CommPulse

Context: I'm running a public API on API Gateway + Lambda, with DynamoDB behind it. Endpoints have very different backend costs, cheap reads vs. a couple of routes that kick off heavier aggregation work. Currently using API Gateway usage plans with a single throttle limit per API key, applied flat across all routes. The problem: usage plans throttle by requests/second regardless of which route is hit, so a client hammering cheap GETs eats the same budget as one calling the expensive routes, and there's no way (as far as I can find) to weight individual routes differently within a single usage plan without splitting them into separate API Gateway stages/plans per cost tier, which gets awkward to manage as the number of "cost classes" grows. What I've looked at so far: Per-stage/per-plan splitting: works, but means maintaining N usage plans and N sets of API keys per client if a client needs access to routes at more than one cost tier. Custom Lambda authorizer + DynamoDB counter: doing weighted token-bucket logic myself (consume different token amounts per route, check/decrement atomically via DynamoDB conditional writes), seems doable but adds a DynamoDB read/write on every request just for the rate-limit check, plus I'd be reimplementing throttling that API Gateway mostly already does for free. Briefly looked at whether Lambda reserved/provisioned concurrency per function could act as an implicit cost-based limiter (route the expensive endpoint through its own function with tighter concurrency), but that limits total throughput, not per-client fairness. Has anyone actually shipped weighted/cost-based rate limiting on top of API Gateway usage plans, or does everyone end up rolling their own with a Lambda authorizer + DynamoDB/ElastiCache counter once costs diverge enough between routes? And if you rolled your own, did you keep API Gateway's built-in throttling as a coarse backstop on top of it, or drop it entirely in favor of the custom logic? submitted by /u/ClickOk5811 to r/aws [link] [comments]

I need some help figuring out if this is a highly targeted scam or a legitimate invoice. I recently received an email containing a PDF invoice for an "Unreturned Advance Exchange Fee". The sender email is ⁠ [email protected] ⁠. Here is what is really tripping me up and making me second-guess: The details of the item on the invoice (a Surface Laptop) and the serial number of the returned item is correct. My personal and organization details listed in the "Bill To" and "Ship To" sections are 100% correct. The invoice claims to be from "MICROSOFT PTY LIMITED" based in North Sydney, Australia, and the total amount is listed in AUD. **The Red Flag:** The "Remit to Bank" section instructs me to send payment to "BANK OF AMERICA". I am based in the Asia Pacific region, so seeing Bank of America as the payment destination feels incredibly suspicious, even though Microsoft is a US-based company. Has anyone else dealt with this before? Is it normal for Microsoft's APAC/Australian branches to use Bank of America for direct wire transfers, or is this just a very sophisticated, highly personalized spoofing attempt using an email address like **⁠ [email protected] **⁠? Customer Success Manager from MS hasn’t replied in a week where I asked if this is legit and I should reply to it. Also btw device was returned within directed time frame. Any advice would be greatly appreciated! submitted by /u/laleric to r/sysadmin [link] [comments]

terraform plan validates syntax and state, it has no opinion on whether the instance size you picked is actually right for the workload. Ran a single-resource RDS example through CloudCostTree: db.t3.large, declared as-is, comes out to $107.28/month, Cost Score F. Simulating one size down, db.t3.medium, same file, no architecture change: $57.64/month. A real $49.64/mo drop, 46.3%. Nothing about that shows up in a terraform plan diff, you only see it once you actually price the resource. submitted by /u/Independent-Ease-609 to r/FinOps [link] [comments]

Hi everyone, so we're looking to better manage our AI spend across multiple dev teams mainly on how to deal with the fluctuating and unpredictable cost of it all. We've already set team / project specific API keys so we can track spend by project, so now I'm just looking for ways to manage the cost itself as a whole. I looked into LLM routers / gateways, mainly from seeing the Ramp Router announcement and it looked interesting to me from a cost cutting perspective. But I have 0 experience in using LLM routers so would love to hear from you guys. I'm open to other suggestions too of course, thanks! submitted by /u/Dangerous_End8856 [link] [comments]

I only have two VM's. I can see in Billing -> Reports I am getting charged $2/day for Persistent Disk. But I can't tell which VM is accounting for most of that charge. submitted by /u/imitation_squash_pro to r/googlecloud [link] [comments]

