AWS Weekly Digest
Week of 11–18 October 2026
No new flagship instances, but plenty to tighten in logging, failover drills, patching and the web tier.
Do this week
- Find every nested-virtualization or .metal hypervisor host and patch it for CVE-2026-99999 through Patch Manager.
- Set a retention policy on every CloudWatch log group, then use pipeline routing to split DEBUG from audit logs.
- Add target-group health gates and quota checks to your ARC Region switch plans, and schedule a drill.
- Audit T-family instances for surplus-credit charges and Ubuntu LTS instances past standard support.
Showing 8 of 12 changes tagged Operational Excellence
Showing 6 of 12 changes tagged Security
Showing 4 of 12 changes tagged Reliability
Showing 4 of 12 changes tagged Performance Efficiency
Showing 7 of 12 changes tagged Cost Optimization
Showing 1 of 12 changes tagged Sustainability
Primary lens — EC2 & IaaS compute
01EC2 T8i burstable instances now available in South America (São Paulo)
Better: Alarm on CPUSurplusCreditsCharged and CPUCreditBalance. If an instance sits above baseline most of the day, move it to M8i, C8i or Graviton and let Compute Optimizer confirm the size.
T8i comes in nano, micro, small and medium sizes. AWS claims up to 30% better price performance than T3, up to 70% more compute, 1.25x the network bandwidth and 2.4x the EBS bandwidth. Standard and Unlimited credit modes work exactly as they do on T3, and t8i.micro and t8i.small are Free Tier eligible.
If you have T3 fleets in São Paulo, such as bastions, dev boxes, small internal services and CI runners, this is a low-risk generational swap. Most current Linux and Windows AMIs already include the ENA and NVMe drivers that Nitro needs, but check older custom AMIs before changing the launch template.
Anti-pattern: Running steady-state production on T-family in Unlimited mode with no alarm on surplus credits, so the instance quietly bills like a larger one.
Better: Alarm on CPUSurplusCreditsCharged and CPUCreditBalance. If an instance sits above baseline most of the day, move it to M8i, C8i or Graviton and let Compute Optimizer confirm the size.
Tradeoff: If your stack is already ARM-ready, Graviton T4g is usually cheaper per credit. T8i is the right pick when you need x86 binaries or licensing.
02Microsecond-accurate Time Sync expands to 135 more EC2 instance types
Better: Pin only the latency-critical tier into a PTPG or cluster group, run a matching group in a second AZ, and keep the stateless tiers spread across zones.
The PTP hardware clock now covers C8a, C8i, C8i-flex, C8id, M8i, M8i-flex, R8a, X8i, C9g, C9gd, M9g and M9gd. You opt in through a new placement strategy, the Precision Time Placement Group (PTPG), and you can attach it to a Cluster Placement Group when you also need low network latency.
For most fleets, plain chrony against the Time Sync endpoint is still enough. This matters if you run distributed databases that use commit-wait, need trustworthy one-way latency measurements, or need to order events across instances for audit or forensics.
Anti-pattern: Putting a whole production tier into one cluster placement group to chase latency, which in practice makes it a single-AZ deployment.
Better: Pin only the latency-critical tier into a PTPG or cluster group, run a matching group in a second AZ, and keep the stateless tiers spread across zones.
Tradeoff: Placement groups narrow where capacity can land, so expect more InsufficientInstanceCapacity errors at scale-out. Use On-Demand Capacity Reservations for the pinned tier.
03License Manager converts running Ubuntu LTS instances to Ubuntu Pro in place
Better: Convert the ones you truly can't replace, rebuild the rest through EC2 Image Builder, and enforce a Patch Manager baseline with maintenance windows.
Until now, getting Ubuntu Pro meant relaunching from a Pro AMI. The conversion now runs on the existing instance, and you can subscribe to Canonical's Marketplace listing from the License Manager console. Ubuntu Pro also covers thousands of universe packages, including NGINX, PostgreSQL and Redis, which standard LTS does not.
This is a pragmatic answer for long-lived pets you can't rebuild quickly. It is not a substitute for an image pipeline. The announcement doesn't say whether conversion needs a reboot, so test it on a non-production instance first.
Anti-pattern: Ubuntu instances past standard support that get patched by hand over SSH, or never.
Better: Convert the ones you truly can't replace, rebuild the rest through EC2 Image Builder, and enforce a Patch Manager baseline with maintenance windows.
Tradeoff: Ubuntu Pro adds a per-hour Marketplace charge for every converted instance. For a large fleet, compare that against the one-time engineering cost of rebuilding on a supported LTS.
