AWS Weekly Digest
Week of 19–25 October 2026
Faster AMI pipelines, tag-aware alarms, 1:1 NAT on Transit Gateway and tighter egress control — the management layer did the heavy lifting this week.
Do this week
- Turn on tag payloads (owner, env, service) in your standard CloudWatch alarm module and retire tag-lookup Lambdas.
- Enable the new GuardDuty runtime rules in dry-run on one EC2 account and check runtime agent coverage across the fleet.
- Start an alert-mode rollout of Route 53 Resolved IP validation on Network Firewall, and find instances that bypass the VPC Resolver.
- Pilot the Image Builder ASG integration on your busiest AMI pipeline in non-prod and measure build time against cost.
Showing 7 of 10 changes tagged Operational Excellence
Showing 4 of 10 changes tagged Security
Showing 4 of 10 changes tagged Reliability
Showing 2 of 10 changes tagged Performance Efficiency
Showing 4 of 10 changes tagged Cost Optimization
Primary lens — EC2 & IaaS compute
01EC2 Image Builder can now build from a warm Auto Scaling group
Better: An Image Builder pipeline on a schedule, fed by a small dedicated build ASG, with the new AMI rolled out through ASG instance refresh and patch compliance verified by Patch Manager.
This was the only real primary-lens launch of the week, and it is a practical one. Image Builder pipelines spend a surprising share of their runtime just launching an instance, waiting for status checks and bootstrapping the SSM agent. Point the infrastructure configuration at an ASG and Image Builder picks an already-running instance, applies components, snapshots it and lets the ASG backfill. Pipelines without an ASG configured behave exactly as before.
The design detail that matters: the instance is consumed. Treat the build ASG as a dedicated, disposable pool — its own launch template, its own subnet, its own instance profile — and never aim Image Builder at a production group.
Anti-pattern: Hand-patching a long-lived "golden" instance and snapshotting it whenever someone remembers.
Better: An Image Builder pipeline on a schedule, fed by a small dedicated build ASG, with the new AMI rolled out through ASG instance refresh and patch compliance verified by Patch Manager.
Tradeoff: A warm pool is idle capacity you pay for between runs. It pays off for pipelines that build several times a day; for a weekly rebuild, the default launch-per-build model is still cheaper and simpler.
Observability & operations
02CloudWatch alarms can now carry their tags into the action payload
Better: Mandatory owner/env/service tags on every alarm, selected keys included in the payload, and EventBridge rules routing on those fields.
If you run a shared alarm pipeline — one SNS topic or EventBridge bus fanning out to ticketing and paging — you've probably written a Lambda that calls ListTagsForResource on every alarm to work out who owns it. That lookup can now go away: the owner, environment and service tags arrive in the event itself, ready for EventBridge rules to route on.
Two caveats. It is opt-in per alarm, so the only sane way to roll it out is through your IaC alarm module defaults. And it is not yet available in Middle East (UAE) or Middle East (Bahrain).
Anti-pattern: Encoding ownership in alarm names, or a router Lambda that looks up tags on every state change (extra latency, API throttling during alarm storms).
Better: Mandatory owner/env/service tags on every alarm, selected keys included in the payload, and EventBridge rules routing on those fields.
03CloudFormation adds force rollback for stuck update rollbacks
Better: Deny mutating calls on stack-managed resources outside the pipeline role (SCP or permission boundary), and run scheduled drift detection.
Anyone who has nursed an EC2 stack out of UPDATE_ROLLBACK_FAILED knows the routine: find the resource that won't roll back (often a security group or instance someone changed in the console), add it to the skip list, retry, repeat. Force rollback collapses that into one call and leaves the stack deployable, with a record of what needs fixing. AWS's suggested follow-up is a drift-aware change set before the next deploy — do that, every time.
Anti-pattern: Making console changes to security groups, launch templates or instances that a stack owns, then discovering the drift mid-rollback.
Better: Deny mutating calls on stack-managed resources outside the pipeline role (SCP or permission boundary), and run scheduled drift detection.
Tradeoff: A stack that is "deployable" is not the same as a stack that matches reality. Force rollback trades a faster recovery for a list of known divergences you must actually work through.
Security & agentic ops
04GuardDuty Runtime Monitoring gets 50+ optional detection rules, with dry-run
Better: Dry-run for two weeks, tune, then enable; enforce agent coverage with State Manager; move sudoers and auditd configuration under State Manager so legitimate changes stop looking like attacks.
These are the detections that are normal in one estate and a red flag in another, which is why they are optional. On EC2 they need the GuardDuty runtime agent (usually deployed through Systems Manager), so check your coverage before you assume the fleet is protected. Dry-run mode is the right on-ramp: you see what would fire without paging anyone.
Expect the sudoers and audit-log rules to light up on any fleet where admins still make changes by hand over SSH. That's the finding working as intended.
Anti-pattern: Enabling every new rule straight into live alerting and drowning the on-call in findings, or leaving runtime agents off half the fleet.
Better: Dry-run for two weeks, tune, then enable; enforce agent coverage with State Manager; move sudoers and auditd configuration under State Manager so legitimate changes stop looking like attacks.
05AWS Continuum for code vulnerabilities is generally available
Action: run Continuum in learn mode only, keep human review on every PR, scope its role to read-only in production accounts, and audit its activity through CloudTrail.
