AWS Weekly Digest
Week of 4–11 October 2026
A quiet week for new silicon, but AMI tag sharing, tighter private paths for identity and certificates, and better Batch telemetry all deserve a slot in your next design review.
Do this week
- Start publishing approval and patch-level metadata as
ec2:SharedTag/tags on your golden AMIs, and gate launches on them with ABAC plus Allowed AMIs. - Lock down SCIM and Identity Store API access in IAM Identity Center to your IdP's IP ranges and your VPC endpoints.
- Add AWS::CloudWatch::AlarmMuteRule and AWS::SSM::MaintenanceWindow to your Config recorder, and flag stale alarm mutes.
- If you run DevOps Agent, install the investigation cost guardrail and back it with an AWS Budgets alert.
Showing 7 of 12 changes tagged Operational Excellence
Showing 6 of 12 changes tagged Security
Showing 4 of 12 changes tagged Reliability
Showing 3 of 12 changes tagged Performance Efficiency
Showing 4 of 12 changes tagged Cost Optimization
Showing 2 of 12 changes tagged Sustainability
Primary lens — EC2 & IaaS compute
01EC2 AMIs can now share tags across accounts
Better: Publish approval and patch-level metadata as shared tags from EC2 Image Builder, gate RunInstances on them with ABAC, and pair that with Allowed AMIs so only trusted publisher accounts are…
If you run a golden-AMI pipeline out of a central tooling account, you have probably written a Lambda or Step Functions job that copies tags like os-version, cis-level or approved into every consumer account. That glue can go. Tag a key with the ec2:SharedTag/ prefix and every account the AMI is shared with sees it immediately, whether the share is to one account, an OU, the whole organization or the public.
Recipients get read-only access to shared tags and can still add private tags of their own. The big win is ABAC: a consumer account can allow ec2:RunInstances only when the image carries status=approved, and the publisher controls that value centrally.
Anti-pattern: Consumer accounts launching from whatever AMI ID appears in a wiki page or a hardcoded launch template, with no machine-checkable approval state.
Better: Publish approval and patch-level metadata as shared tags from EC2 Image Builder, gate RunInstances on them with ABAC, and pair that with Allowed AMIs so only trusted publisher accounts are discoverable.
Tradeoff: Every tag-gated decision in the consumer account now trusts the owner account. A compromised or careless publisher can flip an approval tag org-wide. Shared tags are also visible on public AMIs, so never put sensitive data in them. Tags copy to a new AMI only with --copy-image-tags.
02C8gb (Graviton4, EBS-optimised) expands to more US, EU and Africa Regions
Better: Profile EBS throughput and IOPS in CloudWatch first (VolumeThroughputPercentage, EBSIOBalance%), then right-size onto a b-variant. Let Compute Optimizer confirm the move.
C8gb is the compute-optimised Graviton4 variant built for EBS-heavy workloads: up to 300 Gbps of EBS bandwidth and 1,600K IOPS, up to 48xlarge with 384 GiB of memory, and up to 400 Gbps networking with EFA on the larger sizes. The announcement lists Ohio, N. California, Frankfurt, Ireland, Paris, Stockholm and Cape Town, and also references N. Virginia and Oregon (the page isn't fully consistent, so check the console for your Region).
This is the right shape for high-throughput databases, log and search clusters, and anything that is bottlenecked on block storage rather than CPU. If you've been over-sizing to a bigger C or R instance just to get more EBS bandwidth, this is your correction.
Anti-pattern: Scaling up to a larger instance purely to unlock EBS throughput, paying for vCPUs and memory you don't use.
Better: Profile EBS throughput and IOPS in CloudWatch first (VolumeThroughputPercentage, EBSIOBalance%), then right-size onto a b-variant. Let Compute Optimizer confirm the move.
Tradeoff: Graviton means arm64. Check every agent, sidecar and vendor binary in the AMI before you migrate. EBS-optimised variants carry a price premium over the base C8g, so only use them where storage is actually the bottleneck.
03Graviton4 R8g and R8gd reach the European Sovereign Cloud, and Hpc8a lands in Singapore
Better: Keep the durable copy on EBS or a replicated cluster and use NVMe only for cache, temp tables or shuffle space.
Two regional expansions worth noting. R8g and R8gd are now available in the AWS European Sovereign Cloud (Germany): Graviton4, up to 1.5 TB of memory, 50 Gbps networking and 40 Gbps to EBS, and in the gd variant up to 11.4 TB of local NVMe. Teams with EU data-residency requirements no longer have to trade down to older generations to stay in the sovereign partition.
Separately, Hpc8a reached Singapore on 5 October, which matters if you run tightly coupled simulation or engineering workloads in APAC and have been stretching across Regions for capacity.
Anti-pattern: Using instance-store NVMe as primary storage for a database with no replication, then losing data on a stop, failure or host retirement.
Better: Keep the durable copy on EBS or a replicated cluster and use NVMe only for cache, temp tables or shuffle space.
