Well-Architected pillar
Operational Excellence
Every Operational Excellence item from every issue, newest first.
Search: Ctrl+F (⌘+F on Mac) finds any title, service or summary on this page.
Link to a view: All · Security · Reliability · Performance · Cost · Sustainability
Showing 67 of 106 changes tagged Operational Excellence
Showing 50 of 106 changes tagged Security
Showing 45 of 106 changes tagged Reliability
Showing 31 of 106 changes tagged Performance Efficiency
Showing 44 of 106 changes tagged Cost Optimization
Showing 7 of 106 changes tagged Sustainability
Every change (106)
| # | Change | Service | Pillars |
|---|---|---|---|
| 2026-11-08 Week of 1–8 November 2026 | |||
| 01 | EC2 now publishes an ImdsV1Enabled CloudWatch metric ▲Until now, finding instances that still answer IMDSv1 meant scripting DescribeInstances across every account and Region, or digging through the MetadataNoToken metric after the fact. The new metric lets you put IMDSv1 exposure on a dashboard and alarm on it, which turns a one-off cleanup project into something you can actually keep enforced.Issue 2026-11-08 | Amazon EC2 / Amazon CloudWatch |
|
| 02 | EC2 AMIs can now be scanned for vulnerabilities by Amazon Inspector ▲This closes a long-standing gap. Inspector used to find CVEs only after an instance was running, so a bad golden image could reach production before anyone noticed. Now you can scan the AMI catalog continuously or check specific AMIs from the EC2 console, enable it across an Organization, and send findings to Security Hub.Issue 2026-11-08 | Amazon Inspector / Amazon EC2 |
|
| 03 | EC2 Capacity Manager adds supportability checks and fulfillment metrics ▲Supportability checks answer the question every architect asks before a big launch: will this capacity actually be there? You get a High, Medium or Low score per instance type and AZ, plus an overall score, without launching or reserving anything. Fulfillment metrics then show how much of what you asked for you really got, sliced by organization, account, Region, tagged workload, instance type and AZ.Issue 2026-11-08 | Amazon EC2 Capacity Manager |
|
| 04 | EC2 and VPC consoles now show related resources for every resource type ▲It's a small console change with a big quality-of-life payoff. Before you delete a security group, subnet or route table, you can now see everything that depends on it in one place instead of cross-referencing five console pages.Issue 2026-11-08 | Amazon EC2 / Amazon VPC |
|
| 05 | Security Hub now provides an SBOM inventory for compute resources ✓When the next log4j-style vulnerability lands, the first question is "where do we run this package?" This gives you one place to answer it across every account, without bespoke scripts or SSM inventory queries.Issue 2026-11-08 | AWS Security Hub |
|
| 06 | CloudWatch adds API key authentication for OpenTelemetry traces ▲Any OTLP/HTTP client that can set an Authorization header can now ship traces to CloudWatch, including the OpenTelemetry Collector and standard SDK exporters. You get the same Transaction Search and Application Signals features either way.Issue 2026-11-08 | Amazon CloudWatch / AWS X-Ray |
|
| 07 | Systems Manager Parameter Store adds built-in data types with validation ▲A malformed JSON blob in Parameter Store usually surfaces as an instance that boots, fails its bootstrap, and gets cycled by Auto Scaling over and over. Typed parameters move that failure to the moment someone writes the bad value, which is where you want it.Issue 2026-11-08 | AWS Systems Manager |
|
| 08 | Extending AWS DevOps Agent with skills, MCP servers, custom agents and connectors ▲This is guidance rather than a launch, but it shows where agentic ops is going. You can teach DevOps Agent your runbooks as Markdown skills, give it your own tools over MCP (OAuth 2.0, API key, custom header or SigV4 auth), and build custom agents with their own prompts and memory. The open-source catalog had 42 skills, 6 MCP servers and 9 custom agents at publication.Issue 2026-11-08 | AWS DevOps Agent |
|
| 09 | AWS Interconnect – last mile: Equinix preview and a Northern Virginia metro ▲Last mile packages the circuit from your data center to AWS as a managed service instead of a separate telco project. The Equinix preview covers its data center footprint, with 1 Gbps free during preview in US West (N. California) and US East (N. Virginia). Separately, Lumen customers in the continental US can now order GA connections in a new Northern Virginia metro.Issue 2026-11-08 | AWS Interconnect / AWS Direct Connect |
|
| 10 | Network Load Balancer now available in the Phoenix Local Zone ▲For low-latency workloads serving users in the Phoenix area, putting the load balancer next to the instances removes a round trip to us-west-2.Issue 2026-11-08 | Elastic Load Balancing |
|
| 11 | IAM Roles Anywhere now checks certificate revocation automatically ▲Roles Anywhere is the right way to give on-premises servers and hybrid fleets temporary AWS credentials. But until now, revoking a compromised certificate meant importing CRLs yourself, and many teams simply didn't. Automatic checking closes that gap.Issue 2026-11-08 | AWS IAM Roles Anywhere |
|
| 12 | FSx for Lustre Intelligent-Tiering delivers 16x higher metadata IOPSWorkloads with millions of small files, such as genomics, EDA and rendering on EC2, often hit metadata limits long before throughput limits. This removes much of the reason to pick SSD-tier Lustre purely for metadata performance.Issue 2026-11-08 | Amazon FSx for Lustre |
|
| 13 | Lambda adds queue mode for self-managed Kafka and raises durable function quotas ▲Why it matters to an EC2-centric architect: it replaces the classic "fleet of EC2 consumers sized for peak" pattern for unordered Kafka work.Issue 2026-11-08 | AWS Lambda |
|
| 14 | S3 Tables adds managed migration from Hive tables to Apache IcebergWhy it matters to an EC2-centric architect: it offloads a migration job that would otherwise run on a temporary EMR or self-managed Spark fleet on EC2.Issue 2026-11-08 | Amazon S3 Tables / AWS Glue |