04Security Bulletin 2026-137: KVM host memory corruption via virtio-net (CVE-2026-99999)
Action: Find every instance with nested virtualization enabled or a .metal type running a hypervisor, tag it as a hypervisor host, and patch it through Patch Manager with a reboot window this week…
AWS manages the host for standard EC2, so ordinary instances are out of scope. You are exposed if you are the hypervisor: KVM on EC2 with nested virtualization, VMs on *.metal instances such as c8i.metal-48xl, or Firecracker microVMs using virtio-net. Kernels 4.4 through 6.18 are affected.
Amazon Linux 2 and AL2023 packages are available. For other distributions, follow the vendor advisories from Ubuntu and Red Hat.
Action: Find every instance with nested virtualization enabled or a .metal type running a hypervisor, tag it as a hypervisor host, and patch it through Patch Manager with a reboot window this week. Prioritize hosts where guest users have root.
Tradeoff: This is shared responsibility in practice: once you run the hypervisor, its kernel SLA belongs to you. Give those hosts a tighter patch baseline than the rest of the fleet.
Observability — CloudWatch
05CloudWatch pipelines add conditional log routing and chained parsers
Better: Route by severity, set an explicit retention policy on every group, and enforce it with an AWS Config rule (cw-loggroup-retention-period-check).
Routing is evaluated against processed fields, so one agent stream from an EC2 fleet can be split: DEBUG and INFO to a short-retention group, ERROR to a group with metric filters and alarms, and audit or security events to a long-retention group with tighter IAM. Chained parsers handle the common case of a JSON envelope wrapping an unstructured message.
The feature is available in every commercial Region where CloudWatch pipelines is GA, through the console, CLI and SDKs.
Anti-pattern: One log group per application with retention set to Never expire and everything shipped at DEBUG.
Better: Route by severity, set an explicit retention policy on every group, and enforce it with an AWS Config rule (cw-loggroup-retention-period-check).
Tradeoff: The announcement doesn't mention pricing, so check CloudWatch pipelines pricing before you put high-volume streams through it. Keep pipeline definitions in IaC, because a bad route silently sends logs to the wrong place.
06CloudWatch cross-account log centralization reaches GovCloud and 13 more Regions
Better: Run the CloudWatch agent through a Systems Manager State Manager association and centralize with an Organizations-level rule.
New Regions include Cape Town, Hong Kong, Hyderabad, Jakarta, Malaysia, Melbourne, Calgary, Milan, Spain, Zurich, Tel Aviv, Bahrain and UAE. Rules can target the whole organization, specific OUs or individual accounts, and enriched system fields record the source account and Region.
If you built subscription filters to Firehose to a central bucket to get one pane of glass for EC2 logs, you can probably retire that pipeline in these Regions.
Anti-pattern: Instance logs that live only on local disk, read by SSHing into the box during an incident.
Better: Run the CloudWatch agent through a Systems Manager State Manager association and centralize with an Organizations-level rule.
Tradeoff: The central account becomes a high-value target. Lock it down with SCPs and restricted roles, and remember that only one copy is free.
Resilience & operations automation
07ARC Region switch adds Run Command blocks, quota checks and ASG target-health gates
Better: Use a pilot light or warm pool, gate traffic shift on target group health, enable quota checks, and run a failover drill every quarter.
For EC2, the most important addition is the target-health wait. Until now, a plan could scale the standby ASG and move traffic before the new instances passed load balancer health checks. Quota parity checks address another common DR failure, where the standby Region simply isn't allowed to launch the capacity you need.
Run Command blocks let in-guest steps such as cache warm-up, config flips or service restarts live inside the plan instead of a runbook nobody has tested.
Anti-pattern: A DR plan that scales a cold standby ASG from zero and flips DNS immediately, in a Region whose quotas were never checked.
Better: Use a pilot light or warm pool, gate traffic shift on target group health, enable quota checks, and run a failover drill every quarter.
Tradeoff: Run Command blocks make recovery depend on SSM agent connectivity in the standby Region. Keep VPC endpoints for SSM in place there, and make sure the instance profile allows it.
08AWS DevOps Agent now investigates Resilience Hub findings and resilience tests
Better: Start read-only, add a permissions boundary, and require human approval for any change action. Widen scope one action at a time.
What gets automated is the analysis: correlating test or finding context with telemetry into a structured write-up, including whether recovery actions such as an ARC Region switch actually fired. Per the announcement, tasks are user-initiated from a finding or a test. It doesn't describe autonomous remediation.
The announcement doesn't say which permissions the agent's role needs, so check the integration docs before you enable it.
