Aws on Simple Enough Blog

The Invisible Part of the Iceberg: AWS Security Hub

Wed, 24 Jun 2026 10:00:00 +0200

When we talk about security on AWS, we first think of the visible services: GuardDuty detecting threats, Macie watching sensitive data, Inspector scanning vulnerabilities. These are the tips of the iceberg poking above the water. But beneath the surface lies a far larger mass: hundreds of scattered findings, compliance rules to follow, multiple accounts to correlate. AWS Security Hub is precisely the service that makes that invisible part usable, by gathering it into a single view.

EC2 Checklist: 7 Things to Do After Launching an Instance

Wed, 20 May 2026 19:30:00 +0100

EC2 Checklist: 7 Things to Do After Launching an Instance

Launching an EC2 instance is easy.

A few clicks in the AWS Console, and your machine is running.

In reality, however, a launched instance is not a production-ready instance.

Many production incidents stem from small details that were overlooked immediately after launch:

Misconfigured security groups
No backups
No monitoring
Missing IAM role
Poor SSH configuration
Insufficient storage
Missing tags

Here is a simple and practical checklist of 7 things you should verify immediately after launching an EC2 instance.

How to create a security group that allows only traffic coming from CloudFront?

Tue, 14 Apr 2026 17:52:00 +0100

How to create a security group that allows only traffic coming from CloudFront?

Why this question keeps coming back

In the AWS world, some questions come up again and again.
Not because they are poorly phrased, but because they point to a real friction between security, networking, and application architecture.

AWS multi-accounts: architectural solution or disguised organizational debt?

Wed, 18 Feb 2026 17:30:00 +0100

I. Introduction

Creating multiple AWS accounts is now widely presented as a near-universal best practice.
It is often introduced through simple, console-oriented tutorials that give the impression that the problem boils down to a few clicks.

This view is misleading.

Multi-account is not an implementation detail, but a fundamental architectural choice.
It directly impacts:

how teams work,
how security is enforced,
cost visibility,
the ability to automate,
and organizational resilience to human error.

When misunderstood, it creates organizational debt just as costly as traditional technical debt.

Why AWS Spot Instances Become Impossible to Get in December

Mon, 01 Dec 2025 17:08:49 +0200

I. Why AWS Spot Instances Become Impossible to Get in December

EC2 Spot Instances are a fantastic way to save 50–70% on your AWS compute costs.
They use the unused capacity of AWS data centers… but in December, this unused capacity almost completely disappears.

Result:

Auto Scaling Groups fail to launch new instances
deployments get stuck
“insufficient capacity” everywhere
Spot interruptions become much more frequent

If you’ve experienced this, rest assured: it’s not your fault, and not a configuration issue.
It’s a seasonal phenomenon, and it happens every single year.

Karpenter: The Intelligent Autoscaler for EKS

Mon, 24 Nov 2025 11:18:06 +0200

I. What is Karpenter?

Karpenter is an open-source autoscaler for Kubernetes, created by AWS.
Its purpose is to automatically adjust the EC2 node capacity of an EKS cluster based on real workload demand.

In short:

When your cluster is short on resources, Karpenter adds new nodes.
When nodes become unnecessary, it removes them.

But more importantly:

It does this faster, more intelligently, and more efficiently than Kubernetes’ traditional autoscaler (Cluster Autoscaler).

GitHub Pages vs AWS S3: Which One to Choose for Hosting Your Static Website?

Tue, 28 Oct 2025 11:00:00 +0200

I. Introduction: Context and Challenges

In today’s web landscape, static websites (HTML/CSS/JS with no backend) are highly valued for their simplicity, speed, and minimal cost. Two main solutions lead the discussion for free or low-cost hosting: GitHub Pages and AWS S3.
This article compares the two approaches in terms of technology, cost, performance, and scalability to help you choose the one that best fits your needs.

