AWS Weekly Digest
Week of 1–8 November 2026
A security-heavy week for EC2: IMDSv1 finally gets a metric, AMIs get scanned before launch, and Capacity Manager learns to say whether your request will land.
Do this week
- Put an alarm on the new ImdsV1Enabled metric, then set IMDSv2-required defaults at the account level.
- Turn on Inspector AMI scanning and run Allowed AMIs in audit mode before enforcing it.
- Add data types to the Parameter Store values your EC2 bootstrap depends on.
- Enable automatic CRL checking on IAM Roles Anywhere trust anchors for hybrid servers.
Showing 9 of 14 changes tagged Operational Excellence
Showing 6 of 14 changes tagged Security
Showing 5 of 14 changes tagged Reliability
Showing 5 of 14 changes tagged Performance Efficiency
Showing 5 of 14 changes tagged Cost Optimization
Primary lens — EC2 & IaaS compute
01EC2 now publishes an ImdsV1Enabled CloudWatch metric
Better: Alarm on ImdsV1Enabled, set HttpTokens=required in launch templates, and use ModifyInstanceMetadataDefaults (or a declarative policy) so new instances can't regress.
Until now, finding instances that still answer IMDSv1 meant scripting DescribeInstances across every account and Region, or digging through the MetadataNoToken metric after the fact. The new metric lets you put IMDSv1 exposure on a dashboard and alarm on it, which turns a one-off cleanup project into something you can actually keep enforced.
The announcement doesn't spell out the metric's dimensions, so check the EC2 User Guide before you build cross-account dashboards around it.
Anti-pattern: Fleets that still allow IMDSv1 "because nothing broke" — one SSRF bug away from leaking instance-profile credentials.
Better: Alarm on ImdsV1Enabled, set HttpTokens=required in launch templates, and use ModifyInstanceMetadataDefaults (or a declarative policy) so new instances can't regress.
Tradeoff: Old SDKs and agents that only speak IMDSv1 will break when you flip to required. Watch MetadataNoToken for a week before enforcing.
02EC2 AMIs can now be scanned for vulnerabilities by Amazon Inspector
Better: Build images in EC2 Image Builder with Inspector scanning in the pipeline, and patch running fleets with Systems Manager Patch Manager.
This closes a long-standing gap. Inspector used to find CVEs only after an instance was running, so a bad golden image could reach production before anyone noticed. Now you can scan the AMI catalog continuously or check specific AMIs from the EC2 console, enable it across an Organization, and send findings to Security Hub.
The more interesting part for platform teams is that Allowed AMIs can key off scan results and be enforced with Declarative Policies. That gives you a real gate: images with open critical findings can't be launched at all.
Anti-pattern: Hand-built AMIs patched "whenever someone remembers", then cloned into Auto Scaling groups.
Better: Build images in EC2 Image Builder with Inspector scanning in the pipeline, and patch running fleets with Systems Manager Patch Manager.
Tradeoff: Enforcement can block launches during an incident if your only good image has a fresh CVE. Keep a documented break-glass path.
03EC2 Capacity Manager adds supportability checks and fulfillment metrics
Better: Use attribute-based instance type selection across three AZs, and validate the mix with supportability scores before go-live.
Supportability checks answer the question every architect asks before a big launch: will this capacity actually be there? You get a High, Medium or Low score per instance type and AZ, plus an overall score, without launching or reserving anything. Fulfillment metrics then show how much of what you asked for you really got, sliced by organization, account, Region, tagged workload, instance type and AZ.
AWS also published a companion post on planning and measuring EC2 flexibility that's worth a read.
Anti-pattern: Auto Scaling groups pinned to a single instance type in a single AZ, then surprised by InsufficientInstanceCapacity during peak.
Better: Use attribute-based instance type selection across three AZs, and validate the mix with supportability scores before go-live.
Tradeoff: Both features are included with AWS Unified Operations only, so teams on lower support tiers won't see them.
04EC2 and VPC consoles now show related resources for every resource type
Better: Check Related Resources first, then remove the resource through your IaC so state stays consistent.
