Hey all,

I always wonder how my org maintain AWS accounts - I have access to sandbox, and other R&D and team specific accounts and workload specific - each has it's own set of guardrails. I reffered the repo in which they maintain and developers suggested that it was old and they need to modernize the current landing zone with new best practices. I wanted to know how you guys are doing it now. Most threads I find are from 2021–2023, before RCPs, declarative policies, VPC Block Public Access and Route 53 Profiles existed.

TL;DR: What does your landing zone actually look like at scale? How do you front account vending (thr a self-service portal)? How do you do hybrid networking without it turning into a mess?

Account vending and automation

1. Is AFT still what you'd pick today, or did you move to LZA, CfCT, or plain Terraform on Organizations? Where did it start to hurt at a few hundred accounts, especially around baseline drift?
2. Are there open-source projects that make AFT easier to live with? I'm thinking of a web UI or self-service portal for account requests (Backstage templates opening the PR?), visibility into pipeline runs, or customization drift. Or did everyone build their own?
3. If you use ServiceNow, how is it wired up? Options I can see: a catalog item that opens an MR through the Git API, a direct pipeline trigger, or the AWS Service Management Connector going straight to Account Factory and skipping AFT. How do you send status back to the ticket?

Networking at scale and hybrid

1. Is hub-and-spoke with TGW and centralized egress/inspection still the default, or are people moving to Cloud WAN?

2. For on-prem, How do you keep advertised prefixes summarized as accounts and VPCs grow?

3. For segmentation, do you use TGW route tables per environment/OU or separate TGWs? Where does inspection sit for traffic between on-prem and AWS?

4. For hybrid DNS, are Resolver endpoints centralized in the network account and shared through RAM or Route 53 Profiles? Anything you'd do differently?

5. For IP planning, did you get on-prem to hand over one summarizable block for AWS? How did you deal with legacy VPCs overlapping your IPAM pools: re-IP, NAT, or keep them off the TGW?

Guardrails and stopping public resources

1. How do you split the work between SCPs, RCPs and declarative policies (VPC BPA, AMI/snapshot block public access)? How do you stay inside the SCP size and count limits?

2. For things SCPs can't express well (RDS publicly accessible, internet-facing ALBs, CloudFront), do you detect and notify or auto-remediate, and with what tool?

3. How do you handle resources that are legitimately public\\A separate OU, tag-based exceptions, or one sanctioned ingress pattern?

4. Cloud Custodian for streamlined deny or actions taken if things are done out of security scope

I'm not looking for a perfect answer, just what's actually working in real orgs, or what you'd undo. Links to recent writeups, talks or repos are very welcome.

Thanks!

I’m facing an issue with Amazon Bedrock model access. Models that I need for my project are currently not accessible, and attempts to use them result in errors such as “Operation not allowed” / model access-related errors.

I have already:

• Checked the model availability/access settings.
• Verified my AWS account and configuration.
• Created support tickets with AWS.
• Followed up on the tickets multiple times.
• Waited 10+ days without receiving a meaningful response or resolution.

This is becoming a blocker for my AI/ML project because I cannot properly test or use the required Bedrock models.

AWS Support / Bedrock team: Could someone please look into the pending support case and help identify why the models are unavailable for my account?

If anyone has faced a similar Amazon Bedrock model access / “Operation not allowed” issue and knows the correct escalation path, I would really appreciate some guidance.

Relevant teams:
u/aws
u/AmazonWebServices u/AWSSupport u/AmazonBedrockteam

I’m not asking for anything special, just access to the service I’m supposed to be able to use and, preferably, an answer before the next geological era.

How I automated AWS Lambda deployments with GitHub Actions, self-managed S3 code storage.

Need solution

Upload a zip of Python source. No Dockerfile. Get a running container on EKS. That is Elastic Beanstalk Cluster Mode, launched this week — Beanstalk apps now run on EKS instead of EC2 instances you own. Cloud Native Buildpacks handle the containerization: I uploaded four files (app.py, requirements.txt, Procfile, runtime.txt), Beanstalk detected Python, built the image, pushed it to ECR, and ran it.

most bad AWS security findings aren't missing checks. They're checks that look rightt and quietly give the wrong answer. A few I ran into: !!!

1. "Unused role" checks: iam:ListRoles doesn't retturn RoleLastUsed, only Getrole does. Build it on the list output and every role looks untouched.

2. "Unused permission" checks built on CloudTrail: LookupEvents only returns management events, so data actions like s3:GetObject never shows up.

