tag: Aws · 157 items
- Platform/SRE — Learn: GovCloud parity for ElastiCache Serverless public endpoints means IAM-authenticated Valkey caches can now be reached outside a VPC in GovCloud without a bastion or VPN. Worth noting for any GovCloud workloads that need serverless caching with simplified network topology.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Teams running MSK Connect can now update connector plugins and worker configurations without deleting and recreating connectors, preserving committed offsets; evaluate adopting this for your next connector upgrade cycle to reduce disruption risk.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Managed Grafana 13.2 is now GA with Git Sync for dashboard-as-code, dynamic dashboards, and PromQL in the CloudWatch data source — worth scheduling an upgrade this quarter; no forced-upgrade deadline exists for version 12.4, so no clock is running.
- CI/CD — Skip
- Leader — Skip
- Signals: Grafana 13.2 EOL 2027-05-18 · GA announcement
- Platform/SRE — Plan: New GA capability lets platform teams build automated identity lifecycle workflows — audit Lambda functions, SIEM alerts, or downstream access revocation triggered by group/user changes. Worth incorporating into identity management automation this quarter if IAM Identity Center is the identity source.
- CI/CD — Skip
- Leader — Learn: EventBridge-driven identity change events can strengthen automated compliance and audit posture for organizations managing large workforces in AWS; no strategic vendor or cost decision required, but informs thinking on identity automation capabilities.
- Platform/SRE — Plan: New GA ECS capability that packs tasks across multiple underutilized instances and consolidates Spot capacity — worth evaluating this quarter if you operate ECS Managed Instances with narrow instance-type capacity providers to improve utilization and reduce EC2 spend.
- CI/CD — Skip
- Leader — Learn: Cross-instance and Spot consolidation in ECS Managed Instances is a FinOps-relevant feature for ECS-heavy orgs, but it’s a new GA optimization capability rather than a pricing or vendor-risk event — no strategic decision required now.
- Platform/SRE — Plan: This GA capability removes the need for overly broad IAM roles in multi-Region architectures, enabling per-user fine-grained access control and audit trails across Regions. Teams running distributed or disaster-recovery workloads on AWS should evaluate updating their IAM Identity Center configuration and multi-Region access patterns this quarter.
- CI/CD — Skip
- Leader — Learn: Cross-Region identity propagation tightens the audit and access-control story for multi-Region AWS deployments without additional cost, which may eventually inform golden-path standards for identity architecture, but no strategic decision is required now.
- Platform/SRE — Plan: New GA capability lets you enable Launch Before Terminate once at the account level via PutAccountSetting, ensuring full capacity is maintained during instance refreshes, rebalancing, and health-check replacements across all ASGs. Worth scheduling a review and enabling this quarter to reduce availability risk during replacement events.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: If your org runs WorkSpaces Core Managed Instances, this GA capability removes the previous requirement to rebuild instances for storage changes — useful to know for future capacity planning, but no action needed today.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: This GA capability eliminates the need for a NAT appliance or IP renumbering when connecting networks with overlapping CIDRs — directly relevant if the org has pending M&A integration, partner VPN, or multicloud connectivity work blocked by address conflicts. Evaluate adding to the network-connectivity pattern for such scenarios this quarter.
- CI/CD — Skip
- Leader — Learn: Managed 1:1 NAT on Transit Gateway removes the appliance cost and renumbering complexity historically incurred during M&A network integration; worth noting as an option when assessing future acquisition or partner-connectivity scope.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Plan: A 30% reduction in EMR on EKS per-vCPU and per-GB charges applies automatically with no action required — validate the cost impact in your next FinOps review and update budget forecasts for Spark workloads on EKS accordingly.
- Platform/SRE — Learn: New GA machine-readable IAM service reference (global condition keys, service name mappings, IsDataPlane flag) is a useful building block for automating policy guardrails, but requires no immediate change to existing infrastructure.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Lambda MicroVMs (GA, VM-level isolation with state preservation) is now available in Hong Kong, Malaysia, Thailand, and Spain — relevant if you’re architecting isolated code-execution environments for users in those regions, but no action required unless you have a workload targeting those geos.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful quality-of-life improvement for teams managing CloudFormation stacks — force rollback collapses what was a multi-step manual recovery into a single operation. No migration or deadline; worth knowing for the next stuck rollback.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: This GA capability closes a real security gap by validating destination IPs against Route 53-resolved addresses, extending domain-based filtering to SFTP, SSH, and other protocols beyond HTTP/HTTPS. Evaluate adding Route 53 Resolved IP Validation to existing Network Firewall policies to harden egress controls and prevent SNI spoofing.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: This new GA capability lets platform teams detach a DynamoDB replica into a standalone single-region table without recreating it — useful for regional isolation, offboarding a region, or audit scenarios. Worth evaluating if your platform runs global tables and needs cleaner multi-region lifecycle management.
- CI/CD — Skip
- Leader — Learn: Adds flexibility to multi-region DynamoDB architectures (including multi-account global tables), which may inform future data residency or regional isolation decisions, but no strategic action is required now.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Public beta of a native PyTorch backend for AWS Trainium chips; worth monitoring as a potential cost-efficiency alternative to GPU-based training if the org has AI/ML workloads, but no adoption decision warranted at beta stage.
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Plan: If your team uses EC2 Image Builder to bake AMIs or container base images, this GA opt-in feature eliminates per-build instance launch overhead by reusing warm ASG instances — worth evaluating this quarter for any image pipeline with meaningful build latency.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: CloudWatch Omni is now GA in more regions including major global hubs; platform teams running multi-region or multi-cloud observability stacks should evaluate adopting it as a replacement or complement to their existing Prometheus/Grafana/OpenTelemetry pipeline this quarter.
- CI/CD — Skip
- Leader — Learn: CloudWatch Omni’s AI-powered, multi-cloud observability experience with SSO and agent observability support is worth tracking as it matures — no immediate strategic decision required, but relevant context for future build-vs-buy reviews of the observability stack.
- Platform/SRE — Plan: This open-source module automates ephemeral, auto-scaling GitHub Actions runner fleets on AWS via Terraform — worth evaluating if the org self-hosts runners on EKS or EC2 and wants to reduce idle capacity costs.
- CI/CD — Plan: Teams running self-hosted GitHub Actions runners on AWS should evaluate this module to gain on-demand ephemeral runners and eliminate persistent runner maintenance overhead; no deadline, but a useful near-term adoption candidate.
