--- title: "Happy 20th Birthday EC2, You Beautiful Disaster" id: "15445" type: "newsletter" slug: "happy-20th-birthday-ec2-you-beautiful-disaster" published_at: "2026-08-31T13:30:00+00:00" modified_at: "2026-08-31T13:30:00+00:00" url: "https://www.lastweekinaws.com/newsletter/happy-20th-birthday-ec2-you-beautiful-disaster/" markdown_url: "https://www.lastweekinaws.com/newsletter/happy-20th-birthday-ec2-you-beautiful-disaster.md" excerpt: "Another week full of delightful shitposts is upon us. Read on, dear friends, as summer winds to a close." --- About the Author Corey is the Chief Cloud Economist at Duckbill, where he specializes in helping companies improve their AWS bills by making them smaller and less horrifying. He also hosts the "Screaming in the Cloud" and "AWS Morning Brief" podcasts; and curates "Last Week in AWS," a weekly newsletter summarizing the latest in AWS news, blogs, and tools, sprinkled with snark and thoughtful analysis in roughly equal measure. Sign up for the Newsletter Stay up to date on the latest AWS news, opinions, and tools, all lovingly sprinkled with a bit of snark. "*" indicates required fields ## [Good Morning](https://x.com/QuinnyPig/status/2094162381538824385) ! Another week full of delightful shitposts is upon us. Read on, dear friends, as summer winds to a close. ## Things I Found on the Internet You can misuse ACM as a [storage service](https://github.com/costasko/acmstorage) . [I Used AWS Cognito for a Startup. I Wouldn’t Do It Again](https://joshkaramuth.com/blog/aws-cognito-authentication-startup-nightmare/) is a common sentiment. It’s good to know that the recent improvements to Cognito haven’t gone far enough; I’ve been meaning to test them out myself, and this saves me time. I’d missed that my ridiculous nonsense regarding the [Stwipe acquisition of OpenWouter](https://news.ycombinator.com/item?id=49374738) had made HackerNews. If OpenAI can turn their screwup into a marketing extravaganza, so can I. Introducing a postmortem on the [elementary school pickup incident](https://shitposting.ai/pickup-incident/) . My AI-powered singing office coffee pot periodically outdoes itself with [bangers like this one](https://shitposting.coffee/track/7f3c9c65-f898-476b-8da7-761cc4be6b83) . [Launching Route 53 Files](https://www.daemonology.net/blog/2026-08-27-Launching-Route-53-Files.html) Colin Percival has reimagined an interface for Route 53 as [a filesystem](https://www.theregister.com/offbeat/2026/08/28/aws-route-53-dns-service-reimaginedas-a-file-system/5293357) . The Register has the details. ## What AWS Has For Us This Time [AWS Lambda functions now support full IAM resource-based policies](https://aws.amazon.com/about-aws/whats-new/2026/08/aws-lambda-full-iam-resource-based-policies/) After twelve short years, my CloudFormation / CDK files for deploying Lambdas Function (yes, that’s how it’s pluralized) are no longer 80% IAM by volume. Unfortunately, this is just in time for me to not care since it’s Claude’s problem now. [AWS Security Agent (now part of AWS Continuum) now supports budget controls and finding revalidation](https://aws.amazon.com/about-aws/whats-new/2026/08/aws-security-agent/) “Think buddy, THINK! Our quarterly numbers are gonna plunge if half our customers go bankrupt paying the thing!” is a sentence I wish more AWS service teams would utter prior to launch. [AWS Secrets Manager adds managed external secrets support for Cisco Security Platform and Netskope](https://aws.amazon.com/about-aws/whats-new/2026/08/secrets-manager-cisco-netskope/) Huh, cool. I didn’t realize that Secrets Manager had gotten telnet support. [Automating filtered Cost and Usage Report exports with AWS Data Exports](https://aws.amazon.com/blogs/aws-cloud-financial-management/automating-filtered-cost-and-usage-report-exports-with-aws-data-exports/) Purpose-specific CUR exports can now shed hundreds of gigabytes a month in some cases. That’s not an exaggeration, it’s just a fact. Welcome to my world. [AWS Glue 6.0 now available with 30% lower price and full Apache Iceberg v3 support](https://aws.amazon.com/blogs/aws/aws-glue-6-0-now-available-with-30-lower-price-and-full-apache-iceberg-v3-support/) This feels like a response to Databricks’s increasing market dominance, which is kinda how competition is supposed to work: customers benefit. Good on AWS for improving this and not relaunching its predecessor service, “AWS Horse.” [Happy 20th Birthday, Amazon EC2](https://aws.amazon.com/blogs/aws/happy-20th-birthday-amazon-ec2/) What a long way we’ve come, from “small, cheap, resizable,” all the way to “reserve 144-chip UltraServers in one of our 39 regions,” with over 1200 instance types from which to choose. EBS didn’t exist, flat network was the only option (EC2-Classic, nobody misses you) and