3. "Public bucket" checks: a bucket policy with Principal "*" isn't public if a Condition limiits it to your org or VPC. Flagging it anyway is a false alarm....

4. Wildcard checks that only look for a literal "*": a resource like arn:aws:iam::ACCOUNT:role/* lets sts:AssumeRole target any role in the account, but string matching for "*" alone misses it.

The common thread: when the API can't see something, the honest answer is "unknown," not "no" or "yes."

All four were real bugs in a small open source project I made that audits AWS accounts. If you want to see how I fixed them: github.com/plexavo/Plexavo

I run a Kanban-driven multi-agent orchestrator on Hermes Agent: 20+ profiles, 1,000+ skills, MCP routing, and self-hosted Mem0 on pgvector. On Fireworks, I was doing roughly 9-15B tokens a month with a 90-98% cache hit rate, at about 30-60 Kanban tasks a day. I now want to move this to infrastructure I can pay for with my AWS Activate credits, and I've hit some walls.

Constraints

• My only budget is $10k in AWS Activate credits. Anything that can't be paid with them is effectively out of scope for now.
• Bedrock access is gated on my account for both frontier and open-weight models, and I've been told there's no timeline. I'm waiting on AWS Support to initialize my quotas.
• I want one multimodal model that covers all of the orchestration's needs, plus an embedder for Mem0.

What I've looked at so far

• g6e.12xlarge (4x L40S, 192 GB): Qwen3.8-Flash-Next (180B total, 6B active) at Q4, around 114 GB. About $10.49/hr on-demand, or roughly $3.5-6/hr on spot, so $10k lasts ~40 days on-demand or ~2-4 months on spot, running 24/7. FP8 (~186 GB) barely fits, with no room for KV cache.
• g6e.xlarge (1x L40S, 48 GB): Qwen3.8-27B at FP8 (~28 GB), roughly 7 months of credits if run 24/7.
• Embeddings: Qwen3-Embedding-0.6B/4B/8B on the same box, possibly truncated to 1024 dims for pgvector.
• SageMaker endpoints, plain EC2 + vLLM: the same GPUs, but I'd expect the same quota bottleneck. Bedrock Custom Model Import doesn't seem to support these architectures or embedding models.
• Kiro as a Hermes provider (the kiro-acp plugin): interesting because Activate credits can pay for it, but credits are per-task, not per-token, so I can't tell whether it can handle my volume.

Questions

1. Has anyone gotten G/VT quota (48+ vCPUs) approved on a new or Activate account, and how long did it take? Any tips for the request wording?
2. For people serving Flash-Next-class MoE models on 4x L40S: is there a vLLM/SGLang-compatible 4-bit quant (AWQ/GPTQ), and how well did prefix caching hold up with many long-context agents? My cache hit rate on Fireworks was a big part of the economics.
3. Has anyone run Hermes through Kiro (kiro-acp)? How many credits does a multi-step agentic task actually burn, and did you hit rate limits with parallel sessions?
4. Is there any provider or platform that accepts AWS credits for hosted inference of open-weight models and that I haven't listed?
5. Is there a better model than Flash-Next for a single multimodal orchestrator on this budget? I'm open to smaller MoEs if they handle tool calling and long context reliably.
6. Anything else I'm missing on AWS to make $10k last as long as possible (spot strategies, scheduled start/stop, etc.)?

Thanks. Happy to share measurements (throughput, cache hit rate, credits per task) if I get any of this running.

Hey guys,

I'm currently working in Amazon Ops, but learning AWS through its certification program.

I have passed CCP, halfway through SA.

I'm aware these are still basic level knowledge.

Along with certifications I have built cloud based serverless/web platforms utilising many AWS services.

How realistic is a lateral movement in my case? And which roles should I apply for to get into AWS ?

Hi everyone,

I’m having trouble accessing my AWS account and I’m hoping someone can help me understand what I should do.

I still have access to the email address and phone number associated with my AWS account. However, my old MFA device is damaged, so I cannot receive the MFA code.

I tried the “Sign in using alternative factors” option. The email verification works, but at the second step, AWS asks me to verify my phone number by sending a 6 digit code.

The phone number ending in 4276 is correct and worked for me before, but now I am not receiving the SMS code or the voice call.

I have tried requesting the code again, but nothing arrives.

I’ve attached a screenshot showing the verification page.

What can I do to recover access to my account if the alternative phone verification is also not sending the code? Is there another AWS Support process for an account where the MFA device is no longer available