Categories
cloud sysadmin

Sign up for AWS (new): simpler onboarding and a spending limit

AWS appears to be taking a fresh look at how to get developers started. Its documentation now describes a new sign-up experience called Sign up for AWS (new) – which I’ll simply refer to as AWS (new) in this post.

Over the last 20 years, AWS has gained a lot of capabilities (over 200+ products as of today), and a fair amount of complexity along with them. That flexibility is useful when you know what you are doing. For a new developer who just wants to deploy an application, there is quite a lot to understand before getting to the actual work.

AWS (new) seems to be an attempt to reduce that initial complexity through preconfigured defaults, easier collaboration and built-in cost controls. Of these, the spending limit is probably the most important.

New Sign Up

The traditional AWS sign-up process creates an AWS account with its own sign-in and access-management arrangements. AWS Builder ID is a separate identity, which has contributed to some confusion about which account to use for which purpose.

With the new sign-up experience, you can use an existing Google, Apple, GitHub or Amazon login. AWS also creates an AWS Builder ID as part of the process.

You can start from the sign-up page, or choose the new experience when signing up through the AWS website. After completing your details, AWS provisions your first project. You manage projects, collaborators and billing through AWS Settings. At the time of writing, AWS says this experience is being released to a limited number of customers, so it may not be available to everyone yet.

Project

AWS (new) introduces the concept of a project. At first glance, this might sound like an AWS resource group. However, a project contains an AWS account together with settings for sharing access with collaborators.

This makes collaboration part of the initial experience. You can invite team members through AWS Settings without bothering with IAM roles and policies – which is very hard to get right.

Having said that, simpler permissions also mean less flexibility. According to the collaboration documentation, invited team members receive admin access to the services and resources in the project. They cannot change the owner’s spend limit or perform certain billing and project-management actions.

That seems convenient for a small team building together, but for teams that need different permissions for developers, testers etc, the advanced experience is likely to be more suitable.

Spend limit

For years, developers have been asking for a way to limit AWS bills. It is very easy to leave resources running, misconfigure an application or underestimate how quickly usage can grow.

Budget alerts help but someone still has to act on them. You might be asleep when an alert arrives and wake up to an unexpectedly huge bill. Too many alerts can also lead to alert fatigue – that happens to me. Some developers resort to custom scripts and budget-triggered automation, but it is not easy to cover every service and test that it works.

AWS (new) provides a more direct solution. On the Paid Plan, you can set a monthly spend limit for each project. When usage reaches the limit, AWS pauses the project and stops its resources to contain costs.

The limit applies to pre-tax charges and excludes credits. Its minimum is the greater of US$20 or AWS’s conservative estimate of your likely spending. To reactivate a paused project, you increase the limit; some resources may need a manual restart. AWS also states that project data is permanently deleted if no action is taken within 90 days of the pause.

For experimentation and learning, this could remove a significant source of anxiety – I know some developers who refuse to use AWS for this reason. For production, you need to be comfortable with the possibility of an interruption.

It remains to be seen how smoothly pausing and restarting works in practice. I would want to try this with a few different services before relying on it for an application that other people depend on.

Trade-offs

AWS (new) supports a limited set of services and features. The supported-services list list the services supported, and it is worth checking this against your application’s requirements. There are also limits on particular capabilities, including some cross-Region operations. AWS’s comparison of sign-up options points users towards the advanced experience when they need full control over account configuration, fine-grained permissions or specific regulatory requirements.

I feel that AWS is developing two entry points for different needs:

  • A simpler developer experience, for individuals and small teams that want to start building with less setup and more predictable spending.
  • An advanced experience, for users and organisations that need the full range of services, configuration options and governance controls.

AWS says users can activate advanced features when needed. But it could ease the initial onboarding and make the transition to the full experience more gradual, as they become more familiar with AWS and expand their requirements.

Conclusion

AWS (new) looks like a useful step towards making AWS more approachable. Easier sign-in and collaboration should help developers get started, but the spend limit could be the killer feature. If it works reliably in practice, experimenting on AWS may finally feel a little less like leaving the meter running.

