Use this page to place a service, then follow the link. "Nearest AWS alternative" says which other AWS service people choose instead; AWS's own decision guides compare them in depth. "Outside alternatives" are products teams replace or front the service with. Only facts in the linked patterns are checked, and no prices are given.

Families covered in depth

Service	Use it for	Nearest AWS alternative	Outside alternatives	Works well with	Known friction	Read
IAM / STS	Roles and temporary credentials for workloads; policy evaluation	— (foundation of everything)	HashiCorp Vault-style credential brokers (named, not evaluated)	Every service; OIDC from CI	Six policy types vote; access denied without detail across organizations	`guides/iam/fix-access-denied.md`
IAM Identity Center	Workforce SSO to accounts and apps	IAM SAML/OIDC federation per account; Cognito is for your app's customers, not staff	Okta, Microsoft Entra ID, Google Workspace, JumpCloud, OneLogin, CyberArk, Ping (as the identity source)	External IdP via SAML + SCIM; CLI `sso-session`	NameID ↔ username mismatch; Entra ID nested groups don't sync; SCIM token expires yearly	`guides/identity-center/set-up-sso.md`, `patterns/alternatives/identity-choices.md`
Organizations SCPs/RCPs	Guardrails across accounts	Permissions boundaries (per principal)	—	Identity Center, Control Tower	SCPs don't apply to the management account	`reference/organizations/scps-and-rcps.md`
S3	Object storage, static assets, data lake, event source	EFS (file), EBS (block): storage decision guide	Cloudflare R2, Backblaze B2 (S3 API), self-hosted S3-compatible stores	CloudFront (OAC), Lambda events, KMS	New SDK checksum defaults break some S3-compatible stores; R2 has no SSE-KMS, ACLs or Object Lock; B2 has no object ACLs or tagging	`guides/s3/fix-403.md`, `reference/s3/errors.md`, `patterns/alternatives/s3-compatible-storage.md`
Lambda	Event-driven, short (≤15 min) functions	Fargate (long-running, stateful, containers)	Cloudflare Workers (edge isolates, CPU-time limits); other clouds' functions (named)	S3, SQS, EventBridge, API Gateway, ALB	Timeouts in VPCs without NAT; 6 MB sync payload; recursive loops	`guides/lambda/debug-failing-function.md`, `patterns/alternatives/choosing-compute.md`
ECS on Fargate	Containers without servers	EKS (Kubernetes), ECS on EC2; ECS Express Mode replaces App Runner	Other clouds' container runtimes (named)	ALB (`ip` targets), ECR, Secrets Manager	Image pulls need ECR + S3 routes; two roles confused	`guides/ecs/run-fargate-task.md`, `patterns/alb-to-ecs-fargate.md`
EC2	Full control of VMs, GPUs, special OS needs	Lightsail, Elastic Beanstalk (simpler); Batch	—	SSM Session Manager, Auto Scaling, ALB	IMDSv2 hop limit with containers; capacity and vCPU-quota errors	`guides/ec2/launch-instance.md`
App Runner	(Legacy) source or image → web service	Closed to new customers; AWS points to ECS Express Mode	—	—	No new features; migrate blue/green with Route 53 weights	`patterns/alternatives/choosing-compute.md`
VPC	Private networks, subnets, routing, NAT, endpoints	VPC Lattice (service-to-service), PrivateLink, Transit Gateway	—	Every compute service	Silent timeouts; VPC Block Public Access; public IPv4 billed	`guides/vpc/diagnose-connection-timeout.md`
ALB / NLB	HTTP(S) routing / L4 pass-through	API Gateway (APIs), Global Accelerator	—	ECS, EC2, Lambda, CloudFront, ACM	Keep-alive shorter than idle timeout → 502; NLB hairpin with client-IP preservation	`guides/elb/fix-alb-5xx.md`, `reference/elb/nlb.md`
CloudFront	CDN, TLS edge, origin shield for S3, ALB, private origins	Global Accelerator (non-HTTP, static IPs)	Cloudflare, Fastly, Akamai (named, not evaluated)	S3 (OAC), ALB (VPC origins), ACM in us-east-1, WAF	Certificates must be in us-east-1; website endpoints can't use OAC	`guides/cloudfront/serve-s3-privately.md`, `patterns/alternatives/edge-and-dns-outside-aws.md`