- Leader — Skip
- Platform/SRE — Plan: GuardDuty Runtime Monitoring now supports 50+ tunable detection rules for EC2, EKS, and ECS workloads, covering MITRE ATT&CK tactics like persistence and privilege escalation. Evaluate and enable relevant rules this quarter, using dry-run mode first to reduce false positives before going live.
- CI/CD — Skip
- Leader — Learn: AWS expanding GuardDuty’s runtime threat detection with granular, MITRE-mapped rules signals a maturing managed-security posture for AWS-native environments; useful context when assessing build-vs-buy decisions around runtime security tooling.
- Platform/SRE — Plan: If your org operates in GovCloud or any of the newly supported commercial regions, this GA feature lets you centralize logs across accounts via AWS Organizations without custom pipelines — worth adding to your observability architecture this quarter.
- CI/CD — Skip
- Leader — Learn: Cross-account log centralization is now available in GovCloud, which matters for regulated-industry customers; free for one copy, $0.05/GB beyond that — useful context for FinOps and compliance conversations but no immediate decision required.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: If the org has Azure-native .NET workloads under consideration for migration to AWS, this GA tool (Functions→Lambda, Blob→S3, Queue→SQS) reduces the perceived migration cost and is worth flagging when revisiting cloud consolidation strategy.
- Signals: GA announcement
- Platform/SRE — Learn: T8i instances offer up to 30% better price-performance over T3 with drop-in CPU credit compatibility; worth evaluating for burstable workloads if you operate in the São Paulo region.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA capability enabling precision time on Gen8/Gen9 instance families via Precision Time Placement Groups; evaluate PTPG adoption this quarter for distributed workloads requiring ordered event sequencing or accurate one-way latency measurement.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful architecture pattern for orgs centralizing networking across AWS accounts in healthcare/life sciences workloads, but no deadline or breaking change — worth noting if you operate HealthOmics or shared VPC networking today.
- CI/CD — Skip
- Leader — Skip
Learn
archived
Amazon MSK Connect and Glue Schema Registry launch in AWS EU Sovereign Cloud (Germany)
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: For organizations with German or EU data-sovereignty requirements already on the AWS European Sovereign Cloud, the managed Kafka Connect and Schema Registry stack is now complete in that region — worth noting if evaluating compliance-scoped streaming architectures.
- Platform/SRE — Plan: If you run Transfer Family SFTP servers, evaluate migrating host keys to Secrets Manager this quarter to simplify cross-region failover and server migrations without requiring clients to re-trust new host keys.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Teams running DCV for GPU or visualization workloads and planning migrations to RHEL 10, Rocky Linux 10, or Ubuntu 26.04 should note this release; no deadline or forced upgrade is involved, so there’s no action to take now.
- CI/CD — Skip
- Leader — Skip
- Signals: Ubuntu 26.04 EOL 2031-05-29 · major release (2026.0)
- Platform/SRE — Plan: This GA capability changes how serverless web apps can be architected on AWS — Lambda Web Functions can now sit behind CloudFront for edge TLS, caching, DDoS protection, and WAF, with OAC locking down direct access. Worth evaluating for teams running Lambda-based web workloads this quarter.
- CI/CD — Skip
- Leader — Learn: New AWS capability that shifts the serverless-plus-CDN architecture picture — Lambda Web Functions are now a first-class CloudFront origin — but no pricing change, licensing impact, or forced migration means no decision is pending.
- Platform/SRE — Plan: New GA capability worth evaluating this quarter for any workloads using Databricks or Twilio: eliminates custom rotation Lambda functions and ensures applications pick up rotated credentials automatically without code changes.
- CI/CD — Learn: Relevant if pipelines consume Databricks personal access tokens or Twilio API keys, but there is no deadline or pipeline breakage — file as a pattern to consider when next reviewing how build credentials are rotated.
- Leader — Skip
- Platform/SRE — Learn: G7 instances are now available in two additional European regions, relevant if you run GPU-accelerated workloads in EMEA and are evaluating instance family upgrades from G6.
- CI/CD — Skip
- Leader — Learn: Regional expansion of NVIDIA Blackwell-based GPU instances may inform infrastructure strategy for EU-based AI inference or graphics workloads, especially for teams weighing data-residency requirements.
- Platform/SRE — Plan: A new GA CloudWatch dashboard surfacing OTel metrics (memory, network, latency, keyspace, errors) for Valkey node clusters — worth scheduling adoption to consolidate cache observability; note that detailed 15-second metrics incur standard CloudWatch OTel pricing.
- CI/CD — Skip
- Leader — Learn: AWS now bundles a pre-built observability layer for ElastiCache Valkey at no additional platform cost (standard CloudWatch OTel pricing applies for enhanced polling), relevant context if the org is evaluating its caching observability spend.
- Platform/SRE — Learn: R8gd’s Graviton4 + high-density local NVMe profile is worth noting for memory/storage-intensive workloads, and the EU Sovereign Cloud availability opens a new option for German-data-residency deployments — but no existing workload is forced to change.
- CI/CD — Skip
- Leader — Learn: Relevant context if the org is evaluating AWS European Sovereign Cloud for data-residency compliance, but no pricing, licensing, or contractual change is involved — no decision required yet.
- Platform/SRE — Learn: R8g instances with Graviton4 are now available in the AWS EU Sovereign Cloud (Germany) region, relevant for teams running memory-intensive workloads (databases, in-memory caches) there. No migration pressure — worth noting for future right-sizing or Graviton migration planning.
- CI/CD — Skip
- Leader — Learn: If the org has EU data-residency or sovereignty requirements, Graviton4-based R8g availability in the Germany Sovereign Cloud region opens a new option for memory-intensive workloads; no contract or cost-model change is involved.
- Platform/SRE — Plan: GA feature worth adopting for teams using AWS Network Firewall with EKS/ECS — wildcard patterns like app=payments-* can replace per-variant rules, reducing rule sprawl in dynamic container environments. Evaluate and consolidate existing container attribute rules this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New GA billing dimension adds model, provider, and inference-type breakdowns for Bedrock spend in Cost Explorer and Budgets — useful context for teams managing cloud cost allocation, but no operational infrastructure change required.
- CI/CD — Skip
- Leader — Plan: If your org runs Bedrock workloads, configure Bedrock product attribute dimensions in Cost Explorer and Budgets this quarter to gain per-model and per-provider spend visibility — enables tighter budget guardrails and informs model-selection trade-offs.
- Platform/SRE — Plan: New GA capability to restrict Identity Store and SCIM API access by VPC endpoint or IP allowlist; evaluate enforcing VPC-endpoint-only access for the Identity Store API as part of your AWS SSO hardening roadmap this quarter.
