Tagged
On August 19, 2026 AWS enabled live-web fetch for Bedrock Web Search in 3 US Regions. Default external_web_access is true; AmazonBedrockFullAccess still does not grant ExternalWebAccess, and the 403 does not fail the request.
Palaniappan PAfter Cognito multi-Region replication (June 2026), a B2B API platform (~18k RPS peak) cut auth-related 5xx during a regional drill from 4.2% to 0.1%, but a missing WAF rate rule still let a scraper burn $1.8k in a weekend.
Nash OgdenAfter the April 2026 S3 default that blocks SSE-C on new buckets (and on existing buckets in accounts with zero SSE-C objects), a SaaS media platform (~2.4 PB, 418 buckets) found 11 legacy upload paths still sending customer-key headers, all failing with 403 until migrated to SSE-KMS.
Nash OgdenShield Advanced is $3,000/mo per org plus DTO fees. For a consumer marketplace (~180M req/mo CloudFront), cost protection credited $41k in scaling charges after a 38-minute L7 event when WAF rate rules were pre-configured.
Nash OgdenOn a B2B SaaS crossing Series A (~$18.5k/mo AWS), running the funding-stage gate checklist before the B round cut diligence prep from 11 weeks to 4. The work was an Organizations split, WAF, and a SOC2 evidence path, with no re-platforming.
Palaniappan PBefore a partner-led WA Review, a fintech workload with 23 open HRIs spent 6 weeks on unfocused fixes; after the readiness checklist and HRI cap of 5 for 90 days, the next milestone dropped High Risk items from 23 to 7 in one review cycle.
Palaniappan POn a defense-subcontract SaaS (~$42k/mo AWS, CUI in scope), choosing GovCloud (US) over commercial US-East cut inherited-control review from 11 weeks to 4 after mapping 47 customer-responsibility controls in the SSP inheritance worksheet.
Nash OgdenMost remote-access RFPs still default to full Windows desktops, but 60%+ of contractor work is browser-only. WorkSpaces Secure Browser isolates SaaS in AWS; WorkSpaces Applications (formerly AppStream 2.0) streams fat clients without a desktop. A composite regulated services firm cut 3 legacy VDI vendors to 2 OU-scoped patterns and reduced unmanaged-endpoint incidents from ~9/quarter to ~2 after splitting browser vs app streaming.
Nash OgdenGuardDuty bills across nine separate data sources: CloudTrail management events at a flat $4/M, VPC Flow Logs at $1/GB tiered, EKS Runtime Monitoring per vCPU-month, plus S3, DNS, Lambda, RDS, and Malware Protection. The 30-day free trial regularly hides the true production bill, and organization-wide auto-enable turns every new account into a billing line.
Kevin W.Macie bills two ways: bucket-level evaluation at $0.10 per bucket per month, and sensitive-data discovery at $1.00 per GB inspected. A 500 GB bucket scanned for PII costs $500 just for the discovery; multi-bucket organizations easily hit $10K+ per month. Automated discovery is cheaper than full jobs but compounds across the bucket footprint.
Kevin W.Management events are free for the first trail. Data events bill $0.10 per 100K, and on a busy S3 bucket that lands at thousands per month. CloudTrail Lake is $0.75/GB ingested with one-year extendable retention ($0.023/GB-month after year one), or $2.50/GB with seven years of retention included. Insights events analyze every management event for anomalies at $0.35/100K. Wildcard data-event selectors are the usual source of the overspend.
Kevin W.Default Docker seccomp is not enough for regulated workloads. EKS Pod Security Standards, seccomp profiles, and Fargate platform version constraints.
Manoj V.
