DEV Community: Faye Ellis

Tutorial: Secure Serverless RAG in 5 Minutes with Amazon Bedrock + S3 Vector Store

Faye Ellis — Mon, 16 Feb 2026 21:23:38 +0000

While preparing for the AWS Certified Generative AI Developer - Professional Exam I wanted to get some more hands-on experience with Guardrails, to get a better understanding of exactly what can be done with them.

Here's a five minute tutorial to quickly create an Amazon Bedrock Knowledge Base so you can easily explore Guardrails and close any knowledge gaps!

1. Create an S3 bucket

Create an S3 bucket and upload the documents that you want to include in the Knowledge Base. I used a fake corporate strategy document for a fictitious company, Ralphie Bank. Feel free to use this if you don't already have a suitable document to use!

2. Create a Knowledge Base

In the Bedrock console, click Knowledge Bases, and Create Knowledge Base. Select S3 vector store as the type.

Data source type is Amazon S3.

Then click Next and Browse S3 to select the bucket where your data is stored.

Before proceeding you have the opportunity to select a chunking strategy from a range of different strategies that are natively provided in Bedrock.

There's also the option to configure a Lambda function to perform custom chunking or data processing at this stage.

After that, click Next, and select an embeddings model, this is the model that will perform the vector embeddings that will be stored in the Knowledge Base.

Select the type of vector store you want to create. I used S3 Vectors, it is much cheaper than OpenSearch Serverless and fine for what I need.

Then click Next and Create Knowledge Base.

3. Sync Your Data Source

After the Knowledge Base is showing as available, you'll need to sync your data source to actually create populate the data source with the embeddings. Just select your Knowledge Base and click Sync.

4. Create a Guardrail

Click Guardrails in the Amazon Bedrock menu on the left, then Create Guardrail.

Name it PII-filter and click Next. This is where you can explore all the different capabilities available in Guardrails. Some of them I have not used before, so I wanted to review everything here and understand what can be configured. For instance there's a prompt attack filter to protect against attempts to override system instructions.

After that click Next, and here you can add denied topics. As my data contains information about corporate strategy and some financial data, I want my Guardrail to prevent the model giving investment advice. Click Add Denied Topic, name it Financial-Advice and then provide text describing the topic to block, here's what I added:

Financial advice, investment advice, stock purchase, investment fund

Keeping Input and Output actions set to Block, click Confirm, then Next.

Word filters allow you to add profanity filters as well as custom words and phrases, then click Next.

After that you can specify how to handle PII.

Click Add New PII, then select the type of PII you want to identify. You then select how to deal with that type of PII, block, mask, or detect (no action).

I selected phone and email since I know that this type of PII exists in my data.

After that click Next in the next page you can optionally add a contextual grounding check and relevance check.

Contextual grounding lets you set a threshold for what is acceptable in terms of model confidence score for contextual grounding. The default setting is 0.7 out of 1, if the score is lower than the defined threshold, the model response will be blocked.

Relevance checks work in a similar way, a relevance score is calculated and if the score is lower than the defined threshold, the model response will be blocked.

Then click Next, Next, and Create Guardrail.

After that you are ready to test the functionality and see it in action.

5. Testing the Knowledge Base Functionality

In the left hand menu, click Knowledge Bases, select your Knowledge Base, then click Test Knowledge Base.

Select the model you want to test with, a lite model is fine for this task.

Under Data Manipulation, open the Guardrails dropdown and then select your Guardrail.

There is also the opportunity to use a reranking model, like Cohere rerank to rescore the relevancy of the retrieved data and override the vector database's relevancy ranking.

After that I added a prompt to test out the configuration:
What are Ralphie Bank’s three strategic pillars?

6. Testing the Guardrail

Next I tried some prompts that should trigger the Guardrail, here's what I tried:

Should I invest in Ralphie Bank shares this year?
What is the internal strategy hotline number?
What is the compliance email address?

If it's all worked, the Guardrail will block the request from being sent to the model, and Bedrock should not fulfill the request.

7. Clean-up

Be sure to delete the Guardrail, Knowledge Base, and S3 bucket to avoid unnecessary charges!

Gen AI Is Only as Reliable as Your Data: Lessons from AWS re:Invent 2025

Faye Ellis — Tue, 16 Dec 2025 09:12:00 +0000

These days, it feels like everyone is building something with AI. From specialized analytics assistants, diagnostics and decision-making systems to project management and CRM platforms. AI is becoming part of every tool we use. All powered by large language models and agents that increasingly depend on complex data pipelines.

But what happens when the data behind those applications breaks?

The short answer is that things go wrong very quickly, and not always in obvious ways!

While at re:Invent this year, I attended a session from Commvault on Best practices to simplify resilience at scale for Gen AI data & apps to understand how enterprise customers are doing AI resilience properly.

Gen AI is only as good as its data pipeline

Gen AI applications rarely fail because of the model itself. Instead, failures often start much lower down the stack in the data layer.
AI is only as good as the data we feed it. Missing records, corrupted partitions, overwritten tables, or deleted objects don’t just cause downtime. They cause:

Models to hallucinate
Dashboards to show incorrect insights
Applications to behave unpredictably

The concerning thing is that you may not even realize it, applications can keep running while quietly becoming wrong.

In the session, this was demonstrated using real-world AWS services like DynamoDB, Amazon S3, and Apache Iceberg, showing how failures in each layer of the data pipeline can directly impact Gen AI behavior - even when the application itself appears healthy.

The data protection gap

During the session, the speakers asked a simple question: How many people are building GenAI applications in AWS? Unsurprisingly, many hands were raised. However when asked

How many are actively protecting the data layer that powers those applications? I saw far fewer hands.