- CI/CD — Skip
- Leader — Learn: AWS now allows network-level perimeter controls around the APIs that manage SSO users and groups; worth noting as an available hardening option when setting identity-security standards across accounts.
- Platform/SRE — Plan: If you manage shared AMIs across accounts or organizations, this new GA feature can replace any custom tag-replication automation you’ve built; evaluate adopting the ’ec2:SharedTag/’ prefix pattern this quarter to simplify your cross-account AMI workflows.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: The new feature-level availability notifications and cross-region gap filters in AWS Builder Center can improve how platform teams research regional capability differences when planning multi-region or compliance-driven deployments, but no operational changes are required.
- CI/CD — Skip
- Leader — Learn: The improved regional availability tracking (notifications per feature, gap views across regions) could inform strategic decisions about new-region expansion or workload placement, but this is a discovery-tool improvement with no cost, licensing, or vendor-risk angle.
- Platform/SRE — Plan: Kubernetes 1.37 is now GA on EKS with notable promotions (Metrics API to GA as metrics.k8s.io/v1, DRA device taints to GA). Plan an upgrade evaluation this quarter; no forced-upgrade deadline exists yet, but staying current reduces future skew risk.
- CI/CD — Skip
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Learn: Preview-only AI tool that analyzes Terraform/CDK/CloudFormation against Well-Architected best practices and generates SSM runbooks — worth evaluating, but pre-GA caps this at Learn.
- CI/CD — Skip
- Leader — Learn: Preview of an AI-powered evolution of Trusted Advisor with cost, security, and reliability recommendations tied to business goals — monitor for GA as a potential addition to the platform governance toolchain.
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Plan: A new GA feature in Secrets Manager surfaces rotation gaps and encryption-key misconfigurations directly in the console at no extra cost; schedule a pass through your secrets inventory this quarter to act on flagged items before they become findings in a security review.
- CI/CD — Learn: Console-based recommendations don’t change how pipelines execute, but the rotation and key-management nudges are relevant context for teams auditing how pipeline secrets are stored in Secrets Manager.
- Leader — Learn: A free capability improvement to an existing standard-stack service; no pricing, licensing, or vendor-risk decision required, but worth noting as reinforcement for a secrets-rotation policy or security posture standard.
- Platform/SRE — Plan: If you operate in opt-in or GovCloud/China regions, evaluate enabling multi-Region IAM Identity Center replication this quarter to improve SSO resilience; requires setting up a multi-Region customer-managed KMS key for existing instances.
- CI/CD — Skip
- Leader — Learn: IAM Identity Center now supports identity replication across opt-in and GovCloud regions, a useful resilience capability to factor into multi-region access strategy and compliance planning.
- Platform/SRE — Plan: New GA capability lets Redshift query S3 tables in remote regions without replication, with enhanced VPC routing keeping traffic off public networks; evaluate for multi-region data lake architectures or compliance-sensitive workloads this quarter.
- CI/CD — Skip
- Leader — Learn: Relevant to orgs with data-residency or compliance constraints (financial, healthcare, government) — cross-region querying without replication simplifies global analytics architecture, but no strategic decision is forced by this announcement.
- Platform/SRE — Learn: If you have internal tooling or automation that calls Identity Store APIs, you can now pass ARNs directly instead of stripping them to resource IDs first — purely additive, no existing integrations need updating.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Grafana 13.2 on AMG brings Git Sync (dashboards as code tied to a repo), dynamic dashboards, and PromQL support in the CloudWatch data source — plan an evaluation and workspace upgrade this quarter if you run AMG; 13.2 is supported until 2027-05-18.
- CI/CD — Skip
- Leader — Learn: Git Sync enabling dashboard-as-code and PromQL queries against CloudWatch OTLP metrics represent a meaningful shift in managed observability capabilities, worth factoring into platform tooling direction — but no strategic decision is required now.
- Signals: Grafana 13.2 EOL 2027-05-18 · GA announcement
- Platform/SRE — Learn: New GA capability for ElastiCache Serverless that enables internet-reachable Valkey caches without VPC config; useful for prototyping or external workloads but likely not a fit for production platform architecture where VPC isolation is the norm.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful flexibility for teams that reserve EC2 capacity in advance — you can now shift a reservation start date before delivery without cancelling and rebooking, reducing commitment risk when timelines slip.
- CI/CD — Skip
- Leader — Learn: Reduces risk in long-horizon capacity commitments; worth noting when planning large EC2 reservations for future infrastructure buildouts or cost optimization initiatives.
- Platform/SRE — Plan: This simplifies multi-account automation at scale — teams managing SSM runbooks across an AWS organization can replace manual account-ID lists with OU/org-level RAM shares that auto-update as accounts join or leave. Worth adopting as part of your multi-account SSM document management strategy this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful visibility improvement for teams running large DataSync migrations or recurring transfers — no action required, just awareness that a native dashboard now replaces custom CloudWatch setups.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New opt-in encryption option for Transcribe custom vocabularies and models; relevant if you operate Transcribe-based workloads with compliance requirements around key ownership, but no action required unless you need BYOK for audit or regulatory reasons.
- CI/CD — Skip
- Leader — Learn: If the org uses Transcribe custom resources in regulated environments, this new BYOK option could satisfy compliance or data-sovereignty requirements worth flagging to security/compliance stakeholders.
- Platform/SRE — Learn: New memory-optimized instance generation with up to 15% better price-performance and 2.5x memory bandwidth gains is now GA in AWS European Sovereign Cloud (Germany); worth evaluating for memory-intensive workloads in that region, but no forced migration or deadline.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Teams running ElastiCache Global Datastore across regions can now enforce consistent IAM/SCP policies and cost allocation via tags; worth updating your tagging standards and IAM policies this quarter to close the permission-model gap.
- CI/CD — Skip
- Leader — Learn: This closes a cost-allocation and access-control gap in multi-region ElastiCache deployments, useful context if the org is standardizing FinOps tagging policies across AWS resources.
- Platform/SRE — Plan: A new GA EKS managed add-on that replaces round-robin LB with real-time GPU-signal-aware routing (KV cache, queue depth, LoRA residency) for HyperPod clusters — evaluate adopting this quarter if your team runs SageMaker HyperPod inference workloads on EKS.
- CI/CD — Skip
- Leader — Learn: AWS’s inference gateway pattern (single endpoint, multi-model routing, hardware-aware scheduling) signals a maturing managed alternative to self-built vLLM fleet management — worth tracking as it informs the build-vs-buy framing for LLM serving infrastructure.
- Platform/SRE — Plan: This GA relaunch adds cross-account event sharing via RAM, strict ordering, CloudEvents format support, and up to 1-year retention — capabilities worth evaluating this quarter if the platform uses EventBridge for inter-team or multi-account event routing.