I know this is obsessive. That is the point. For time, my definition of a clean Windows installation was simple: Create an official Microsoft installation USB. Boot from it. Delete every partition. Install Windows. Sign in with a Microsoft account. Install Windows and Microsoft Store updates. Remove the applications I did not need. Install the drivers from my laptop manufacturer. Apply all my personal settings. Windows was clean, updated, and ready. Or at least, that was what I thought. The standard clean installation was not clean enough The first problem was driver installation. As soon as Windows connected to the internet, Windows Update started installing drivers automatically. After that, I installed the official driver packages from my laptop manufacturer’s website. This meant Windows could install one driver first, and then the manufacturer’s installer could install another version over it. Sometimes everything worked, but the process did not feel controlled. Windows Update also tried to install many updates, drivers, and Microsoft Store components simultaneously. This occasionally produced failed updates, retries, and unnecessary confusion. There was another issue: removing applications after they had already been installed did not feel truly clean. The applications had already been registered, initialized, and possibly updated. Uninstalling them afterward was not the same as preventing them from being installed in the first place. Improvement 1: Complete the first boot without internet My next method was: Install Windows → Complete OOBE using a local account → Enter the desktop without internet → Install the official laptop drivers from USB → Restart → Connect to Wi-Fi → Install Windows and Store updates → Remove unwanted applications → Apply my settings This was much better. Windows Update could not install random drivers before I installed the correct manufacturer drivers. It felt almost perfect. But it still was not perfect. When I finally connected to the internet, Windows still had to process a large cumulative update, smaller updates, driver checks, security updates, and Store updates at the same time. There were still occasional update errors and retries. Improvement 2: Install the large cumulative update offline I decided to integrate the latest large cumulative update into Windows before connecting the computer to the internet. The idea was simple: Install the large update offline → Boot Windows → Connect to the internet later → Download only the smaller remaining updates This significantly reduced the work Windows Update had to perform after the first boot. Instead of downloading and processing a massive cumulative update alongside everything else, Windows only needed the smaller updates released afterward. The process became faster, more predictable, and less likely to produce errors. But I still had two problems: Unwanted applications were being installed before I removed them. Manufacturer driver packages contained drivers for hardware my laptop did not actually have. Improvement 3: Extract and select the exact drivers Many laptop manufacturers provide one driver package that supports several possible hardware configurations. For example, a Wi-Fi driver package may include: Intel drivers Realtek drivers Qualcomm drivers MediaTek drivers My laptop only uses one of them, but the complete package may copy or stage drivers for several supported configurations. That did not feel precise enough. I started extracting the manufacturer’s .exe driver packages and examining the files inside them. I identified the exact hardware installed in my machine and selected only the appropriate drivers. However, I also learned that not every driver should be treated the same way. Some drivers are primarily standard INF-based packages and work well with offline DISM injection. Other packages are more complex and may include: Multiple dependent drivers Services Registry configuration Software components Firmware utilities Control panels Microsoft Store or UWP companion applications Custom installation logic Graphics, audio, and some Intel platform or firmware packages can fall into this category. For those packages, blindly extracting every INF file and injecting everything is not necessarily correct. I therefore inspected each driver package and divided them into two groups: Safe standard drivers → Inject offline with DISM Complex software-assisted drivers → Install after the first desktop boot using the official installer This gave me control without breaking the functionality supplied by the manufacturer. Improvement 4: Inject drivers before Windows boots Even when the correct driver was installed, installing it after reaching the desktop could temporarily restart or reinitialize the related device. For example, installing a network driver can cause the adapter to disappear and reappear. That is completely normal, but I wanted the hardware to be ready from the first real Windows boot. I therefore started servicing install.wim offline with DISM. My early method was: Copy install.wim from the official Microsoft ISO → Mount the WIM → Inject the safe drivers → Inject the cumulative update → Modify the image → Commit and unmount it → Use the modified image for installation DISM is already part of Windows, so the entire servicing stage could be performed using Microsoft’s own deployment tools. At this point, the installation already had the correct core drivers and the largest Windows update before it ever reached the desktop. Improvement 5: Prevent unwanted Store applications from being provisioned Microsoft Store applications are commonly provisioned in the Windows image. Provisioned applications are prepared so that Windows can register them when a new user account is created. Instead of allowing these applications to register and then uninstalling them afterward, I removed the unwanted provisioned packages from the offline image using DISM. First, I listed the provisioned packages: dism /Image:W:\ /Get-ProvisionedAppxPackages Then, for each package I did not want: dism /Image:W:\ /Remove-ProvisionedAppxPackage /PackageName:<exact-package-name> This meant the applications were removed before my user profile was created. I did not remove essential components such as Microsoft Store or Desktop App Installer. I only removed applications I had already decided I would never use. This felt much cleaner than uninstalling them after the first login. Improvement 6: Prevent OneDrive Setup from starting for the new user OneDrive was a separate case. It was not simply a provisioned Store application in the same way as the other packages. Windows contained a startup entry that launched OneDrive Setup when the user profile was created. I loaded the offline default-user registry hive and removed the OneDrive Setup startup entry. That stopped OneDrive Setup from automatically running when the first user account was created. Again, the objective was not to install something, allow it to initialize, and then remove it. The objective was to prevent the unwanted setup process from starting at all. Improvement 7: Apply my settings before the first login I then realized that many settings could also be applied offline. Instead of entering the desktop and manually changing everything, I loaded the offline registry hives and configured settings such as: Dark application mode Dark Windows interface mode Windows Spotlight policies News and Interests Delivery Optimization Fast Startup OneDrive startup behavior Other system and default-user preferences The settings were therefore present when Windows created the user profile. The system started in the state I wanted instead of starting with default settings and being changed afterward. Everything was now: Official Controlled Repeatable Performed with built-in Windows deployment tools Completed before Windows created its first normal user session But I still was not satisfied. The normal USB installer still hid too much of the process Even with a customized install.wim, the normal Windows Setup interface was still performing many operations automatically. It created partitions, applied the image, configured the boot files, and prepared recovery behind the scenes. That is convenient for normal users. For my perfection-obsessed installation, however, I wanted to know and control exactly what was happening. So I stopped using the normal graphical installation process. I moved the entire deployment into WinRE. The final method: Build Windows manually from WinRE WinRE is a small recovery environment that boots into RAM and provides access to tools such as DiskPart, DISM, BCDBoot, Registry Editor, and ReAgentC. I placed the official Microsoft install.wim, updates, drivers, answer file, and recovery image on a separate drive. Then I booted into WinRE and manually built the complete Windows disk. Step 1: Create the GPT partition structure manually I selected the correct target disk, deleted the existing partition structure, and manually created: EFI System Partition — 300 MB FAT32 Microsoft Reserved Partition — 16 MB Windows partition Windows Recovery partition — 2048 MB This gave me full control over the partition sizes, order, and purpose. The EFI, Windows, and Recovery partitions were assigned temporary drive letters during deployment. Step 2: Apply the official Windows image Instead of running Windows Setup, I applied the Microsoft image directly: dism /Apply-Image /ImageFile:C:\install.wim /Index:1 /ApplyDir:W:\ At this stage, W: contained a fresh Windows installation that had never booted. Step 3: Service the offline installation While Windows was still completely offline, I: Injected the compatible drivers Installed the latest large cumulative update Removed unwanted provisioned applications Modified the default-user and system registry hives Disabled the OneDrive Setup startup entry Applied my preferred Windows settings Added the unattended configuration Cleaned the component store For the final component cleanup, I used: dism /Image:W:\ /Cleanup-Image /StartComponentCleanup /ResetBase I only used /ResetBase after finalizing the update state because it prevents the integrated updates from being uninstalled later. Step 4: Configure OOBE officially through Panther A recent Windows 10 update complicated the local-account path during OOBE, and Windows 11 also strongly encourages online account creation. There are command-line workarounds that restart or interrupt OOBE, but that did not feel clean to me. Instead, I used a Windows answer file in the Panther directory: W:\Windows\Panther\unattend.xml The answer file configured items such as: Language Keyboard layouts Time zone Local user account OOBE behavior Automatic initial login This is part of Windows Setup’s own unattended-deployment system. It did not require third-party bypass tools or interrupting OOBE with an improvised restart. Any plaintext password contained in the answer file should be removed after Setup is complete. Windows 11 builds can behave differently, so an answer file should be validated against the specific build being deployed. Step 5: Create the UEFI boot files manually I generated the boot environment directly from the applied Windows installation: W:\Windows\System32\bcdboot.exe W:\Windows /s S: /f UEFI This created the UEFI boot files on the EFI System Partition. Step 6: Build and register the recovery environment I created the recovery directory, copied winre.wim, and registered it against the offline Windows installation: md R:\Recovery\WindowsRE copy /y C:\winre.wim R:\Recovery\WindowsRE\winre.wim W:\Windows\System32\reagentc.exe /setreimage /path R:\Recovery\WindowsRE /target W:\Windows I then assigned the proper recovery-partition GPT type and attributes and removed its temporary drive letter. The result was a complete disk containing: A fresh UEFI boot partition Windows A properly configured recovery environment No previous user activity No Audit Mode session No Sysprep generalization cycle The controlled first boot The offline deployment was only the first stage. For the first real boot, I still kept the laptop disconnected from the network. My sequence was: Boot Windows without internet → Complete the local OOBE process → Enter the desktop → Install the