wildly varying latency were the order of the day, and the console was so craptastic that people paid Rightscale just for something comprehensible by a human. Here’s to the next 20. [I’m an Amazon SVP who hadn’t coded in 25 years. Then I wrote 100,000 lines of code with AI.](https://www.aboutamazon.com/news/workplace/amazon-svp-ai-tools-employees-careers) Setting aside entirely the question of “the SVP of HR is boasting about having ‘written’ 100K lines of code, is that good?,” the line that stuck out to me was “I asked our internal AI workplace assistant, called Aza.” Good to know that they have an internal assistant that’s different from the various assistants they’re selling to customers. Whenever Amazon starts using something different internally, they’re removing themselves from the customer experience. That bodes… ill. [AWS and DuckLabs: Building the future of analytics together](https://aws.amazon.com/blogs/big-data/aws-and-ducklabs-building-the-future-of-analytics-together/) I confess, when I was briefed on this under embargo I misread it as “Duckbill” for a split second and almost wet myself. “Corey, we’ve had enough of your shenanigans so we’ve bought your company just for the pleasure we’re about to take in firing you” would have been understandable, but more creative than AWS usually gets with respect to solving problems. [State of Kansas modernizes mainframe file transfer using AWS Transfer Family](https://aws.amazon.com/blogs/publicsector/state-of-kansas-modernizes-mainframe-file-transfer-using-aws-transfer-family/) Nothing says “Modernize” like “we’re finally using SFTP to talk to an object store,” but this is Kansas we’re talking about; they’re the same folks who put up a since-deleted [case study](https://web.archive.org/web/20230326221406/https://aws.amazon.com/partners/apn-journal/all/state-of-kansas-payit/) (wayback machine) about how the state uses GovCloud despite not having workloads that would require the use of that environment. Bulletins 086 through 090 are here with a consistent theme this week: this is code AWS publishes but does not operate, fixing it thus falls to the customer. We start with [four consecutive FreeRTOS kernel CVEs](https://aws.amazon.com/security/security-bulletins/rss/2026-086-aws/) that read like a bulk order, where AWS’s exposure is a web page and yours is a truck roll to microcontrollers with no OTA path. Then comes [the Neptune federated query connector](https://aws.amazon.com/security/security-bulletins/rss/2026-087-aws/) , a Lambda function you adopted from a repo and now own forever like an incontinent chihuahua, whatever the word “managed” implied at adoption time. Stored XSS via [an imported OpenSearch Dashboards template](https://aws.amazon.com/security/security-bulletins/rss/2026-088-aws/) means the tool you installed to watch for attackers will cheerfully host one instead. My favorite is [the Strands agent consent bypass](https://aws.amazon.com/security/security-bulletins/rss/2026-089-aws/) , where the human-in-the-loop guardrail on an arbitrary-Python REPL turns out to be a polite suggestion, which is awkward given the SDK already ships a supported environment variable for skipping it. Capping the set, [Zip Slip in the awsdac diagram tool](https://aws.amazon.com/security/security-bulletins/rss/2026-090-aws/) resurrects a 2018 bug class in a 2026 utility that draws your architecture and, fed the wrong archive, redraws your filesystem. … and that’s what happened ***Last Week in AWS.*** ## You might also like [More Newsletter Issues](https://www.lastweekinaws.com/newsletter/) Issue No.488 ### [Claude Fable 5.1 and Other Bedtime Stories](https://www.lastweekinaws.com/newsletter/claude-fable-5-1-and-other-bedtime-stories/) [Read More about Claude Fable 5.1 and Other Bedtime Stories](https://www.lastweekinaws.com/newsletter/claude-fable-5-1-and-other-bedtime-stories/) Issue No.486 ### [London Gets an AZ, You Get an Outage](https://www.lastweekinaws.com/newsletter/london-gets-an-az-you-get-an-outage/) [Read More about London Gets an AZ, You Get an Outage](https://www.lastweekinaws.com/newsletter/london-gets-an-az-you-get-an-outage/) Issue No.485 ### [The Week AWS Explained Its Own Error Messages](https://www.lastweekinaws.com/newsletter/the-week-aws-explained-its-own-error-messages/) [Read More about The Week AWS Explained Its Own Error Messages](https://www.lastweekinaws.com/newsletter/the-week-aws-explained-its-own-error-messages/) Issue No.484 ### [DynamoDB Does Vectors Now, Because Of Course It Does](https://www.lastweekinaws.com/newsletter/dynamodb-does-vectors-now-because-of-course-it-does/) [Read More about DynamoDB Does Vectors Now, Because Of Course It Does](https://www.lastweekinaws.com/newsletter/dynamodb-does-vectors-now-because-of-course-it-does/)