- CI/CD — Skip
- Leader — Learn: New enterprise-grade EventBridge capabilities (cross-account brokering, CloudEvents, retention) could reshape how the org designs event-driven platform integrations, but no strategic or cost decision is forced now.
- Platform/SRE — Plan: If your platform runs EMR workloads, this GA release brings notable operational improvements: Serverless shuffle storage raised from 200 GiB to 1 TiB, IPv6 EKS cluster support, and Spark Connect endpoints on EMR on EKS. Schedule evaluation for teams hitting storage or networking constraints this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: CloudWatch Omni is now GA and offers OpenTelemetry interoperability, multi-cloud (including Azure) telemetry, and AI-driven root-cause analysis — worth evaluating this quarter as a replacement or augmentation for existing AWS-based observability pipelines if CloudWatch is already in use.
- CI/CD — Skip
- Leader — Learn: Omni signals AWS’s direction for AI-native, multi-cloud observability and could shift the build-vs-buy calculus for teams invested in third-party observability vendors alongside CloudWatch; no immediate strategic decision required.
- Signals: GA announcement
- Platform/SRE — Learn: Relevant if running VMware workloads on AWS in a government or regulated environment; no operational change required, but expands compliance options for teams evaluating EVS for FedRAMP-scoped workloads.
- CI/CD — Skip
- Leader — Learn: If the org has federal or regulated customers, EVS gaining FedRAMP Class C authorization may open a path to migrate VMware workloads to AWS while meeting compliance requirements — worth noting in cloud strategy discussions.
- Platform/SRE — Plan: Teams running ECS workloads can now consolidate deployment health signals — circuit breaker status, alarm state, container and LB health checks — into a single console view instead of jumping between tools. No migration required; worth scheduling time to evaluate and adopt as the standard deployment monitoring workflow.
- CI/CD — Learn: If your ECS-based release process uses canary or blue/green strategies, this console view surfaces traffic-shift progress and task failure diagnostics in one place, but there is nothing to configure or pin — useful context for how to troubleshoot ECS deployment failures faster.
- Leader — Skip
- Platform/SRE — Plan: Three new GA capabilities directly relevant to EKS workload resilience: scoped resource discovery via existing K8s labels, AI-powered dependency pattern analysis, and cross-account policy sharing via AWS Organizations. Evaluate integrating Resilience Hub into the platform runbook this quarter.
- CI/CD — Skip
- Leader — Learn: Organization-wide resilience policy sharing through AWS Organizations is a governance capability worth tracking as a potential standard for cross-team resilience posture, but no immediate strategic decision is required.
- Platform/SRE — Plan: New GA capability worth evaluating this quarter: workloads that currently split or offload large SNS payloads can be simplified by setting the new MaximumMessageSize topic attribute on Standard or FIFO topics, though note the constraint of up to 100 subscriptions per topic at the larger size.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Teams using Transfer Family SFTP behind an NLB for compliance or IP-based access controls should evaluate enabling this feature; no deadline, but it unlocks accurate audit logs and identity-provider IP filtering that may be required for security reviews.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful IAM pattern for multi-tenant HealthOmics workloads — session policies let you scope down permissions per run without proliferating IAM roles. No deadline; relevant only if you operate HealthOmics.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Beanstalk Cluster Mode is EKS under the hood with AWS managing the control plane — worth understanding as an abstraction layer above raw EKS, but platform engineers already running EKS have no action to take and no deadline.
- CI/CD — Learn: A new official Beanstalk GitHub Action ships alongside this feature, relevant only to teams already in the Beanstalk ecosystem; no deprecation or deadline pressure makes this worth monitoring rather than scheduling.
- Leader — Learn: Cluster Mode’s shared-infrastructure model could reduce per-app compute cost for orgs with many small services on Beanstalk, but there is no pricing change or strategic forcing function to act on — file for the next platform golden-path review.
- Platform/SRE — Plan: T8i instances offer up to 30% better price performance than T3 with the same CPU credit model, making them a straightforward drop-in upgrade for burstable workloads like small databases, ingress gateways, or low-traffic internal services; evaluate swapping T3 instances this quarter to reduce compute TCO.
- CI/CD — Learn: T8i instances are explicitly called out as suitable for CI/CD pipelines and could reduce runner costs compared to T3, but no pipeline migration is required — worth noting if self-hosted runners are being right-sized.
- Leader — Plan: T8i delivers up to 30% better price performance over T3 with no migration complexity due to compatible CPU credit mechanics; flag this for the next FinOps review as a low-effort TCO reduction for burstable workload fleets.
- Signals: GA announcement
- Platform/SRE — Plan: S3 Files now reaches feature parity across all three ECS launch types; evaluate adopting shared S3-backed volumes for data-intensive EC2 workloads this quarter to eliminate data staging overhead.
- CI/CD — Skip
- Leader — Learn: ECS S3 Files now uniform across EC2, Fargate, and Managed Instances — useful context when evaluating EC2 vs Fargate positioning for data-heavy or AI-agent workloads on the platform.
- Platform/SRE — Plan: If you run LLM inference workloads on SageMaker HyperPod, this GA feature cuts scale-out time ~60% by pre-loading model weights to NVMe and pre-pulling container images; evaluate adding a modelCacheConfig block to InferenceEndpointConfig resources this quarter.
- CI/CD — Skip
- Leader — Learn: HyperPod’s new model caching substantially narrows the cold-start penalty for large-model inference, which is relevant context if evaluating HyperPod as the org’s managed inference platform versus self-managed alternatives.
- Platform/SRE — Plan: If you run S3 File Gateway for regulated workloads, you can now route FIPS-compliant traffic over PrivateLink instead of the public internet — plan to create FIPS VPC endpoints and upgrade gateway software to 2.1.10 or later to enable this.
- CI/CD — Skip
- Leader — Learn: This expands compliance options for regulated workloads using AWS Storage Gateway, potentially simplifying FIPS requirements in GovCloud or heavily regulated environments — no immediate decision required.
- Platform/SRE — Learn: Amazon EVS (Elastic VMware Service) now available in AP Osaka, AP Taipei, EU Spain, and Israel Tel Aviv, expanding options for VMware workloads with lower latency and data residency coverage — no action required unless actively planning VMware-to-AWS migration in these geographies.
- CI/CD — Skip
- Leader — Learn: Regional expansion of Amazon EVS is worth noting for organizations with data sovereignty or latency requirements in Asia-Pacific or Europe, but no pricing, licensing, or strategic decision is triggered by this announcement.