complex official driver packages → Restart → Pause Windows Update temporarily → Connect to Wi-Fi → Allow required OEM and Store components to install → Run Windows Update → Update Microsoft Store applications → Apply the remaining personal settings → Install required DirectX and Visual C++ runtimes → Restart again The complex driver packages included components that were better installed through their official installers, such as graphics, audio, and certain Intel platform packages. After connecting to the internet, official companion applications such as Dolby or Intel software could install normally. Because the large cumulative update had already been integrated offline, Windows Update only had a relatively small amount of remaining work. Because unnecessary provisioned applications had already been removed, Microsoft Store also had fewer applications to register and update. At this point, I had a complete Windows installation with: Official Microsoft Windows files Official manufacturer drivers Official NVIDIA drivers Official Microsoft updates Official Microsoft Store components My complete configuration No random third-party customization utility No unnecessary driver families No unwanted provisioned applications A working EFI partition A working WinRE partition This was finally the Windows state I wanted. But there was one final problem. Reproducing all of this again would take hours. Preserving the perfect state Once I started using Windows normally, installing random applications, testing software, and modifying files, the installation would no longer be in that carefully prepared state. I wanted to preserve it before normal use. Windows includes the older system-image backup concept, and many third-party disk-cloning tools also exist. However, I had completed the entire deployment using Windows-native tools. I did not want the final backup stage to depend on an unrelated third-party cloning application. So I returned to WinRE and used DISM again. WIM capture First, I captured the Windows partition into a WIM file: dism /Capture-Image /ImageFile:C:\Final-Windows.wim /CaptureDir:W:\ /Name:"Final Ready-to-Use Windows" /Compress:max /CheckIntegrity /Verify Because the capture was performed from WinRE, the Windows installation was offline. The WIM represented the files on the Windows partition at the exact point when I shut the system down. Restoring it later would return the Windows partition to that state. However, a WIM only captures the selected partition. It does not automatically preserve: The EFI partition The Microsoft Reserved partition The recovery partition The complete disk layout To restore a WIM to a completely empty disk, I would still need to recreate the partitions, apply the WIM, rebuild the boot files, and configure recovery again. That was not perfect enough for my objective. FFU: The complete-disk image DISM also supports Full Flash Update images. Instead of capturing only the Windows partition, an FFU captures the physical disk layout. From WinRE, I used: dism /Capture-FFU /ImageFile:C:\Final-Windows.ffu /CaptureDrive:\\.\PhysicalDrive1 /Name:"Final Perfect Windows" The FFU contains the complete disk: EFI partition MSR partition Windows partition Recovery partition Partition order Boot files Windows files Drivers Updates Applications Settings Recovery configuration Now I can boot into WinRE, erase the target disk, and apply the FFU. It recreates the complete disk structure and restores the files to the captured state. Instead of repeating hours of partitioning, servicing, driver selection, updating, and configuration, I can restore the complete prepared Windows environment in a small fraction of the time. It is effectively like returning the machine to the exact day when I finished preparing it. The WIM remains useful as a flexible Windows-partition backup. The FFU is the complete bare-metal recovery image. The final result My complete workflow became: Official Microsoft ISO → Manual GPT partitioning in WinRE → Direct DISM image application → Offline cumulative update integration → Selective offline driver injection → Offline provisioned-application removal → Offline registry customization → Official unattended OOBE configuration → Manual UEFI boot creation → Manual WinRE registration → Component-store cleanup → Controlled offline first boot → Official complex driver installation → Controlled internet connection → Remaining Windows and Store updates → Final runtimes and settings → Offline WIM capture → Complete-disk FFU capture Is this necessary for most people? Absolutely not. The normal Microsoft installer is sufficient for almost everyone. But for someone who is obsessed with understanding, controlling, and perfecting every stage of a Windows installation, this is the closest I have reached to an absolutely clean, official, and reproducible system. The best part is that I can now use Windows freely, install experimental software, and potentially break things without worrying about repeating the entire process. My final FFU image preserves the complete perfect state. I only need to restore it, and I am back where I started. Important notes Always verify the physical-disk number before using DiskPart or FFU commands. Selecting the wrong disk can destroy data. Test the FFU restoration before treating it as your only backup. FFU images are less flexible than WIM images and are best suited to the same machine, disk layout, or compatible target storage. The target disk generally needs enough capacity for the captured layout. Some driver installers should not be replaced with blind INF injection. Windows 10 and Windows 11 do not always use identical package names, updates, or unattended settings. Remove answer files containing passwords after Windows Setup completes. Keep personal files backed up separately. A system image is not a substitute for a separate data backup. I am interested in hearing how deployment specialists would improve this workflow, and whether anyone else has taken the Microsoft-native WinRE, DISM, WIM, and FFU approach this far. submitted by /u/kaidocodm to r/sysadmin [link] [comments]

