Good Morning!
AWS Interconnect hit GA last week, which means you can now buy dedicated multicloud connectivity between AWS and Oracle Cloud Infrastructure. Sit with that one for a minute. This is the company whose leadership spent the better part of a decade explaining that multicloud is what happens when you let architects wander around unsupervised, and whose historical relationship with Oracle was conducted largely through billboards and stage insults. Turns out enough customer money will make anyone friendly.
The rest of the week’s announcements felt smaller than usual, and I think I know why. Satellite imagery shows Iran struck Amazon data centers again as the war widens. It’s hard to work up a proper head of steam about CloudWatch Logs finally supporting ALB logs when the physical layer of the cloud is being hit with munitions. Redundancy across three Availability Zones was not designed with this threat model in mind.
On a considerably lighter note: I’m co-hosting a drink-up with Philip Kiely of Baseten near our office on Tuesday, 8/25, and we’re partnering with them to make it happen. RSVP here.
Things I Found on the Internet
Ars did the unglamorous work here: cross-checking Iran’s own claims against Copernicus Sentinel-2 imagery to see what actually got hit in Bahrain. The detail that sticks with me from this satellite-based reporting is that the AWS health dashboard for the region hasn’t been touched since April 30. Silence as a status update. Hoping everyone is okay.
The sharpest bit in this rundown of Amazon’s $1.8m Claude bill isn’t my quote, it’s the mechanism: buggy human code crashes, a misconfigured model just keeps billing you. Nobody caught it for five months. Worth ten minutes if your AI spend shows up on an invoice instead of in a build log.
The video generation race keeps adding runners that nobody following only the US labs has on their radar. Reuters on MiniMax’s H3 release is a short, useful reminder that frontier model announcements stopped being a San Francisco story a while ago. Worth five minutes if your mental map of this space needs updating.
I read Amazon’s Q2 earnings release in full so you don’t have to, and made it two whole pages before hitting Kiro described as “available on iOS” when it’s a TestFlight waitlist. My piece for El Reg also does the arithmetic on that 39.4% AWS margin, which apparently goes harder on energy derivative gains than anyone’s citing.
Every neocloud ships an S3-compatible endpoint, and your muscle memory follows you there whether the APIs behave or not. Wiz went poking through Nebius, Crusoe, Vultr and friends in this look at the S3 clones. On one, `delete-bucket-policy` deleted the entire bucket. Worth reading before you assume Block Public Access exists.
What AWS Has For Us This Time
Amazon CloudWatch Logs now supports Application Load Balancer logs
What the… so soon? I swear, I feel like AWS trips over these things a decade after they should have been implemented, is as shocked as I am that they need to be implemented, then finally does it.
AWS announces AWS Interconnect – multicloud connectivity with Oracle Cloud Infrastructure in GA
There’s now a great story around routing your internet-bound traffic to Oracle instead of directly to the internet, and saving a boatload of money because Oracle’s almost 10x less expensive than AWS is for egress.
AWS announces aws-bench, an open-source benchmark for AI agents on AWS
A benchmark that scores how well AI agents navigate AWS is something they view as a model test, rather than the stunning indictment that it is of just how dogshit AWS’s inconsistent API and CLI surface really is. Note, the ground-truth answers assume there IS a right way to configure this stuff.
AWS Direct Connect now supports BGP route visibility on Virtual Interfaces
For roughly a decade, diagnosing a Direct Connect routing problem meant guessing which prefixes AWS dropped, then opening a support ticket to have someone else guess too. Now you can just look. Free, no less! Every network engineer alive deserved this in 2016.
AWS IAM Identity Center extends multi-Region support to Identity Center directory
I’ve always been uncomfortable with access being region-locked; one bad day in a region means your workforce will not be using the cloud today. Now it’s fixed, provided you wire up a multi-Region CMK, because “provided at no additional cost” means the resilience gets billed through KMS instead. Everyone who lived through a us-east-1 login outage should be implementing this.