This gap isn’t surprising. Most teams invest heavily in scaling compute, tuning models, and improving performance, while assuming data protection is handled somewhere in the background. Many organizations expect their existing backup system will handle the restoration of data following a loss or corruption.

In reality, many modern data pipelines are only partially protected, or protected in ways that don’t support the fast, clean recovery that customers expect.

Why traditional backup isn’t enough

Traditional backup tools weren’t designed for the way modern cloud-native and Gen AI data pipelines fail, particularly when recovery needs to happen quickly and at a very granular level.
A recurring theme throughout the talk was that recovery speed and simplicity matter more than theoretical durability.

Traditional recovery approaches often look like this:
Step 1: Restore an entire dataset
Step 2: Create temporary tables or buckets
Step 3: Repoint applications
Step 4: Rebuild downstream dependencies, like manually recreating dashboards

This process is slow, error-prone, and expensive, especially when customers are waiting for systems to be back online.

What stood out to me was the emphasis on in-place, granular recovery.

Recover only what broke, restore it directly to the original location, and avoid reconfiguration wherever possible. Less operational work means faster recovery, and fewer mistakes during already stressful incidents.

Clumio Backtrack enables individual records or partitions to be recovered in-place without creating temporary tables or repointing applications.

The “last known good state” problem

Another subtle but important insight: in distributed cloud systems, there is rarely a single “last known good” timestamp.

Different components fail at different times. DynamoDB partitions may be corrupted minutes apart, S3 objects may be deleted individually, Iceberg tables may be overwritten by a single bad query. Effective recovery needs to work at the level of records, partitions, objects, and snapshots, not just entire databases or buckets.

Clumio Backtrack also supports point-in-time and granular recovery across distributed services like DynamoDB and S3 rather than forcing teams into lengthy all-or-nothing restores.

RAG pipelines are especially vulnerable
Retrieval-augmented generation (RAG) pipelines introduce an extra layer of fragility. Vector stores depend on underlying source data, if that disappears, embeddings quickly become useless, if you’ve ever ingested data into an Amazon Bedrock knowledge base you’ll know that recreating vectors is time-consuming and costly for large datasets.

Even small amounts of data loss can lead to wildly inaccurate AI responses, delivered with high confidence. Protecting raw source data turns out to be one of the most important steps in keeping Gen AI outputs trustworthy.

S3 object-level recovery from Clumio Backtrack enables only the impacted objects to be restored, avoiding the need to recompute whole vector stores or rebuild the entire RAG pipeline.

Apache Iceberg: powerful, but not immune

The session also covered Apache Iceberg, which has become a hugely popular foundation for modern lakehouse architectures. Supporting large-scale analytics, transactional consistency and schema evolution.

However it also introduces new failure modes. A single overwrite or schema change can silently break dashboards and analytics without obviously deleting data.

If you are only backing up the general purpose S3 bucket data that is powering the Iceberg tables, you’ll need to first do a full restore of every S3 bucket that holds Iceberg data, then restore the Iceberg table structure, including reconfiguring your manifest files, metadata and data files. Then reconfigure your applications to talk to the new table and recreate all your dashboards that existed for the previous dataset.

**The key takeaway for me is that Iceberg-aware recovery matters. Restoring raw files alone isn’t sufficient. **Table structure, metadata, and dashboards must be preserved to truly recover.

The first Iceberg-aware and S3 tables data protection solution

For organizations that require true AI maturity, Commvault recently announced Iceberg-aware recovery capability from Clumio Backtrack. Providing industry-first Iceberg recovery capability, preserving table structure, metadata, and snapshots and delivering recovery without rebuilding dashboards or reconfiguring applications. Just pick a snapshot, pick a point in time, and recover, all in one step.

Key takeaways I’ll be applying going forward

Design resilience at the data layer, not just the model layer
Protect the entire data pipeline not individual services in isolation
Optimize for fast, in-place recovery
Plan for granular failures, not entire rollbacks
Focus on user experience, not uptime metrics

As GenAI applications become more central to how all of us operate, AI maturity demands that data resilience becomes non-negotiable. The quality, accuracy, and trustworthiness of AI outputs all depend on it.

To learn more, check out Best practices to simplify resilience at scale for Gen AI data & apps or request a demo of Commvault’s cloud-native cyber resiliency, data protection and recovery solutions.

Getting Started with Spec-driven Development Using Kiro

Faye Ellis — Sat, 13 Dec 2025 18:33:12 +0000

Curious to learn how Kiro could be your development partner for spec-driven development? Here's my simple tutorial to help you get started.

Creating a Simple Voting API

What You’ll Build

A simple REST API where users can:

Create a poll with options
Vote on a poll
View poll results

Pre-requisites

Download and install the Kiro IDE for your operating system

Create a Project Folder and Start Developing!

1) Create a folder in your local file system named Kiro_Voting_API, this will be your project folder

2) Launch Kiro, select File, Open Folder, and open the folder you just created

3) To begin a spec driven development session, select Spec from the options

4) Enter a natural language prompt into the chat window, here's what I used:

Build a simple poll and voting REST API using Python and FastAPI

Requirements:

- A poll has: id, question, options, votes
- Options are strings
- Votes are counted per option
- Endpoints:
  - POST /polls to create a poll
  - GET /polls/{id} to retrieve a poll and its results
  - POST /polls/{id}/vote to vote for an option
- Store all data in memory
- Return JSON responses

5) Wait for Kiro to create a requirements document based on your prompt, it will create a document containing requirements, user stories and acceptance criteria:

6) To refine the requirements, enter any additional requirements into the chat window to tell Kiro to add whatever you think is missing. Here's what I added:

Add support for displaying poll results as a percentage

Poll results must be calculated as a percentage as well as displaying the raw numbers of votes

7) After that, if the requirements look good to you, click Move to design phase

8) Kiro will create a design based on the agreed requirements, click on the generated design.md file to view the design document.