Tradeoff: Local NVMe on R8gd is ephemeral. Treat it as cache or scratch, never as the only copy of data, and design for instance replacement. Sovereign Cloud is a separate partition with its own IAM and tooling boundaries, so plan for that before you treat it as just another Region.
Governance, operations & automation
04AWS Config adds 77 resource types, including VPC CIDRs, SSM maintenance windows and alarm mute rules
Better: Record AWS::CloudWatch::AlarmMuteRule in Config and add a custom rule that flags any mute older than your maintenance window.
The headline number is 77, but the useful part for EC2 operators is a handful of types: AWS::EC2::VPCCidrBlock, AWS::EC2::TransitGatewayMeteringPolicy, AWS::SSM::MaintenanceWindow and AWS::CloudWatch::AlarmMuteRule. If you record all resource types, Config picks them up automatically, and they work in rules and aggregators.
Alarm mute rules are the sleeper here. A mute rule that never gets lifted is a silent outage waiting to happen, and now you can write a Config rule that flags mutes past their window.
Anti-pattern: Muting CloudWatch alarms during a maintenance window and forgetting to un-mute them, leaving production instances unmonitored for weeks.
Better: Record AWS::CloudWatch::AlarmMuteRule in Config and add a custom rule that flags any mute older than your maintenance window.
Tradeoff: Recording all resource types increases configuration-item charges. If you use selective recording, add the new types explicitly instead of turning on everything.
05Control Tower Account Factory for Terraform adds plan-only runs
Better: Make a plan-only run a mandatory PR check, review the per-account diff, then apply in waves starting with a sandbox OU.
Until now, every AFT customization run was a full apply across your managed accounts, with no dry run. Plan-only runs fix that. You can preview what a change to a baseline VPC, SCP-adjacent IAM role or default EBS-encryption setting will do across every account before it lands, and use the same mechanism to detect drift.
It works with open-source Terraform, Terraform Cloud and Terraform Enterprise, so it slots into whatever review gate you already run.
Anti-pattern: Pushing a baseline change through AFT straight to every account and finding out from an incident that it broke a workload's networking.
Better: Make a plan-only run a mandatory PR check, review the per-account diff, then apply in waves starting with a sandbox OU.
Security, IAM & networking
06IAM Identity Center adds network access controls for the Identity Store and SCIM APIs
Better: Restrict SCIM to your IdP's IP ranges, put Identity Store API calls behind VPC endpoints, and rotate the SCIM token on a schedule.
The Identity Store holds the users and groups behind every permission set that grants access to your EC2 fleet. Until now, anyone with valid credentials could call its API from anywhere. You can now require the Identity Store API to come through your VPC endpoints or source VPCs, and lock SCIM provisioning to your IdP's published IP ranges. Each API can have its own policy, and calls AWS makes on your behalf are exempt.
It's configured through the Identity Store API (CLI or SDK), not the console, so treat it as infrastructure as code from day one.
Anti-pattern: Leaving the SCIM endpoint and bearer token open to the internet, so a leaked token can create users and add them to admin groups from anywhere.
Better: Restrict SCIM to your IdP's IP ranges, put Identity Store API calls behind VPC endpoints, and rotate the SCIM token on a schedule.
Tradeoff: Misconfigured network controls can break provisioning from your IdP or lock out break-glass automation. Test in a non-production organization and document the rollback path.
07ACM can now issue public certificates over PrivateLink with ACME
Better: Use ACM's ACME endpoint over PrivateLink and remove the internet route if nothing else needs it. Alarm on renewal failures in CloudWatch.
If you terminate TLS on the instance rather than at an ALB, for example for end-to-end encryption, NLB pass-through or non-HTTP protocols, your instances have needed outbound internet access just to renew certificates. Now you create a managed ACME endpoint in ACM plus a standard interface endpoint, and private DNS points your existing ACME directory URL at it. Certbot and similar clients work unchanged.
Everything is logged in CloudTrail and reported in CloudWatch metrics, so certificate issuance finally shows up in the same audit trail as the rest of your fleet.
Anti-pattern: Giving private-subnet instances a NAT Gateway route to the internet only so certbot can renew certificates, widening egress for a single job.
Better: Use ACM's ACME endpoint over PrivateLink and remove the internet route if nothing else needs it. Alarm on renewal failures in CloudWatch.
Tradeoff: Interface endpoints are billed per AZ-hour plus data processed. For a handful of instances, that can cost more than a shared NAT Gateway. It pays off when it lets you remove internet egress entirely.
08Client VPN adds device posture checks with continuous re-evaluation
Better: Enforce device posture on Client VPN, keep authorization rules scoped per subnet, and use Session Manager instead of SSH for interactive access.
Client VPN is still how many teams reach private EC2 hosts and internal ALBs. It now reads device signals such as encryption status, compliance score and risk level from CrowdStrike, Jamf or JumpCloud, evaluates them against Cedar policies, and re-checks during the session. A device that drifts out of compliance mid-session is disconnected.