AWS announces general availability of Policy-Based Routing on AWS Transit Gateway
Policy-based routing, a feature Cisco shipped when Friends was still airing, has arrived. No extra charge, which sounds run-of-the-mill generous until you remember Transit Gateway bills per gigabyte per hop, and this removes hops. A rare accidental discount! Your network team gets first-match-wins rule ordering, so enjoy debugging that at 3am.
IAM Policy Simulator moves to the IAM console and adds additional capabilities
That standalone simulator site always looked like a page someone forgot to decommission during the stone age, so welcome to the console at last. SCP support is the win here: you can now discover why your deploy gets denied before your on-call engineer does, at 2am, over Slack. And it’s still free, which counts as news. They’re on a roll this week!
Amazon Kinesis Data Streams now supports scaling down ingest capacity with warm throughput
AWS has always used the term “scale” to mean that capacity could only ratchet up, like a one-way turnstile into your bill. Now you can scale down too, provided you enabled “On-demand Advantage mode,” a name suggesting the base tier was the disadvantage mode, and that this thing costs extra. But shockingly, the feature’s free too.
Accelerate Spark on EMR Serverless with larger workers and shuffle-optimized disks
Serverless, they said. No clusters to size, they said. And now the best practice is hand-picking 32 vCPU workers with 2TB of shuffle disk, which is… sizing a cluster. “Enjoy your infrastructure-free experience, please specify your infrastructure below!”
Installing and updating the AWS CLI with single-line commands
Curl piped straight to bash, officially blessed by the same company that sells you six products to prevent exactly that. Somewhere a security team is drafting an exception request. But what’s this? `aws update` means a decade of “download the pkg again like it’s 2009” has finally ended. Progress, technically.
Deploying Kimi K3 on AWS – “Open weights” sounds free right up until you read that you need eight B300s and a capacity reservation to run the thing. Moonshot gives away the model; AWS rents you the only building big enough to hold it. Two days from release to blog post, which tells you exactly who profits from open source.
How Amazon CloudFront delivered traffic for the FIFA World Cup 2026
117 Tbps of traffic and “not a single viewer knew it was happening,” which is exactly how AWS wishes its billing worked too. Impressive engineering, though watching them count Roku market share by time zone suggests someone’s building a very expensive case study to justify next year’s edge pricing.
Amazon identifies North Korean hacker group behind open-source supply chain attacks
Five names for one threat actor – SAPPHIRE SLEET, BlueNoroff, Alluring Pisces – because the one thing the security industry agrees on is that naming things is too fun to standardize. Solid research, though. The scarier detail: axios moves 100 million downloads a week on the goodwill of maintainers nobody pays. Meet your supply chain! AWS would have published this a few weeks ago but they wanted to validate it wasn’t a frontier lab running a security breach as a marketing story first.
AWS KMS or AWS CloudHSM: Choose the right key management solution
Jesus, use KMS unless you’re chained to 3DES and a PKCS#11 integration from 2009. That should be obvious since CloudHSM runs $1.60 per HSM per hour while KMS charges a buck per key per month. A decision guide whose conclusion is “please stop buying our other product” is spicier than I’d expect from AWS.
For $3,000 a month, Shield Advanced now bundles the rule group any random customer can flip on solo. Comforting. And blocked DDoS traffic drops off your bill, which feels less generous when you remember they’d otherwise charge you for the attack.
Secure your npm and pip package updates in Amazon Linux
Turns out the fix for supply chain attacks is procrastination as a control. Wait 24 hours and every recent npm catastrophe becomes somebody else’s incident report. Weirdly solid advice, and free, which means nobody in Seattle got a bonus for it. Your laziest engineer has been doing security work all along.
Last year’s code injection fix in the Amplify codegen package has now itself earned a CVE for the patch, announced in a bulletin that misspells the name of the package you’re being told to upgrade. Over in Dashboards, prototype pollution in a chart plugin turns into remote code execution because the server checked how long the URL was instead of what was in it, and the remediation is to build from source and redeploy both halves of the thing yourself. Input validation performed by people who’d rather be anywhere else.
… and that’s what happened Last Week in AWS.
