Opinionated. Priced. Provisionable. The Stack.

Gotcha: Pay-as-you-go egress can turn a viral page into a big bill.

Fix: Check the flat-rate plans, or put Cloudflare in front.

Gotcha: Cost Explorer labels log ingestion 'PutLogEvents', which looks like a per-call charge. It's billed per GB ingested.

Fix: Find the log groups with the most IncomingBytes. The cost is in bytes, not calls.

Gotcha: Logging whole message payloads in high-throughput functions. One function produced 59% of a client's 1 TB a month.

Fix: Log IDs and errors, not payloads. If payloads must be kept, send them to S3 or sample them.

Gotcha: The default Text log format can't drop DEBUG and INFO lines before ingestion.

Fix: Switch Lambda to JSON log format with application log level WARN in production.

Gotcha: Log groups never expire by default.

Fix: Set retention on every log group in your Pulumi code.

Gotcha: Infrequent Access log groups are half price but drop Live Tail, metric filters, subscription filters and Embedded Metric Format, which silently breaks Powertools Metrics. A log group's class can't be changed later.

Fix: Use IA only for verbose groups you rarely read, and create a new group (repoint LoggingConfig) to switch.

Gotcha: API Gateway execution logs at INFO level log every request.

Fix: Keep access logs, turn execution logs down.

Gotcha: Cognito gives trigger Lambdas about 5 seconds. Cold container-image Lambdas blow through it and sign-in fails.

Fix: Keep triggers small and zip-packaged.

Gotcha: Cognito's built-in email sender is capped at 50 emails a day per AWS account.

Fix: Point the user pool at SES before going live.

Gotcha: Passkeys need the username first, and can only be registered after a first sign-in.

Fix: Offer passkeys as an upgrade after sign-in, not as the first-time path.

Gotcha: Direct PUT bills every record rounded up to 5 KB. One 200-byte log line per record costs 25 times the list price, about $925 per TB.

Fix: Pack many newline-delimited lines into each record (up to about 1,000 KB). Records of 100 KB or more make the rounding negligible.

Gotcha: Lambda freezes the environment when the handler returns, so buffered lines can be lost.

Fix: Await a flush before returning (try/finally), flush on size, and send WARN/ERROR synchronously to console so CloudWatch keeps the critical lines.

Gotcha: A stream accepts 1 MiB/s by default in Sydney. Busy peaks throttle.

Fix: Request a higher limit up front, and retry the records reported in FailedPutCount.

Gotcha: Lambda's built-in log destination to Firehose is not the cheap path: CloudWatch charges $0.335/GB to deliver it, then Firehose charges $0.17/GB for vended logs.

Fix: Call PutRecordBatch from your own logger instead.

Gotcha: Dynamic partitioning looks handy and adds about $25 per TB plus per-object and per-hour fees.

Fix: Use the default YYYY/MM/DD/HH prefix (free) and one stream per app or per table.

Gotcha: Reads are eventually consistent by default, so a read right after a write can miss it.

Fix: Use strongly consistent reads (tables only, not global secondary indexes), or use Postgres.

Gotcha: Existing Pinpoint campaigns and journeys stop being supported on 30 October 2026.

Fix: Move marketing email to Resend (or SES with your own list tool).

Gotcha: No hybrid (keyword + vector) search.

Fix: Search pgvector and S3 Vectors separately and merge with Reciprocal Rank Fusion, or put OpenSearch's s3vector engine on top at scale.

Gotcha: New SES accounts silently default to the Essentials plan at $0.16 per 1,000, 60% more than à la carte.

Fix: Choose the à la carte plan explicitly if you don't need Essentials features.

Gotcha: Sandbox exit is per region, and AWS quotes about 96 hours for a first response.

Fix: Request production access on day one of the project, in every region you'll send from.

Gotcha: SNS → Lambda invokes a function per message: at IoT volumes that's millions of tiny invocations.

Fix: SNS → SQS → Lambda with batching, or skip SNS and write straight to SQS.

Gotcha: Messages reappear and get processed twice, or go to the DLQ, when the queue's visibility timeout is too close to the function's timeout.

Fix: Set the visibility timeout to at least six times the function timeout.

Gotcha: One bad message in a batch fails the whole batch, and the good messages retry too.

Fix: Enable ReportBatchItemFailures and return only the failed message IDs.

Gotcha: Messages bounce to the DLQ after too few attempts, or loop forever.

Fix: Set maxReceiveCount deliberately (for example 3–5), and alarm on DLQ depth.