It's a small console change with a big quality-of-life payoff. Before you delete a security group, subnet or route table, you can now see everything that depends on it in one place instead of cross-referencing five console pages.
It's especially handy during cost clean-ups, where "unused" resources often turn out to be referenced by a forgotten launch template or ASG.
Anti-pattern: Deleting "orphaned" security groups and subnets from the console during a clean-up sprint.
Better: Check Related Resources first, then remove the resource through your IaC so state stays consistent.
Observability & security
05Security Hub now provides an SBOM inventory for compute resources
Action: Confirm Inspector is enabled org-wide; the SBOM inventory is only as complete as Inspector's coverage.
When the next log4j-style vulnerability lands, the first question is "where do we run this package?" This gives you one place to answer it across every account, without bespoke scripts or SSM inventory queries.
Pair it with this week's AMI scanning and you cover both the images you build and the instances already running.
Action: Confirm Inspector is enabled org-wide; the SBOM inventory is only as complete as Inspector's coverage.
06CloudWatch adds API key authentication for OpenTelemetry traces
Better: Use SigV4 with the instance profile on EC2. Off AWS, pull the key from a secrets store at startup and rotate it on a schedule.
Any OTLP/HTTP client that can set an Authorization header can now ship traces to CloudWatch, including the OpenTelemetry Collector and standard SDK exporters. You get the same Transaction Search and Application Signals features either way.
For anything running on EC2, nothing changes: AWS still recommends SigV4, and the ADOT SDKs keep using it by default.
Anti-pattern: Pasting a static API key into a collector config file baked into an AMI.
Better: Use SigV4 with the instance profile on EC2. Off AWS, pull the key from a secrets store at startup and rotate it on a schedule.
Tradeoff: API keys are easier to wire up but are long-lived bearer secrets, so a leaked key works until someone revokes it.
Operations & automation
07Systems Manager Parameter Store adds built-in data types with validation
Better: Use typed parameters for anything EC2 bootstrap depends on, and validate in CI before writing.
A malformed JSON blob in Parameter Store usually surfaces as an instance that boots, fails its bootstrap, and gets cycled by Auto Scaling over and over. Typed parameters move that failure to the moment someone writes the bad value, which is where you want it.
Ten of the types work on standard parameters. url, json and jsonc need advanced parameters, which carry a per-parameter monthly charge and API costs.
Anti-pattern: Configuration stored as untyped strings that's only validated when an instance tries to boot.
Better: Use typed parameters for anything EC2 bootstrap depends on, and validate in CI before writing.
Tradeoff: Moving JSON config to advanced parameters adds cost at scale. Keep large config blobs in S3 or AppConfig instead.
08Extending AWS DevOps Agent with skills, MCP servers, custom agents and connectors
Better: Scope the role to read-only describe and CloudWatch calls first. Route any mutating action through SSM Automation with an approval step.
This is guidance rather than a launch, but it shows where agentic ops is going. You can teach DevOps Agent your runbooks as Markdown skills, give it your own tools over MCP (OAuth 2.0, API key, custom header or SigV4 auth), and build custom agents with their own prompts and memory. The open-source catalog had 42 skills, 6 MCP servers and 9 custom agents at publication.
Billing is per second of active agent work. The MCP servers you deploy, such as Lambda functions and API Gateway endpoints, are billed separately in your account.
Anti-pattern: Giving an agent's MCP server an IAM role that can stop, terminate or modify any EC2 instance "so it can remediate".
Better: Scope the role to read-only describe and CloudWatch calls first. Route any mutating action through SSM Automation with an approval step.
Tradeoff: More tools give the agent more reach, and a bigger blast radius. AWS itself says the sample repo isn't production-ready without an IAM and security review.
Networking & connectivity
09AWS Interconnect – last mile: Equinix preview and a Northern Virginia metro
Better: Use diverse connections across two locations, or at minimum a Site-to-Site VPN backup with BGP failover tested regularly.
Last mile packages the circuit from your data center to AWS as a managed service instead of a separate telco project. The Equinix preview covers its data center footprint, with 1 Gbps free during preview in US West (N. California) and US East (N. Virginia). Separately, Lumen customers in the continental US can now order GA connections in a new Northern Virginia metro.