How to Host a Static Website for Free with AWS S3

Tue, 30 Sep 2025 14:00:00 +0200

I. Why Choose AWS S3 to Host a Static Website for Free?

Amazon S3 allows hosting of fully static websites (HTML, CSS, JavaScript).
With the AWS Free Tier, a small site can stay free for 12 months (up to 5 GB of storage, 20,000 GET requests & 2,000 PUT requests per month).
Highly resilient, scalable, and serverless, S3 provides 99.999999999% durability and handles traffic spikes effortlessly.
For HTTPS and custom domains, Amazon recommends using Amazon CloudFront + Route 53.

II. Prerequisites and Initial Setup

Create a bucket
Disable public access restrictions
Add a public access policy

Before deploying a static site with S3, basic configuration is required. Here’s the step-by-step setup:

Amazon Macie: A Comprehensive Solution for Data Security and Privacy

Wed, 10 Sep 2025 08:00:00 +0200

I. Introduction to Amazon Macie

Amazon Macie is a fully managed data security service provided by AWS. It uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It provides risk visibility, generates findings when security or privacy issues are detected, and automates protective actions. A 30-day free trial is included for automated S3 bucket evaluation and data scanning.

Introduction to Amazon Inspector

Wed, 03 Sep 2025 11:18:06 +0200

I. Overview of Amazon Inspector

Amazon Inspector is an automated vulnerability management service on AWS that automatically discovers workloads such as EC2 instances, container images in ECR, and Lambda functions, and continuously scans them for software vulnerabilities and unexpected network exposures.
It generates findings used to prioritize patches based on a contextualized risk score, which adapts the CVSS score according to the environment (e.g., absence of open ports).

AWS Containers

Fri, 29 Aug 2025 09:09:45 +0200

I. Introduction

Containers encapsulate an application and all its dependencies in an isolated and reproducible environment. Unlike virtual machines, containers share the host system’s kernel, making them lighter, faster to start, and easier to deploy.

This approach has revolutionized the software lifecycle by improving the portability of applications between environments (development, testing, production).

AWS offers several services to build, manage, orchestrate, and run containers. Each service fits a specific level of control, user expertise, or application type.

Report: Amazon GuardDuty Malware Protection for S3

Wed, 20 Aug 2025 10:09:45 +0200

I. What is Amazon GuardDuty?

Amazon GuardDuty is an AI-based security service that continuously monitors AWS accounts and workloads.
It uses machine learning algorithms to detect suspicious activities, abnormal behaviors, and potential threats in your cloud environment.
GuardDuty integrates seamlessly with other AWS services like S3, EC2, and IAM to provide a comprehensive view of your infrastructure’s security posture.
It also works alongside AWS CloudTrail and AWS Config to gather additional context and trigger automatic responses to threats.

Global Availability of EC2 Instance Types

Wed, 13 Aug 2025 07:57:39 +0200

I. Introduction

When designing infrastructure on AWS, one of the first technical decisions involves the EC2 instance types used. However, this decision cannot be made in isolation: the regional availability of instance types varies by geographic location, impacting your architecture’s resilience, scalability, and cost.

This article explains in detail how to understand and anticipate this global availability, with a clear approach directly applicable by developers, DevOps engineers, and data scientists.

Interview EC2

Mon, 09 Jun 2025 15:55:01 +0200

I. What is Amazon EC2 and what is it used for?

AWS Expert: Amazon EC2 (Elastic Compute Cloud) is an on-demand infrastructure service that allows you to launch virtual servers — called instances — in the cloud. It is used to host web applications, run data processing, serve as development environments, or simulate production loads.

What makes EC2 powerful is its scalability and flexibility. You can start with a small instance for testing, then scale up to high-capacity clusters without switching platforms. Developers also love the full control they get over configuration, open ports, attached disks, and more.

This is who IAM

Tue, 27 May 2025 15:33:47 +0200

I. IAM: Core Components and Concepts

IAM is based on entities and policies.