Categories
cloud legal

Build production-ready applications without infrastructure complexity using Amazon ECS Express Mode | AWS News Blog

AWS just introduced a new wizard UI called Amazon ECS Express Mode. Amazon ECS is Amazon’s own container orchestration service. Compared to EKS, it is much simpler. However there are still quite a number of concepts (eg. task definition, task, service etc) to learn and steps to perform. ECS Express Mode simplifies it to just a single page or single CLI command. It’s like the equivalent of LightSail for EC2.

Honestly, I am not sure who the intended audience is for ECS Express Mode. It is ok for spinning up something quickly for demonstrations or testing purposes. However, for teams operating production-ready ECS clusters, the required configurations are typically more complex, eg. multiple container images, more sophisticated autoscaling strategies, and various networking and storage requirements etc. A more useful feature might be to import docker compose configuration directly.

Amazon ECS Express Mode provides a simplified interface to the Amazon ECS service resource with new integrations for creating commonly used resources across AWS. ECS Express Mode automatically provisions and configures ECS clusters, task definitions, Application Load Balancers, auto scaling policies, and Amazon Route 53 domains from a single entry point.

Categories
cloud

Free data transfer out to internet when moving out of AWS

One of the common complaint about using AWS is the egress fees, which can be quite significant if a company wants to transfer lots of data out of the cloud. I happen to chance upon this announcement which I missed last year, that talks about a way for customers to perform data transfer out (DTO) for free.

The caveat is that this offer is only for customers who are migrating away from AWS, and you will need to contact support to make a request – although it says AWS doesn’t require customers to close their accounts. Also, it appears that the “free exit” window is time-limited. Meaning once you get an approval, you should quickly migrate your data before the free DTO window is over.

We believe this choice must include the one to migrate your data to another cloud provider or on-premises. That’s why, starting today, we’re waiving data transfer out to the internet (DTO) charges when you want to move outside of AWS.

– Source

Categories
ai cloud

DeepSeek-R1 now available as a fully managed serverless model in Amazon Bedrock

In my previous writeup, I wrote that you have to spent a lot (using GPU), or put up with very slow performance (using CPU) if you wanted to use Deepseek R1 on AWS. Not anymore. AWS now offers Deepseek R1 as a base model starting from 10 Mar 2025 (in selected regions). Check out AWS blog on the demo walkthrough.

Just take note that you may have to increase the maximum output length in order to complete your request – this applies to most reasoning models. In my test, output was abruptly stopped halfway, as the default output token length is only 4096. Extending the output length solves the problem.

Categories
cloud

The AWS Management Console now supports simultaneous sign-in for multiple AWS accounts – AWS

Finally, AWS has a new feature to support multiple AWS accounts in the same browser easily. The problem faced by people using multiple AWS accounts is that you can only log in to one AWS account console at any one time – at least using the same browser. Workarounds include use of different browsers (eg. one console in Chrome, one in Safari etc), use of incognito mode, or – my favourite – use of browser containers in Firefox, but they all come with limitations. Now you don’t have to do that anymore.

Today, AWS announces multi-session support, which enables AWS customers to access multiple AWS accounts simultaneously in the AWS Console. AWS Customers can sign-in to up to 5 sessions in a single browser, and this can be any combination of root, IAM, or federated roles in different accounts or in the same account.

 

Categories
ai cloud

How Many ‘Copilots’ Do We Need?

Dear companies, please stop using the term “Copilot” for everything. It is honestly confusing and doesn’t help anyone. Imagine a conversation like this:

Person A: Hey, have you tried Copilot? It's honestly amazing!
Person B: Yeah! I was using it to finish writing my Python assignment in half the time!
Person C: I didn't know you can do that? I was using Copilot to setup my AWS ECS services
Person D: Wait what? Isn't Copilot for summarizing emails and drafting Word documents?

¯\_(ツ)_/¯
How many “Copilots” are out there really? Let’s see.

Github Copilot

This should be familiar to developers.

GitHub Copilot is an AI coding assistant that helps you write code faster and with less effort, allowing you to focus more energy on problem solving and collaboration.

From the website

In short: Coding assistant

AWS Copilot

This one is less well-known, unless you are a AWS power user.

AWS Copilot is an open source command line interface that makes it easy for developers to build, release, and operate production ready containerized applications on AWS App Runner, Amazon ECS, and AWS Fargate.