Note that Kiro includes error handling and a testing strategy. In practice I found that this added a lot of time and iteration to my implementation steps, as it was validating changes and asking for permission to run tests throughout implementation.

You may prefer reduce the amount of testing and error handling to quickly see something in action, then work on adding the appropriate tests afterwards. It's up to you because you can refine the requirements and design to fit your needs as you go!

9) After reviewing the design you can ask Kiro to make any modifications that you like, then when you're ready, click Move to implementation plan. After that, Kiro creates an implementation plan based on the agreed requirements and design.

10) Kiro has created an implementation plan and created a file named tasks.md. Open this file to view the contents and begin the implementation. You can open it by clicking Task list at the top of the screen, or tasks.md from the folder view on the left.

11) To begin implementing your feature, click Start task above the first task in your implementation plan. If you allow it to, Kiro will set up everything needed to run your code and begin testing it. Be sure to understand everything that it is doing and ensure you are happy before allowing it!

Before installing dependencies, it asks you for permission. Be sure to review the contents of requirements.txt and only click Run to allow it if you are happy to install the dependencies.

12) After that, work through the rest of the steps in the implementation plan. As you go, Kiro will periodically ask for permission to perform tests at each stage to ensure the code runs as expected.

13) I ended up aborting the step to add error handling and response formatting during the initial implementation, since I wanted to check the API's basic functionality myself before adding this.

14) After all the implementation tasks have been completed. Open the README.md file to see the steps to run your API. If anything doesn't make sense, or doesn't work as expected, you can chat with Kiro to ask for help with troubleshooting or interacting with your API.

15) From the terminal window in Kiro, making sure I am in the folder where main.py exists, I'll run the application in the background, using the following command, (check the details of your own README file to see how to start your app):

python main.py &

16) In the terminal, hit the enter key to get your cursor back, so you can run the next command in the same terminal window.

Next I'll test that the API is running:

curl http://localhost:8000/

17) Finally I can try interacting with my API :

My poll ID is: 1f46ff20-88e0-4349-a31a-ce588c187b62 and I'll use it in the next command to cast a vote.

I can also view the votes that have been cast.

Kiro Credits

The Kiro free-tier allows you 50 credits per month, with the most affordable pro-tier providing 1000 per month for $20/month. I can see how you could easily burn through a lot of credits just trying it out, as this entire exercise used up around 33 credits to tackle what I think is a very simple use-case.

Working in a Structured Way

Building this simple voting API was a fun way to understand how Kiro’s spec-driven workflow actually feels in practice. Rather than jumping straight into writing code, Kiro encouraged me to slow down and think about requirements, design, and implementation as distinct steps, and then guided me through each phase in a structured way!

Other Practical Use-cases

A lot of my work involves creating CloudFormation templates, simple Python scripts, IAM policies and other AWS-related code, so having explored the spec-driven workflow I can imagine lots of ways that Kiro can help increase productivity when working with AWS APIs and SDKs. I can't wait to try it out for some of these use cases!

If you try out this exercise or similar for yourself, please let me know what you think!

The Future of Cyber Resilience for Complex AWS Environments is Here

Faye Ellis — Thu, 27 Nov 2025 15:05:48 +0000

2025 has seen the cloud landscape continue to evolve at an extraordinary pace. As organizations accelerate their AI, analytics, and digital transformation workloads, many of us are experiencing a significant increase in complexity.

Systems are becoming more distributed, with workloads spread across multiple regions, accounts, and vendors. With complexity comes fragmentation, and a sharp rise in risk around cyber threats, identity compromise, and multi-cloud governance, leading many of us to wonder how to maintain visibility across disparate systems as well as how to handle protection, resilience, and recovery at scale.

This is why I was excited to learn about some of the latest announcements and releases from Commvault, announced at SHIFT 2025.

Commvault Cloud Unity - a unified platform designed for the realities of cloud at scale

Most organizations’ AWS environments have grown organically, spanning multiple accounts and regions, with the vast majority using multiple cloud vendors as well as running hosted workloads and data on-premises. This approach allows for the adoption of best-of-breed technologies and services, however the trade-off is that such mixed environments become increasingly difficult to manage and protect.

Commvault Cloud Unity is a major release that unifies data security, cyber recovery, and identity resilience into one AI-enabled platform. It provides a single pane of glass spanning all workloads, regions, and protection policies, across AWS, on-premises, and hybrid environments.

Features of the Commvault Cloud Unity platform:

AI-driven discovery of all AWS workloads across accounts and regions

Commvault Cloud Unity automatically identifies AWS workloads and data across EC2, EKS, RDS, DynamoDB, S3, Lambda-backed services, and more.

Clear visibility into what’s protected (and what isn’t)

One of the biggest challenges is understanding where data is located. What’s protected? What’s under-protected, or not protected at all? In addition to helping you discover your data landscape, Commvault Cloud Unity also provides automated classification and protection policy recommendations.

Synthetic Recovery: Clean, Complete Restorations for AWS Workloads

This is, in my view, one of the most exciting capabilities Commvault has introduced.

AWS estates often include:

Distributed EC2 workloads
Massive S3 data lakes
Numerous databases (RDS, Aurora, DynamoDB)
Containerized workloads running on EKS

If any part of this is compromised, restoring cleanly can be incredibly complex and nuanced. Previously, you’d have to choose between an older backup that’s clean, or a recent snapshot that might be contaminated. Neither option is great.

Synthetic Recovery changes that completely.

It uses AI to identify compromised blocks or files, remove them automatically, then reassemble them into a synthetically clean recovery point, preserving all clean, recent data. This is incredibly valuable for AWS environments where speed and precision are essential.

No more rolling back to a recovery point from last Tuesday because it’s the only one you trust.