|
| 2026-11-01 Week of 26 October–1 November 2026 | |||
| 01 | EC2 Auto Scaling: Launch Before Terminate as an account-wide default ▲You set it once with the new PutAccountSetting API (read it back with DescribeAccountSettings), and from then on every group in the account launches the replacement, waits for it to pass health checks, and only then terminates the old instance. That covers instance refreshes, AZ rebalancing, unhealthy-instance replacement and max-instance-lifetime recycling. It's available in all Regions at no extra cost.Issue 2026-11-01 | Amazon EC2 Auto Scaling |
|
| 02 | Full-stack observability for AWS Outposts with Systems Manager, CloudWatch and EventBridge ▲The useful part for EC2 teams is the metric checklist: service-link health (ConnectedStatus, VifBgpSessionState, VifConnectionStatus), CapacityExceptions for instance capacity, EBS and S3 on Outposts free-space metrics, and an EventBridge rule on aws.health events for the OUTPOSTS service that opens an OpsCenter OpsItem automatically.Issue 2026-11-01 | Amazon CloudWatch / AWS Systems Manager |
|
| 03 | Amazon Managed Grafana 13.2 adds PromQL queries over CloudWatch metrics ✓If your EC2 fleet already ships metrics to CloudWatch via OTLP, this lets teams that think in PromQL build dashboards without standing up a separate Prometheus store. The in-place upgrade avoids rebuilding workspaces, though dashboards and plugins should still be tested in a non-production workspace first.Issue 2026-11-01 | Amazon Managed Grafana / Amazon CloudWatch |
|
| 04 | Resilience Hub adds FIS-powered recommended resilience tests ▲For EC2 workloads, the dependency validation test uses aws:ssm:send-command to inject faults on instances, so the SSM Agent and an IAM service role are prerequisites. Tests run from 1 minute to 12 hours (30 minutes by default) against up to 10 dependencies, and each run produces a report.Issue 2026-11-01 | AWS Resilience Hub / AWS Fault Injection Service |
|
| 05 | AWS Backup: restore testing for Redshift and cross-account backup in the European Sovereign Cloud ▲Neither launch is about EC2 directly, but both extend the same pattern you should already use for EC2 and EBS: scheduled restore tests that measure restore time against RTO, and organisation-wide backup policies managed from a delegated admin account rather than per-account plans. If your EC2 tier depends on a Redshift warehouse, you can now prove the whole stack restores, not just the instances.Issue 2026-11-01 | AWS Backup |
|
| 06 | Route 53 Resolved IP Validation for AWS Network Firewall ▲The feature launched on 21 October; this week's deep-dive post is the practical guide. It needs DNS through Route 53 Resolver, a DNS Firewall rule group associated with the VPCs, and the policy setting enabled before you add aws_route_53_resolved_domain rules. The feature itself is free; standard DNS Firewall rule charges apply.Issue 2026-11-01 | AWS Network Firewall / Route 53 Resolver |
|
| 07 | IAM Identity Center's Identity Store now emits change events to EventBridge ✓This replaces polling scripts for joiner-mover-leaver automation. Typical uses: a Lambda that revokes Session Manager access or tags owned resources when someone leaves a group, SIEM alerts on admin-group changes, and an audit trail of who was added to the groups that hold EC2 permission sets.Issue 2026-11-01 | AWS IAM Identity Center / Amazon EventBridge |
|
| 08 | IAM Identity Center supports cross-Region trusted identity propagation ▲Previously, multi-Region designs often fell back on broad shared IAM roles once a request crossed Regions, which loses the per-user trail. This keeps individual identity in the logs across Regions at no extra cost. It's most relevant to data and analytics access, but it removes a common excuse for coarse roles in multi-Region setups.Issue 2026-11-01 | AWS IAM Identity Center |
|
| 09 | Evidence-based S3 lifecycle rules at petabyte scale ▲This matters to EC2 teams because instance and application logs, AMI-adjacent artefacts and backups often land in S3 buckets nobody lifecycles. The approach: use Storage Lens groups to find large buckets with no lifecycle rule, confirm cold access with 30+ days of Storage Class Analysis, then transition objects over 128 KB at a proven age (90 days in the example).Issue 2026-11-01 | Amazon S3 |
|
| 10 | DataSync Enhanced mode supports FSx for Windows File Server and FSx for NetApp ONTAP ▲For Windows-on-EC2 estates, this is a cleaner path for moving file shares into FSx (or between FSx file systems) than robocopy jobs running on a helper instance. You get managed scheduling, verification and CloudWatch reporting instead of scripts on a box someone has to remember to patch.Issue 2026-11-01 | AWS DataSync / Amazon FSx |
|
| 11 | AWS DevOps Agent: tracing failures across Terraform state boundaries, plus Nubank's DR automation ✓In the Terraform walkthrough, a security group egress change in a networking stack breaks an application path in another stack. The agent correlates the alarms, maps the dependency, finds the change in CloudTrail and drafts a fix that an engineer reviews with terraform plan before applying. The sample code is explicitly not production-ready.Issue 2026-11-01 | AWS DevOps Agent |
|
| 12 | Lambda Managed Instances gets SOCI lazy loading for container images ▲Why it matters to an EC2-centric architect: Lambda Managed Instances runs functions on EC2 capacity in your account, which makes it a real alternative to a small always-on fleet for steady but spiky workloads. Large container images were a weak spot; SOCI narrows the startup gap. Push a SOCI index to ECR with a tag like my-function:v1-soci, point the function at it and publish a version.Issue 2026-11-01 | AWS Lambda |
|
| 13 | Step Functions workflows can now be used as tools by AI agents ▲Why it matters: this is the safer way to let an agent operate EC2. Instead of giving an agent broad EC2 and SSM permissions, wrap approved runbooks (stop or resize an instance, run a Patch Manager baseline, rotate an AMI) in Step Functions with their own narrowly scoped role, validation steps and approval gates, and expose only those workflows.Issue 2026-11-01 | AWS Step Functions |