Gotcha: REST API pricing ($3.50/M) is almost three times HTTP API pricing ($1.29/M).

Fix: Default to HTTP APIs, or a function URL, unless you need a REST-only feature.

Gotcha: Adding API Gateway later looks like a rewrite.

Fix: It isn't. Function URLs use the same event format as HTTP APIs (payload version 2.0), so the same handler works behind either.

Gotcha: API Gateway execution logs at INFO level log every request into CloudWatch.

Fix: Keep access logs; turn execution logging down or off in production.

Gotcha: Astro 6 changed how the Cloudflare adapter exposes bindings: Astro.locals.runtime is deprecated.

Fix: Read bindings (KV, R2, secrets) through env instead, and check the adapter's upgrade notes when you move between major versions.

Gotcha: RDS Proxy 'pins' a session to one connection when it sees SET, prepared statements, temporary tables, advisory locks or statements over 16 KB. Pinned sessions exhaust the pool.

Fix: Watch the DatabaseConnectionsCurrentlySessionPinned metric and remove the pinning causes. Or move HTTP logic to Lambda Web Functions, which share one pool across up to 128 requests.

Gotcha: Serverless v2 can pause at 0 ACU, but resuming takes about 15 seconds (30+ after a day paused).

Fix: Don't pause production databases that serve users.

Gotcha: A function idle for weeks goes Inactive, and the first calls fail while it reactivates.

Fix: Ping it on a schedule, use provisioned concurrency for critical paths, or move bursty HTTP endpoints to Workers.

Gotcha: Scaling is capped: 1,000 concurrent executions per account by default, and each function adds at most 1,000 instances every 10 seconds.

Fix: The limit is requests in flight, not per second (2,000 req/s at 100 ms is only 200). Raise the quota before launches, and put Workers in front of known spikes.

Gotcha: SnapStart doesn't help Node.js. As of October 2026 it only supports Java, Python, .NET and container images.

Fix: For Node.js zip functions, keep the bundle small, initialise lazily, and use provisioned concurrency where latency matters.

Gotcha: Log-level filtering (drop DEBUG and INFO before you pay for them) only works with the JSON log format. The default Text format logs everything.

Fix: Set the log format to JSON and the application log level to WARN in production.

Gotcha: Response streaming isn't available through a function URL when the function is in a VPC.

Fix: Keep streaming endpoints out of the VPC, or stream from Workers or Lambda Web Functions.

Gotcha: Long-lived IAM user keys scattered across laptops.

Fix: SSO through Identity Center for every human; no static keys.

Gotcha: There's no hosted login page. Better Auth gives you the endpoints and a client SDK, not the screens.

Fix: Build sign-in, sign-up and reset-password pages in your app (a day with Claude Code), or use a ready-made component kit if the front end is React. They match your design, which Cognito's pages never quite do.

Gotcha: It doesn't send email. Password reset, verification and magic links produce a link and wait for you.

Fix: Pass it to Resend in a few lines (sendResetPassword, sendVerificationEmail, sendMagicLink).

Gotcha: 27 security advisories in 2026 (3 critical), many in the young SSO and SCIM plugins. Other open-source auth projects had similar years.

Fix: Pin exact versions, let Renovate or Dependabot open update PRs, and run a weekly scheduled agent that checks the repo's security advisories and opens the upgrade. Enable only the plugins you use.

Gotcha: Letting users register their own SSO providers caused most of the 2026 SSO advisories (account takeover through unproven domains).

Fix: Register SSO providers only from your own server code, require DNS domain verification, turn on requireTimestamps for SAML, and keep implicit account linking off.

Gotcha: Its JWT plugin signs EdDSA by default, which API Gateway JWT authorizers and IAM don't accept.

Fix: Configure RS256. Then Workers, API Gateway and Cognito identity pools all accept its tokens.

Gotcha: Google Workspace can't push users to custom apps over SCIM.

Fix: Google sign-in works; for Google directory sync, use another tool (Ory Polis or WorkOS) or invite users by domain.

Gotcha: Single-threaded isn't automatically transactional across an await. If you await an outside call (asking AWS whether a bidder is verified) between reading the price and writing the bid, other bids run in the gap.

Fix: Do outside checks before the critical section. Keep read → check → write → broadcast synchronous (the SQLite API is synchronous, or use transactionSync).

Gotcha: Every deploy restarts all Durable Objects and drops every WebSocket.

Fix: Clients must reconnect automatically. Don't deploy during a live event.