Request a demo of this exciting feature to see it in action!

Threat Scan: Protecting AWS Backups from Hidden Threats

For AWS customers maintaining vast amounts of data in S3 or using snapshot-heavy workflows for EC2 and RDS, this adds vital intelligence to the recovery process.

Threat Scan brings AI-driven scanning of AWS backup datasets, detection of encrypted files, malware, and indicators of compromise, the ability to inspect recovery points before restoring them, proactive identification of risks inside S3 object versions, EC2 snapshots, and more.

With attackers now targeting backups directly, the security of AWS backup data has never been more critical.

Identity Resilience for AWS-Hybrid Environments

AWS customers who rely on Active Directory for authentication, whether that’s through AWS Managed AD or integrated with on-premises AD, will benefit from new identity resilience enhancements, which detect, audit, and reverse malicious identity changes.

Commvault Unity also includes the ability to spot identity anomalies, maintain forensic change logs, roll back malicious AD changes in real time, and even safely test AD recovery inside a cleanroom on AWS. All of this is invaluable for anyone operating a hybrid IAM setup on AWS.

Solving the challenges that AWS customers struggle with the most

Collectively, these announcements represent a major step forward for AWS resilience. They bring clarity where there has been confusion, automation where there has been manual effort, and integrated protection where there have been fragmented tools.

**Commvault Cloud Unity solves the challenges that AWS customers struggle with the most, like data sprawl, inconsistent policies, cyber risk, and complex backup management. **With one secure, automated platform spanning hybrid and multi-cloud environments, organizations benefit from faster recovery, streamlined operations, and complete confidence that their critical data is properly protected and recoverable when it matters most.

Want to Learn More?

Exciting times for Commvault, for AWS, and for those of us responsible for mission critical workloads in the cloud! If you’re interested in hearing more about all of these announcements, you can watch all the sessions from SHIFT 2025 on demand, and request a demo!

Commvault at re:Invent 2025

If you’re heading to AWS re:Invent this year, visit the Commvault team in the Expo Hall at booth #621 to talk cyber recovery and AWS-native resilience, experience some very cool demos, and more!

From SysOps to CloudOps : Breaking Down the New SOA-C03 Exam from AWS

Faye Ellis — Tue, 09 Sep 2025 20:59:49 +0000

The AWS Certified SysOps Administrator - Associate (SOA-C02) exam had been the go-to certification for cloud operations and support folks for several years. However, as cloud roles continue to evolve, AWS recently announced plans to retire it and introduce a brand-new certification. Let’s look at what’s new with AWS Certified CloudOps Engineer – Associate (SOA-C03) and what to expect in the exam.

What’s new in the SOA-C03 exam?

The most important thing to note is that the exam is still intended for the same audience, and at least one year of experience in cloud operations roles is recommended.

Great news is that it still includes 65 multiple-choice and multiple-response questions, 15 of which are unscored, so you are only scored on 50 of the questions. Passing score is still 720 out of a possible 1000.

On the whole, the exam domains and topics have not changed very much. My interpretation is that nothing has really been removed from the exam, and just a few extra things have been added. The exam guide now explicitly calls out skills like containerization, orchestration, and a general understanding of CI/CD practices.

Exam Domains Compared

At first glance, the exam domains seem extremely similar. The Cost and Performance Optimization domain from SOA-S02 has been removed, however the content of that domain seems to have been distributed across the remaining domains. When reviewing the exam guide, I noticed that nothing has been removed.

Key shifts to pay attention to

The most significant shift in the new SOA-C03 exam is the increased emphasis on modern cloud operations practices, with a greater focus on the following:

Automation and IaC (infrastructure as code)

You should know how to manage stacks of resources using CloudFormation and the AWS Cloud Development Kit (AWS CDK).

Hands-on knowledge of containers and orchestration

Be familiar with the basics of running and orchestrating workloads on Amazon Elastic Container Service (Amazon ECS) and Amazon Elastic Kubernetes Service (Amazon EKS). You should also understand how to collect metrics and logs from these services using the Amazon CloudWatch Agent.

Multi-account and multi-region design skills

You'll need an understanding of operating in complex environments, including building CloudWatch dashboards to handle metrics and alarms across multiple accounts and AWS Regions, provisioning and sharing resources across accounts and regions, and securely implementing multiple accounts.

Cost optimization and cloud financial management

The ability to optimize for cost when configuring core AWS services like EBS, RDS, and for Networking services, as well as understanding how to use AWS Cost Explorer and Cost and Usage Reports will also be useful.

New AWS services to know

The SOA-C03 exam now includes additional AWS services, like:

Amazon Managed Service for Prometheus (used for monitoring & logging)

AWS Managed Grafana ( a widely used service for data visualization)

AWS Network Firewall (network-level traffic inspection and filtering)

Amazon Elastic Container Service (managed containerization orchestration service)

Amazon Elastic Container Registry (used to centrally store container images)

Amazon EKS (managed Kubernetes service)

IAM Identity Center (centralized identity management)

Wrapping up

In short, AWS has rebranded and revamped this exam to match the realities of modern cloud management and some newer technologies that many of us are using. The SOA-C03 is now all about proving you’re ready to manage AWS at scale in today’s cloud-driven world, using the latest tools and technologies.

I've booked to take the new exam on September 30th and will let you know what I think as soon as I can. Are you planning to try SOA-C03?

Using AWS MCP Servers with the Amazon Q Developer CLI

Faye Ellis — Tue, 05 Aug 2025 16:47:34 +0000

What is MCP?

The Model Context Protocol (MCP) is an open standard which allows AI models to communicate seamlessly with external tools. If you haven’t already tried using MCP servers with your favourite LLM, this is a really easy way to get started.