From the website

To be fair, AWS Copilot was launched in 2020, before everyone started using the term to mean some form of AI assistant.

In short: Another AWS command line tool

It gets more confusing from here.

Microsoft Copilot (formerly known as Bing Chat, or Bing AI)

I can’t actually find an official definition for Microsoft Copilot. Lol.
As of Nov 2024, if you do a search and end up in the above page, all you see is a chat interface and page titled “Microsoft Copilot – Your AI companion”.

In short: ChatGPT variant

Note that if you sign in using your work Microsoft account, you will be unable to use Microsoft Copilot. You must either:

  1. Sign in with a personal account, or
  2. Sign out completely, or
  3. Use Microsoft 365 Copilot (see next section)

In addition, the features you can use in (1) and (2) are slightly different. Sounds confusing? Let’s go on.

Microsoft 365 Copilot

The official page for Microsoft 365 Copilot is full of marketing-speak. It doesn’t help that different features are available depending on the region you are in. For the purpose of this article, we’ll go with the US version.

Based on info from the page, Microsoft 365 Copilot is an AI-powered virtual assistant that is integrated into Microsoft 365 apps like Word, Excel, PowerPoint, and Outlook. The gist of what is included is covered in the pricing section – a per-user license is required. When you meet others at work talking about “Copilot”, they are mostly likely referring to this.

In short: Clippy on steroids

Microsoft Dynamics 365 Copilot

There’s not a lot of content on this. Just a blog post from Microsoft. From what I can tell, Microsoft Dynamics 365 Copilot is an add-on to Microsoft Dynamics 365 range of products that deals with CRM and ERP.

In short: A chat interface for Dynamics 365

Microsoft Copilot in Azure

This newly launched feature is in preview, and the official website says: Simplify operations and management from cloud to edge with an AI companion.

In short: FAQ for Azure

Actually there are more, like this and that, and also not forgetting this. And I’m sure I’m missing quite a few others as well. Hopefully we will quickly move past this fad and avoid situations like the hypothetical conversion at the beginning of this article.

Or if you are still confused, you can always ask “Copilot”. 🙂

Categories
ai cloud

AWS AI Certifications

AWS is launching not one, but two new AI certifications, as demand for AI skills skyrockets.

For those who are unaware, AWS certification comes in 4 levels, roughly in terms of difficulty/professional experience required:

  • Foundational
  • Associate
  • Professional
  • Specialty

Previously the only AWS AI certification available is their specialty one: AWS Certified Machine Learning – Specialty, which is aimed at data scientists and ML engineers. To fill the intermediate gaps, AWS will be launching the following certifications:

(Foundational) AWS Certificated AI Practitioner
(Associate) AWS Certified Machine Learning Engineer – Associate

The former is aimed at generalists (business analyst, product or project manager, sales professional) whereas the latter is targeting developers/engineers doing ML work but whom may not be full-time ML specialists.

These new certifications are marked as beta, so expect syllabus and content to change. They are currently priced at a discounted price of
USD75. The usual foundational certifications are USD100 and associate ones are USD150, so this is quite a good offer.

Registration for the new certification opens on 13 Aug 2024 and you can use Skill Builder resources listed in the certification page to prepare for it.

Categories
ai cloud

Build RAG applications with MongoDB Atlas, now available in Knowledge Bases for Amazon Bedrock | AWS News Blog

More vector database choices for Amazon Bedrock Knowledge Base. This might make sense if you are already using MongoDB Atlas.

MongoDB Atlas vector store in Knowledge Bases for Amazon Bedrock is available in the US East (N. Virginia) and US West (Oregon) Regions. Be sure to check the full Region list for future updates.

Categories
ai cloud

Amazon Bedrock Knowledge Base – Part 3 (SDK)

Since the last writeup, AWS has added support for Anthropic Claude 3 model to AWS Bedrock Knowledge Base (ABKB). It has also added the ability to add your own metadata to your source files in order to perform filtering when doing query. For example, you may want to add a metadata to a certain set of files to indicate that they are from year 2023. Then during your query, you can include a filter to indicate you only want to use data from year 2023. This provides another set of tools for developers to create more relevant and targeted query. Note that filtering is only supported for FAISS vector engine.

