# AWS hub Hub: aws Section served: docs Start here: call the `_hello` tool on the MCP endpoint below. It says what this endpoint is and names the first document to read; every answer after it names the next call. No key and no header are needed to read a public hub. Canonical document URL: https://cuppy.io/aws/doc/{path without .md} Raw markdown URL: https://cuppy.io/aws/docs/{path} Raw file URL: the same path with its .md extension Sitemap: https://cuppy.io/aws/sitemap.xml MCP endpoint: https://cuppy.io/mcp/aws — start with the `_hello` tool: ranked search across the hub, the merged view when you work in a layer, workarounds matched to the error you hit, and depth control. Something wrong in this document? Report it with the `session feedback` tool on the same endpoint. ## Folders - changelog/ — 1 files, 513 tokens - changelog/doc-findings/ — 1 files, 8254 tokens - examples/ — 1 files, 2365 tokens - examples/healthcare-master-data/ — 11 files, 38084 tokens - guides/ — 1 files, 1797 tokens - guides/cdk/ — 2 files, 4108 tokens - guides/cloudformation/ — 1 files, 2204 tokens - guides/cloudfront/ — 1 files, 1730 tokens - guides/cloudtrail/ — 1 files, 2019 tokens - guides/cloudwatch/ — 2 files, 4025 tokens - guides/dynamodb/ — 1 files, 1782 tokens - guides/ec2/ — 1 files, 1726 tokens - guides/ecs/ — 2 files, 3452 tokens - guides/elb/ — 2 files, 3452 tokens - guides/eventbridge/ — 1 files, 2335 tokens - guides/iam/ — 6 files, 10189 tokens - guides/identity-center/ — 1 files, 2374 tokens - guides/lambda/ — 2 files, 3811 tokens - guides/rds/ — 1 files, 1671 tokens - guides/route53/ — 1 files, 1558 tokens - guides/s3/ — 4 files, 5732 tokens - guides/secrets-manager/ — 1 files, 2101 tokens - guides/sqs/ — 1 files, 2263 tokens - guides/vpc/ — 2 files, 4009 tokens - patterns/ — 15 files, 26646 tokens - patterns/alternatives/ — 5 files, 7954 tokens - patterns/iam/ — 1 files, 2078 tokens - reference/acm/ — 1 files, 1475 tokens - reference/cdk/ — 2 files, 4574 tokens - reference/cloudformation/ — 3 files, 8338 tokens - reference/cloudfront/ — 1 files, 3004 tokens - reference/cloudtrail/ — 2 files, 3269 tokens - reference/cloudwatch/ — 4 files, 8194 tokens - reference/dynamodb/ — 2 files, 3941 tokens - reference/ec2/ — 3 files, 5379 tokens - reference/ecs/ — 2 files, 4334 tokens - reference/elb/ — 3 files, 5082 tokens - reference/eventbridge/ — 2 files, 3671 tokens - reference/iam/ — 5 files, 10704 tokens - reference/identity-center/ — 3 files, 6162 tokens - reference/kms/ — 1 files, 1828 tokens - reference/lambda/ — 4 files, 7661 tokens - reference/organizations/ — 1 files, 1721 tokens - reference/overview/ — 1 files, 3004 tokens - reference/rds/ — 2 files, 3428 tokens - reference/route53/ — 1 files, 1531 tokens - reference/s3/ — 7 files, 11675 tokens - reference/sns/ — 2 files, 3666 tokens - reference/sqs/ — 2 files, 3804 tokens - reference/sts/ — 3 files, 5219 tokens - reference/vpc/ — 4 files, 6719 tokens ## Hub pages - https://cuppy.io/aws — the hub's front page: what it is, its folder spine with counts - https://cuppy.io/aws/documents/{folder} — one folder, laid out as a catalog or a reading list - https://cuppy.io/aws/doc/{path without .md} — one document, rendered - https://cuppy.io/aws/search?q={query} — one search over this hub (on a host this hub serves directly, drop the `/aws` prefix: /, /documents/{folder}, /doc/{path}, /search) ## Files - HUB.md — 2SVS-REVC — AWS hub — boot/markdown — 428 tokens — asserted - changelog/2026-10-19-first-release.md — QFGH-BWZQ — AWS hub — first release (2026-10-19) — reference/markdown — 513 tokens — asserted - changelog/doc-findings/aws-doc-findings.md — 1YS2-VYNJ — Where AWS's documentation disagrees with itself — 21 verified findings (2026-10-21) — reference/markdown — 8254 tokens — asserted - examples/healthcare-master-data/00-overview-and-decision.md — HKST-6FW6 — Native AWS healthcare master data: the decision — example/markdown — 2546 tokens — asserted - examples/healthcare-master-data/01-reference-architecture.md — Y4DQ-4KEH — Reference architecture for a HIPAA healthcare master — example/markdown — 3626 tokens — asserted - examples/healthcare-master-data/02-identity-resolution-and-survivorship.md — WS0W-HVNJ — Identity resolution and survivorship without an MDM licence — example/markdown — 4066 tokens — asserted - examples/healthcare-master-data/03-data-model-and-fhir.md — J8ZS-SF0G — The master data model and FHIR interoperability — example/markdown — 3361 tokens — asserted - examples/healthcare-master-data/04-security-and-hipaa.md — 5ZQZ-MGHG — Security and HIPAA for a native healthcare master — example/markdown — 4175 tokens — asserted - examples/healthcare-master-data/05-stewardship-and-data-quality.md — 97E8-77RA — Stewardship and data quality — example/markdown — 3263 tokens — asserted - examples/healthcare-master-data/06-operations-scaling-and-performance.md — 1AYG-P6FX — Operations, scaling and performance — example/markdown — 3634 tokens — asserted - examples/healthcare-master-data/07-cost-model.md — 89JV-WRE9 — Cost model and where the savings come from — example/markdown — 3487 tokens — asserted - examples/healthcare-master-data/08-gaps-and-custom-code-register.md — W2JS-PC7V — Gaps and custom-code register — example/markdown — 3989 tokens — asserted - examples/healthcare-master-data/09-interview-brief.md — DDYH-N27X — Interview brief: the pattern in one page — example/markdown — 3997 tokens — asserted - examples/healthcare-master-data/README.md — 9R0D-3HVZ — Healthcare master data on AWS without an MDM licence — example/markdown — 1940 tokens — asserted - examples/sqs-lambda-worker-cdk.md — SB9W-GKFY — Example project: SQS worker on Lambda with DLQ and alarms (CDK, TypeScript) — example/markdown — 2365 tokens — asserted - guides/cdk/bootstrap-and-deploy.md — 05CR-4AGQ — Bootstrap an environment and deploy with the CDK — guide/markdown — 1755 tokens — asserted - guides/cdk/write-stacks-in-typescript.md — 0EJH-JBZ8 — Write CDK stacks in TypeScript that deploy cleanly — guide/markdown — 2353 tokens — asserted - guides/cloudformation/fix-failed-stack.md — 4BZH-FPYE — Fix a failed CloudFormation stack — guide/markdown — 2204 tokens — asserted - guides/cloudfront/serve-s3-privately.md — T3FM-F7ZG — Serve a private S3 bucket through CloudFront with OAC — guide/markdown — 1730 tokens — asserted - guides/cloudtrail/find-who-did-what.md — 143C-87EV — Find who changed something, or why a call was denied, with CloudTrail — guide/markdown — 2019 tokens — asserted - guides/cloudwatch/create-alarms.md — TMJ8-3H3A — Create CloudWatch alarms that fire when they should — guide/markdown — 2177 tokens — asserted - guides/cloudwatch/query-logs.md — VHXE-77N1 — Query CloudWatch Logs with Logs Insights — guide/markdown — 1848 tokens — asserted - guides/dynamodb/design-and-access.md — SHR9-MGGP — Design a DynamoDB table and read and write it correctly — guide/markdown — 1782 tokens — asserted - guides/ec2/launch-instance.md — F3GE-HT3Q — Launch an EC2 instance safely — guide/markdown — 1726 tokens — asserted - guides/ecs/express-mode.md — 342J-XT4E — Deploy a web service with ECS Express Mode — guide/markdown — 1496 tokens — asserted - guides/ecs/run-fargate-task.md — GB9S-RJKF — Run a container on ECS Fargate — guide/markdown — 1956 tokens — asserted - guides/elb/create-https-alb.md — B4MM-3VY5 — Put an HTTPS Application Load Balancer in front of a service — guide/markdown — 1772 tokens — asserted - guides/elb/fix-alb-5xx.md — 3TNR-J9EE — Fix 502, 503 and 504 from