Anti-pattern: Giving an AI ops agent's role broad write access such as ec2:*, autoscaling:* or iam:PassRole so it can “fix things” during an incident.
Better: Start read-only, add a permissions boundary, and require human approval for any change action. Widen scope one action at a time.
Tradeoff: Faster post-test analysis versus trusting an agent's root-cause narrative. Treat its report as a draft for the post-incident review, not the verdict.
Security, governance & networking
09Security Hub adds resource criticality to exposure prioritization
Better: Enforce environment and criticality tags through Organizations tag policies and an SCP on ec2:RunInstances, and back them with explicit automation rules rather than relying on name inference.
Criticality shows up as a sortable column on the Resources page and in each exposure's impact assessment. You can set it with explicit rules, for example “all compute in the prod-payments account = Very High”, or let Security Hub infer it from tags and names, which records where each value came from.
For EC2 fleets this finally separates an exposed instance in production from the same finding on a dev sandbox.
Anti-pattern: Untagged or inconsistently named instances, so inference guesses and every finding looks equally urgent.
Better: Enforce environment and criticality tags through Organizations tag policies and an SCP on ec2:RunInstances, and back them with explicit automation rules rather than relying on name inference.
Tradeoff: Inference is free and needs no setup, but it's opaque about how tags map to levels. Use explicit rules for anything tied to an SLA.
10CloudFront VPC origins now support dual-stack (IPv6) to private ALB, NLB and EC2
Better: Put origins in private subnets behind VPC origins, enable dual-stack subnets, and allow only the CloudFront origin-facing path in security groups.
VPC origins previously connected over IPv4 only, so teams that wanted end-to-end IPv6 had to expose the origin publicly. The origin can now stay in a private subnet, reachable only from its distribution, while serving IPv6 clients.
It also helps the cost side: fewer internet-facing load balancers and instances means fewer public IPv4 addresses on the bill.
Anti-pattern: An internet-facing ALB or public EC2 origin kept open only so CloudFront can reach it, protected by an IP allow-list that drifts.
Better: Put origins in private subnets behind VPC origins, enable dual-stack subnets, and allow only the CloudFront origin-facing path in security groups.
Tradeoff: You need dual-stack VPCs and subnets, and an IPv6 review of security groups and NACLs. A stray ::/0 rule is the new 0.0.0.0/0.
Tertiary — Lambda as glue and offload for EC2
11Lambda Web Functions: HTTP-native Lambda billed on active CPU time
Better: Move it to a Web Function with VPC connectivity to the database, and keep EC2 for the high, steady-traffic services.
Why it matters to an EC2-centric architect: it offloads the small, bursty web tier, such as internal APIs, admin consoles and webhook receivers, that today idles on t-class instances behind an ALB. Because you aren't billed for CPU while waiting on a database, I/O-bound handlers get much cheaper, and multi-concurrency per environment cuts cold starts sharply. Existing functions are renamed Lambda Event Functions with no code changes.
Against EC2: a steady, high-throughput web tier on Graviton with Savings Plans is still cheaper per request and has no runtime limits. Web Functions win when utilization is low or spiky and you'd rather not patch, scale and monitor instances. Today it supports Node.js only, in us-east-1, us-east-2, us-west-2, ap-northeast-1 and eu-west-1, and quotas aren't published in the announcement.
Anti-pattern: An always-on t3.medium plus ALB serving an internal API that sees traffic two hours a day.
Better: Move it to a Web Function with VPC connectivity to the database, and keep EC2 for the high, steady-traffic services.
Tradeoff: Lower idle cost and no patching versus Node-only runtime, Region limits and deeper Lambda lock-in. Benchmark p99 latency under real concurrency before migrating anything customer-facing.
12Lambda recursive loop detection now covers EventBridge custom event buses
Better: Narrow the event patterns, emit results to a separate bus, make handlers idempotent, and scope the execution role to tagged resources. Disable loop detection only for functions that recurse…
Why it matters to an EC2-centric architect: EventBridge plus Lambda is the standard glue for EC2 automation, such as tag-on-launch, auto-remediation of security groups, and scheduled start/stop. That's exactly where a function that emits an event matching its own rule creates a runaway loop and a surprise bill. The detection is now a free safety net on custom buses as well as the default bus.
Anti-pattern: A remediation function that publishes to the same bus it consumes from, with a broad event pattern and an execution role that can modify every instance in the account.
Better: Narrow the event patterns, emit results to a separate bus, make handlers idempotent, and scope the execution role to tagged resources. Disable loop detection only for functions that recurse by design.
Tradeoff: Detection stops the loop after it starts, so it limits the bill rather than preventing the bug. You still need reserved concurrency limits and design-time guards.