This is the agentic-ops story of the week. What makes it relevant to an EC2 shop is the context graph: a vulnerable library on an instance that is reachable from the internet through its security groups ranks differently from the same library on an isolated batch box. Fixes arrive as PRs with exploitability evidence and a blast-radius assessment, and it works alongside GuardDuty and Security Hub.
The autonomy question is the one to settle up front. Learn mode is the default; enforce mode lets it act on its own within guardrails, and the announcement doesn't yet spell out what those guardrails look like.
Action: run Continuum in learn mode only, keep human review on every PR, scope its role to read-only in production accounts, and audit its activity through CloudTrail.
Tradeoff: Machine-speed remediation shortens exposure windows, but an agent that merges its own patches into application repos widens the blast radius of a bad fix. Keep humans on the merge button until you have precision data from your own estate.
VPC & networking
06Transit Gateway and Cloud WAN now do managed 1:1 NAT on attachments
Better: Allocate non-overlapping ranges through VPC IPAM, and keep 1:1 NAT for the edges you don't control: acquisitions, partners and multicloud links.
Overlapping CIDRs after an acquisition, or a partner who insists on 10.0.0.0/16, used to mean renumbering or a pair of NAT instances on EC2 that somebody had to patch, scale and fail over. Now the translation rule lives on the attachment, AWS runs it, and it shows up in CloudWatch metrics and EventBridge events. The supporting API landed on 22 October (ModifyTransitGatewayAttachmentNatConfiguration).
Pricing isn't stated in the announcement — it points to the VPC pricing page, so check it before you retire any appliances.
Anti-pattern: Every account VPC carved from the same 10.0.0.0/16, then fixed later with self-managed NAT instances.
Better: Allocate non-overlapping ranges through VPC IPAM, and keep 1:1 NAT for the edges you don't control: acquisitions, partners and multicloud links.
Tradeoff: Translation hides real source addresses. Security group rules, flow logs and on-prem firewall logs will show translated IPs, so keep the translation map documented and in source control.
07Network Firewall validates destinations against Route 53 Resolver answers
Better: Domain-based allowlists with resolved-IP validation and DNS Firewall, all egress forced through the inspection VPC.
Domain allowlists have always had a soft spot: a client can claim a permitted SNI while connecting to any IP it likes, and non-TLS protocols didn't get domain filtering at all. Resolved IP validation closes both gaps by tying the allowed connection to what the VPC Resolver actually answered. Pair it with Route 53 Resolver DNS Firewall and you have consistent egress policy for SFTP drops and SSH to Git hosts, not just web traffic.
Anti-pattern: Egress rules that allow 0.0.0.0/0 on port 22 or 443 from EC2 subnets "because the vendor's IPs change".
Better: Domain-based allowlists with resolved-IP validation and DNS Firewall, all egress forced through the inspection VPC.
Tradeoff: Anything that resolves names somewhere other than the VPC Resolver — hardcoded IPs, public resolvers, or Windows instances pointed straight at domain controllers — will fail validation. Run in alert mode and fix those paths first.
IAM & identity
08IAM Identity Center keeps users and assignments when you move off Active Directory
Action: if an AD-to-IdP migration has been parked because of re-assignment effort, put it back on the roadmap and start with an ABAC attribute mapping check.
Previously, moving off AD meant rebuilding every assignment — which in practice meant a weekend change window and a tense Monday. Now the identity store stays put, so permission sets that grant Session Manager or console access to EC2 keep working, and policies that reference user, group or identity store IDs don't break. After the switch, users sign in through the dual-stack access portal URL, so plan the communication and any conditional-access rules that pin the old URL.
Action: if an AD-to-IdP migration has been parked because of re-assignment effort, put it back on the roadmap and start with an ABAC attribute mapping check.
Tradeoff: IDs carry over, but attributes don't magically map. If you use ABAC on EC2 (for example, a team or costcenter session tag), confirm the new IdP emits exactly the same attribute names and values before cutover.
EBS & storage
09AWS Transform now sizes on-prem storage for S3, EBS, EFS and FSx
Better: Default to gp3, size from observed peak IOPS and throughput, and revisit with Compute Optimizer EBS recommendations after two weeks in production.
For rehost programmes landing on EC2, storage is where business cases quietly go wrong: LUNs mapped one-to-one onto provisioned-IOPS volumes, file shares bolted onto instances that should have been EFS or FSx. Having the assessment generate the mapping and the TCO in one pass is a good starting point for the conversation.
Anti-pattern: Lifting every SAN LUN onto io2 at its provisioned on-prem size.
Better: Default to gp3, size from observed peak IOPS and throughput, and revisit with Compute Optimizer EBS recommendations after two weeks in production.
Tradeoff: An inventory file shows what was provisioned, not what is used. Treat the output as a first draft and validate against real performance data before committing volume types.
Adjacent services
10Aurora and RDS get On-Demand Capacity Reservations
Better: Give every reservation an end date and an owner tag, and back it with an AWS Budgets alert.
Why it matters to an EC2 architect: it closes the gap in DR and peak-event planning where the app tier had EC2 Capacity Reservations but the database tier could still hit insufficient-capacity errors on failover or scale-up. The model mirrors EC2 ODCRs, so the same planning, tagging and cost controls apply.
Anti-pattern: Reserving capacity for a launch or DR test and forgetting about it; an idle reservation costs full On-Demand.
Better: Give every reservation an end date and an owner tag, and back it with an AWS Budgets alert.
Tradeoff: You pay for certainty. For a warm-standby DR region, compare the reservation cost with simply running a small replica that you scale up on failover.