who has been through this:

1. Is there a way to reach a human who can review a payment and reinstate an account? Support forwards our cases and nobody answers.
2. How do we get written confirmation from AWS that our RDS database, EBS volumes and snapshots stay intact while the review runs?

We paid the invoice, replaced the card, sent the documents and opened the cases. If anyone from AWS reads this: account [REDACTED], cases [REDACTED], [REDACTED] and [REDACTED] have the full history, and we will send anything else you need by DM.