- Platform/SRE — Plan: This GA capability removes a key architectural constraint that pushed long-running workloads off Lambda toward ECS/Batch/Step Functions; evaluate whether existing workarounds in the platform’s serverless stack can be simplified this quarter.
- CI/CD — Skip
- Leader — Learn: The 6x timeout increase changes the serverless vs. dedicated-compute trade-off for batch and AI inference workloads, worth factoring into the next platform strategy review, but no urgent decision is required.
- Platform/SRE — Learn: New GA capability on Timestream for InfluxDB 3 that lets you push custom transformation and alerting logic into the managed database; worth evaluating if your observability stack already uses this service, but no migration or deadline pressure.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: GA feature enabling ACM-backed mTLS from API Gateway to backend services — worth adopting for any zero-trust or regulated workload this quarter; audit existing REST API integrations and plan certificate provisioning via ACM or AWS Private CA.
- CI/CD — Skip
- Leader — Learn: Closes a common compliance gap in regulated industries (finance, healthcare) by extending mTLS to the API-to-backend path; relevant context if the org is pursuing zero-trust architecture or FedRAMP/HIPAA posture.
- Platform/SRE — Learn: New GA capability lets AMI owners enforce instance-type compatibility at launch, reducing failed deployments from mismatched pairings. Worth evaluating for custom AMIs shared across teams, but no existing workflow is affected until restrictions are explicitly set.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Teams running MWAA Provisioned environments should evaluate the new one-click recommended alarms and built-in metrics dashboard as a quick win for observability coverage without manual CloudWatch alarm configuration.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: AL2027 preview surfaces meaningful changes — kernel 7.1+, SELinux enforcing by default, AWS-LC crypto — worth evaluating against workloads built on AL2023, but no migration decision is warranted before GA.
- CI/CD — Learn: Container base images are available on ECR Public Gallery in preview, useful for early pipeline testing against AL2027, but nothing to pin or migrate to before GA.
- Leader — Skip
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Plan: Teams running ECS with Managed Daemons for logging or metrics collection should evaluate configuring auxiliary daemons as non-critical to prevent churn on mission-critical tasks; no deadline, but worth adopting this quarter when reviewing ECS daemon configurations.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New NVIDIA Blackwell Ultra GPU instance type now available in Jakarta — worth noting for teams with AI/ML workloads in that region, but no operational change required for existing infrastructure.
- CI/CD — Skip
- Leader — Learn: P6-B300 instances offer 2x networking and 1.5x GPU memory over P6-B200, relevant for leaders evaluating AI/ML infrastructure capacity or regional expansion strategy for large model training.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: P6-B200 instances with NVIDIA Blackwell GPUs now available in Hyderabad, offering 2x training/inference performance over P5en — worth tracking for teams evaluating GPU compute strategy or regional AI workload placement.
- Platform/SRE — Plan: New GA capability unifies monitoring of self-managed PostgreSQL on EC2 alongside RDS/Aurora in a single console; worth evaluating if you run mixed database fleets to consolidate your observability stack.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA AWS service adds cross-account agent catalog support via CloudFormation, Terraform, CDK, and AWS RAM — worth evaluating this quarter if your org is building shared AI agent infrastructure, as it may change how you architect agent discovery and access control across accounts.
- CI/CD — Skip
- Leader — Learn: AWS Agent Registry offers a governed, org-wide catalog for AI agents and tools with audit trails and cross-account sharing; worth tracking as a pattern for AI governance strategy, but no immediate decision or vendor-risk event is present.
- Signals: GA announcement
- Platform/SRE — Plan: If Redshift is in your stack and you have data residency or network-isolation requirements, this is worth adopting: SSO via IAM Identity Center with all auth traffic staying inside your VPC via PrivateLink. Evaluate enabling EVR and wiring up Identity Center for your provisioned clusters or serverless workgroups this quarter.
- CI/CD — Skip
- Leader — Learn: Redshift now supports SSO via IAM Identity Center with network traffic fully contained in your VPC — relevant context if your org has regulatory or data-residency mandates for analytics infrastructure, but no decision is forced by this launch.
- Platform/SRE — Plan: New GA Graviton5 memory-optimized instances offer up to 25% better compute and 30% faster database performance vs R8g; evaluate migrating memory-intensive workloads (Kubernetes nodes, caches, databases) this quarter to capture the price-performance gains.
- CI/CD — Skip
- Leader — Learn: Graviton5 R9g instances establish a new price-performance ceiling for memory-intensive workloads on AWS; useful context for future FinOps and instance-family standardization decisions but no forcing function today.
- Signals: GA announcement
- Platform/SRE — Learn: New higher-core-count bare-metal option for VMware-on-AWS workloads may inform future capacity planning if your org runs Amazon EVS, but no deadline or migration requirement exists.
- CI/CD — Skip
- Leader — Learn: Worth noting for orgs running VMware workloads on AWS via EVS — better price-performance on i7i over i4i could factor into cloud cost optimization conversations this planning cycle.
- Platform/SRE — Learn: New high-end GPU instance type now available in additional regions — relevant if your org runs large AI/ML training workloads on EC2, but no operational change required for existing infrastructure.
- CI/CD — Skip
- Leader — Learn: P6-B300 regional expansion is worth noting if your org runs large-scale model training; evaluate whether the new regions reduce latency or cost for AI workloads versus existing placements.
- Platform/SRE — Learn: X8i instances now available in two more EU regions is worth noting if you run SAP HANA or large in-memory databases there, but no existing workload is forced to change — evaluate for future capacity planning.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful Cognito admin capability if you enforce TOTP MFA — the new AdminDeleteSoftwareToken API simplifies locked-out user recovery without recreating accounts. No urgency or migration required.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New instance generation available in an additional region — worth noting if you run workloads in Canada West, but no deadline or breaking change makes this actionable today.
- CI/CD — Skip
- Leader — Skip
Plan
archived
AWS Secrets Manager adds native rotation for Cisco Security Platform and Netskope tokens
- Platform/SRE — Plan: If your platform integrates Cisco Security Cloud Control or Netskope, you can now remove any custom Lambda rotation logic and let Secrets Manager handle scheduled credential rotation natively; worth scheduling a migration this quarter for affected integrations.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: AWS’s new preview model lets platform teams validate Lambda workloads against upcoming runtimes before GA; pre-GA and explicitly unsupported for production, so evaluate only in non-critical environments.
- CI/CD — Learn: Notable design detail: preview runtimes use the same identifier as the eventual GA release, so Lambda functions automatically graduate with no pipeline or IaC changes required — worth factoring into future Lambda deployment workflows once GA.