submitted by /u/heldsteel7 to r/FinOps [link] [comments]

Renewal season is hitting a lot of people and I keep seeing the same pattern: the quote gets escalated before anyone has actually measured what they run. RVTools is free, read-only and takes about twenty minutes with a service account. Here is the checklist I would work through before replying to anyone. Count billed cores, not sockets. The metric moved from per-socket to per physical core. vHost gives you "# CPU" (sockets) and "Cores per CPU". Multiply, sum per site. Then apply two floors, in this order: The historical 16-core-per-socket minimum. An 8-core CPU bills as 16. The 72-core-per-product-per-order-line minimum, which went up from 16 in April 2025. The second one is the one people miss, and it lands on small sites rather than big ones. 16-host cluster, dual 32-core CPUs = 1,024 cores. Neither floor touches it. 3-host edge site, one 16-core CPU per host = 48 real cores, bills at 72. A 50% overpay. 2-host site, dual 8-core CPUs = 32 real cores, floored to 64 by the socket rule, then to 72 by the order-line rule. A 125% overpay on a box in a cupboard. Worth confirming with your reseller whether they can consolidate sites onto one order line, because that changes the answer a lot. Get it in writing. Find what you are licensing for no reason. vInfo, filter Powerstate = poweredOff, sum "In Use MiB". Powered-off VMs still occupy storage and still sit in your capacity planning. vSnapshot, anything with a date older than about 30 days. Those are a production risk as well as reclaimable space. vHealth has a built-in check for possible orphaned VMDKs and zombie files. Provisioned is not consumed, and that is the number that decides your business case. Sum CPUs in vInfo for powered-on VMs, divide by total physical cores from vHost. That is your real vCPU:pCore ratio. Do it against physical cores, not hyperthreaded logical CPUs, because licensing is physical. Then compare three storage numbers that usually get treated as one: provisioned VMDK capacity (vDisk), datastore in-use (vInfo), and guest filesystem consumed (vPartition). The gap between the first and the third is often most of your "capacity". This matters beyond the renewal. Cloud block storage bills on allocated volume size, not what the guest is using, so a thin 2TB VMDK holding 200GB becomes a 2TB bill on day one unless you shrink it first. Sizing any target on provisioned figures will make a migration look far more expensive than it actually is. Gotchas worth knowing before you start: Column names drift between RVTools versions, and older exports say MB where newer ones say MiB. Print your columns before writing any filters. RVTools is a configuration snapshot, not performance history. It cannot tell you utilisation over time. You still want around 30 days of vCenter stats and a P95 per VM before you size anything. Check vDisk for independent/persistent disk mode and RDMs. Both break most snapshot-based migration tooling. Check vMemory for ballooned and swapped. That tells you where you are already past comfortable overcommit. RVTools cannot see inside the guest, so it will not tell you where SQL Server is installed. On some estates the Windows and SQL per-core licensing delta is bigger than the hypervisor saving, and it follows you to whatever you migrate to. Use a dedicated read-only account, not an admin one, and treat the export as sensitive. It is a complete map of your estate. One framing thing. Moving to a managed vSphere offering on a hyperscaler is not an exit, it is a change of landlord. It may still be the right call if you are up against a datacentre lease deadline, but it is worth saying out loud in the writeup before someone else does. Also worth pricing honestly: "renew a smaller, cleaned-up footprint" is a legitimate option, and doing the cleanup makes every other option cheaper too. Curious what ratios other people are finding when they actually pull the numbers. The provisioned-to-consumed gap seems to be the one that surprises people most. submitted by /u/RulezZzOr to r/sysadmin [link] [comments]

