TIL

AWS Payment Cryptography PVK algorithm has a documentation inconsistency

Bedrock Converse API tool use calls multiple tools in parallel in a single turn

With 3 tool types and 4 total calls needed in Bedrock Converse API tool use, the model requested all 4 in a single response instead of calling them sequentially. The implementation must handle multiple toolUse blocks per turn.

ECS NLB infra role policy ARN has no service-role/ prefix

AmazonECSInfrastructureRolePolicyForLoadBalancers ARN doesn't use the service-role/ prefix. Using the same pattern as other ECS policies causes AttachRolePolicy to fail.

ECS update-service can dynamically switch between Linear and Canary

No need to recreate the ECS service — update-service with --deployment-configuration switches between Linear and Canary strategies in place.

ElastiCache for Valkey requires CreateReplicationGroup, not CreateCacheCluster

aws elasticache create-cache-cluster --engine valkey fails with InvalidParameterValue. Valkey engine requires the CreateReplicationGroup API even for single-node clusters.

RDS StorageEncrypted: false does not mean unencrypted

Aurora Express Configuration clusters return StorageEncrypted: false, but the official documentation states they are encrypted with RDS service-owned keys. An example where the API response contradicts the docs.

EKS Pod Identity session policy AccessDenied errors clearly state the cause

Session policy denials say 'no session policy allows', while IAM role denials say 'no identity-based policy allows'. Knowing the difference makes IAM troubleshooting much easier.

Network Firewall Proxy PreRequest rules work for HTTP even without TLS intercept

HTTP absolute-form requests expose headers to the proxy without TLS decryption. The documentation's 'only filter based on IP' statement applies to HTTPS only.

Network Firewall Proxy SourceIp is NATed when accessed via PrivateLink

Cross-VPC access through PrivateLink endpoints NATs the source IP to the endpoint's ENI IP. Use SourceVpc or SourceVpce instead of SourceIp for cross-VPC source identification.

Aurora PostgreSQL Blue/Green with custom parameter groups requires a pre-created Green parameter group

Creating a Blue/Green deployment with a major version upgrade on an Aurora PostgreSQL cluster using a custom parameter group fails with InvalidParameterCombination. You must explicitly specify a Green parameter group.