an Application Load Balancer — guide/markdown — 1680 tokens — asserted - guides/eventbridge/route-events.md — PVR3-DRQB — Route events with EventBridge rules — guide/markdown — 2335 tokens — asserted - guides/iam/ci-oidc-github.md — JE04-YZV4 — Let GitHub Actions deploy to AWS without stored keys — guide/markdown — 1835 tokens — asserted - guides/iam/create-service-role.md — VJY9-SB7F — Give an AWS service a role it can assume — guide/markdown — 1525 tokens — asserted - guides/iam/cross-account-access.md — 4E07-5KSH — Let a principal in one account act in another — guide/markdown — 1623 tokens — asserted - guides/iam/fix-access-denied.md — JSHZ-DGYG — Diagnose an AccessDenied from the error text to the policy — guide/markdown — 2076 tokens — asserted - guides/iam/least-privilege-policy.md — AX0F-9XHK — Write a least-privilege policy and check it before deploying — guide/markdown — 1720 tokens — asserted - guides/iam/local-credentials.md — EJD4-6GJK — Get credentials for local development and confirm which identity is in use — guide/markdown — 1410 tokens — asserted - guides/identity-center/set-up-sso.md — 7P0E-SFRG — Set up workforce SSO with IAM Identity Center and an external IdP — guide/markdown — 2374 tokens — asserted - guides/lambda/debug-failing-function.md — ZV3P-JR3C — Debug a Lambda function that fails, times out or is throttled — guide/markdown — 2012 tokens — asserted - guides/lambda/deploy-function.md — 1TAT-T4FF — Deploy a TypeScript Lambda function — guide/markdown — 1799 tokens — asserted - guides/rds/connect-securely.md — EZT7-PVEX — Connect an application to RDS or Aurora securely — guide/markdown — 1671 tokens — asserted - guides/route53/point-domain-at-aws.md — N92F-GPPW — Point a domain at CloudFront or a load balancer — guide/markdown — 1558 tokens — asserted - guides/s3/create-secure-bucket.md — EFNN-BAKJ — Create a bucket that is private, encrypted and HTTPS-only by default — guide/markdown — 1489 tokens — asserted - guides/s3/fix-403.md — YF6K-W93W — Diagnose an S3 403 Forbidden — guide/markdown — 1578 tokens — asserted - guides/s3/share-with-presigned-urls.md — WN6G-MPYQ — Share or accept an object with a presigned URL — guide/markdown — 1337 tokens — asserted - guides/s3/upload-large-objects.md — Z4SQ-ZA0V — Upload large objects with multipart upload — guide/markdown — 1328 tokens — asserted - guides/secrets-manager/rotate-secrets.md — NGHW-0XEA — Rotate database secrets with Secrets Manager — guide/markdown — 2101 tokens — asserted - guides/sqs/send-and-receive.md — E0BZ-CV6R — Send and receive SQS messages correctly — guide/markdown — 2263 tokens — asserted - guides/vpc/build-private-network.md — QQ43-CMR1 — Build a VPC for private workloads — guide/markdown — 1885 tokens — asserted - guides/vpc/diagnose-connection-timeout.md — AJWB-W6CR — Diagnose "it deployed but cannot connect" — guide/markdown — 2124 tokens — asserted - guides/when-the-console-has-changed.md — 50Y4-F7QT — When the console has changed — guide/markdown — 1797 tokens — asserted - patterns/alb-to-ecs-fargate.md — Q5EM-SS37 — ALB to ECS Fargate: target type ip and security group chaining — pattern/markdown — 1382 tokens — asserted - patterns/alternatives/choosing-compute.md — YW45-29EP — Choosing compute: Lambda, Fargate, EC2, App Runner's replacement, and edge functions — pattern/markdown — 1639 tokens — asserted - patterns/alternatives/choosing-messaging.md — R7G7-EFRE — Choosing messaging: SQS, SNS, EventBridge (and Kafka or MQ) — pattern/markdown — 1477 tokens — asserted - patterns/alternatives/edge-and-dns-outside-aws.md — B5CE-1CN1 — Edge and DNS outside AWS: a third-party CDN or DNS in front of AWS origins — pattern/markdown — 1583 tokens — asserted - patterns/alternatives/identity-choices.md — KK2V-94ZQ — Identity choices: Identity Center, IAM federation, Cognito and external IdPs — pattern/markdown — 1514 tokens — asserted - patterns/alternatives/s3-compatible-storage.md — 7058-MKTD — S3 and S3-compatible storage: what carries over and what breaks — pattern/markdown — 1741 tokens — asserted - patterns/cloudfront-to-alb.md — 63BT-KWT6 — CloudFront to a load balancer: VPC origins or a locked-down public ALB — pattern/markdown — 1739 tokens — asserted - patterns/cloudfront-to-s3.md — 7P24-6VX9 — CloudFront to S3: OAC, bucket policy and KMS — pattern/markdown — 1447 tokens — asserted - patterns/dynamodb-streams-to-lambda.md — CWCV-R0V3 — DynamoDB Streams to Lambda — pattern/markdown — 1772 tokens — asserted - patterns/ecs-to-ecr.md — 25C4-36Z9 — ECS Fargate pulling from ECR — pattern/markdown — 1467 tokens — asserted - patterns/external-idp-to-identity-center.md — P7RT-ZQVX — External IdP to IAM Identity Center: SAML for sign-in, SCIM for users — pattern/markdown — 1653 tokens — asserted - patterns/github-actions-to-cdk-deploy.md — D5D8-JB1T — GitHub Actions to cdk deploy (OIDC role to CDK bootstrap roles) — pattern/markdown — 1807 tokens — asserted - patterns/iam-to-s3.md — RJZR-Y9C1 — IAM to S3: every layer that votes on a request — pattern/markdown — 1608 tokens — asserted - patterns/iam-to-vpc-endpoints.md — TGER-J63A — IAM to VPC endpoints: the extra policy on the network path — pattern/markdown — 1764 tokens — asserted - patterns/iam/trust-policies.md — VZNY-HXEY — Trust policies: known-good shapes and the mistakes that bite — pattern/markdown — 2078 tokens — asserted - patterns/lambda-in-vpc.md — WR7Y-0CMK — Lambda in a VPC: reaching the internet and AWS services — pattern/markdown — 1525 tokens — asserted - patterns/lambda-to-rds.md — A444-3Z9F — Lambda to RDS or Aurora: VPC, connections and credentials — pattern/markdown — 1222 tokens — asserted - patterns/s3-to-lambda.md — VMG0-X0MF — S3 event notifications to Lambda — pattern/markdown — 1959 tokens — asserted - patterns/sns-to-sqs-fanout.md — T0QY-VWPM — SNS to SQS fan-out — pattern/markdown — 2375 tokens — asserted - patterns/sqs-to-lambda.md — G74H-CXJH — SQS to Lambda (event source mapping) — pattern/markdown — 2834 tokens — asserted - patterns/xray-to-opentelemetry.md — NYXR-VJ6T — Tracing on AWS with OpenTelemetry (X-Ray SDK replacement) — pattern/markdown — 2092 tokens — asserted - reference/acm/certificates.md — D9DE-JDDT — ACM certificates for load balancers and CloudFront — reference/markdown — 1475 tokens — asserted - reference/cdk/bootstrap-roles-and-trust.md — RK6C-5S9Q — CDK bootstrap resources, roles and trust — reference/markdown — 1997 tokens — asserted - reference/cdk/errors.md — MGG0-0X5M — AWS CDK CLI errors — reference/markdown — 2577 tokens — asserted - reference/cloudformation/change-sets-drift-and-import.md — M64Q-6G5M — CloudFormation change sets, drift, import and cross-stack references — reference/markdown — 2499 tokens — asserted - reference/cloudformation/errors.md — Y44G-Q97X — AWS CloudFormation errors — reference/markdown — 3004 tokens — asserted - reference/cloudformation/stack-operations.md — 7Q2F-SG1R — CloudFormation stack operations — what each call changes — reference/markdown — 2835 tokens — asserted - reference/cloudfront/errors.md — PVW8-NAG3 — Amazon CloudFront errors — reference/markdown — 3004 tokens — asserted - reference/cloudtrail/errors.md — D51T-M3ED — CloudTrail errors — reference/markdown — 1360 tokens — asserted - reference/cloudtrail/event-records.md — K26T-NN3M — CloudTrail event records and userIdentity — reference/markdown — 1909 tokens — asserted - reference/cloudwatch/errors.md — 5XN6-S5CE — CloudWatch Logs and CloudWatch metrics errors — reference/markdown — 2577 tokens — asserted - reference/cloudwatch/log-groups.md — XCP5-0KJY — CloudWatch log groups: retention, classes, tiering, encryption and Lambda log format — reference/markdown — 1848 tokens — asserted - reference/cloudwatch/logs-insights-queries.md — W5EK-WDA7 — Logs Insights queries for the hub's error catalogues — example/markdown — 1594 tokens — asserted - reference/cloudwatch/metrics-and-math.md — QT04-VGV8 — CloudWatch metrics: identity, retention, publishing, EMF and metric math — reference/markdown — 2175 tokens — asserted - reference/dynamodb/errors.md — 2HVP-R0RX — Amazon DynamoDB errors — reference/markdown — 1951 tokens — asserted - reference/dynamodb/ttl-pitr-and-global-tables.md — M6B0-D7N1 — DynamoDB TTL, point-in-time recovery and global tables — reference/markdown — 1990 tokens — asserted - reference/ec2/auto-scaling-and-spot.md — 615P-QB6B — EC2 Auto Scaling launch failures and Spot interruptions — reference/markdown — 1770 tokens — asserted - reference/ec2/errors.md — 1ATC-M3EP — Amazon EC2 API errors — reference/markdown — 1816 tokens — asserted - reference/ec2/instance-metadata-and-roles.md — 7D8H-EBTE — Instance metadata (IMDSv2) and instance roles — reference/markdown — 1793 tokens — asserted - reference/ecs/errors.md — KY1N-FSK2 — Amazon ECS on Fargate errors — reference/markdown — 2819 tokens — asserted - reference/ecs/roles-and-networking.md — M91Z-VR2M — ECS task roles, Fargate sizes and networking — reference/markdown — 1515 tokens — asserted - reference/elb/errors.md — NPAD-6HHW — Application Load Balancer errors and target health reason codes — reference/markdown — 2329 tokens — asserted - reference/elb/health-checks-and-timeouts.md — 6H8R-4BGB — ALB health checks, timeouts and attributes — reference/markdown — 1348 tokens — asserted - reference/elb/nlb.md — QER9-JPQ9 — Network Load Balancer behaviour and failures — reference/markdown — 1405 tokens — asserted - reference/eventbridge/errors.md — FQG4-ZMMT — EventBridge errors and troubleshooting — reference/markdown — 2385 tokens — asserted - reference/eventbridge/event-patterns.md — A5EN-YQHV — EventBridge event pattern syntax — reference/markdown — 1286 tokens — asserted - reference/iam/errors.md — 4FA8-31XJ — IAM authorization errors — reference/markdown — 2983 tokens — asserted - reference/iam/limits.md — T0ZN-E6JS — IAM and STS limits that cause failures, and how to read the live values — reference/markdown — 1391 tokens — asserted - reference/iam/policy-evaluation.md — 9C8N-8K9X — How AWS decides allow or deny — reference/markdown — 2045 tokens — asserted - reference/iam/policy-grammar-and-conditions.md — NV25-312X — Policy JSON, condition operators and the keys that matter — reference/markdown — 2178 tokens — asserted - reference/iam/roles-and-trust.md — 0MSE-GAKQ — Roles, trust policies, service-linked roles and PassRole — reference/markdown — 2107 tokens — asserted - reference/identity-center/errors.md — G3BN-R05V — IAM Identity Center (SSO) errors — reference/markdown — 3011 tokens — asserted - reference/identity-center/permission-sets-and-access.md — HXN9-0P8D — IAM Identity Center: permission sets, account access, recent changes — reference/markdown — 1679 tokens — asserted - reference/identity-center/provisioned-roles-and-sessions.md — X4PE-95CT — Identity Center provisioned roles, session lengths and propagation — reference/markdown — 1472 tokens — asserted - reference/kms/key-policies-and-errors.md — ZYM8-8XFN — KMS key policies, grants and errors — reference/markdown — 1828 tokens — asserted - reference/lambda/errors.md — 9030-SAQ0 — AWS Lambda errors — reference/markdown — 2665 tokens — asserted - reference/lambda/invoke.md — Q7D6-1W8S — Invoke: the exact request, what it returns and how it fails — reference/markdown — 1465 tokens — asserted - reference/lambda/permissions.md — EE5Q-7WR9 — Lambda's two policies: execution role and resource-based policy — reference/markdown — 2116 tokens — asserted - reference/lambda/runtimes-and-limits.md — JP09-5W8P — Lambda runtimes, deprecation dates and fixed limits — reference/markdown — 1415 tokens — asserted - reference/organizations/scps-and-rcps.md — 6Q6K-FZBX — SCPs and RCPs: what they cap and how they inherit — reference/markdown — 1721 tokens — asserted - reference/overview/services-and-alternatives.md — KF3K-DYTG — AWS services in this hub, their alternatives, and what they pair with — reference/markdown — 3004 tokens — asserted - reference/rds/backups-and-restore.md — 3M2S-CZYE — RDS backups, snapshots and restores: what each call changes and costs — reference/markdown — 1373 tokens — asserted - reference/rds/errors.md — HYWR-RVVC — Amazon RDS and Aurora errors and bad states — reference/markdown — 2055 tokens — asserted - reference/route53/records-and-changes.md — 5HK2-FMTD — Route 53 records, alias targets and change batches — reference/markdown — 1531 tokens — asserted - reference/s3/access-control.md — J2GR-47WC — How S3 decides access: policies, ownership, Block Public Access, access points — reference/markdown — 1857 tokens — asserted - reference/s3/bucket-and-object-errors.md — Y31X-AE2H — Amazon S3 bucket, object and upload errors — reference/markdown — 1719 tokens — asserted - reference/s3/buckets-and-objects.md — JMR2-H9KZ — Buckets and objects: naming, namespace, consistency, size limits, Regions — reference/markdown — 1787 tokens — asserted - reference/s3/encryption.md — YVKG-Q7G2 — S3 encryption: SSE-S3, SSE-KMS, Bucket Keys, SSE-C and TLS — reference/markdown — 1486 tokens — asserted - reference/s3/errors.md — VP6N-203K — Amazon S3 access and request errors — reference/markdown — 2319 tokens — asserted - reference/s3/put-object.md — KQXP-PERH — PutObject and GetObject: the exact request, what it changes and what it costs — reference/markdown — 1375 tokens — asserted - reference/s3/replication-and-object-lock.md — THC2-NRX3 — S3 replication and Object Lock: requirements and surprises — reference/markdown — 1132 tokens — asserted - reference/sns/errors.md — CH67-VC09 — Amazon SNS errors and delivery failures — reference/markdown — 2224 tokens — asserted - reference/sns/filter-policies.md — WHD6-N7Q4 — SNS subscription filter policies — reference/markdown — 1442 tokens — asserted - reference/sqs/errors.md — Y6S2-0KZ4 — Amazon SQS errors — reference/markdown — 2364 tokens — asserted - reference/sqs/queue-settings-and-encryption.md — MC7Q-TYGR — SQS queue settings, FIFO options and encryption — reference/markdown — 1440 tokens — asserted - reference/sts/assume-role.md — H09T-EQXW — AssumeRole: the exact request, what it changes and what it costs — reference/markdown — 1799 tokens — asserted - reference/sts/credential-sources.md — RG3C-GB4F — Where the CLI and SDKs get credentials, and why the wrong identity gets used — reference/markdown — 1374 tokens — asserted - reference/sts/errors.md — 9H6Q-WAPM — STS and credential errors — reference/markdown — 2046 tokens — asserted - reference/vpc/errors.md — ZHYS-M7RY — VPC errors and Reachability Analyzer explanation codes — reference/markdown — 2212 tokens — asserted - reference/vpc/flow-logs.md — XC9F-XK6H — Reading VPC Flow Logs — reference/markdown — 1428 tokens — asserted - reference/vpc/routing-and-gateways.md — D9J7-MV61 — Routes, internet gateways, NAT gateways and Block Public Access — reference/markdown — 1695 tokens — asserted - reference/vpc/security-groups-and-nacls.md — NN11-V15C — Security groups and network ACLs — reference/markdown — 1384 tokens — asserted files_listed: 131 / files_total: 131