In the context of the Amazon Q Developer CLI, MCP enables you to extend Q's capabilities by connecting it to a range of pre-built and custom tools!

I wrote previously about the Ten ways I use the Amazon Q Developer CLI to save time, but the addition of MCP servers can seriously take your productivity to a whole new level and you can get started in just a few minutes with a few easy commands.

What can MCP Servers actually do?

Here are a few examples of interesting MCP servers that can be added to Amazon Q Developer, to extend its functionality:

AWS Pricing MCP Server creates cost analysis reports based on current pricing
AWS Terraform MCP Server lets you run Terraform commands, get best practice advice, run security scans on code
Amazon EKS MCP Server allows you to create EKS clusters, deploy apps, troubleshoot
AWS Documentation MCP Server allows you to read and search the AWS documentation
AWS Diagram MCP Server generates diagrams using the diagrams Python package

I needed to create a few diagrams this week, so I decided to see how the AWS Diagram MCP Server performs, however you can check out the GitHub repo for AWS MCP Servers to see what else is available.

Adding the AWS Diagram MCP Server to the Amazon Q Developer CLI Agent

Pre-requisites

Before you start adding MCP Servers to Q Developer, there are a few pre-req's to configure. You'll need to be running Python ≥ 3.10, uv (used for package management), and for my example below I also needed to install Graphviz (for graph visualizations) and diagrams (a Python module for creating and displaying diagrams).

If like me, you're working on macOS here's how to add these pre-requisites (otherwise check the instructions for your OS):

pip install uv

uv python install 3.10

brew install graphviz

pip install diagrams

Adding the MCP Server

First I added the AWS Diagram MCP Server using this command:

qchat mcp add --name aws-diagram --command uvx --args awslabs.aws-diagram-mcp-server

I also added the AWS Documentation MCP Server using the following command:

qchat mcp add --name aws-docs --command uvx --args awslabs.aws-documentation-mcp-server@latest

Using the MCP Server with the Q Developer CLI Agent

To invoke the MCP server, start a chat session with Amazon Q Developer:

q chat

When you start the Q CLI, it will load any MCP servers that you have added, and you can check that any MCP servers have successfully loaded using the following command:

/tools

You should see output similar to this:

After that you can start interacting with the MCP server, here are some examples to try.

1. Creating a diagram needed for a lab I'm working on

Create a diagram that shows a DynamoDB table named orders, 
data being populated from a JSON file, 
2 x Global secondary indexes (one named OrderDateIndex, 
and one named OrderStatusIndex) as well as a query and scan 
operation being submitted to the dynamodb table. 
please save the diagram to the current folder.

The initial diagram Q created made some assumptions about how I was running commands, and added Lambda and S3 which I am not using, so I give it some more information to try and get closer to what I need:

The scan and query operations are run from the AWS CLI 
using the AWS CloudShell and so is the batch_write_items 
command that is used to populate the table. Please update 
the diagram to remove the Lambda and S3 references, 
also the sort key for this table is user_id.

Here's the final diagram, pretty good!

2. Convert CloudFormation or Terraform code into a diagram

This is great for visualizing complex IaC templates and showing resource dependencies.

Create a diagram that shows everything being created 
by the CloudFormation template named library-bot.yml, 
the diagram should show all resource dependencies 
and relationships. please save the diagram to the current folder.

Here's the result, enabling me to check that I've included everything I need in this template:

Other use-cases

I can see how this MCP server could be really useful for reviewing architectures, explaining concepts in meetings, quickly creating diagrams to illustrate different options for comparison and discussion, and to help with on-boarding team members enabling them to visualize existing architectures. I'm looking forward to trying some of the other capabilities!

Have you started using any of the MCP servers with the Amazon Q Developer CLI Agent yet?

10 ways I use the Amazon Q Developer CLI to save time

Faye Ellis — Wed, 25 Jun 2025 07:40:35 +0000

If you haven’t already started using the Amazon Q Developer CLI Agent in your terminal, this is your sign to install it right now, and get more done without the burnout.

I wrote previously about how I used Q Developer to create architecture diagrams in seconds from a CloudFormation template, but recently I challenged myself to integrate AI into every possible area of my workflow.

Avoiding burnout from day-to-day activities

I should mention that my day-to-day role focuses on content creation. This involves a lot of hands-on implementation, primarily using AWS services.

A large part of my day is currently spent designing practical exercises, building from scratch, but also operating within the constraints of a sandbox environment which has its own challenges. For instance, in our environment certain permissions are denied to prevent misuse, and each sandbox is only available for a few hours before being wiped clean, and all resources deleted.

I also have a lot of variety in my work, in terms of the AWS services I get to work with, though right now I’m working mainly with AI/ML focussed tech. This is a fast-moving space, so any help I can get in terms of lifting the cognitive load all contributes to saving my rocket fuel, avoiding burnout, and freeing my mind to think creatively.

My top ten

So here the ways that Amazon Q Developer has been most effective in lightening the load. If you work with AWS regularly, then I hope that some of these might save you some time and energy too!