For EC2 workloads that talk to on-premises systems, this can shorten lead times for resilient Direct Connect considerably.
Anti-pattern: A single Direct Connect circuit backing "production" hybrid traffic, with no VPN fallback.
Better: Use diverse connections across two locations, or at minimum a Site-to-Site VPN backup with BGP failover tested regularly.
Tradeoff: It's still a preview for Equinix, and the 99.99% SLA ends at the Direct Connect port, not at your router.
10Network Load Balancer now available in the Phoenix Local Zone
Better: Run the latency-sensitive tier in the Local Zone and keep a Regional multi-AZ deployment behind Route 53 health checks.
For low-latency workloads serving users in the Phoenix area, putting the load balancer next to the instances removes a round trip to us-west-2.
Treat Local Zones as an edge tier, though, not a production home on their own.
Anti-pattern: A Local Zone deployment treated as production with no multi-AZ or Regional failover.
Better: Run the latency-sensitive tier in the Local Zone and keep a Regional multi-AZ deployment behind Route 53 health checks.
Identity & storage
11IAM Roles Anywhere now checks certificate revocation automatically
Better: Use IAM Roles Anywhere with short-lived certificates from your PKI and automatic revocation checking.
Roles Anywhere is the right way to give on-premises servers and hybrid fleets temporary AWS credentials. But until now, revoking a compromised certificate meant importing CRLs yourself, and many teams simply didn't. Automatic checking closes that gap.
Anti-pattern: Long-lived IAM user access keys on on-premises servers that call AWS APIs.
Better: Use IAM Roles Anywhere with short-lived certificates from your PKI and automatic revocation checking.
12FSx for Lustre Intelligent-Tiering delivers 16x higher metadata IOPS
Tradeoff: It applies to new file systems only, so existing ones need a data migration to benefit.
Workloads with millions of small files, such as genomics, EDA and rendering on EC2, often hit metadata limits long before throughput limits. This removes much of the reason to pick SSD-tier Lustre purely for metadata performance.
Tradeoff: It applies to new file systems only, so existing ones need a data migration to benefit.
Adjacent compute — Lambda & data processing
13Lambda adds queue mode for self-managed Kafka and raises durable function quotas
Better: Use Lambda queue mode for bursty, order-insensitive work, and keep a right-sized EC2 or Auto Scaling consumer only for steady, ordered streams.
Why it matters to an EC2-centric architect: it replaces the classic "fleet of EC2 consumers sized for peak" pattern for unordered Kafka work.
Queue mode is built on Kafka share groups (Kafka 4.2 or later), so multiple pollers can read the same partition, each with up to 10 concurrent invocations. Separately, durable functions quotas rose from 1M to 5M running executions per account and from 300 to 3,000 starts per second, doubled in N. Virginia, Oregon and Ireland.
Anti-pattern: Always-on EC2 consumer instances sized for peak to drain a Kafka topic that's idle most of the day.
Better: Use Lambda queue mode for bursty, order-insensitive work, and keep a right-sized EC2 or Auto Scaling consumer only for steady, ordered streams.
Tradeoff: Against EC2: Lambda wins on bursty load and operational overhead, but loses on cost at sustained high throughput, on the 15-minute limit, and on ordering, since queue mode doesn't preserve partition order.
14S3 Tables adds managed migration from Hive tables to Apache Iceberg
Tradeoff: Against EC2 or Glue jobs: less control over partitioning and compaction during the conversion, and no cross-account or cross-Region moves.
Why it matters to an EC2-centric architect: it offloads a migration job that would otherwise run on a temporary EMR or self-managed Spark fleet on EC2.
It works within the same account and Region for Glue-registered Parquet tables, in 10 Regions including N. Virginia, Ohio, Oregon, Singapore, Sydney, Frankfurt and Ireland.
Tradeoff: Against EC2 or Glue jobs: less control over partitioning and compaction during the conversion, and no cross-account or cross-Region moves.