|
| 2026-10-25 Week of 19–25 October 2026 | |||
| 01 | EC2 Image Builder can now build from a warm Auto Scaling group ▲This was the only real primary-lens launch of the week, and it is a practical one. Image Builder pipelines spend a surprising share of their runtime just launching an instance, waiting for status checks and bootstrapping the SSM agent. Point the infrastructure configuration at an ASG and Image Builder picks an already-running instance, applies components, snapshots it and lets the ASG backfill. Pipelines without an ASG configured behave exactly as before.Issue 2026-10-25 | EC2 Image Builder |
|
| 02 | CloudWatch alarms can now carry their tags into the action payload ▲If you run a shared alarm pipeline — one SNS topic or EventBridge bus fanning out to ticketing and paging — you've probably written a Lambda that calls ListTagsForResource on every alarm to work out who owns it. That lookup can now go away: the owner, environment and service tags arrive in the event itself, ready for EventBridge rules to route on.Issue 2026-10-25 | Amazon CloudWatch |
|
| 03 | CloudFormation adds force rollback for stuck update rollbacks ▲Anyone who has nursed an EC2 stack out of UPDATE_ROLLBACK_FAILED knows the routine: find the resource that won't roll back (often a security group or instance someone changed in the console), add it to the skip list, retry, repeat. Force rollback collapses that into one call and leaves the stack deployable, with a record of what needs fixing. AWS's suggested follow-up is a drift-aware change set before the next deploy — do that, every time.Issue 2026-10-25 | AWS CloudFormation |
|
| 04 | GuardDuty Runtime Monitoring gets 50+ optional detection rules, with dry-run ▲These are the detections that are normal in one estate and a red flag in another, which is why they are optional. On EC2 they need the GuardDuty runtime agent (usually deployed through Systems Manager), so check your coverage before you assume the fleet is protected. Dry-run mode is the right on-ramp: you see what would fire without paging anyone.Issue 2026-10-25 | Amazon GuardDuty |
|
| 05 | AWS Continuum for code vulnerabilities is generally available ✓This is the agentic-ops story of the week. What makes it relevant to an EC2 shop is the context graph: a vulnerable library on an instance that is reachable from the internet through its security groups ranks differently from the same library on an isolated batch box. Fixes arrive as PRs with exploitability evidence and a blast-radius assessment, and it works alongside GuardDuty and Security Hub.Issue 2026-10-25 | AWS Continuum |
|
| 06 | Transit Gateway and Cloud WAN now do managed 1:1 NAT on attachments ▲Overlapping CIDRs after an acquisition, or a partner who insists on 10.0.0.0/16, used to mean renumbering or a pair of NAT instances on EC2 that somebody had to patch, scale and fail over. Now the translation rule lives on the attachment, AWS runs it, and it shows up in CloudWatch metrics and EventBridge events. The supporting API landed on 22 October (ModifyTransitGatewayAttachmentNatConfiguration).Issue 2026-10-25 | AWS Transit Gateway / Cloud WAN |
|
| 07 | Network Firewall validates destinations against Route 53 Resolver answers ▲Domain allowlists have always had a soft spot: a client can claim a permitted SNI while connecting to any IP it likes, and non-TLS protocols didn't get domain filtering at all. Resolved IP validation closes both gaps by tying the allowed connection to what the VPC Resolver actually answered. Pair it with Route 53 Resolver DNS Firewall and you have consistent egress policy for SFTP drops and SSH to Git hosts, not just web traffic.Issue 2026-10-25 | AWS Network Firewall |
|
| 08 | IAM Identity Center keeps users and assignments when you move off Active Directory ✓Previously, moving off AD meant rebuilding every assignment — which in practice meant a weekend change window and a tense Monday. Now the identity store stays put, so permission sets that grant Session Manager or console access to EC2 keep working, and policies that reference user, group or identity store IDs don't break. After the switch, users sign in through the dual-stack access portal URL, so plan the communication and any conditional-access rules that pin the old URL.Issue 2026-10-25 | AWS IAM Identity Center |
|
| 09 | AWS Transform now sizes on-prem storage for S3, EBS, EFS and FSx ▲For rehost programmes landing on EC2, storage is where business cases quietly go wrong: LUNs mapped one-to-one onto provisioned-IOPS volumes, file shares bolted onto instances that should have been EFS or FSx. Having the assessment generate the mapping and the TCO in one pass is a good starting point for the conversation.Issue 2026-10-25 | AWS Transform |
|
| 10 | Aurora and RDS get On-Demand Capacity Reservations ▲Why it matters to an EC2 architect: it closes the gap in DR and peak-event planning where the app tier had EC2 Capacity Reservations but the database tier could still hit insufficient-capacity errors on failover or scale-up. The model mirrors EC2 ODCRs, so the same planning, tagging and cost controls apply.Issue 2026-10-25 | Amazon Aurora / Amazon RDS |
|
| 2026-10-18 Week of 11–18 October 2026 | |||
| 01 | EC2 T8i burstable instances now available in South America (São Paulo) ▲T8i comes in nano, micro, small and medium sizes. AWS claims up to 30% better price performance than T3, up to 70% more compute, 1.25x the network bandwidth and 2.4x the EBS bandwidth. Standard and Unlimited credit modes work exactly as they do on T3, and t8i.micro and t8i.small are Free Tier eligible.Issue 2026-10-18 | Amazon EC2 |
|
| 02 | Microsecond-accurate Time Sync expands to 135 more EC2 instance types ▲The PTP hardware clock now covers C8a, C8i, C8i-flex, C8id, M8i, M8i-flex, R8a, X8i, C9g, C9gd, M9g and M9gd. You opt in through a new placement strategy, the Precision Time Placement Group (PTPG), and you can attach it to a Cluster Placement Group when you also need low network latency.Issue 2026-10-18 | Amazon EC2 / Amazon Time Sync Service |