submitted by /u/RnadmolyGneeraedt to r/FinOps [link] [comments]

For a small team with a few services, an enterprise checklist can become ceremony without reducing the main risks. My minimum gate would cover a tested rollback, backups with a restore exercise, health and readiness checks, bounded timeouts and retries, an alert owner, log correlation, secret ownership, and a short incident runbook. I would add load testing or multi-region recovery only when the service’s traffic and recovery target justify them. Which item has prevented a real incident for a small team, and which common checklist item has mostly created busywork? submitted by /u/UkrMalt to r/devops [link] [comments]

submitted by /u/Spiritual-Kitchen-79 to r/FinOps [link] [comments]

tldr; my coding agent refused to leak a secret after setting up the toolkit and running it through the wringer. Secrets Manager shipped a "secret safety" skill in the aws-core plugin of Agent Toolkit for AWS . The idea is that an agent can use a secret without ever seeing the plaintext. I ran it against a throwaway secret in a real account with Claude Code, then spent a while trying to get around it. Posting the findings in case it saves someone else the same trial and error. How it actually works, which is two layers not one: A PreToolUse hook that denies the tool call before it executes and hands the agent a message pointing at the safe path. A wrapper called asm-exec plus {{resolve:secretsmanager:...}} dynamic references. The agent's command holds a placeholder, asm-exec resolves it in its own process, and the plaintext never lands in the model's context. I tested ten fetch shapes against the hook. Six denied, four correctly allowed. It catches the CLI fetch, the batch fetch, structured API calls, a boto3 call buried in a script, a curl straight at the local daemon on port 2773, and an inline python3 -c one-liner. It leaves writes, unrelated calls and a plain grep alone. A few things that tripped me up: The skill usually refuses before the hook ever fires. When I just asked for the value in plain language, the agent declined on its own, cited the skill and pointed me at asm-exec . The deny message never appeared because no tool call was attempted. I only saw the hook fire when I insisted it actually run the command. The skill is what changes the agent's mind, the hook is the backstop for when it tries anyway. Hooks load at session start. Install the plugin mid-session, retry, and the secret comes back exactly as before. You have to restart the agent session. This is in the docs but it is easy to miss and it looks like the feature is broken. aws configure agent-toolkit does not install this one. That's the one-command setup for all agents, and it pulls from the skills catalog. The secret-safety skill and the hook only ship with the aws-core plugin, so if you set up via the CLI you don't get the block. I have the steps I took to get this setup in the full blog linked below. The safe path still calls GetSecretValue . It is not read-free. Your identity still needs secretsmanager:GetSecretValue , and the read still lands in CloudTrail. What changes is where the plaintext ends up, not whether the API is called. CloudTrail attribution is nicer than I expected, but not how I first assumed. Reads through the MCP endpoint show invokedBy , sourceIPAddress and userAgent all as aws-mcp.amazonaws.com , so agent reads are trivially separable from your own. The aws:CalledViaAWSMCP context key is a related but separate thing, it is what you write IAM and SCP conditions against rather than a field in the event record. The hook is shape-aware, and the boundary is sharper than the docs suggest. grep get-secret-value ./src is allowed. grep 'aws secretsmanager get-secret-value' ./src is denied, because the CLI pattern is checked before the read-only allowlist applies. Same for rg and echo . I tripped it grepping my own notes for this writeup. Stack: Claude Code on macOS, one throwaway secret with fake values in us-east-1, deleted afterward. See the full walkthrough using Claude Code here Happy to answer questions. If you find a fetch shape it misses, post it. For folks already using the toolkit, if there is something in the developer experience that could be better, tell me and I'll pass it to the team. submitted by /u/j-vogel to r/aws [link] [comments]

[ Removed by Reddit on account of violating the content policy . ] submitted by /u/hadez1999 to r/FinOps [link] [comments]

I currently manage 2 different environments: a dev server running in ec2 and an EKS environment for production server. Problem is that their setup is different, which adds extra management and makes it harder to test prod changes before deployment. I can spawn a UAT EKS for load testing and preparing for prod but it would be just too expensive. I already raised the cost concerns with EKS that this would be an expensive and unnecessary setup but the clients wanted it so I did it. Now they're complaining with cost. I'm just trying to find the best way to manage the current architecture without increasing costs too much. How would you handle this? submitted by /u/RoundCircle12 to r/devops [link] [comments]