There is a monitoring-only mode, so you can log the impact of a policy before you enforce it. Use it. Posture policies written blind tend to lock out half of engineering on day one.
Anti-pattern: Treating VPN authentication as the only control, so any authenticated laptop, including unmanaged or compromised ones, gets a network path to production subnets.
Better: Enforce device posture on Client VPN, keep authorization rules scoped per subnet, and use Session Manager instead of SSH for interactive access.
Tradeoff: Posture checks depend on your EDR or MDM vendor's availability and signal quality. An outage on their side can become an access outage on yours, so plan a break-glass path.
09Security Hub exports findings to S3 as CSV or OCSF JSON
Better: Send exports to a dedicated, KMS-encrypted bucket with Block Public Access, a tight bucket policy and a lifecycle rule.
This is a small feature that removes a lot of glue. Audit and compliance teams that wanted a spreadsheet of EC2 vulnerability or exposure findings used to need a custom Lambda pulling from the API. Now it's an on-demand export from the console, straight to S3, as CSV for humans or OCSF JSON for your SIEM or data lake.
Anti-pattern: Exporting security findings to a general-purpose bucket with broad read access, turning a vulnerability list into a target list.
Better: Send exports to a dedicated, KMS-encrypted bucket with Block Public Access, a tight bucket policy and a lifecycle rule.
Tradeoff: On-demand export is a manual step, not a pipeline. For continuous feeds, EventBridge or Security Lake is still the better pattern.
Agentic AI ops
10AWS publishes a cost guardrail for DevOps Agent investigations
Better: Install the guardrail skill, add a space-level instruction to always consult it, and set log-group retention so there's less to scan in the first place.
When DevOps Agent investigates an EC2 incident, it can run CloudWatch Logs Insights scans, broad PromQL queries, Athena queries and cross-Region reads. Each of those costs money, and an agent will happily run a 30-day unbounded scan. This skill classifies each planned call, prices it from the live Price List API, and returns Proceed, Warn (with a cheaper alternative) or Halt against a per-investigation budget.
What's automated is the pre-flight estimate and the gate. What isn't is the decision to spend past budget: halted investigations wait for a human. The skill needs only pricing:GetProducts, so it adds no meaningful blast radius.
Anti-pattern: Letting an AI ops agent run log scans with no time window across every log group, then finding the bill at month end.
Better: Install the guardrail skill, add a space-level instruction to always consult it, and set log-group retention so there's less to scan in the first place.
Tradeoff: Classification is heuristic and AWS says it catches most, not all, billable calls. Treat it as a seatbelt, not a hard budget control, and keep AWS Budgets alerts on the account.
Tertiary — Lambda & Batch alongside EC2
11Lambda functions can now read their Availability Zone ID
Action: For chatty Lambda-to-cache or Lambda-to-replica paths, read the AZ ID at init and prefer same-AZ endpoints, with a cross-AZ fallback.
Why it matters to an EC2-centric architect: Lambda functions that call services on your EC2 fleet or in RDS can now be AZ-aware, which closes one of the few performance gaps between Lambda and an instance that always knew its AZ through IMDS.
The function reads AWS_LAMBDA_METADATA_API and a bearer token, calls the endpoint once at init, and gets back an AvailabilityZoneID. It's free in commercial Regions. Powertools wraps it for Python, TypeScript, Java and .NET, including the refresh needed after a SnapStart restore.
Action: For chatty Lambda-to-cache or Lambda-to-replica paths, read the AZ ID at init and prefer same-AZ endpoints, with a cross-AZ fallback.
Tradeoff: Versus EC2: an instance gets its AZ from IMDS for free and never moves. Lambda environments can resume in a different AZ after SnapStart restore, so you must refresh. Always keep a cross-AZ fallback, because a same-AZ replica may not exist, and replicas lag the primary.
12AWS Batch now publishes job state and duration metrics to CloudWatch
Better: Move to Batch with Spot-backed managed compute environments, and alarm on runnable time and failed-job counts per queue.
Why it matters to an EC2-centric architect: Batch on EC2 compute environments is the managed alternative to hand-rolled cron-plus-Auto-Scaling job runners. Its weak spot was observability, and native queue metrics close that gap.
You now get counts of jobs entering each state (submitted, runnable, running, succeeded, failed) and durations between states, such as submitted-to-runnable and total runtime, dimensioned by JobQueueName. That's enough to alarm on a growing runnable backlog, which usually means your compute environment has hit max vCPUs or can't get Spot capacity.
Anti-pattern: Running batch jobs on always-on EC2 instances with cron, and no metric that tells you whether jobs are queuing, failing or finishing late.
Better: Move to Batch with Spot-backed managed compute environments, and alarm on runnable time and failed-job counts per queue.
Tradeoff: Versus self-managed EC2 job runners: Batch removes scheduler and scaling code and scales to zero between runs, but you give up some control over placement and bin-packing, and debugging moves to CloudWatch Logs. For steady 24/7 throughput, a right-sized Savings Plan fleet can still win on cost.