Creating IaC templates, e.g. “convert this CloudFormation template to CDK”, or "help me write a CloudFormation template to provision this IAM policy"
Look up the syntax of some of the more obscure AWS CLI commands that I don't use very often e.g. “how do I stop a Comprehend sentiment detection job using the AWS CLI”
Perform quick troubleshooting when an error occurs e.g."I have already configured IAM permissions, so why am I seeing this error: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied"
Generate sample data to use for testing / proof of concept e.g. "generate a csv file containing 100 examples of synthetic names and addresses" Interestingly, when I asked for 100 examples of Personally Identifiable Information (PII), Q declined. Instead it created the file and redacted the PII!
Help writing IAM policies, and S3 bucket policies e.g."review this IAM policy for security best practices"
Explain code e.g. “explain what this Python function does”
Quick code generation: Generate code snippets, functions, or entire files with natural language prompts e.g. “add error handling to this function”
Bash Command Generation - Get complex bash commands without having to remember syntax e.g. "show me how to find all files that have been modified in the last 7 days"
Get help with using AWS SDKs and APIs e.g. “explain how to use boto3 to interact with Amazon Bedrock”
Get best practice guidance e.g. “explain the best practices when setting common request body parameters for models in Amazon Bedrock”

Here's why I think the Amazon Q CLI agent is a game changer: each of these capabilities saves me significant time by providing immediate answers and guidance without having to search through documentation or switch context to one of the 44 browser tabs I currently have open. In my role, my differentiator, or unique selling point is creativity, ideas, and imagination - the Q CLI gives me the headspace to focus on exactly that, allowing me to preserve my energy for tasks that really matter.

If you have been using Amazon Q recently, I'd love to hear how it has saved you time and energy, what should I try next?

Create Architecture Diagrams in Seconds with the Amazon Q Developer CLI Agent!

Faye Ellis — Fri, 23 May 2025 17:17:04 +0000

If you haven't used the Amazon Q Developer CLI Agent, this is your sign to get started!

Installation Steps

Install is very quick and easy, though the steps vary depending on your operating system, so you'll need to follow the required steps for your particular OS.

I use a Mac, so my steps were really straightforward, if you are also using a Mac, here's what you do to install the Q Developer Agent CLI. In a terminal, simply type:

brew install amazon-q
You can verify the install using:

q --version
If it doesn’t show the version the first time, then just restart your shell or terminal and try again.

exec $SHELL
q --version

Next login to the Q Developer CLI, you'll get the choice of logging in using your AWS Builder ID which is the free-tier option, or if you are subscribed to pro-tier log in using your IAM Identity Center credentials:

q login
Then, to start a session with the Q Developer CLI, its:
q chat

Creating Architecture Diagrams from an IaC Template

I wanted to use Q to help me quickly create an architecture diagram based on the contents of my CloudFormation template that I was using to create a basic VPC. As my template is saved in GitHub, I provided a link to the raw file in my prompt and Q was able to find it, however you can of course get Q to read the files on your local machine, inside the directory you're working in.

The Prompt

First I tried creating a Mermaid diagram. If you haven't used Mermaid before, it's a JavaScript based tool used for rendering diagrams from markdown text.
Here's the prompt I used:

Create a mermaid diagram that represents the contents
of the CloudFormation template named cf-template.yaml.
Here is a link to the template:
https://raw.githubusercontent.com/fayekins/amazon-q-dev/refs/heads/main/cf-template.yaml 
The diagram should include all the AWS resources that
are described in the template, and use the following 
best practices: 
consistent spacing between elements, 
align elements properly, 
use clear labels for all components, 
include CIDR blocks for all networking components,
make sure text is a readable size.

The resulting diagram that Amazon Q Developer created can be viewed by pasting the resulting code into the Mermaid Live Editor.

Here's the result, not too bad!

Refining the Diagram

Ultimately, I wanted to get Q to create diagrams that I could actually use. For that I really need the official AWS icons. So I asked Q to create a draw.io diagram instead, using the official icons. Here's my next prompt:

Can you create the same diagram again but this time
create a draw.io diagram using the correct AWS icons
for the AWS resources.

Here's the response from Q, explaining the steps taken and instructions for viewing the diagram.

And here is the result, a pretty decent diagram!

I'm really happy with the result, and will definitely be able to use this capability going forward! Amazon Q Developer is certainly improving fast and I'm looking forward to seeing what else it can do to save me time day-to-day.

Would you use AI to create your architecture diagrams?

Tutorial: Build an Agentic AI Application with Agents for Amazon Bedrock

Faye Ellis — Tue, 11 Mar 2025 15:08:54 +0000

Here's a step-by-step process for building an application that uses Agents for Amazon Bedrock to trigger a Lambda function with the ability to execute tasks for you. The code I used can be found here. The cost will be <$5, if you remember to run all the clean-up steps at the end!

This simple application allows parents to book an appointment with their child's high school teacher at the upcoming Parents and Teachers Evening. Data relating to the available time slots, existing appointment bookings, teachers, their subjects, and classrooms is stored in DynamoDB tables.

The architecture looks like this:

Architecture Components

Amazon Bedrock

Used to provide API access to the required foundation model. In this example, the model we are using is: anthropic.claude-3-sonnet-20240229-v1:0

Amazon Bedrock Agent

The Bedrock agent uses the reasoning capabilities of the specified AI model, along with the data available to it, and the available actions to figure out how to deal with the user requests it receives. In this example, the agent needs to answer questions like checking the availability of appointments at the Parents and Teachers Evening, as well as booking the appointments.

Amazon Bedrock Action Group

This defines the actions that the agent can take, for instance the ability to search and update the data held in DynamoDB. The actions are really API calls that the agent is able to make in order to fulfil user requests.

Lambda Function

A Lambda function is used to make the necessary API calls, like searching and updating the data held in DynamoDB.

DynamoDB

DynamoDB is used to store the data held by the system. Two tables are created and populated with data relating to appointments with teachers at the upcoming parents' evening. This is our custom data that our agent is able to interact with.

Jupyter Notebook

A Jupyter notebook running in SageMaker is used as the IDE (Integrated Dev Environment), to run all commands used to build all the various components in AWS, as well as download the GitHub repository and run the Python code.

Prerequisites

1) Do everything in us-east-1.
2) In your AWS account, be sure to request access for the Bedrock models that you would like to use. You'll find this in the Bedrock console, under model access. (For this exercise, I enabled anthropic.claude-3-sonnet-20240229-v1:0 .)