Gotcha: No published maximum of WebSockets per object. The real ceilings are one thread, 128 MB and about 1,000 incoming requests a second.

Fix: Up to about 2,000 watchers connect directly. Above that, fan out through helper objects that each hold 1,000 to 2,000 sockets, and batch broadcasts every 50–100 ms.

Gotcha: Alarms can fire more than once.

Fix: Make the alarm handler idempotent: check the object's state before acting.

Gotcha: An object is created near its first request (or where locationHint says) and never moves.

Fix: Pass locationHint 'oc' on first access for Australian users.

Gotcha: 10 GB per object, 100 columns per table, 2 MB per row.

Fix: Design the schema around one entity (this auction, this room), and export finished data to AWS.

Gotcha: Without a dead-letter queue, failed messages are deleted.

Fix: Always configure a DLQ.

Gotcha: Untrusted code can still try to reach your APIs or leak secrets through the network.

Fix: Never put secrets inside the sandbox. Route its traffic through an outbound Worker, the egress proxy that injects credentials per destination so the code never sees them, and allow only the destinations it needs.

Gotcha: Costs grow with every session left running.

Fix: Give every session a timeout and destroy it when the user leaves; back up the workspace and restore it if they come back.

Gotcha: The widget alone doesn't stop bots: they post straight to your endpoint and never load it.

Fix: Check every token on the server, with your secret, at https://challenges.cloudflare.com/turnstile/v0/siteverify, and reject the request unless it succeeds.

Gotcha: A token can be checked only once and expires after 5 minutes, so a slow form or a retry fails.

Fix: Verify once, at submission; if the form errors, reset the widget for a new token before the user resubmits.

Gotcha: Some bots still get through: Turnstile tells you a browser was there, not that a human meant it.

Fix: Add a hidden honeypot field and drop any submission that fills it.

Gotcha: It's not full Node.js. Most pure-JavaScript npm packages work, but there are no native modules and child_process, worker_threads, cluster and vm are stubs.

Fix: Treat Workers as the layer in front of your backend. If a Worker grows into business logic that needs these, move it to Lambda Web Functions.

Gotcha: Memory is fixed at 128 MB per isolate.

Fix: Stream instead of buffering. Anything heavy goes to Lambda.

Gotcha: Calling AWS from a Worker means storing access keys: there's no IAM role.

Fix: Use narrowly scoped keys in Workers secrets, or call an AWS endpoint (function URL with signed requests) instead of AWS APIs directly.

Gotcha: Cron triggers are UTC only.

Fix: Convert schedules to UTC, or schedule in AWS with EventBridge Scheduler.

Gotcha: Workers Logs bills per log event until 30 November 2026 (20M included, then $0.60 per million). Five console.log lines per request multiplies the bill by five.

Fix: Log one structured object per request. From 1 December 2026 billing moves to $0.25/GB, cheaper than CloudWatch in Sydney ($0.67/GB).

Gotcha: Operation names can mislead: CloudWatch log ingestion shows as 'PutLogEvents' but is billed per GB.

Fix: Group by usage type as well as operation.

Gotcha: Lambda has no HOME directory, so INSTALL, LOAD and CREATE SECRET fail with "Can't find the home directory".

Fix: Run SET home_directory='/tmp' first.

Gotcha: The S3, AWS and Iceberg extensions are downloaded at runtime unless bundled: about 100 MB on every cold start.

Fix: Bundle them in the layer and SET extension_directory to it.

Gotcha: DuckDB SQL isn't Athena's (Trino) SQL. Date, array and approximate functions differ.

Fix: Test shared queries on both engines, or keep each query on one engine.

Gotcha: The layer zip is over 50 MB.

Fix: Upload the layer through S3, or use a container image.

Gotcha: Fargate Spot tasks can be stopped with two minutes' notice.

Fix: Use Spot only for jobs that checkpoint or can safely restart.

Gotcha: Cognito gives trigger functions about 5 seconds. A cold container image can blow through that.

Fix: Keep Cognito triggers small, zip-packaged and Node.js.

Gotcha: Whether retries are billed as extra operations isn't verified.

Fix: Pilot on one workload and read the bill before rolling out.

Gotcha: Response streaming doesn't work through a function URL for a function inside a VPC.

Fix: Keep streaming functions outside the VPC, or use Workers or Lambda Web Functions.

Gotcha: Up to 128 requests share one process. Lambda code that keeps the current user or tenant in a module-level variable becomes a data leak between users.