|
| 03 | License Manager converts running Ubuntu LTS instances to Ubuntu Pro in place ▲Until now, getting Ubuntu Pro meant relaunching from a Pro AMI. The conversion now runs on the existing instance, and you can subscribe to Canonical's Marketplace listing from the License Manager console. Ubuntu Pro also covers thousands of universe packages, including NGINX, PostgreSQL and Redis, which standard LTS does not.Issue 2026-10-18 | AWS License Manager |
|
| 04 | Security Bulletin 2026-137: KVM host memory corruption via virtio-net (CVE-2026-99999) ✓AWS manages the host for standard EC2, so ordinary instances are out of scope. You are exposed if you are the hypervisor: KVM on EC2 with nested virtualization, VMs on *.metal instances such as c8i.metal-48xl, or Firecracker microVMs using virtio-net. Kernels 4.4 through 6.18 are affected.Issue 2026-10-18 | Amazon EC2 (self-managed KVM) |
|
| 05 | CloudWatch pipelines add conditional log routing and chained parsers ▲Routing is evaluated against processed fields, so one agent stream from an EC2 fleet can be split: DEBUG and INFO to a short-retention group, ERROR to a group with metric filters and alarms, and audit or security events to a long-retention group with tighter IAM. Chained parsers handle the common case of a JSON envelope wrapping an unstructured message.Issue 2026-10-18 | Amazon CloudWatch Logs |
|
| 06 | CloudWatch cross-account log centralization reaches GovCloud and 13 more Regions ▲New Regions include Cape Town, Hong Kong, Hyderabad, Jakarta, Malaysia, Melbourne, Calgary, Milan, Spain, Zurich, Tel Aviv, Bahrain and UAE. Rules can target the whole organization, specific OUs or individual accounts, and enriched system fields record the source account and Region.Issue 2026-10-18 | Amazon CloudWatch Logs |
|
| 07 | ARC Region switch adds Run Command blocks, quota checks and ASG target-health gates ▲For EC2, the most important addition is the target-health wait. Until now, a plan could scale the standby ASG and move traffic before the new instances passed load balancer health checks. Quota parity checks address another common DR failure, where the standby Region simply isn't allowed to launch the capacity you need.Issue 2026-10-18 | Amazon Application Recovery Controller |
|
| 08 | AWS DevOps Agent now investigates Resilience Hub findings and resilience tests ▲What gets automated is the analysis: correlating test or finding context with telemetry into a structured write-up, including whether recovery actions such as an ARC Region switch actually fired. Per the announcement, tasks are user-initiated from a finding or a test. It doesn't describe autonomous remediation.Issue 2026-10-18 | AWS DevOps Agent / AWS Resilience Hub |
|
| 09 | Security Hub adds resource criticality to exposure prioritization ▲Criticality shows up as a sortable column on the Resources page and in each exposure's impact assessment. You can set it with explicit rules, for example “all compute in the prod-payments account = Very High”, or let Security Hub infer it from tags and names, which records where each value came from.Issue 2026-10-18 | AWS Security Hub |
|
| 10 | CloudFront VPC origins now support dual-stack (IPv6) to private ALB, NLB and EC2 ▲VPC origins previously connected over IPv4 only, so teams that wanted end-to-end IPv6 had to expose the origin publicly. The origin can now stay in a private subnet, reachable only from its distribution, while serving IPv6 clients.Issue 2026-10-18 | Amazon CloudFront / Amazon VPC |
|
| 11 | Lambda Web Functions: HTTP-native Lambda billed on active CPU time ▲Why it matters to an EC2-centric architect: it offloads the small, bursty web tier, such as internal APIs, admin consoles and webhook receivers, that today idles on t-class instances behind an ALB. Because you aren't billed for CPU while waiting on a database, I/O-bound handlers get much cheaper, and multi-concurrency per environment cuts cold starts sharply. Existing functions are renamed Lambda Event Functions with no code changes.Issue 2026-10-18 | AWS Lambda |
|
| 12 | Lambda recursive loop detection now covers EventBridge custom event buses ▲Why it matters to an EC2-centric architect: EventBridge plus Lambda is the standard glue for EC2 automation, such as tag-on-launch, auto-remediation of security groups, and scheduled start/stop. That's exactly where a function that emits an event matching its own rule creates a runaway loop and a surprise bill. The detection is now a free safety net on custom buses as well as the default bus.Issue 2026-10-18 | AWS Lambda / Amazon EventBridge |
|
| 2026-10-11 Week of 4–11 October 2026 | |||
| 01 | EC2 AMIs can now share tags across accounts ▲If you run a golden-AMI pipeline out of a central tooling account, you have probably written a Lambda or Step Functions job that copies tags like os-version, cis-level or approved into every consumer account. That glue can go. Tag a key with the ec2:SharedTag/ prefix and every account the AMI is shared with sees it immediately, whether the share is to one account, an OU, the whole organization or the public.Issue 2026-10-11 | Amazon EC2 (AMIs) |
|
| 02 | C8gb (Graviton4, EBS-optimised) expands to more US, EU and Africa Regions ▲C8gb is the compute-optimised Graviton4 variant built for EBS-heavy workloads: up to 300 Gbps of EBS bandwidth and 1,600K IOPS, up to 48xlarge with 384 GiB of memory, and up to 400 Gbps networking with EFA on the larger sizes. The announcement lists Ohio, N. California, Frankfurt, Ireland, Paris, Stockholm and Cape Town, and also references N. Virginia and Oregon (the page isn't fully consistent, so check the console for your Region).Issue 2026-10-11 | Amazon EC2 |
|
| 03 | Graviton4 R8g and R8gd reach the European Sovereign Cloud, and Hpc8a lands in Singapore ▲Two regional expansions worth noting. R8g and R8gd are now available in the AWS European Sovereign Cloud (Germany): Graviton4, up to 1.5 TB of memory, 50 Gbps networking and 40 Gbps to EBS, and in the gd variant up to 11.4 TB of local NVMe. Teams with EU data-residency requirements no longer have to trade down to older generations to stay in the sovereign partition.Issue 2026-10-11 | Amazon EC2 |