3)Before creating the SageMaker Notebook, first make sure you have a SageMaker AI Domain in us-east-1, this one-time step creates home directory space, and VPC configurations needed by any notebooks you create in this region. If you don't have one already, select the Create domain option, and it will do everything for you.

Building the Application

1) Use this CloudFormation template - create_SM_notebook.yaml to create a SageMaker Notebook, that we'll use to run the commands from. The template will configure the SageMaker Notebook instance, with an associated IAM role that includes permissions for a few required services, including:

Bedrock full access
DynamoDB full access
IAM full access
Lambda full access

This access is needed in the beginning because we'll be running commands on the notebook instance to build everything. After everything has been configured, these permissions can be tightened up.

2) When the notebook is ready, select the notebook instance and select open Jupyter Lab. The required GitHub repository containing the application code will already be downloaded and saved to a folder named bedrock-agent-demo.

3) From the cloned repository, open the file named: bedrock_agents_demo.ipynb - this is an Interactive Python Notebook, each block of code is displayed in a cell that can be run in sequence, to observe the outcome of each step.

4) Run all the cells in contained in the bedrock_agents_demo.ipynb file, which at a high level, will do the following:

Install required libraries like boto3, which is the AWS SDK for Python that interacts with Bedrock.

Create the two DynamoDB tables to store data relating to teachers, and appointments. Then populate them with some sample data that the agent will be able to interact with.

Create a Lambda function that has the ability to check if a teacher is available at a specific time, book an appointment with a teacher, and get all available appointment slots.

Create the agent and action group
The action group defines all the functions that the agent is able to do, for instance check_teacher_availability and book_appointment.

Testing

Run some prompts to test that everything is working. You can update the input text to modify the prompts to see what is possible.

Example Prompts to Try:

Try running the following prompts, or create your own:

Who teaches Sociology?
Book the first available appointment with the I.T. teacher
When is the history teacher available?
List all Miss White's appointments
Cancel the 18:30 appointment with Mr Stokes

Observe how the agent uses reasoning, the small number of very basic actions, and the limited data that it has available to try to fulfil your requests. Explore what the agent is able to do, and what the limitations are. Even with a small amount of data and some simple actions, it is able to do quite a lot using reasoning or asking for clarification to try to get the job done!

Cleaning Up to Avoid Charges

After exploring, be sure to run the last few cells in the notebook, to clean up the DynamoDB tables, the Bedrock Action Group and Agent, and the Lambda Function to avoid unnecessary charges. Then remember to delete the CloudFormation stack as well if you no longer need the Jupyter notebook instance.

Reimagining Resilience with Commvault

Faye Ellis — Wed, 11 Dec 2024 12:37:40 +0000

In today's rapidly evolving digital landscape, the importance of data protection and cyber-resilience cannot be overstated. As organizations increasingly adopt cloud-first strategies and navigate complex multi-cloud environments, the need for robust, scalable, and intelligent solutions has never been greater.

That's why I'm thrilled to share some exciting developments from Commvault and their recent acquisition, Clumio, that are set to revolutionize the way we approach data protection and cyber-resilience in the cloud-first era.

Unveiling Game-Changing Innovations at AWS re:Invent

At AWS re:Invent 2024, Commvault showcased a suite of cutting-edge solutions that promise to redefine cyber-resilience.

Lightning-Fast Recovery with Clumio Backtrack

One of the most anticipated announcements is Clumio Backtrack, a groundbreaking capability that enables lightning-fast recovery of Amazon S3 buckets, effortlessly scaling to billions of objects.

With over 400 trillion objects being stored in S3 globally, this is a game-changer for organizations dealing with massive datasets, especially considering more data than ever is being collected and stored as organizations gear up their AI and machine learning efforts.

I was excited to be able to experience Clumio Backtrack firsthand, and witness the process of selecting a point-in-time recovery source, and rolling back specific versions of selected S3 objects.

I was surprised to see that recovery completed without issues, within seconds of initiating the job!

Turning Back Time with Cloud Rewind

Commvault recently introduced Cloud Rewind, which is like a time-machine for AWS environments! Enabling organizations to roll back to a clean state before a cyber incident, not just recovering data but also rebuilding entire cloud applications and infrastructure. Like having a reset button for your entire cloud estate.

Seeing this in action was particularly impressive, and you can request your own demo of Clumio Backtrack and Cloud Rewind, to see for yourself!

Fortifying Your Cyber Defenses

In addition to these exciting launches, Commvault is bolstering its cyber-resilience arsenal with two more upcoming offerings:

Cloud Air Gap Protect: Coming soon to AWS, this solution will provide air-gapped, immutable, and indelible copies of critical data, offering an extra layer of protection against sophisticated cyber threats.
Cloud Cleanroom Recovery: Also on the horizon for AWS users, this feature will deliver an on-demand, isolated cloud-based cyber recovery environment. It's perfect for both resilience testing and actual recovery scenarios.

A New Era of Continuous Business

The combination of Commvault and Clumio marks a significant milestone in the journey towards true cyber-resilience. By combining Commvault's enterprise-grade data protection with Clumio's cloud-native expertise, organizations can now access a comprehensive suite of solutions that ensure business continuity in the face of any threat.

As we look to the future, the ability to protect, recover, and rebuild critical data and systems will be paramount, as the value of data increases exponentially. With these new offerings, Commvault is empowering businesses to face the challenges of the digital age with confidence, knowing that their most valuable asset – their data – is always secure and recoverable.

The future of cyber-resilience is here, and it's more exciting than ever. Request a demo to learn more!

Save time with the Amazon Bedrock Converse API!

Faye Ellis — Tue, 26 Nov 2024 17:45:52 +0000

With Bedrock you get access a range of different large language models, ( for instance, Claude, Mistral, Llama and Amazon Titan) with new versions becoming available all the time.

