✨ AWS Tip of the Week

Nine times out of ten, when something doesn’t work as expected on AWS, the root cause will be permissions—I’m assuming you’re not giving everyone administrator-level access. For this week’s tip, I will highlight a few important services for troubleshooting permissions issues on AWS.

First, the absolute most important AWS service for troubleshooting is CloudTrail. I’ve talked about CloudTrail in the past, and if you’re a regular reader, you know how much I love this service!

As you know, CloudTrail records all API calls in your AWS account, regardless of their origin—programmatic or console. This comprehensive logging makes it an ideal starting point for troubleshooting. With the CloudTrail console, you can swiftly filter events based on user ID and service (and others) and promptly identify any ‘Access Denied’ errors. You can use CloudWatch Logs or Athena and S3 for more advanced querying.

One important thing to note is that (by default) CloudTrail only records management events. However, you can gain deeper insights by enabling data events. These events can provide valuable information for troubleshooting but will increase the costs of your CloudTrail implementation. As always, it’s crucial to understand the pricing model of an AWS service before making configuration changes or enabling a new feature.

The IAM Policy Simulator is another crucial (often overlooked) troubleshooting tool. You can use it through the management console (my favourite way) or programmatically. The simulator lets you quickly determine if an IAM action is allowed or denied. If the action is denied, the simulator will even help identify why.

If you’re logged into your AWS account and access the simulator webpage, you can select Users, Groups and IAM Roles as part of your permissions simulation. If the AWS account is part of an AWS organization, it will also evaluate the actions against any applications Service Control Policies (SCPs). It will even simulate the effects of permissions boundaries!

You can create new policies or edit existing ones to see how those changes affect any IAM actions. Remember that no changes are applied if you create or edit existing policies in the simulator.

CloudTrail and the IAM Policy Simulator are my two ‘go-tos’ for finding and fixing permission issues in our AWS accounts or the accounts we manage on behalf of our customers. Check them out; they’ll help you be more effective and efficient!

📚 Always Be Learning

Staying with the certification theme, here are a few links to help you on your AWS journey

• Build your first Generative AI application with Amazon Bedrock
• Generative AI: Architectures and applications in depth
• Building a Generative AI-ready organization (requires a skill builder login)

📺 Exploring GenAI: AWS Services, Skills and Getting Started

Last Friday afternoon, Travers and I were joined by Deborshi and Gerardo - two AWS Senior Solution Architects, for a special edition of our weekly Talking Cloud Podcast. During the podcast, we discussed several important GenAI topics, including:

• Real-life use cases of organizations using GenAI
• The skills teams and organizations will need to succeed
• AWS services that can help you get started faster
• As always, you can watch the episode on YouTube or listen to it on Spotify.