IAM Entities

Users: Represent people or applications. Example: a developer named “alice”.
Groups: Collections of users sharing the same permissions.
Roles: IAM entities that can be temporarily assumed by others. Ideal for federation or services like EC2 or Lambda.
Policies: JSON documents that define permissions attached to an entity.

Sample JSON Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "s3:ListBucket",
 "Resource": "arn:aws:s3:::example_bucket"
 }
 ]
}

This IAM policy allows an AWS entity (user, role, or group) to list the objects in a specific S3 bucket named example_bucket. It uses the standard IAM version format (2012-10-17) and allows the s3:ListBucket action on the resource identified by its ARN. It lets the entity see the list of objects (names, sizes, metadata), but not read or modify them—unless additional permissions are granted. This minimal policy is often used for inventory or bucket navigation via the AWS Console or API.

3 Simple Ways to Save Up to 90% on EC2 Costs: Spot Instances

Fri, 02 May 2025 17:08:49 +0200

I. Introduction to Spot Instances

Amazon EC2 Spot Instances offer a powerful way to drastically reduce cloud computing costs. Designed to utilize unused Amazon EC2 capacity, these instances are available at a price up to 90% lower than On-Demand instances.

While these savings are appealing, Spot Instances are not suitable for all workloads. They are ideal for flexible, interruption-tolerant, or distributed jobs such as data processing, machine learning training, or performance testing.

A problem. Don’t panic, prepare a support ticket

Fri, 25 Apr 2025 13:10:00 +0100

I. Identify and Reproduce the Problem Precisely

Before contacting AWS Support, it’s crucial to clearly document the observed behavior. The goal is to enable the support team to quickly analyze the context. Start by identifying the service involved: EC2, S3, Lambda, or another component of your cloud infrastructure. Documenting an incident clearly is key to avoiding unnecessary back-and-forth.

Introduction to AWS ELB

Sat, 15 Mar 2025 21:11:49 +0000

I. Introduction to Load Balancers in AWS

An Elastic Load Balancer (ELB) acts as a traffic distributor, automatically spreading incoming traffic across multiple target resources such as EC2 instances, containers, or IP addresses.

This functionality is a cornerstone of fault-tolerant and highly available cloud application design. AWS offers three types of ELB tailored to different use cases, each with specific features.

Amazon EventBridge vs Amazon SNS: Which Solution to Choose?

Tue, 11 Mar 2025 10:05:00 +0100

Introduction

In this article, we will compare these two services, explore their use cases, and see how to integrate them effectively into an AWS architecture.

I. Comparison of Amazon EventBridge vs Amazon SNS

Feature	Amazon EventBridge	Amazon SNS
Communication Type	Event-Driven	Publish-Subscribe (Pub/Sub)
Use Cases	Event routing between AWS services and SaaS applications	Sending notifications to subscribers (emails, SMS, Lambda, SQS, etc.)
Message Sources	AWS Services, SaaS applications, custom applications	Applications, users, AWS services
Targeting Consumers	Advanced filtering rules to send an event to one or multiple targets	Sends the same message to all topic subscribers
Supported Protocols	AWS Lambda, SQS, API Gateway, Kinesis, Step Functions, etc.	Emails, SMS, Lambda, SQS, HTTP(S) endpoints, mobile applications (FCM, APN)
Message Filtering	Advanced filtering based on JSON rules	Limited filtering based on message attributes
Architecture	Event-driven and integrates with other AWS services	Notification-based messaging between producers and consumers
Durability & Message Retention	No native storage (events are routed immediately)	Messages stored for 4 days (up to 14 days with Extended Retention)
Message Ordering	Not guaranteed (messages may arrive out of order)	FIFO ordering available with SNS FIFO

II. Detailed Use Cases

A. Amazon EventBridge Use Case: Orchestrating Events Between Services

EventBridge is ideal for connecting different AWS services and SaaS applications.