If you’re looking to integrate ABKB into your code, there are two primary methods: using one of the AWS SDK or interacting through HTTP API. In this article, we will be using Boto3, the AWS SDK for Python. Here is a simple example to do a retrieve and generate query using Boto3. This example uses the new Claude 3 Sonnet model.

import boto3
import json

AWS_ACCESS_KEY="_your_access_key_"
AWS_SECRET_KEY="_your_secret_key_"
REGION_NAME="_your_region_"

client = boto3.client('bedrock-agent-runtime',
                      aws_access_key_id=AWS_ACCESS_KEY,
                      aws_secret_access_key=AWS_SECRET_KEY,
                      region_name=REGION_NAME
)

# retrieval and generate
response = client.retrieve_and_generate(
    input={
        'text': 'how to apply for leave'
    },
    retrieveAndGenerateConfiguration={
        'knowledgeBaseConfiguration': {
            'knowledgeBaseId': 'LEBQPJQ9BY',
            'modelArn': 'arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-sonnet-20240229-v1:0',
            'retrievalConfiguration': {
                'vectorSearchConfiguration': {
                    'overrideSearchType': 'HYBRID'
                }
            }
        },
        'type': 'KNOWLEDGE_BASE'
    }
)

print(json.dumps(response))

Running the code produces the following output in JSON:

{
  "ResponseMetadata": {
		...trimmed...
  },
  "citations": [
    {
      "generatedResponsePart": {
        "textResponsePart": {
          "span": {
            "end": 705,
            "start": 364
          },
          "text": "...trimmed..."
        }
      },
      "retrievedReferences": [
        {
          "content": {
            "text": "...trimmed..."
          },
          "location": {
            "s3Location": {
              "uri": "s3://...trimmed..."
            },
            "type": "S3"
          }
        }
      ]
    }
  ],
  "output": {
    "text": "To apply for leave as an employee on the Workday mobile app:\n\n1. Navigate to your Workday Mobile Homepage and select 'View Applications' under 'Frequently Used'\n2. Select 'Time Off'\n3. Select the date(s) you want to apply for leave\n4. Select 'Next' and choose the leave type\n5. Select any required reasons or upload attachments if applicable\n6. Submit the request To apply for leave as an employee on the Workday desktop:\n\n1. Go to the Workday Homepage and select the 'Absence' worklet\n2. Under 'Request', select 'Request Absence'\n3. Select the date(s) for the leave and click 'Request Absence'\n4. Choose the leave type\n5. Select 'Next' and provide any required reasons or attachments\n6. Submit the request"
  },
  "sessionId": "c8332417-df3c-41e5-8516-ad38cc09de15"
}

For this simple task there is not much difference in output from the various Claude models. I expect the differences will be more pronounced for complex tasks or those involving much larger context window.

With this, we conclude the three-part series on Amazon Bedrock Knowledge Base. I have covered everything from creating the knowledge base, testing it in the playground, to executing queries via CLI and SDK. Hopefully this gives a good overview of the processes involved and capabilities of this new service.

Categories
ai cloud

Amazon Bedrock Knowledge Base: Part 2 (CLI)

In Part 1, I showed how you can set up an Amazon Bedrock Knowledge Base (ABKB for short) using the AWS console. I also showed how you can perform queries against the knowledge base via the playground in AWS console. In this article, I will show how you can do the same thing via AWS CLI.

First, make sure you are using the latest version of the CLI. Otherwise some commands might not be available. To see if your CLI supports the commands, run

aws bedrock-agent-runtime help

It should return something like this:

BEDROCK-AGENT-RUNTIME()                                BEDROCK-AGENT-RUNTIME()



NAME
       bedrock-agent-runtime -

DESCRIPTION
       Amazon Bedrock Agent

AVAILABLE COMMANDS
       o help

       o retrieve

       o retrieve-and-generate

Next, make sure you have the access and secret keys configured in AWS CLI. You can do it via the usual aws configure but I usually do it in a profile since I have many AWS accounts/IAM users, eg. aws configure --profile demo. For convenience, I will use alias to use the new profile like this: alias aws='aws --profile=demo --region=us-east-1'

We can now test the retrieve command in CLI. To run the command, you will need the knowledge base ID. Strangely, there is no way to get this via the CLI 🤷.For now just copy the value from AWS console. Once that is done, you are ready to run the CLI command. Omitting optional/default parameters, this is an example of the simplest version of the command:

aws bedrock-agent-runtime retrieve \
--knowledge-base-id LEBQPJQ9BY \
--retrieval-query '{ "text": "how to apply for leave" }'

Retrieve performs a vector search using the query text and returns a list of matches with a score. As mentioned in Part 1, if you are implementing a custom RAG workflow, you can use the output of retrieve as the context for further prompting. Score ranges from 0-1, 1 being most relevant.