Fix: Audit global variables before migrating. Keep per-request data in AsyncLocalStorage or pass it explicitly.

Gotcha: A brand-new Web Function starts with a conservative per-environment concurrency limit and learns the right one from traffic. Your first big burst uses more environments and cold-starts more.

Fix: Load-test before launch and judge by the second run. Lambda remembers what it learned, even after scaling to zero.

Gotcha: No minimum or reserved environments, and AWS doesn't publish how fast new ones are added. A burst faster than the spare headroom waits on cold starts, and over the limits requests get HTTP 429, not a queue.

Fix: Clients retry with backoff and jitter. For known spikes, put Workers in front.

Gotcha: Default limits per region: 10,000 req/s per endpoint, 100,000 per account, 2,000 vCPUs (1,000 environments).

Fix: Request increases ahead of growth, and set rateLimit on endpoints to protect Postgres.

Gotcha: Node.js 24 on Arm64 only, 2 GB and 2 vCPU per environment.

Fix: Keep anything bigger on classic Lambda.

Gotcha: The pooled endpoint accepts 10,000 clients, but real concurrent transactions are about 90% of max_connections: roughly 94 at 0.25 CU, 377 at 1 CU. Queued clients time out after 120 s.

Fix: Size compute for concurrent transactions, not client count. Use the HTTP driver for one-shot queries.

Gotcha: The HTTP driver has no interactive transactions.

Fix: Use the WebSocket mode of the serverless driver when you need a session.

Gotcha: After 5 minutes idle, compute scales to zero and the next query waits a few hundred milliseconds.

Fix: Fine for most apps. Disable scale-to-zero on production branches that need instant answers.

Gotcha: The build goes over the Worker size limit.

Fix: Run npx @opennextjs/cloudflare build and read what's in the bundle; heavy server-only dependencies are the usual cause.

Gotcha: ISR pages serve stale content longer than expected when the cache sits in Workers KV, which is eventually consistent.

Fix: Use R2 for the incremental cache, as OpenNext's docs recommend (and D1 for the tag cache).

Gotcha: Calling it from the browser exposes your API key.

Fix: Always go through a server-side proxy. A Cloudflare Worker is ideal: see the LLM proxy guide.

Gotcha: The HNSW index has to fit in memory, so large collections force a big, always-on database.

Fix: Keep the hot data in pgvector and move the archive to S3 Vectors. Watch Neon's Lakebase Search, which keeps the index on disk.

Gotcha: The unscoped npm package postmark-mcp was malware that BCC'd every email to an attacker.

Fix: If you use Postmark with agents, the official package is @activecampaign/postmark-mcp.

Gotcha: A vendor has no Pulumi package.

Fix: Run pulumi package add terraform-provider <namespace>/<name>: Pulumi generates an SDK from any Terraform or OpenTofu provider.

Gotcha: Community providers are often maintained by one person (Neon, Resend, Clerk).

Fix: Pin provider versions and upgrade deliberately.

Gotcha: New AWS services can land in @pulumi/aws-native before @pulumi/aws (Lambda Web Functions today).

Fix: Use aws-native for those resources alongside the classic provider.

Gotcha: Pulumi doesn't bundle Cloudflare Worker code.

Fix: Build with Wrangler, deploy the output with Pulumi, and give each Worker one owner.

Gotcha: Young company (founded 2023).

Fix: Keep sending behind one small module of your own so a switch would be a day's work, not a rewrite.

Gotcha: The Terraform provider is community-maintained.

Fix: Pin its version and keep templates in code, not in IaC.

Gotcha: Data partitioned by date, queried by customer: every query scans every partition.

Fix: Keep the date partitions and sort each file by the second key (DuckDB COPY ... ORDER BY). Athena and DuckDB skip row groups by their min/max statistics, and Athena bills only the bytes it reads. For a real fix, use Iceberg tables in S3 Tables, partitioned by day(ts) plus bucket(N, customer_id), with sort or z-order compaction.

Gotcha: Partition projection and Glue partition indexes look like secondary indexes. They only speed up query planning.

Fix: Use sorting, bucketing or Iceberg to prune data; projection to skip catalog lookups.

Gotcha: CTAS and INSERT INTO write at most 100 partitions per query.

Fix: Write Parquet with DuckDB COPY (no limit, full control of sort order and file size), or split the job.

Gotcha: Unofficial MCP packages can be malicious (the fake postmark-mcp BCC'd every email to an attacker).

Fix: Use vendors' official servers, pin versions, and read the code of anything community-made.