The 5 Must-Read Whitepapers

Sat, 01 Mar 2025 10:56:41 +0100

Prepare for Your First AWS Certification with These Essential Whitepapers

AWS whitepapers help you gain an in-depth understanding of best practices and cloud architectures. These free resources are invaluable for anyone looking to pass their certification exam successfully.

In this article, we introduce the key whitepapers for your preparation and explain how to use them effectively.

I. Why Read AWS Whitepapers?

AWS whitepapers are written by cloud experts and provide practical guidance on designing, managing, and securing AWS infrastructures. They cover topics ranging from general architecture principles to performance and security best practices. Reading these documents allows you to deepen your knowledge beyond simple tutorials and better understand the requirements of AWS fundamental or associate-level exams.

Reverse

Tue, 25 Feb 2025 00:00:00 +0000

Visualization tool. Triggering a scan to generate IaC for AWS. Infrastructure History.

How to Filter S3 Events by Object Size?

Tue, 18 Feb 2025 17:16:31 +0100

I. When Do You Need to Filter S3 Events by Object Size?

Filtering S3 events by object size is useful in various scenarios, especially when triggered actions depend on file volume. Here are some concrete use cases where this filtering is relevant:

1. Cost Optimization and Storage Management

Automatically deleting oversized files: Prevents the accumulation of unnecessary files that take up space and generate extra costs.
Automatically moving files to lower-cost storage (e.g., Glacier) when they exceed a certain size.

2. Process Automation

Executing a specific process on large files (e.g., video/audio conversion, compression, splitting large files into smaller chunks).
Triggering a Lambda function to index only relevant files based on their size.

3. Security and Compliance

Avoiding the storage of excessively large files in public buckets, which could lead to abuse (e.g., uploading large archives by malicious users).
Triggering an alert or blocking uploads if a user exceeds a defined size limit.

4. Data Flow Optimization

Directing small files to real-time processing (Lambda, Kinesis) and larger files to batch processing to optimize system efficiency.
Redirecting files based on their size to different buckets (e.g., files < 1MB to a high-speed access bucket, files > 100MB to cold storage).

5. Monitoring and Reporting

Generating reports on storage usage by filtering objects exceeding a critical size.
Detecting anomalies, such as sudden uploads of very large files, which could indicate an issue (e.g., massive log errors, data leaks, etc.).

II. How to Filter S3 Events by Object Size? c3 Methods

1. Filtering via AWS EventBridge and AWS Lambda

AWS S3 sends events to EventBridge or an AWS Lambda function. Unfortunately, EventBridge rules do not directly allow filtering by object size. However, you can configure an AWS Lambda function to process events and apply filtering based on size.

Demystifying AWS KMS

Sun, 19 Jan 2025 09:56:41 +0100

I. Introduction to AWS KMS

A. What is AWS KMS?

AWS KMS, short for Key Management Service, is a fully managed service designed to simplify the creation, management, and control of encryption keys. Everytime encryption is mentioned in AWS services like EBS, S3, RDS, or SSM, AWS KMS is probably involved. This service integrates seamlessly with IAM and, of course, it also ensures robust access control and auditing through CloudTrail.

A Brief History of AWS Architectures

Fri, 20 Dec 2024 09:56:41 +0100

I. The Early Days of AWS and Cloud Computing (2002 - 2006)

Context: The Origin of the AWS Project

Before AWS became a cloud giant, Amazon.com (the e-commerce site) had to manage a massive IT infrastructure to support its rapid growth. The company invested in expensive data centers and had to anticipate server capacity for peak traffic periods (such as Black Friday). However, much of this capacity remained unused outside of high-demand periods.

Learn AWS by Yourself? 10 Services to Know

Wed, 20 Nov 2024 09:56:41 +0100

Here are the 10 essential services to master to fully leverage AWS.

1. IAM (Identity and Access Management)

IAM is the AWS service that allows you to manage access to your account’s resources. It plays a crucial role in security by controlling who can do what on your cloud infrastructure. With IAM, you can create individual users or group multiple users into groups. You can also define roles that allow other AWS services to interact with each other.