--- cuppy_hub: aws cuppy_path: reference/overview/services-and-alternatives.md cuppy_section: docs cuppy_doc: KF3K-DYTG cuppy_doc_uuid: 73fd00fd-0373-461c-a494-6315d3f2c258 cuppy_permalink: https://cuppy.io/aws/d/KF3K-DYTG cuppy_version: 4 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/aws/docs/reference/overview/services-and-alternatives cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: c5fdfb6a52393341ce0b7e6d8c808904e2c42537e9d7ff9d802ad155d84b65dd # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # AWS services in this hub, their alternatives, and what they pair with **Use this page to place a service, then follow the link.** "Nearest AWS alternative" says which other AWS service people choose instead; AWS's own decision guides compare them in depth. "Outside alternatives" are products teams replace or front the service with. Only facts in the linked patterns are checked, and no prices are given. ## Families covered in depth | Service | Use it for | Nearest AWS alternative | Outside alternatives | Works well with | Known friction | Read | |---|---|---|---|---|---|---| | **IAM / STS** | Roles and temporary credentials for workloads; policy evaluation | — (foundation of everything) | HashiCorp Vault-style credential brokers (named, not evaluated) | Every service; OIDC from CI | Six policy types vote; access denied without detail across organizations | `guides/iam/fix-access-denied.md` | | **IAM Identity Center** | Workforce SSO to accounts and apps | IAM SAML/OIDC federation per account; **Cognito is for your app's customers, not staff** | Okta, Microsoft Entra ID, Google Workspace, JumpCloud, OneLogin, CyberArk, Ping (as the identity source) | External IdP via SAML + SCIM; CLI `sso-session` | NameID ↔ username mismatch; Entra ID nested groups don't sync; SCIM token expires yearly | `guides/identity-center/set-up-sso.md`, `patterns/alternatives/identity-choices.md` | | **Organizations SCPs/RCPs** | Guardrails across accounts | Permissions boundaries (per principal) | — | Identity Center, Control Tower | SCPs don't apply to the management account | `reference/organizations/scps-and-rcps.md` | | **S3** | Object storage, static assets, data lake, event source | EFS (file), EBS (block): storage decision guide | Cloudflare R2, Backblaze B2 (S3 API), self-hosted S3-compatible stores | CloudFront (OAC), Lambda events, KMS | New SDK checksum defaults break some S3-compatible stores; R2 has no SSE-KMS, ACLs or Object Lock; B2 has no object ACLs or tagging | `guides/s3/fix-403.md`, `reference/s3/errors.md`, `patterns/alternatives/s3-compatible-storage.md` | | **Lambda** | Event-driven, short (≤15 min) functions | **Fargate** (long-running, stateful, containers) | Cloudflare Workers (edge isolates, CPU-time limits); other clouds' functions (named) | S3, SQS, EventBridge, API Gateway, ALB | Timeouts in VPCs without NAT; 6 MB sync payload; recursive loops | `guides/lambda/debug-failing-function.md`, `patterns/alternatives/choosing-compute.md` | | **ECS on Fargate** | Containers without servers | **EKS** (Kubernetes), ECS on EC2; **ECS Express Mode** replaces App Runner | Other clouds' container runtimes (named) | ALB (`ip` targets), ECR, Secrets Manager | Image pulls need ECR + S3 routes; two roles confused | `guides/ecs/run-fargate-task.md`, `patterns/alb-to-ecs-fargate.md` | | **EC2** | Full control of VMs, GPUs, special OS needs | Lightsail, Elastic Beanstalk (simpler); Batch | — | SSM Session Manager, Auto Scaling, ALB | IMDSv2 hop limit with containers; capacity and vCPU-quota errors | `guides/ec2/launch-instance.md` | | **App Runner** | (Legacy) source or image → web service | **Closed to new customers**; AWS points to **ECS Express Mode** | — | — | No new features; migrate blue/green with Route 53 weights | `patterns/alternatives/choosing-compute.md` | | **VPC** | Private networks, subnets, routing, NAT, endpoints | VPC Lattice (service-to-service), PrivateLink, Transit Gateway | — | Every compute service | Silent timeouts; VPC Block Public Access; public IPv4 billed | `guides/vpc/diagnose-connection-timeout.md` | | **ALB / NLB** | HTTP(S) routing / L4 pass-through | API Gateway (APIs), Global Accelerator | — | ECS, EC2, Lambda, CloudFront, ACM | Keep-alive shorter than idle timeout → 502; NLB hairpin with client-IP preservation | `guides/elb/fix-alb-5xx.md`, `reference/elb/nlb.md` | | **CloudFront** | CDN, TLS edge, origin shield for S3, ALB, private origins | Global Accelerator (non-HTTP, static IPs) | Cloudflare, Fastly, Akamai (named, not evaluated) | S3 (OAC), ALB (VPC origins), ACM in us-east-1, WAF | Certificates must be in us-east-1; website endpoints can't use OAC | `guides/cloudfront/serve-s3-privately.md`, `patterns/alternatives/edge-and-dns-outside-aws.md` | | **Route 53** | Authoritative DNS, alias records, health checks | — | Cloudflare DNS (CNAME flattening at the apex), others (named) | ALB, CloudFront, ACM DNS validation | Alias records exist only inside Route 53; registrar name-server mismatch | `guides/route53/point-domain-at-aws.md` | | **CloudFormation** | Declarative stacks; change sets, drift, import | — (the engine under the CDK and SAM) | Terraform / OpenTofu, Pulumi (named, not evaluated) | CDK, SAM, Organizations StackSets | `ROLLBACK_COMPLETE` can only be deleted; replacement ignores `DeletionPolicy`; express mode (2026) turns rollback off by default | `guides/cloudformation/fix-failed-stack.md`, `reference/cloudformation/errors.md` | | **CDK** | Infrastructure in TypeScript (and other languages), synthesized to CloudFormation | Plain CloudFormation; SAM for serverless | Pulumi, CDKTF-style tools (named, not evaluated) | GitHub OIDC → bootstrap roles; grants | Bootstrap per environment; default execution role is `AdministratorAccess`; exports lock stacks together | `guides/cdk/bootstrap-and-deploy.md`, `guides/cdk/write-stacks-in-typescript.md` | | **Secrets Manager** | Stored, rotated credentials | SSM Parameter Store (named, not evaluated); IAM DB auth for RDS | External vaults (named) | RDS-managed master passwords; ECS and Lambda secrets | Rotation function needs network access to the Secrets Manager endpoint; RDS Proxy doesn't support alternating users | `guides/secrets-manager/rotate-secrets.md` | | **CloudWatch** (Logs, metrics, alarms) | Logs, Logs Insights queries, metrics, EMF, alarms | CloudTrail for *who did what*; X-Ray (via OpenTelemetry) for traces | OpenTelemetry-based and SaaS monitoring tools (named, not evaluated) | Lambda, ECS, VPC Flow Logs, CloudTrail trails | Log groups never expire by default; new metrics take up to 15 min to list; `TreatMissingData: missing` hides error-only metrics | `guides/cloudwatch/query-logs.md`, `guides/cloudwatch/create-alarms.md`, `reference/cloudwatch/errors.md` | | **CloudTrail** | API audit: who did what, and what was denied | CloudWatch for operational health (complementary) | SIEM tools (named, not evaluated) | CloudWatch Logs, EventBridge, Lake | Event history: management events, 90 days, one Region, 2 req/s; data events opt-in | `guides/cloudtrail/find-who-did-what.md`, `reference/cloudtrail/errors.md` | | **X-Ray** | Distributed traces | — | OpenTelemetry backends (named) | OpenTelemetry SDK/ADOT → CloudWatch agent or Collector | X-Ray SDKs and daemon in maintenance since 2026-02-25 | `patterns/xray-to-opentelemetry.md` | | **SQS / SNS / EventBridge** | Queues; push fan-out; content-routed event bus | Amazon MQ, MSK (decision guide) | Kafka, RabbitMQ, other clouds' pub/sub (named) | Lambda triggers, S3 notifications, CloudWatch alarms | Service producers can't use `aws/sqs`; SNS/EventBridge discard after retries without a DLQ; IAM events only in us-east-1 | `patterns/alternatives/choosing-messaging.md`, `patterns/sqs-to-lambda.md` | | **ACM** | Free public TLS certificates for AWS endpoints | — | Certificates from any Mozilla-trusted CA, imported | ALB, NLB, CloudFront | Pending validation, 72-hour timeout; Region rules | `reference/acm/certificates.md` | All eight charter families are built. The database decision guide also names Aurora DSQL, DocumentDB, Keyspaces, ElastiCache/MemoryDB, Neptune and Timestream; outside IaC alternatives (Terraform/OpenTofu, Pulumi) are named only. ## Out of scope for this release Generative AI and ML (Bedrock, SageMaker); analytics and warehousing (Glue, Athena, Redshift, EMR, OpenSearch); partitions other than `aws`; billing, support and Marketplace. AWS publishes decision guides for these too (analytics, ML, "Bedrock or SageMaker AI?"). ## How to use the alternatives columns - **Choosing inside AWS** → read the AWS decision guide for the category (index: `https://docs.aws.amazon.com/decision-guides/index.md`), then the hub's guide for the service you pick. - **Replacing or fronting an AWS service with an outside one** → read the matching `patterns/alternatives/` document. It lists what keeps working (APIs, SDKs, IAM) and what silently stops (headers, encryption modes, alias records). --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.