|
| 04 | AWS Config adds 77 resource types, including VPC CIDRs, SSM maintenance windows and alarm mute rules ▲The headline number is 77, but the useful part for EC2 operators is a handful of types: AWS::EC2::VPCCidrBlock, AWS::EC2::TransitGatewayMeteringPolicy, AWS::SSM::MaintenanceWindow and AWS::CloudWatch::AlarmMuteRule. If you record all resource types, Config picks them up automatically, and they work in rules and aggregators.Issue 2026-10-11 | AWS Config |
|
| 05 | Control Tower Account Factory for Terraform adds plan-only runs ▲Until now, every AFT customization run was a full apply across your managed accounts, with no dry run. Plan-only runs fix that. You can preview what a change to a baseline VPC, SCP-adjacent IAM role or default EBS-encryption setting will do across every account before it lands, and use the same mechanism to detect drift.Issue 2026-10-11 | AWS Control Tower (AFT) |
|
| 06 | IAM Identity Center adds network access controls for the Identity Store and SCIM APIs ▲The Identity Store holds the users and groups behind every permission set that grants access to your EC2 fleet. Until now, anyone with valid credentials could call its API from anywhere. You can now require the Identity Store API to come through your VPC endpoints or source VPCs, and lock SCIM provisioning to your IdP's published IP ranges. Each API can have its own policy, and calls AWS makes on your behalf are exempt.Issue 2026-10-11 | AWS IAM Identity Center |
|
| 07 | ACM can now issue public certificates over PrivateLink with ACME ▲If you terminate TLS on the instance rather than at an ALB, for example for end-to-end encryption, NLB pass-through or non-HTTP protocols, your instances have needed outbound internet access just to renew certificates. Now you create a managed ACME endpoint in ACM plus a standard interface endpoint, and private DNS points your existing ACME directory URL at it. Certbot and similar clients work unchanged.Issue 2026-10-11 | AWS Certificate Manager / PrivateLink |
|
| 08 | Client VPN adds device posture checks with continuous re-evaluation ▲Client VPN is still how many teams reach private EC2 hosts and internal ALBs. It now reads device signals such as encryption status, compliance score and risk level from CrowdStrike, Jamf or JumpCloud, evaluates them against Cedar policies, and re-checks during the session. A device that drifts out of compliance mid-session is disconnected.Issue 2026-10-11 | AWS Client VPN |
|
| 09 | Security Hub exports findings to S3 as CSV or OCSF JSON ▲This is a small feature that removes a lot of glue. Audit and compliance teams that wanted a spreadsheet of EC2 vulnerability or exposure findings used to need a custom Lambda pulling from the API. Now it's an on-demand export from the console, straight to S3, as CSV for humans or OCSF JSON for your SIEM or data lake.Issue 2026-10-11 | AWS Security Hub |
|
| 10 | AWS publishes a cost guardrail for DevOps Agent investigations ▲When DevOps Agent investigates an EC2 incident, it can run CloudWatch Logs Insights scans, broad PromQL queries, Athena queries and cross-Region reads. Each of those costs money, and an agent will happily run a 30-day unbounded scan. This skill classifies each planned call, prices it from the live Price List API, and returns Proceed, Warn (with a cheaper alternative) or Halt against a per-investigation budget.Issue 2026-10-11 | AWS DevOps Agent |
|
| 11 | Lambda functions can now read their Availability Zone ID ✓Why it matters to an EC2-centric architect: Lambda functions that call services on your EC2 fleet or in RDS can now be AZ-aware, which closes one of the few performance gaps between Lambda and an instance that always knew its AZ through IMDS.Issue 2026-10-11 | AWS Lambda |
|
| 12 | AWS Batch now publishes job state and duration metrics to CloudWatch ▲Why it matters to an EC2-centric architect: Batch on EC2 compute environments is the managed alternative to hand-rolled cron-plus-Auto-Scaling job runners. Its weak spot was observability, and native queue metrics close that gap.Issue 2026-10-11 | AWS Batch / CloudWatch |
|
| 2026-10-04 Week of 28 Sep–4 Oct 2026 | |||
| 01 | GuardDuty Runtime Monitoring for EC2 now billed inside Security Hub Threat Analytics ▲Runtime Monitoring (EC2, EKS, ECS on Fargate) is now folded into the Security Hub Threat Analytics plan. If Security Hub is enabled in an account/Region, you stop seeing separate GuardDuty Runtime Monitoring line items; detection coverage, finding types and the GuardDuty security agent on your instances are unchanged and need no reconfiguration.Issue 2026-10-04 | Amazon GuardDuty / AWS Security Hub |
|
| 02 | AWS Well-Architected Agent enters preview ✓An AI agent that correlates metrics and application topology against Well-Architected best practices and returns recommendations ranked by impact and effort. It analyzes Terraform, CDK and CloudFormation and proposes IaC diffs, and it ships fixes as SSM runbooks, CLI scripts or guided console walkthroughs.Issue 2026-10-04 | AWS Well-Architected Tool |
|
| 03 | Security Hub remediation plans group exposures by root cause ✓Security Hub now groups related exposure findings that share a root cause, such as one overly permissive policy or one misconfigured setting, into a single plan. Each plan carries a priority, an impact assessment and fix steps in CLI, Terraform, CloudFormation, Python or CDK. It's included in the Essentials plan at no extra cost, in all Security Hub Regions.Issue 2026-10-04 | AWS Security Hub |
|
| 04 | Amazon DevOps Guru enters sunset (end of support 30 Sep 2027) ▲AWS's quarterly availability update puts DevOps Guru into sunset with end of support on 30 September 2027. Also in the update: Infrastructure Composer's standalone console ends on 7 December 2026, and Managed Blockchain and Backint Agent for SAP ASE are sunsetting. Nothing in the core EC2, VPC, ELB, EBS or IAM services is affected.Issue 2026-10-04 | Amazon DevOps Guru |