{
    "retrievalResults": [
        {
            "content": {
                "text": "<trimmed>"
            },
            "location": {
                "type": "S3",
                "s3Location": {
                    "uri": "s3://<trimmed>"
                }
            },
            "score": 0.75545114
        },
        {
            "content": {
                "text": "<trimmed>"
            },
            "location": {
                "type": "S3",
                "s3Location": {
                    "uri": "s3://<trimmed>"
                }
            },
            "score": 0.7345349
        },

(Note: output trimmed for brevity and sanitization)

Next we will test retrieve-and-generate command, which implements the fully managed RAG workflow.

Unlike some other CLI commands which uses model id, you will need the model ARN for querying. There is currently no way to get the model ARN from AWS console, so you will need to get it via another CLI command:

aws bedrock list-foundation-models

Not all models can be used in ABKB – at least for now. Stick to Claude Instant V1, V2, V2.1 and only use ON_DEMAND models. I made the mistake of choosing a PROVISIONED model and all I get is a cryptic error message. Yikes.

An error occurred (ValidationException) when calling the RetrieveAndGenerate operation: 1 validation error detected: Value 'arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-instant-v1:2:100k' at 'retrieveAndGenerateConfiguration.knowledgeBaseConfiguration.modelArn' failed to satisfy constraint: Member must satisfy regular expression pattern: (arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}/[a-z0-9]{12})|(:foundation-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|([0-9]{12}:provisioned-model/[a-z0-9]{12})))|([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|(([0-9a-zA-Z][_-]?)+)

With the right model ARN in hand, you are ready to execute the retrieve-and-generate command. Here is an example of the command you can execute:

aws bedrock-agent-runtime retrieve-and-generate \
--input '{ "text": "how to apply for leave" }' \
--retrieve-and-generate-configuration '
{
  "knowledgeBaseConfiguration": {
    "knowledgeBaseId": "LEBQPJQ9BY",
    "modelArn": "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-instant-v1",
    "retrievalConfiguration": {
      "vectorSearchConfiguration": {
        "overrideSearchType": "HYBRID"
      }
    }
  },
  "type": "KNOWLEDGE_BASE"
}
'

If all goes well, you will get an output like this:

{
    "sessionId": "0ff48086-f26f-4ebd-bb68-7c7bcd1e414a",
    "output": {
        "text": "To apply for leave, navigate to the Workday homepage and select the Absence worklet. Then select \"Request Absence\" and choose the date range and type of leave you want to apply for. You may need to provide additional details or attachments depending on the leave type. Finally, select \"Submit\" to complete the request."
    },
    "citations": [
        {
            "generatedResponsePart": {
                "textResponsePart": {
                    "text": "<trimmed>",
                    "span": {
                        "start": 0,
                        "end": 317
                    }
                }
            },
            "retrievedReferences": [
                {
                    "content": {
                        "text": "<trimmed>"
                    },
                    "location": {
                        "type": "S3",
                        "s3Location": {
                            "uri": "s3://<trimmed>"
                        }
                    }
                },

In an earlier attempt, I included numberOfResults in vectorSearchConfiguration and got an error message. Note that numberOfResults is currently unsupported.

Closing Thoughts

While writing this article, I noted some general observations in the terms of CLI/console usage:

  • Use of model id vs model ARN: some CLI commands use model id while others use model ARN
  • Some information can only be found in AWS console (eg. knowledge base id), others only via AWS CLI (eg. model ARN)
  • Inconsistent naming in CLI (eg. –retrieve-query vs –input) and error message (error message refers to numResults while actual field is numberOfResults)

Since ABKB is so new there are bound to be some rough edges here and there. None of these are showstoppers and I expect them to clear up over time as the service becomes more mature. For now do be aware as the service undergoes rapid development and updates.