Today I Learned — Daily learnings
With 3 tool types and 4 total calls needed in Bedrock Converse API tool use, the model requested all 4 in a single response instead of calling them sequentially. The implementation must handle multiple toolUse blocks per turn.
AmazonECSInfrastructureRolePolicyForLoadBalancers ARN doesn't use the service-role/ prefix. Using the same pattern as other ECS policies causes AttachRolePolicy to fail.
No need to recreate the ECS service — update-service with --deployment-configuration switches between Linear and Canary strategies in place.
aws elasticache create-cache-cluster --engine valkey fails with InvalidParameterValue. Valkey engine requires the CreateReplicationGroup API even for single-node clusters.
Aurora Express Configuration clusters return StorageEncrypted: false, but the official documentation states they are encrypted with RDS service-owned keys. An example where the API response contradicts the docs.
Session policy denials say 'no session policy allows', while IAM role denials say 'no identity-based policy allows'. Knowing the difference makes IAM troubleshooting much easier.
HTTP absolute-form requests expose headers to the proxy without TLS decryption. The documentation's 'only filter based on IP' statement applies to HTTPS only.
Cross-VPC access through PrivateLink endpoints NATs the source IP to the endpoint's ENI IP. Use SourceVpc or SourceVpce instead of SourceIp for cross-VPC source identification.
Creating a Blue/Green deployment with a major version upgrade on an Aurora PostgreSQL cluster using a custom parameter group fails with InvalidParameterCombination. You must explicitly specify a Green parameter group.
Running create-blue-green-deployment with the default parameter group fails with SourceClusterNotSupportedFault. Set rds.logical_replication = 1 for PostgreSQL or binlog_format = ROW for MySQL, then reboot all instances.