|
| 05 | GuardDuty enablement enforced through Organizations declarative policies ▲GuardDuty can now be enabled through AWS Organizations declarative policies applied at the root, an OU or an individual account, with Region-specific overrides. Once a policy sets enablement, the console and API can't override it, so a member-account admin can no longer turn GuardDuty off. It's available in all commercial and GovCloud (US) Regions.Issue 2026-10-04 | Amazon GuardDuty |
|
| 06 | IAM Identity Center multi-Region support expands to opt-in Regions ▲Identity Center replicates identities, entitlements and configuration from the primary Region to additional Regions. If the primary Region goes down, users keep access to their AWS accounts through the permissions already provisioned. Support now extends to opt-in Regions and within GovCloud (US) and China. It requires a multi-Region customer-managed KMS key.Issue 2026-10-04 | AWS IAM Identity Center |
|
| 07 | Secrets Manager console surfaces posture recommendations ▲The console now flags secrets with no rotation configured and secrets encrypted with the default service key instead of a customer-managed KMS key, along with other configuration improvements. It's free, in all commercial Regions.Issue 2026-10-04 | AWS Secrets Manager |
|
| 08 | CloudTrail Event Coverage shows data-plane logging gaps ✓A new console view shows, per account and across the organization, which services and resource types have data-event logging on and which have it off, for example S3 GetObject and PutObject. It's available in all commercial Regions. AWS hasn't published the full list of supported data-event sources.Issue 2026-10-04 | AWS CloudTrail |
|
| 09 | DNS analytics and insights for Route 53 Global Resolver and DNS Firewall ✓A new Analytics tab adds CloudWatch metrics, Contributor Insights, metric filters and alarms for DNS query patterns and DNS Firewall rule hits. AWS's example: alarm when blocked queries for a VPC exceed 10 per hour. Standard CloudWatch pricing applies.Issue 2026-10-04 | Amazon Route 53 |
|
| 10 | AWS Budgets requires email verification for new subscribers ✓Email addresses added to budget notifications from 30 September 2026 onward only start receiving alerts after the recipient clicks a verification link. Existing subscribers are unaffected. The console shows verification status and has a resend option. It isn't available in GovCloud or China.Issue 2026-10-04 | AWS Budgets |
|
| 11 | Aurora and RDS add AMD-based R8a (and RDS M8a) instances ✓R8a database instances map each vCPU to a physical core, with up to 75 Gbps network and 60 Gbps EBS bandwidth. They support Aurora PostgreSQL/MySQL and RDS for PostgreSQL, MySQL and MariaDB in 9 Regions. RDS also gets M8a.Issue 2026-10-04 | Amazon Aurora / Amazon RDS |
|
| 12 | AWS Health version catalog for software lifecycle ✓The catalog is a central place to see supported versions and end-of-life timelines, starting with RDS, EKS and Lambda. It's in the Health Dashboard for everyone. API access requires Business Support+, Enterprise or Unified Operations. It doesn't cover EC2 AMIs or operating systems yet.Issue 2026-10-04 | AWS Health |
|
| 2026-09-27 Week of 21–27 September 2026 | |||
| 01 | EC2 C8i, M8i and R8i (plus -flex) reach the AWS European Sovereign Cloud ▲All three 8th-gen Intel families landed in the European Sovereign Cloud on the same day. AWS positions them at up to 20% faster than the 7i equivalents, with headline workload gains of up to 60% on NGINX and 30% on PostgreSQL. C8i and R8i also carry a new 96xlarge size, and R8i remains the SAP-certified pick (142,100 aSAPS).Issue 2026-09-27 | Amazon EC2 |
|
| 02 | AWS Elastic Disaster Recovery now protects Graviton (arm64) source servers ▲DRS now auto-detects arm64 source servers and recovers them onto Graviton instances, with the same replication and drill workflow as x86 and no extra configuration or charge. It's available in every Region where DRS runs.Issue 2026-09-27 | AWS Elastic Disaster Recovery |
|
| 03 | Route 53 Resolver now runs locally on second-generation Outposts racks ✓EC2 instances on gen-2 Outposts racks now get managed recursive DNS on the rack itself instead of going back to the parent Region over the Service Link. Cached records keep resolving when the Service Link drops, which was a real single point of failure for "edge-resilient" designs.Issue 2026-09-27 | Amazon Route 53 Resolver / AWS Outposts |
|
| 04 | IAM outbound identity federation: OIDC discovery over interface VPC endpoints ▲Outbound identity federation lets EC2 workloads get short-lived JWTs from STS and present them to external services. Until now, verifying those tokens meant reaching the public OIDC discovery and JWKS endpoints. That forced isolated VPCs to open a NAT path or take an egress-firewall exception.Issue 2026-09-27 | AWS IAM / AWS STS |
|
| 05 | AWS Network Security Manager is generally available (us-east-1) ▲NSM moves out of preview. It targets internet-facing ALBs and CloudFront distributions in front of EC2 fleets, pushes consistent WAF and Shield Advanced policy across accounts, and automatically remediates drift. It's GA in N. Virginia only for now, and Network Firewall support is "coming soon".Issue 2026-09-27 | AWS Network Security Manager |
|
| 06 | Amazon CloudWatch Omni brings the AWS DevOps Agent into incident investigation ✓Omni discovers services, maps dependencies and surfaces golden metrics across accounts, Regions and even Azure. Engineers sign in through IAM Identity Center and don't need console access. The AWS DevOps Agent joins investigation sessions, correlates signals along the dependency graph and suggests next steps.Issue 2026-09-27 | Amazon CloudWatch Omni / AWS DevOps Agent |
|
| 07 | Billing and Cost Management adds a billing-context API built for agents ✓The new ListBillingViewSegments API tells you who pays and at what rates over a time window. It covers management vs member account, billing-group membership and Billing Conductor rate settings, split into effective-dated segments. It deliberately returns no cost or usage data.Issue 2026-09-27 | AWS Billing and Cost Management |