Having choice is great, but having to code your requests differently for each model is a pain.

Here’s why the Amazon Bedrock Converse API is going to save you a bunch of time and effort, when comparing the output of different foundation models!

Consistency is key!

The Converse API is a consistent interface that works with all models that support messages / system prompts. This means that you can write your code once, and use it to experiment with different models.

Here’s an example of how it works, and this exercise should cost < $1.

Configure model access

Before you begin, be sure to check that the models you want to use are available in your region, and that you have enabled access to them, here are the ones I'm using, you can select these or choose your own:
anthropic.claude-v2 anthropic.claude-3-haiku Claude 3.5 Sonnet Mistral small

1) We can do everything using the CloudShell in the AWS console.

2) When the CloudShell is ready, install boto3 which is the AWS SDK for Python
pip install boto3

3) Download the file named converse_demo.py from GitHub You can do this using wget and providing the raw path to the file:

wget https://raw.githubusercontent.com/fayekins/demos/refs/heads/main/converse_demo.py

converse_demo.py

#first we import boto3 and json 
import boto3, json

#create a boto3 session - stores config state and allows you to create service clients
session = boto3.Session()

#create a Bedrock Runtime Client instance - used to send API calls to AI models in Bedrock
bedrock = session.client(service_name='bedrock-runtime')

#here's our prompt telling the model what we want it to do, we can change this later
system_prompts = [{"text": "You are an app that creates reading lists for book groups."}]

#define an empty message list - to be used to pass the messages to the model
message_list = []

#here’s the message that I want to send to the model, we can change this later if we want
initial_message = {
            "role": "user",
               "content": [{"text": "Create a list of five novels suitable for a book group who are interested in classic novels."}],
               }

#the message above is appended to the message_list
message_list.append(initial_message)

#make an API call to the Bedrock Converse API, we define the model to use, the message, and inference parameters to use as well
response = bedrock.converse(
modelId="anthropic.claude-v2",
messages=message_list,
system=system_prompts,
inferenceConfig={
            "maxTokens": 2048,
            "temperature": 0,
            "topP": 1
            },
)

#invoke converse with all the parameters we provided above and after that, print the result 
response_message = response['output']['message']
print(json.dumps(response_message, indent=4))

4) Run the Python code like this:

python converse_demo.py

It should give you an output similar to this:

5) We can also run this same code using different model, by replacing the model ID in our code as follows:

anthropic.claude-3-haiku-20240307-v1:0

Compare the output from the second model, it is slightly different:

6) We can test again with another version:

anthropic.claude-3-5-sonnet-20240620-v1:0

When a new version of Claude is released, we can request access and then just replace the name of the model in our code!

Access denied error

If you see an error similar to this, it just means you are trying to use a model that you don't have access to yet. Simply request access to the model, and try again after access is granted.

7) I also tried it with a different model provider, by changing the model id to:

mistral.mistral-small-2402-v1:0

So the Converse API gives you a simple, consistent API, that works with all Amazon Bedrock models that support messages. And this means that you can write your code once and use it with different models to compare the results!

So next time you’re working with Bedrock, do yourself a favour, try out the Converse API, and thank me later!

Here's how I improved my public speaking, and made it an enjoyable part of my role!

Faye Ellis — Wed, 23 Oct 2024 11:45:32 +0000

I probably shouldn’t say this, but I used to be terrible at public speaking! At school, I even hated reading out loud in front of people. I would either refuse or dissolve into nervous giggles.

The first time I delivered a talk professionally, I wanted to run away and hide. I was so anxious, I couldn’t understand what I was feeling, and this was the first time I learned about fight-or-flight! Afterwards, I got some good feedback (my lovely team said that I knew my stuff, which was the kindest thing they could have said) and I felt encouraged to keep on trying.

Years later, when I began my role at A Cloud Guru, I was still very awkward and uncomfortable - I had not had much experience other than small presentations to my own team, or within projects I’d worked on. Talking on camera feels like a completely different skill!

So what happened? - Lots and lots of practice! Over the past 3 years I’ve delivered almost 60 talks in-person or online.

Here’s what I learned along the way to make public speaking an energising and enjoyable part of my work!

Preparation is key

I like to be well prepared, so I practice until I feel ready. My first big talk was practiced at least 20 times - I realise that this is completely unreasonable and unnecessary! But at the time, doing that made me feel much more comfortable on the day, and I felt I was ready. These days, I practice a new talk 3 times, and that’s usually enough!

Ask the audience

Always ask some questions. Understanding more about your audience will help you to deliver a talk that resonates. Making it a two way street also changes the energy in the room, because people feel like they are part of something, not just sitting there being talked at.

Start strong

The first 2 or 3 minutes are always the most nerve wracking! So having a strong start can really set you up for success, by this I mean practicing how you’ll introduce yourself, begin the talk, and be sure to have something interesting to catch people’s attention at the beginning.

Stay on track

Don’t get thrown off track by your own slides! Make sure they are well structured, this will make it much easier to take your audience on a journey and make it easy for you to deliver as well. If ideas are bouncing around all over the place, it makes it much more challenging for you to deliver a coherent message.

Slow and steady

This was the hardest thing for me in the beginning, because if you’ve met me, you’ll know I’m a bundle of nervous energy, I naturally talk fast, especially when I’m excited so I have to consciously slow down! Breathing deeply helps a lot, as well as arriving early, so that I’m not rushing about at the last minute.

Channel your inner superhero!

🦸‍♀️ My bonus tip is to find your power pose. It’s such a cliche but it works. Mine is: Superhero! I find a quiet place a few minutes before my session starts and take a few moments to stand, hands on hips, shoulders back and head held high, after that, I’m ready for anything!

What are your tips for successful public speaking?