Probably been answered else where but even AI gets it wrong (surprise surprise). Have a client with a few MS365 business licences. He wants an estimate of costs. Can find previous invoices easy enough but renewal costs has me stumped. AI says to switch off auto renew to get an estimate but no go. Can't believe giving MS a blank cheque is good biz for anyone bar MS or even legal. So how do I get an estimate from the portal? submitted by /u/mujikcom to r/sysadmin [link] [comments]

I’ve been thinking about this while working with observability systems and I’m curious how other people handle it. We have metrics, logs, traces, alerts, deployment information, etc. In theory, there should be enough information to understand what happened during an incident. But in practice, it often seems like the hard part is connecting everything. Something like: latency spike → database saturation → retries → downstream failures The individual signals are there, but figuring out that they’re all part of the same failure — and determining which event was actually the cause — still seems to require a lot of manual investigation. For people who actually operate production systems: what does your RCA process look like when there’s a serious incident? Do your current observability tools actually help you establish the causal chain, or are they primarily helping you find the relevant data? I’m particularly interested in what happens when the information is spread across multiple systems. submitted by /u/Acceptable_Duty4044 to r/devops [link] [comments]

Case ID: 178633616200405 AWS charged my debit card $600 for a transaction that does not belong to my AWS account. My normal AWS bill is about $3.40/month, and this $600 charge appears nowhere in my billing history. I opened a support case with all the transaction details, and AWS still has not meaningfully investigated it. After multiple calls, one Amazon/AWS support agent told me they could see that the charge came from another AWS account that had already been suspended. Despite that, AWS's fraud department later emailed me saying they found nothing wrong with my account, completely missing the issue. Another agent told me the $600 had already been refunded, while another told me the refund was rejected. Wise is refusing to treat the charge as unauthorized because I have legitimately used AWS before and says AWS needs to provide information about the transaction. AWS keeps claiming another department will investigate, but nothing actually happens. At this point, AWS has acknowledged that the charge came from another account, has apparently suspended that account, and still will not properly resolve or document the fraudulent $600 charge they processed against my card. The complete lack of ownership, contradictory information, and failure to investigate is unacceptable. submitted by /u/polarmass to r/aws [link] [comments]

I'm working to try and change the primary domain inside of a Google Workspace. The workspace had chromeOS devices provisioned. I opened up a support ticket with Google and they stated that I just needed to de-provision those devices, which I have now done, and that the licensing needed to be removed which they have done. The error I'm getting says: Changing your primary domain is not available for: Accounts that included the purchase of your domain when you signed up Accounts in a free trial period Accounts purchased from Google Domains G Suite legacy free edition Google Workspace for Education Google Workspace Resellers Chrome Enterprise Upgrade (Standalone, Offline) Chrome Education Upgrade (Standalone, Offline) Kiosk and Signage Upgrade (Standalone, Offline) Chrome Management Hangouts Software The issue is, I don't know that that is the *ONLY* thing that is erroring out. Support is just useless in the matter and keeps linking me the same support docs that do not answer the question. My question: How do I know that deprovisioning these devices is the 1 out of 11 things that it's erroring out about? They are saying I have to wait 24 hours, then try again, and if I get another error, to wait another 24 hours and open up a new ticket. One of the support guys responses was "All the chrome upgrades is the reason for the errors that you are receiving, It falls to this; - Chrome Enterprise Upgrade or Chrome Education Upgrade licenses purchased through an authorized partner - Standalone Chrome Enterprise Upgrade purchased through an authorized partner, Chrome Enterprise trials, and standalone Chrome Education Upgrade" Which I was pointing out, well, if it's failing for multiple reasons, why would you not be able to address those other issues now, rather than having to wait 24 hours between issue? Anyone by chance have any advice? submitted by /u/nme_ to r/sysadmin [link] [comments]