Route 53	Authoritative DNS, alias records, health checks	—	Cloudflare DNS (CNAME flattening at the apex), others (named)	ALB, CloudFront, ACM DNS validation	Alias records exist only inside Route 53; registrar name-server mismatch	`guides/route53/point-domain-at-aws.md`
CloudFormation	Declarative stacks; change sets, drift, import	— (the engine under the CDK and SAM)	Terraform / OpenTofu, Pulumi (named, not evaluated)	CDK, SAM, Organizations StackSets	`ROLLBACK_COMPLETE` can only be deleted; replacement ignores `DeletionPolicy`; express mode (2026) turns rollback off by default	`guides/cloudformation/fix-failed-stack.md`, `reference/cloudformation/errors.md`
CDK	Infrastructure in TypeScript (and other languages), synthesized to CloudFormation	Plain CloudFormation; SAM for serverless	Pulumi, CDKTF-style tools (named, not evaluated)	GitHub OIDC → bootstrap roles; grants	Bootstrap per environment; default execution role is `AdministratorAccess`; exports lock stacks together	`guides/cdk/bootstrap-and-deploy.md`, `guides/cdk/write-stacks-in-typescript.md`
Secrets Manager	Stored, rotated credentials	SSM Parameter Store (named, not evaluated); IAM DB auth for RDS	External vaults (named)	RDS-managed master passwords; ECS and Lambda secrets	Rotation function needs network access to the Secrets Manager endpoint; RDS Proxy doesn't support alternating users	`guides/secrets-manager/rotate-secrets.md`
CloudWatch (Logs, metrics, alarms)	Logs, Logs Insights queries, metrics, EMF, alarms	CloudTrail for who did what; X-Ray (via OpenTelemetry) for traces	OpenTelemetry-based and SaaS monitoring tools (named, not evaluated)	Lambda, ECS, VPC Flow Logs, CloudTrail trails	Log groups never expire by default; new metrics take up to 15 min to list; `TreatMissingData: missing` hides error-only metrics	`guides/cloudwatch/query-logs.md`, `guides/cloudwatch/create-alarms.md`, `reference/cloudwatch/errors.md`
CloudTrail	API audit: who did what, and what was denied	CloudWatch for operational health (complementary)	SIEM tools (named, not evaluated)	CloudWatch Logs, EventBridge, Lake	Event history: management events, 90 days, one Region, 2 req/s; data events opt-in	`guides/cloudtrail/find-who-did-what.md`, `reference/cloudtrail/errors.md`
X-Ray	Distributed traces	—	OpenTelemetry backends (named)	OpenTelemetry SDK/ADOT → CloudWatch agent or Collector	X-Ray SDKs and daemon in maintenance since 2026-02-25	`patterns/xray-to-opentelemetry.md`
SQS / SNS / EventBridge	Queues; push fan-out; content-routed event bus	Amazon MQ, MSK (decision guide)	Kafka, RabbitMQ, other clouds' pub/sub (named)	Lambda triggers, S3 notifications, CloudWatch alarms	Service producers can't use `aws/sqs`; SNS/EventBridge discard after retries without a DLQ; IAM events only in us-east-1	`patterns/alternatives/choosing-messaging.md`, `patterns/sqs-to-lambda.md`
ACM	Free public TLS certificates for AWS endpoints	—	Certificates from any Mozilla-trusted CA, imported	ALB, NLB, CloudFront	Pending validation, 72-hour timeout; Region rules	`reference/acm/certificates.md`

All eight charter families are built. The database decision guide also names Aurora DSQL, DocumentDB, Keyspaces, ElastiCache/MemoryDB, Neptune and Timestream; outside IaC alternatives (Terraform/OpenTofu, Pulumi) are named only.

Out of scope for this release

Generative AI and ML (Bedrock, SageMaker); analytics and warehousing (Glue, Athena, Redshift, EMR, OpenSearch); partitions other than aws; billing, support and Marketplace. AWS publishes decision guides for these too (analytics, ML, "Bedrock or SageMaker AI?").

How to use the alternatives columns

Choosing inside AWS → read the AWS decision guide for the category (index: https://docs.aws.amazon.com/decision-guides/index.md), then the hub's guide for the service you pick.
Replacing or fronting an AWS service with an outside one → read the matching patterns/alternatives/ document. It lists what keeps working (APIs, SDKs, IAM) and what silently stops (headers, encryption modes, alias records).