|
| 08 | EventBridge relaunches custom event buses: org-wide sharing, ordering and one-year replay ✓Why it's relevant to EC2: fleet lifecycle events (Auto Scaling lifecycle hooks, instance state changes, Spot interruption notices) are usually fanned out through per-account buses and fragile cross-account rules. A single shared bus with ordering and replay makes a central fleet-ops or DR controller much simpler to build.Issue 2026-09-27 | Amazon EventBridge |
|
| 09 | DynamoDB multi-Region strong consistency expands to 15 Regions and cross-continent setups ▲Why it's relevant to EC2: the hard part of an active-active EC2 application tier across Regions is the state, not the instances. MRSC gives you a zero-RPO session, entitlement or order store, so stateless EC2 fleets in each Region can take writes during a Regional failure.Issue 2026-09-27 | Amazon DynamoDB |
|
| 10 | RDS for SQL Server: Multi-AZ now supported on Developer Edition ▲Why it's relevant to EC2: many Windows/.NET estates run their app tier on EC2 against SQL Server. Until now, testing AG failover in non-production meant paying for Enterprise licensing or skipping the test. Developer Edition now supports Multi-AZ with Always On AGs for 2019, 2022 and 2025 Enterprise Developer, but not 2025 Standard Developer.Issue 2026-09-27 | Amazon RDS for SQL Server |
|
| 2026-09-20 Week of 14–20 September 2026 | |||
| 01 | EC2 T8i is GA — the burstable floor moves ▲T8i lands on custom Intel Xeon 6 and sixth-gen Nitro cards in nano, micro, small and medium. AWS claims up to 30% better price-performance than T3, 70% more compute, 1.25x network bandwidth and 2.4x EBS bandwidth. The CPU credit model (Standard / Unlimited) is unchanged, so this is a drop-in swap rather than a new mental model. t8i.micro and t8i.small are Free Tier eligible.Issue 2026-09-20 | Amazon EC2 |
|
| 02 | Multi-modal autoscaling: stop scaling on CPU alone ▲Not a launch — a Compute Blog piece, and the most directly useful thing published this week. The pattern layers three target-tracking signals on one Auto Scaling group: reactive infrastructure metrics (CPU, memory, network), an application metric that reflects business state (active sessions, queue depth, in-flight orders), and predictive scaling for cyclical demand.Issue 2026-09-20 | Amazon EC2 Auto Scaling |
|
| 03 | Elastic Beanstalk Cluster Mode — pooled EKS instead of an ASG per app ▲Cluster Mode runs many applications on pooled infrastructure backed by Amazon EKS in your account, instead of Beanstalk’s traditional dedicated environment — own EC2 instances, own ASG, own load balancer — per application. It accepts source code, a Dockerfile or an ECR image, and ships with event-driven autoscaling, OpenTelemetry instrumentation, Secrets Manager integration, automatic HTTPS via ACM and a GitHub Action. No charge for Cluster Mode itself; you pay for the EKS cluster and EKS Auto Mode capacity underneath.Issue 2026-09-20 | AWS Elastic Beanstalk |
|
| 04 | ECS on EC2: Graviton in Express Mode, and S3 Files reaches the EC2 launch typeTwo ECS items that matter if you run containers on EC2 capacity rather than Fargate.Issue 2026-09-20 | Amazon ECS |
|
| 05 | PrivateLink Tunnel Endpoints — share a CIDR, not a service ▲The most architecturally interesting launch of the week. A new VPC endpoint type that gives private access to an entire network segment in another VPC or account. You define a Resource Configuration representing a CIDR range, share it through AWS RAM, and the consumer creates a tunnel endpoint that reaches into that range using GENEVE encapsulation.Issue 2026-09-20 | AWS PrivateLink |
|
| 06 | Direct Connect flat-rate pricing on 10/100 Gbps dedicated connections ▲Dedicated 10 Gbps and 100 Gbps connections can now be bought as a single fixed monthly fee based on bandwidth and geographic scope, with data transfer out eliminated within the selected tier. Five geographic tiers run from same-metro to global. The previous model — port hours plus per-GB DTO — remains for everything else, including 1 Gbps and hosted connections.Issue 2026-09-20 | AWS Direct Connect |
|
| 07 | Source IP preservation for SFTP behind an NLBTransfer Family SFTP servers fronted by a Network Load Balancer now preserve the real client IP using Proxy Protocol v2, instead of presenting the NLB’s private address. The true source IP flows through authentication and logging, so IP allow-lists, custom identity providers and audit records all see the client rather than the load balancer. Enabled per server via console, CLI or API; available in all Regions where Transfer Family runs.Issue 2026-09-20 | AWS Transfer Family / Elastic Load Balancing |
|
| 08 | STS unifies session token size at 4,096 bytes — and finally tells you how full it is ✓STS replaced its separate limits on token size and passed-in parameters (inline policies, managed policy ARNs, session tags) with one 4,096-byte boundary. More usefully, AssumeRole responses now return the token size and its utilisation as a percentage of the limit, logged to CloudTrail and published to CloudWatch. There is also a new optional API parameter for testing larger tokens up to the threshold.Issue 2026-09-20 | AWS STS |
|
| 09 | Root user sign-in goes multi-Region — and quietly breaks your CloudTrail alarm ✓Root user sign-in now distributes across US East (N. Virginia), US East (Ohio) and US West (Oregon) instead of depending primarily on us-east-1. Routing is automatic; nothing changes about how anyone signs in. Good, overdue resilience work on one of the last genuinely single-Region control-plane dependencies.Issue 2026-09-20 | AWS Sign-In |
|
| 10 | Two advisories worth a patch cycle — SSM Agent SSRF and TEAM privilege escalation ▲CVE-2026-89049 — SSRF in SSM Agent remote-host port forwarding (published 10 Sep). Flagged here because it sits directly on the EC2 path and did not make the previous digest. An authenticated user holding port-forwarding permission can bypass destination restrictions, reach link-local endpoints and pull the instance role’s temporary credentials — then use that role from outside the instance. Every version before 3.3.4851.0 that supports remote-host port forwarding is affected.Issue 2026-09-20 | AWS Security Bulletins |