After over a decade working in software sales, along with dealing with a recent layoff, I'm seriously considering making a career switch into IT. It's something I've wanted to do for several years, but I never really had a clear idea of what the path into the industry would look like. I have some limited technical experience and have been learning Python and SQL on my own, but I wouldn't consider myself an experienced programmer. Right now, I'm particularly interested in Linux System Administration and potentially working my way toward DevOps, SRE, or Cloud Engineering down the road. I've been looking closely at Yellow Tail Tech's Linux System Administrator & DevOps Training Program. A friend of mine made a similar career switch and completed the program in 2024. He was eventually able to land a Site Reliability Operations Engineer role, so seeing someone I personally know make the transition has made me more interested in the program. I'm normally pretty skeptical of bootcamps and career-training programs, so I'm not taking the decision lightly. One thing that interests me about this program is that it's around 10 months and includes an unpaid apprenticeship, which would give me an opportunity to get some hands-on experience and potentially have something relevant to put on my resume. I actually considered joining their September cohort but decided to hold off until January so I could spend the next few months doing as much research as possible before committing. The biggest thing giving me pause is the cost. I would need to take out a loan to pay for the program, so I want to be very confident that I'm making a smart investment rather than making an impulse decision because I'm currently unemployed. I'm fully aware that completing a program doesn't guarantee a job, and I'm not expecting to go from zero experience to a six-figure DevOps job immediately. I'm prepared for the possibility that I'll need to start in an entry-level IT/Linux role and work my way up. For those who currently work in Linux, System Administration, DevOps, SRE, or related fields: Is a program like this actually worth paying for, or would you recommend going the self-study/certification route? Has anyone here completed Yellow Tail Tech's program? What was your experience? How valuable is the apprenticeship portion when trying to land that first IT job? Given my background in software sales, would you see that as an advantage, disadvantage, or mostly irrelevant when applying for technical roles? If you were in my position, what would you do over the next 6–12 months to make yourself employable? Are there specific certifications, projects, or skills you'd prioritize before spending money on a program like this? I'm not necessarily looking for someone to tell me whether I should or shouldn't do the program. I'm more interested in hearing from people who have actually made a similar career transition and what you would do differently if you were starting over. Any honest feedback, including criticism of the plan, would be greatly appreciated. submitted by /u/Cheem1014 to r/sysadmin [link] [comments]

Hello I’m 28 years old. I’m not married, I don’t have a partner. I don’t have children. I don’t have pets. I’m on my own for everything at the moment. I’m currently enrolled in an apprenticeship in Networks & Systems Administration (Sysadmin). I recently got an internship offer at Google. I’m in Belgium, so this type of opportunity, especially as a student, is very rare and hard to get here. I’m very excited about this opportunity, but there are some elements I need to seriously take into account before jumping on it: - Commute (from Monday to Friday): 245km (150 miles) per day. Leave home at 7:00AM and drive for 100 minutes, leave work at 6:00PM and drive back home for 100 minutes. That’s best case scenario, without traffic jams. Highways here often have heavy traffic jams, so honestly I’m probably looking at a 120-minute/2-hour commute for a single trip on most days. Which means I’d get home at around 8:00PM. Here, shops close at 6:00PM and supermarkets at 8:00PM. Working from home isn’t possible during the internship. - School obligations: I have class on every Saturday from 09:00AM until 4:00PM. - Transportation: No public transport reaches the workplace. I’d have to use my personal car and pay for the fuel costs. My car is from 2023 and has 7000km (4500 miles). From my calculations, I’d have to spend about 600€ ($700) per month on fuel alone. The increased wear and tear on my car means that I’ll have to get car maintenance twice per year, so I’d be spending about 400€ ($460) for car maintenance each year, instead of the usual 150-180€. The workplace is located in an area where it snows a lot during winter, so I’d have to spend about 500€ ($580) on new winter tyres the first year. - Income: The internship pays 1000€ ($1200) per month, or 12K€ ($14.4K) per year, which isn’t enough to cover all of my monthly expenses. No possible help from my family. I’d have to take about 500€ ($580) out of my savings each month to cover all of my expenses for 2 years. By my calculations, my savings can juuusssttt cover my expenses for the 2 years. I won’t have much left after that. If something happens to my car, I won’t have enough money to replace it. - Long-term and after the internship: The recruiter told me that because of my profile, and if the internship goes great, it’s highly likely that I will be offered a permanent contract after the internship. But a lot can happen in 2 years, so who really knows… Worst case, I have the experience of working for Google and it looks great on my CV. For 2 years, and maybe more, my professional life will be great, but my personal and social life will be non-existent. Is an internship at Google worth that? I value my time with my friends and my time doing sports activities a lot, I really need that to change my mind and decompress, but I also want to build a good career. I also received other internship offers from 2 other companies. These companies are a lot closer to me. I’d have to drive 15 minutes to get there. But they’re both small MSP companies and my role would be Helpdesk in a 3-people team and no access to infrastructure at all, basically just answering the phone and solving problems from a distance. But at Google, I would be part of a big team, I would be mentored by a senior employee and I would work with infrastructure every day. Google checks all of the boxes for me. Except for the fact that it’s really far away. What would you do if you were in my place? Thanks! submitted by /u/bluedorar to r/sysadmin [link] [comments]