- Leader — Skip
- Signals: pre-GA (alpha/beta/RC/preview) · breaking-change flagged
- Platform/SRE — Plan: A new GA ECS capability worth adopting this quarter: Fargate and Managed Instances now auto-drain and replace impaired instances, while EC2-based ECS surfaces the new AGENT_CONNECTIVITY health event that teams must wire into their own instance-replacement automation. No deadline, but teams running ECS on EC2 should build the event-driven replacement workflow to gain equivalent resilience.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful new GA observability capability for teams running Aurora DSQL — per-statement wait states and normalized SQL at no extra cost — but no migration or upgrade required; worth noting when evaluating DSQL observability strategy.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: For orgs running GenAI workloads on SageMaker, this Studio-based benchmarking experience could meaningfully reduce the time-to-production-config from weeks to hours — worth knowing as a capability when evaluating inference cost and performance strategy, though no decision is forced.
- Platform/SRE — Plan: If you use S3 MRAP with CloudFront, you can now drop the Lambda@Edge workaround for SigV4a signing and let CloudFront handle OAC natively — plan to migrate existing custom auth header functions to simplify the architecture.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New geographic option for low-latency or data-residency workloads in the Las Vegas metro; worth knowing if you have edge or latency-sensitive use cases there, but no change required to existing platform infrastructure.
- CI/CD — Skip
- Leader — Learn: Relevant if the org has Las Vegas-area latency, data-residency, or legacy-migration requirements; could inform a future edge or hybrid-cloud placement decision.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: New Blackwell Ultra GPU instance type expands high-memory AI training capacity to Seoul region; worth noting if the org runs large-scale model training on AWS and evaluates regional availability for latency or data-residency reasons.
- Platform/SRE — Plan: GA capability that simplifies multi-team DynamoDB Streams IAM policy management via tag-based conditions; worth adopting this quarter if you manage access across multiple environments or teams on DynamoDB Streams.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Relevant if your org runs SageMaker and Lake Formation with fine-grained data access; this GA feature removes the need for shared execution roles and adds per-user CloudTrail audit trails. No immediate action required unless you’re actively designing a multi-user analytics platform.
- CI/CD — Skip
- Leader — Learn: Per-user data boundaries enforced at the Lake Formation layer with automatic identity propagation reduces compliance friction for orgs with strict data governance requirements; worth noting when evaluating SageMaker Unified Studio for enterprise analytics use cases.
- Platform/SRE — Learn: If you run SAP HANA, Oracle, or large in-memory databases in eu-central-2 (Zurich), U7i-6TB is now an option offering up to 45% better price/performance versus U-1 instances. No deadline — evaluate as part of next instance-type review if you have Zurich-resident heavy-memory workloads.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: GA additions to CloudWatch pipelines reduce the need for custom log-transformation Lambda functions or external processors; evaluate replacing any bespoke RDS/XML parsing glue with these managed processors during the next observability stack review.
- CI/CD — Skip
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Plan: Teams using CloudWatch Centralization can now preserve cost, ownership, and compliance tags across accounts — worth enabling tag propagation on existing centralization rules to unlock IAM scoping and per-team cost attribution in Cost Explorer.
- CI/CD — Skip
- Leader — Learn: Tag propagation on centralized logs enables per-team observability cost attribution out of the box, which may inform how your org structures log ownership and FinOps reporting for multi-account environments.
- Platform/SRE — Plan: If you run Tape or Volume Gateway for regulated workloads, you can now route FIPS-compliant traffic privately via PrivateLink instead of over the public internet; plan to create a FIPS interface VPC endpoint and re-activate gateways on software version 3.2.7 or later.
- CI/CD — Skip
- Leader — Learn: For organizations with compliance mandates (FedRAMP, HIPAA) using Storage Gateway, this removes a previous architectural constraint — FIPS traffic can now stay private — which may simplify audit scope for regulated workloads.
- Platform/SRE — Learn: New AZ in eu-west-2d provides an additional fault isolation domain and AI/ML instance types; worth noting for teams running eu-west-2 workloads who may want to re-evaluate multi-AZ distribution, but no deadline or breaking change requires action now.
- CI/CD — Skip
- Leader — Learn: For orgs with UK data-residency requirements or growing AI/ML workloads in London, this expands architectural options and capacity; no strategic decision is forced, but worth factoring into infrastructure planning conversations.
- Platform/SRE — Plan: Platform engineers managing Terraform-deployed AWS infra can now generate least-privilege IAM policies directly from plan files rather than hand-crafting them; worth integrating into the IaC workflow this quarter to reduce wildcard usage and policy drift.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Useful GA capability for teams running large ephemeral fleets (ML training, event-driven); worth adopting in scale-down logic this quarter to reduce API call overhead and simplify fleet teardown scripts.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Rule hit counts are now enabled by default on AWS Network Firewall stateful rules, enabling detection of shadow, redundant, and unused rules — worth scheduling a policy audit this quarter to clean up firewall rule sets.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful capability expansion for teams running OpenSearch in VPC environments — semantic search now available without public exposure. No operational changes required; worth noting if search relevance is on the roadmap.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful capacity increase for complex multi-region or multi-account ECR setups; no migration required, but worth revisiting replication rule consolidation workarounds if your registry hit the old 10-rule ceiling.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful signal for teams running Spot workloads that span Local Zones — the expanded placement score can inform capacity planning decisions, but no migration or deadline is involved.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Role manager can simplify onboarding new AWS services by auto-generating least-privilege starter roles, but teams with strict IaC discipline should evaluate whether console-created roles conflict with Terraform/CDK-managed IAM. Schedule a review of how role manager interacts with existing role governance before enabling org-wide.
- CI/CD — Skip
- Leader — Learn: Role manager lowers the barrier to correct IAM role setup for console-driven workflows, which may reduce misconfiguration risk across teams; worth noting as a governance tool but no immediate strategic decision required.
