u/baever

You can use the pre-token generation lambda trigger to modify claims even with a refresh token. https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html

If you have a method of signaling to the client that the group membership has changed and to dynamically look up group membership, triggering a refresh and then injecting current groups in your lambda trigger could work. It would also work if the client performs some action it knows would modify the groups (update the paid plan for example) and initiates a refresh to cause the lambda trigger to run.

In the display drop-down, try setting it to display columns with details. When I set it to that I see the stream link as the rightmost column.

Is it something you can enable somewhere or does it require a support ticket? I got this too when I attempted to use it last year but never could figure out how to enable it.

Are you the same developer as this? https://cloudda.sh/ If not, expect some confusion and consider a different product name.

Yes, these messages appear on Android phones since 2023.

I emit 1 structured log entry per request with details on if it's my error (fault) or customer error (error). I then set alarms to trigger based on thresholds and have dashboards that summarize top faults by different dimensions. I've written about it here: https://speedrun.nobackspacecrew.com/blog/2023/09/08/logging-for-scale.html

Does your requirements.txt list all the packages?

I've done a bit of work with this and wrote an article https://speedrun.nobackspacecrew.com/blog/2025/07/21/the-fastest-node-22-lambda-coldstart-configuration.html

If you're bundling the v3 sdk, you can save 40 ms by excluding unnecessary credentials providers and 20-25 ms on end to end time by not using environment variables. The part about saving 50ms by patching http support is no longer necessary after the sdk team started lazy-loading http in version 3.1011.0.

There's a lambda extension which polls parameter store periodically based on a ttl to obtain the latest value: https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-integration-lambda-extensions.html

Alternatively, if you set the log level via an environment variable and deploy it, new instances will be spun up for new requests and all existing instances will be terminated after the request they are processing completes.

The Wikipedia article you reference has the following information under the picture on why it's in the public domain:

-The creator(s) died before 22 August 1980, for works that their copyright expired before 22 August 2010 according to the 1970 law. -The creator(s) died more than 50 years ago. (Reformation of article 12 - 22 August 2010)

Could it be that the 2013 date is when it became public domain, not when it was taken?

GetUserAttributeVerificationCode has a quota of 5 requests/user/hour. The only thing I can think of is that the bucket is based on hour of day. So if you start at 1:59 and make 4 requests and then at 2:01 you make 4 requests (for a total of 8) it won't block you because those span 2 hour buckets. However, if you make 6 requests in the same hour (say between 2:01 and 2:05) it should block you because it's in 1 hour bucket. Are you never seeing it enforced or are you seeing it intermittently enforced?

All these scenarios are solvable with engineering effort

> If when you need to replay a failed event (cache won't help, you need to force reprocess)?

You can either clone the event with a new id when you redrive or delete the existing id entry from the ddb table.

> Or when you want visibility into all pending/in-flight events (not just idempotency keys)?

The ddb table has inflight events, depending on the source of the events, you may not be able to easily see pending events.

> Or when your event sources aren't all Lambda-triggered (e.g., direct HTTP ingestion)?

You'll need idempotency on every ingestion point if you want to ensure something is only processed once.

Take a look at Lambda Powertools' idempotency utility It is available for multiple languages and is built for this use case.

AssumeRoleWithWebIdentity does not support cross account role assumption.

If you do role chaining you could use an external id set to the repo with a trust policy that only allows those external IDs.

The stack set that stamps out the same identity provider in each account is likely your best option.

I mainly see it on cloudwatch dashboard pages as well.

I'm seeing it on my 2021 MBP M1 Pro with Firefox 146.01/Tahoe 26.1 and ublock origin with multi account turned on. It's typically happening when returning to a tab after a period of inactivity.

Externally, Identity Center is the closest thing to Isengard. It provides group based access to temporary credentials in roles. If you need just in time access to your roles use TEAM. If you want the easier console deeplink functionality and to quickly pivot between accounts and roles use Speedrun.

If you watch your arm64 node cold starts like me, occasionally (1/20) there is an outlier that is 50ms faster than average. It's possible a few of the fleet are on a newer graviton instance. This is in us-west-2.

AWS Cognito is for providing sign-up and sign-in capabilities for modern web and mobile applications. It is not for signing into AWS. You probably signed up for something called Sterling Candidates using it: https://share.google/ezqLtPYcO7RGnO0iA

I saw that, but it's still not clear whether automation broke everything, part of it, or just the regional endpoint.

What isn't explained in this summary is whether the account based dynamodb endpoints that launched in 2024 were impacted in addition to the regional endpoint. In theory, these account based endpoints should have reduced the blast radius if not all of them were wiped out. Were the internal teams that got impacted not using the account based endpoints?

Look into attribute based access control. The permissions are dynamically assigned based on user attributes.

Does the header x-amz-content-sha256 have the same restriction? I think it will reject with SignatureMismatch or similar error if you include it in the signed headers and it doesn't match the payload sha256. It's a slightly different name (content vs. checksum).

Veo has instructions on how to verify it is correctly inserted If it's still not showing up and it's pushed all the way in, work with Veo support, you might have a defective unit.

When it's correctly inserted, you'll be able to follow the instructions in this comment to set the custom APN value to Wholesale. No username/password are necessary.

Mint Mobile works great. Our team got the $15/month unlimited deal that is going on through September '25. The Veo uses phone data so you get 35GB before it starts throttling. That's more than enough for a month of games even if you're in tournaments.

When you get the SIM, set it up as a new phone number. Insert it in the Veo and set the APN to Wholesale in settings. It takes a minute or so to connect to the network once you power it on.