|
| 11 | S3 Express One Zone adds 7 Regions — and a reminder of what “One Zone” means ▲Now in Asia Pacific (Singapore, Sydney, Seoul), South America (São Paulo), US West (N. California), Canada (Central) and Europe (Paris) — 15 Regions in total. Single-digit-millisecond access, up to 10x faster than S3 Standard, with request costs up to 80% lower.Issue 2026-09-20 | Amazon S3 |
|
| 12 | Agentic ops this week: all read-and-recommend, none auto-remediate ▲Three items, and the useful observation is what they have in common — consistent with the DevOps Agent Slack integration from the previous digest, AWS is still shipping agents that investigate and propose rather than act. Blast radius stays with the human.Issue 2026-09-20 | AWS Continuum, Amazon Q, AWS Billing and Cost Management |
|
| 2026-09-14 Week of 3–14 September 2026 | |||
| 01 | Second-generation single-rack Outposts, GA ▲A self-contained 42U rack — compute, storage and networking in one unit — up to 2,688 vCPU and 100 TB of EBS. Instance coverage is x86 across three shapes: M7i/M8i general purpose, C7i/C8i compute-optimised, R7i/R8i memory-optimised, plus Bmn-sf2e / Bmn-cx2 / Bmn-cx3a for accelerated networking. This is the one to reach for when latency to a factory floor or a data-residency rule is what is actually driving the architecture, not preference.Issue 2026-09-14 | AWS Outposts |
|
| 02 | AMIs can now declare which instance types they support ▲AMI owners can attach a supported list, an unsupported list, or both. A launch on a non-permitted type is blocked outright rather than booting into a broken instance. All Regions, no charge, opt-in — existing AMIs stay launchable on anything. The obvious win is the x86 AMI that someone points at a Graviton ASG: you now get a clean API error instead of half an hour of debugging why the instance is unreachable.Issue 2026-09-14 | Amazon EC2 / AMI |
|
| 03 | Amazon Linux 2027 in public preview — SELinux enforcing by default ▲Kernel 7.1+, AWS-LC for crypto, refreshed toolchains and language runtimes, preview AMIs in all commercial Regions on both x86-64 and arm64, container base images on ECR Public. The headline for anyone with a real fleet is buried in the feature list: SELinux runs in enforcing mode out of the box, a change from AL2023.Issue 2026-09-14 | Amazon Linux |
|
| 04 | SSM now gives a real root cause for unmanaged EC2 instances ▲The diagnostic Automation used to check network connectivity and shrug at everything else. It now covers six more categories — IAM permissions, SSM Agent version, instance status checks, OS configuration, Default Host Management Configuration, and hybrid activation — and returns a specific cause with remediation steps instead of “unidentified.”Issue 2026-09-14 | AWS Systems Manager |
|
| 05 | C8g reaches Taipei, New Zealand and GovCloud US-East; X2idn lands in Hong KongGraviton4-based C8g adds Asia Pacific (Taipei), Asia Pacific (New Zealand) and GovCloud (US-East): 12 sizes including two bare metal, up to 50 Gbps network and 40 Gbps to EBS, up to 3x the vCPU and memory of C7g. X2idn — 3rd-gen Xeon, Nitro, SAP-certified for S/4HANA, BW and NetWeaver — arrives in Asia Pacific (Hong Kong).Issue 2026-09-14 | Amazon EC2 — regional footprint |
|
| 06 | EBS Volume Clones across accounts, with re-encryption on the way through ▲Share the volume via AWS RAM, then the destination account creates a copy in the same AZ, optionally re-encrypting with a KMS key it owns. Works from unencrypted or CMK-encrypted sources; available everywhere Volume Clones is, including GovCloud, China and supported Local Zones. Console, CLI and SDK.Issue 2026-09-14 | Amazon EBS |
|
| 07 | Network health indicator now covers TGW inter-Region peeringCloudWatch Network Monitoring synthetic monitors can now tell you whether a performance problem on a path crossing a TGW inter-Region peering connection is AWS’s network or yours. Previously the indicator only covered Direct Connect paths. Publishes to CloudWatch for dashboards and alarms. All Regions except GovCloud and China.Issue 2026-09-14 | Amazon CloudWatch / Transit Gateway |
|
| 08 | IAM condition keys for task CPU and memory on RunTask / StartTask ▲ecs:task-cpu and ecs:task-memory are now evaluated on RunTask and StartTask, not just at task-definition registration. All ECS Regions, no additional cost.Issue 2026-09-14 | Amazon ECS / IAM |
|
| 09 | FIPS 140-3 endpoints over PrivateLink for S3 File Gateway ▲FIPS endpoints for File Gateway used to be reachable only over the public internet — an awkward position for the regulated workloads that need FIPS in the first place. NFS and SMB shares can now reach S3 through FIPS interface VPC endpoints. Requires gateway software 2.1.10+; eight Regions, including both GovCloud Regions.Issue 2026-09-14 | AWS Storage Gateway / PrivateLink |
|
| 10 | DevOps Agent gains bidirectional Slack — investigate from the incident channel ✓@mention the agent in a connected private Slack channel and ask about resources, metrics, alarm state, deployment history or incident patterns across AWS, multicloud and on-prem. The whole investigation — agent findings, human input, recommended actions — stays in one thread. All commercial Regions where DevOps Agent is supported.Issue 2026-09-14 | AWS DevOps Agent |
|
| 11 | Lambda Managed Instances: Graviton5 support and a 90-minute async timeout ✓Why this is in an EC2 digest: Lambda Managed Instances is EC2 capacity — C9g/C9gd/M9g/M9gd here — billed on EC2 economics, with Lambda owning instance lifecycle, OS patching, routing, load balancing and scaling. For a batch or queue-worker fleet currently running as an ASG plus SQS plus your own patching, it is a genuine alternative worth costing, not a serverless sidebar.Issue 2026-09-14 | AWS Lambda (Managed Instances) |
|