Good Morning!
Here are two chances to complain about the content of this newsletter in person. I’m in Seattle next week for a drinkup on Tuesday, August 18th at 6PM, and I don’t have a venue locked yet, so if you know a spot that can absorb a crowd without anyone having to shout, hit reply and tell me. Then on August 25th I’m doing a drinkup in San Francisco with Philip Kiely over at Baseten. Come argue with me about cloud, AI, and the intersection thereof.
Things I Found on the Internet
Every consumer with its own IAM policy and its own copy of your bucket layout is the cloudy version of shared database antipatterns. James Carr’s fix in this claim check writeup puts nginx-s3-gateway in front of the read side, so six services fetching the same object hit S3 once. Nice reuse of an old lesson.
Community-run conferences produce some of the best AWS content out there, largely because nobody’s checking the slides for approved messaging; this is evidenced by my fairly-unhinged keynote. The organizers posted the full session recordings from Midwest for free, and you don’t have to hand over an email address to watch them.
Timothy Prickett Morgan runs the numbers on carving 20-30 percent stakes of AWS and Annapurna out of the mothership, using the EMC/VMware financial shell game as the model. The financial thought experiment here is my kind of speculative, and well worth reading before your next Amazon earnings call.
The environmental cost of AI buildouts tends to get discussed in abstractions like megawatts and PUE. The Times went to Texas and talked to the people living next to it, which is a reporting choice more outlets should make. Worth reading before your next sustainability slide deck; are we even making those anymore thanks to the rise of AI as a narrative?
What AWS Has For Us This Time
Amazon ECR now supports image layers up to 200 GB
Two hundred gigabytes in one layer, because someone decided containers should be lightweight right up until that line of reasoning became politically uncomfortable for them. Cram your entire LLM in there and enjoy the pull times (go get a snack, you’ll need it), plus ECR storage billing that scales exactly as you fear. Also, the CLI still caps at 50 GB, so pick your uploader carefully. Good hustle, team.
AWS Lambda announces scalable network bandwidth up to 3,000 Mbps for functions outside a VPC
“At no additional charge,” which is technically true if you ignore that reaching 3,000 Mbps requires provisioning 10 GB of memory for a function that needs 512 MB. This is how vCPU scaling has worked since Lambda launched. The curious part that I don’t understand is why unlocking this behavior requires making a service quota request? Unless there’s a downside here I don’t understand why it’s gated like that; can someone who knows please hit reply and let me know?
AWS Security Hub Extended adds supply chain security as its 10th category
The bill for this is gonna be some customer’s 13th reason.
OpenAI GPT-5.6 Sol, Terra, and Luna now support 1 million token context windows on Amazon Bedrock
Sol, Terra, and Luna sound less like models and more like a Subaru dealership going through a spiritual phase, but that naming convention can’t hold a candle to some of the nonsense AWS has pulled over the years. A million tokens means you can, as some do, shove an entire monorepo into one prompt, and also that you’re paying for an entire monorepo in one prompt. The 90% cache discount exists because someone already did that math and screamed. The last I heard they were still screaming.
How to understand and estimate combined AWS WAF and AWS Shield Advanced costs
A 2,000-word guide on estimating what your DDoS protection costs? Yeah, on that metric alone the pricing is customer hostile, sucks, and should get fixed, but this is about to make it the customer’s problem instead. My favorite detail: turning on Shield Advanced renames your WAF usage types in billing data, so every historical comparison you’ve built just breaks. Three grand a month on a one year minimum, plus you get to play data transfer roulette. This team has work to do. Will they do it?
Amazon DynamoDB now supports real-time vector search at any scale
Every service can be misused as a database, and every database eventually gets a vector index bolted onto it, and also DynamoDB’s number just came up. “Trillions of vectors” combined with pay-per-request pricing is something that should only be read within striking distance of a defibrillator. I confess I got slammed and have yet to model / build something horrifying with this, so I don’t have many hot takes YET. This may change.
Runtime instances: persistent compute for production AI agents on Amazon Bedrock AgentCore
Fourteen-day sessions, GPU access, direct OS control. Congratulations, we’ve reinvented the server, except now a language model decides how long it stays running. Hibernate Monday night, resume Wednesday morning, and find out your worker agents spent the interim “iterating autonomously until the job is done.” Welcome to a brave new world of paying for computers talking to themselves.
Reintroducing Network Firewall Proxy for Secure Egress Connectivity
Eight months from preview to “actually, forget the standalone product.” Customer feedback works, particularly when it’s “this thing sucks,” apparently. The catch: this new proxy mode hangs off a NAT Gateway (the villain in every AWS billing story), so every inspected byte incurs a NAT data processing charge alongside the firewall’s own. Your egress budget has somehow managed to unlock an even more expensive new hobby.