- Signals: GA announcement
- Platform/SRE — Plan: R8a instances offer meaningful memory bandwidth and price-performance gains over R7a for memory-intensive workloads (databases, in-memory caches); worth evaluating for Canada Central production workloads during the next capacity planning cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: This GA feature replaces bespoke health-monitoring scripts for EC2 workloads and integrates with Auto Scaling recovery — worth evaluating this quarter to simplify the observability stack for any EC2-based services.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Relevant to any team using BYOIP prefixes on AWS: the new delegated RPKI automation eliminates manual ROA creation/renewal at the RIR, and the centralized dashboard surfaces hijacking risk via route overlap detection. Evaluate enabling this during the next IPAM configuration review cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: This GA simplification reduces friction for deploying resilient multi-Region identity access — if standing up a new IAM Identity Center organization instance, select the one-click multi-Region option rather than manually wiring KMS keys and Region replication. Existing instances are unaffected, so queue this for next new-instance or resilience-architecture work this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New memory-optimized instance family now available in eu-south-1; worth noting if you run memory-intensive workloads (PostgreSQL, SAP) in Milan, but no deadline or migration required.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: AgentCore runtime instances GA lets you attach EC2 capacity (GPU, memory-optimized, etc.) to managed AI agent workloads without infrastructure ops; worth evaluating if your org is deploying long-running or hardware-intensive agents on AWS.
- CI/CD — Skip
- Leader — Learn: New GA managed compute tier for AI agents on AWS changes the build-vs-buy calculus for teams scaling agentic workloads; worth factoring into AI infrastructure strategy and EC2 cost modeling.
- Signals: GA announcement
- Platform/SRE — Learn: Useful GA capability for teams running large-scale cloud migrations via AWS Transform, automating per-server SSM post-launch steps at account scale. No urgency or deadline; worth evaluating if a migration project is planned.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New configuration option for net-new IAM Identity Center instances reduces the service-linked role footprint when only AWS application SSO is needed. Worth noting for future greenfield deployments; no action required on existing instances.
- CI/CD — Skip
- Leader — Learn: Reduces the access surface when standardizing on IAM Identity Center for application SSO without requiring full AWS account management delegation — useful context when evaluating identity architecture for new AWS org setups.
- Platform/SRE — Learn: New CloudWatch metrics for WorkSpaces Applications session health and resource utilization are useful if you manage a WorkSpaces fleet, but there’s no deadline or forced migration — worth noting for dashboard updates during next review cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA ECS capability lets you right-size GPU containers (1/8, 1/4, or 1/2 of an L4 GPU) on G6f instances, with CloudWatch GPU metrics and automatic health monitoring included. Evaluate this quarter if you run ECS-based AI inference or rendering workloads where full-GPU allocation is wasteful.
- CI/CD — Skip
- Leader — Learn: Fractional GPU scheduling in ECS reduces the cost floor for small-model inference and GPU experimentation workloads; worth factoring into GPU cost optimization reviews if the org runs AI workloads on ECS.
- Platform/SRE — Learn: M8g Graviton4 instances are now available in two additional regions; worth noting for teams planning workloads in AP Taipei or Mexico Central, but no deadline or operational change required.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: G7 (NVIDIA RTX PRO 4500 Blackwell) is now a viable option for EU-based GPU workloads requiring data residency in Spain; no change to existing infrastructure required, but worth noting for future capacity planning.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New GA controls for AI agent traffic (stateful authz and rate limiting) are worth evaluating if your platform exposes Bedrock-based agents, but there is no operational urgency or EOL signal.
- CI/CD — Skip
- Leader — Learn: Temporal policies and rate limiting in AgentCore address governance and fairness concerns for AI agent deployments — relevant context for teams standardizing on AWS AI infrastructure, but no strategic decision required now.
- Platform/SRE — Learn: Relevant only if you run I/O-intensive workloads in ap-southeast-7 or il-central-1; no deadline or forced migration, just a new regional option worth noting for future capacity planning.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: This GA tool auto-creates PRs/MRs with validated code fixes from technical debt analysis connected to GitHub, GitLab, and Bitbucket — worth evaluating if the team wants automated remediation integrated into their pipeline workflow, but no pipeline change is required today.
- Leader — Plan: Evaluate AWS Transform as a platform-level technical debt and modernization tool for standardizing debt management across teams; assess whether its agentic remediation and scheduling capabilities fit the org’s golden-path tooling this quarter.
- Signals: GA announcement
- Platform/SRE — Learn: Useful capability increase for teams packaging large artifacts (LLMs, genomics datasets) into container images, but no operational change required — existing workloads are unaffected and there is no migration deadline.
- CI/CD — Learn: Pipelines that previously split large layers or used external storage workarounds can now simplify, but this is an optional improvement with no deadline or deprecation pressure.
- Leader — Skip
- Platform/SRE — Plan: If you run EC2 Dedicated Hosts or Mac Instances for isolation rather than BYOL, you can now create Host Resource Groups without the AWS License Manager self-managed license prerequisite, simplifying the provisioning workflow. Review and update any Terraform/IaC automation that currently creates SMLs solely to satisfy the HRG requirement.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: If your org runs LLM inference on SageMaker in APAC or Europe, G7e availability in these regions may reduce latency and simplify architecture by eliminating multi-node setups for models up to 70B parameters — worth factoring into GPU capacity planning.
- Platform/SRE — Learn: Regional availability expansion for niche high-memory instances (16–24 TiB) is worth noting if you run SAP HANA or large in-memory databases in those regions, but no action required unless you’re actively planning such workloads there.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Relevant if the org runs VMware workloads and is evaluating cloud migration paths; this regional expansion improves latency and data-residency options for EVS customers but requires no operational change for existing users.
- CI/CD — Skip
- Leader — Learn: Useful context for leaders evaluating VMware-to-cloud migration strategy, particularly if data residency in APAC or Europe is a requirement; no immediate decision is forced by this regional expansion.
- Platform/SRE — Learn: M8id instances with Intel Xeon 6 and up to 22.8TB NVMe are now available in Ireland, relevant if you run I/O-intensive workloads or databases in eu-west-1 and are evaluating next-gen instance families.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: ALB logs are now a first-class CloudWatch vended log type, enabling Logs Insights queries, metric filters, and Live Tail for load balancer traffic without custom shipping pipelines; evaluate adopting telemetry enablement rules to standardize coverage across accounts, noting the per-GB vended log cost vs. free S3 delivery.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful CloudWatch architecture change for teams running Bedrock AgentCore—unified per-agent log groups simplify IAM scoping and CMK encryption, but this is an AI-agent platform feature with no infra operational urgency.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA capability removes the CloudTrail-parsing workaround for secret rotation events; evaluate adding EventBridge rules this quarter to auto-refresh credential caches or trigger service restarts on rotation, reducing the lag window between rotation and downstream adoption.
- CI/CD — Learn: Could inform future pipeline designs that need to react to secret rotation (e.g., invalidating cached build credentials), but no current pipeline change is required and no deprecation is introduced.