AWS Supports Agent Plugins: An Open Standard for Portable Agent Extensions
I maintain that if telling the agent to install a given extension doesn’t work, your agent blows and should be replaced with something good.
Introducing Dogwood: runtime verification for AI agents
Cedar begat Dogwood, so AWS is now naming its policy languages after whatever’s growing outside the Seattle office. Fine. I can’t wait for “Resentment.” What’s happening: temporal logic, formal verification, a mathematical foundation, all deployed so your agent doesn’t email a customer the confidential file it just opened.
AWS partners with Anthropic and OpenAI to bring AWS Continuum into developer workflows
“Continuum” is a name that means nothing, which is convenient, because it can therefore mean anything they ship at re:Invent. The pitch: frontier models find vulnerabilities humans would need weeks to trace. The sequel: your backlog now contains nine thousand findings, all of them technically correct but the nonsense drowns out the “oh, and by the way your password is printed as the default placeholder text in the field.” Preview pricing remains a mystery, which is its own kind of finding.
A 77% KMS bill reduction, with the fun caveat “this post assumes familiarity with envelope encryption.” Pfft, who isn’t? Three cents per ten thousand calls sounds adorable right up until four hundred threads stampede for the same tenant key at once, and even if rate limiting doesn’t murder you, your bill will.
Route Amazon Bedrock Guardrails interventions to Amazon Security Lake – Calling this an “integration” is generous when the architecture diagram features a subscription filter, a Lambda transform, and a Parquet writer you now own forever. Four billable services so your SOC can correlate “chatbot said something rude” against VPC Flow Logs. Tripping a guardrail is free. Storing the evidence is the line item.
Access Amazon S3 backup data directly using S3 Access Points in AWS Backup
Reading backup data without a restore is useful, which is why I’m squinting at the fine print: an active access point pauses lifecycle transitions and blocks deletion of the recovery point. Uh… I have questions! Well just one, really, but it’s loud and obnoxious. Forget that thing exists and your backup sits in the pricier warm tier forever. Free to create, expensive to abandon.
Most of these are AI tooling relearning lessons we absorbed during the guestbook-CGI era. Strands Agents Tools shows up three times unassisted: an insecure direct object reference that lets one agent page through another’s memories, a consent gate defeated by text claiming consent already happened, and http_request trusting a model-chosen proxy that sent your credential sightseeing in cleartext. The MCP servers fared no better, between bad authorization in DocumentDB’s aggregation pipeline, path traversal in AWS Transform, and prompt injection coughing up broker credentials and OAuth tokens out of Amazon MQ. Bedrock AgentCore drew a CVE for insufficient input validation, which is a strange complaint about a product whose whole pitch is handing arbitrary model output to your infrastructure. Kiro earned two for trusting executables in the project folder on Windows, a bug class older than most of the people wiring AI into production. The non-AI entries feel almost nostalgic: the AWS CLI’s EMR helpers skipped host key verification on your behalf, the standup wheel spinner turned stored XSS into session token theft, and deeply nested JSON kills smithy-rs servers via unauthenticated stack exhaustion, in Rust, the language that was supposed to be the adult in the room. Rounding it out, a code injection fix that missed in Amplify’s codegen-ui-react is back for a sequel CVE a year later. Patch all of it. Then sit wondering how hardening became “give the text predictor a shell.”
Enforcing data residency with single-Region Claude Code on Amazon Bedrock
AWS made an often-times customer infuriating but ultimately correct choice at the beginning: hard separation between regions. Now, in their rush to present as Leaders of AI, they’ve blended regions so thoroughly that running a relatively simple workload in a single region is now itself a dizzyingly complex undertaking. Great job. They’ve also taken the post down, possibly because Claude Code itself will work around this with its native multi-region handling. Just covering themselves in glory, aren’t they.
Amazon Connect Service Quota Monitor
Three hundred-plus quotas, zero native usage visibility, so here’s a CloudFormation stack costing you $11 a month to watch AWS’s own guardrails on your behalf. Bonus round: it polls hourly for rate limits that reset every second. Bonus bonus round: they took this down, presumably after realizing that Connect emits Quota metrics natively.
From weeks to minutes: How Formula 1® uses agentic AI on AWS to accelerate data operations
Buried in that “minutes” headline: 40 minutes of code generation, plus “hours of deployment.” Marketing rounded aggressively while also including the registered trademark symbol because we cannot upset Legal. And also a company with 800 million fans somehow accumulated an 18-month integration backlog before Bedrock showed up, which sounds an awful lot like a headcount problem turned into an AI story.
… and that’s what happened Last Week in AWS.