- Leader — Skip
- Platform/SRE — Plan: New GA NLB capability worth evaluating this quarter for teams running dual-stack workloads: a single NLB can now route IPv4 and IPv6 clients to same-family targets without protocol translation or a second load balancer. Audit existing dual-stack NLB deployments and update Terraform/IaC to add listener rules where protocol translation is currently causing IP preservation issues.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Relevant if you’re designing DR for workloads in Bangkok, Malaysia, New Zealand, Taipei, Calgary, or Mexico Central — DRS is now available in 36 regions, which may enable in-region DR targets previously requiring cross-region routing.
- CI/CD — Skip
- Leader — Learn: If the org has data-residency or latency requirements for any of these six new regions, this expands DR options worth noting in a future architecture review — no immediate decision required.
- Platform/SRE — Learn: Regional expansion of network-optimized instances is worth noting if you run memory-intensive or high-throughput workloads in eu-west-3 or ca-central-1, but no action is required unless you’re actively evaluating instance types for those regions.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: A community module for self-hosted GitHub Actions runner autoscaling on AWS; worth evaluating if teams are self-hosting runners, but no deadline or GA milestone signals a required change.
- CI/CD — Plan: If cost or throughput is a pain point with GitHub-hosted runners, this Terraform module offers a path to autoscaled self-hosted runners on AWS — worth scheduling an evaluation this quarter.
- Leader — Skip
- Platform/SRE — Plan: If you run memory-intensive workloads (PostgreSQL, NGINX, ML inference) in EU Stockholm or Zurich, evaluate migrating to R8i for up to 30–60% workload-specific gains; no deadline, so schedule as a cost-performance optimization this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Relevant only if you have workloads targeting Greece or EMEA data-residency requirements; no action needed unless expanding into that region.
- CI/CD — Skip
- Leader — Learn: Worth noting if the org has Greek or EMEA in-country data-residency obligations; no strategic decision required unless expansion into that market is on the roadmap.
- Signals: GA announcement
- Platform/SRE — Learn: New storage-optimized instance type with Graviton4 and third-gen Nitro SSDs is now available in GovCloud — worth evaluating if you run high-IOPS workloads there, but no migration urgency or deprecation pressure.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Teams running OpenSearch Service domains or serverless collections with Dashboards tenants and saved objects can now migrate to the new OpenSearch UI without manual recreation; worth scheduling as a low-risk migration this quarter to reduce legacy UI dependency.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful discoverability improvement for IaC workflows that reference public AMIs via SSM aliases; no urgent action required, but worth updating Terraform data sources or scripts to leverage the new field when refreshing AMI references.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New GA functions like outlier detection, sessionization, and cidrlookup enrich the observability toolkit for teams already on CloudWatch Logs; no migration or operational change required, but worth knowing when debugging complex log patterns.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If you use AWS DRS for EC2 workloads, enabling this feature can meaningfully shrink your RTO with no added cost — evaluate enabling it account-wide or per server during your next DR review.
- CI/CD — Skip
- Leader — Learn: A no-cost RTO improvement of up to 65% on EC2 disaster recovery is worth noting when reviewing reliability targets and DR posture with engineering leadership.
- Platform/SRE — Plan: Teams running Amazon MQ RabbitMQ M7g cluster deployments on version 4.2+ can now right-size storage independently of instance type; evaluate current broker storage allocations and adjust during the next planned maintenance window.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Regional expansion of G7e GPU instances is useful context if your org runs GPU workloads on EC2; no operational change required for existing deployments.
- CI/CD — Skip
- Leader — Learn: If the org is deploying LLM or generative AI inference on EC2, G7e availability in EU/APAC regions may inform capacity planning or region selection conversations.
- Platform/SRE — Plan: New GA capability that consolidates CloudFront Function decisions (A/B variants, auth outcomes, routing) directly into access log records, eliminating cross-system correlation with CloudWatch Logs. Worth adopting in existing CloudFront Functions this quarter by replacing or augmenting console.log() with cf.logCustomData().
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful console improvement for teams using Storage Gateway who need to migrate file shares between gateways (e.g., upgrading to AL2023). No deadline or forced migration — worth knowing for the next gateway migration project.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: IAM Identity Center can now be used for FedRAMP Class C workloads in four US regions — relevant if you operate in a federal or regulated environment, but no action required for non-FedRAMP shops.
- CI/CD — Skip
- Leader — Learn: Broadens the compliance posture of a core AWS identity service; worth noting for organizations pursuing or maintaining FedRAMP authorization, but no strategic decision is forced without an active compliance program in scope.
- Platform/SRE — Plan: Teams running I/O-intensive workloads (databases, etc.) on AWS DRS should evaluate setting an EBS initialization rate on DRS launch templates to reduce time-to-full-performance during recovery drills — no deadline, but worth scheduling as a DR configuration review this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: A GA PII-detection model now deployable on SageMaker JumpStart could inform data-sanitization strategy for teams handling sensitive data in ML pipelines; worth tracking as a build-vs-buy option against custom NER approaches.
- Platform/SRE — Learn: AI-assisted workflows for DocumentDB cluster ops (provisioning, migration, tuning, version upgrades) may be worth evaluating if your team runs DocumentDB, but this is a developer-tooling addition with no operational change required to existing infrastructure.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Regional expansion of I7ie instances is worth noting if you run storage-intensive workloads (large NVMe, low-latency I/O) and operate in Hyderabad; no action required unless you’re planning new capacity in that region.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If running memory-intensive or high-network-throughput workloads in ap-northeast-1, eu-central-1, or eu-west-1, evaluate whether R8i-family instances offer a cost/performance improvement over existing R6i deployments — up to 43% better compute per vCPU and highest-in-class EBS/network bandwidth are meaningful for caching, NoSQL, or analytics tiers.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful if planning a SQL Server to AWS migration — the offline metadata extraction removes connectivity barriers — but no deadline or version constraint makes this actionable now.
- CI/CD — Skip
- Leader — Learn: Reduces security-review friction for SQL Server migrations to AWS, which may accelerate a planned migration project, but no strategic decision is forced.
- Platform/SRE — Learn: OAuth integration for the AWS MCP Server extends IAM governance to AI agents via standard OAuth flows, CloudTrail audit events, and token revocation APIs — worth understanding as AI agent infrastructure matures, but no operational change required today.
- CI/CD — Skip
- Leader — Learn: AI agents can now authenticate to AWS using existing IAM policies and OAuth 2.0, which lowers the governance barrier for agentic automation — relevant context for teams evaluating AI agent adoption on AWS infrastructure.
- Platform/SRE — Plan: Teams running Timestream for InfluxDB can replace API polling with EventBridge rules to automate responses to scaling completions, failures, and maintenance events; worth building into monitoring/alerting workflows this quarter.
- CI/CD — Skip
- Leader — Skip