Good Morning!
The DeepRacer, that little toy car AWS spent years insisting would teach the world reinforcement learning, now supports custom OS installation. Which is a polite way of saying the platform has reached the phase of its lifecycle where the most exciting thing you can do is wipe it and pretend it’s something else. I own two of these things. I regret one of them.
Meanwhile, Amazon SES introduced pricing plans this week, because nothing says “your email bill was too simple to understand” like adding tiers to it. I’ve spent a career watching AWS take services that cost a fraction of a cent and layer on enough optionality that you need a spreadsheet to feel confident about a rounding error.
And if you want a reminder that the fundamentals never change, one AWS customer learned the hard way that the smallest oversight can be mission-critical. The tooling keeps getting shinier and yet somehow the failure modes stay exactly as ancient as they’ve always been.
Things I Found on the Internet
Every network diagnostic tool assumes you only care about the path from your machine. This traceroute suite runs TCP traces from 14 regions at once, plus DNS lookups and HTTP checks, no login or install required. Handy when “works from here” and “works from your customer’s region” disagree.
A Swift-native video editor that exposes an MCP server, so Claude or Cursor can edit your timeline alongside you. The editor’s free and open source, Premiere Pro is the north star, and only the generative AI bits sit behind a login. Needs Tahoe on Apple Silicon, so mind the gate.
A cautionary tale where an expired card, a spam filter eating billing warnings, and MFA stranded on a dead laptop take down every site a firm hosts. The recovery email lived on a domain in the suspended account. Honestly, it’s hard to come up with much that they could have done that would have been worse. The whole ouroboros is worth reading before you audit your own root account.
What AWS Has For Us This Time
Amazon ECS now provides Action Logs for deployment and orchestration visibility
Apparently ECS was doing things on your behalf this whole time and just declining to mention them. Now you can watch, for the “low” price of CloudWatch ingestion fees. Meet the observability feature that ends the “please open a support case” ritual, and starts the “why is my log bill higher than my compute” one.
Amazon Managed Service for Prometheus supports 1.5B active metrics and 200K rules per workspace
Nobody sane wakes up wanting 1.5 billion active metric time series. They wake up with a cardinality explosion that caught them by surprise and a bill that reads like a hostage negotiation. This raises the ceiling on how much you can measure, which conveniently also raises the ceiling on how much you’ll pay to measure it.
Amazon SES introduces pricing plans
Three tiers named Essentials (“shitty”), Pro (“you probably want this one”), and Enterprise (“we think you’re a cow, and are absolutely going to try to milk you”), because “Simple” Email Service apparently outgrew simplicity somewhere around the second bullet point. The pitch is that bundling saves you money versus à-la-carte, which they’re hoping occludes the fact that they just axed the SES free tier.
AWS Network Load Balancer now supports Listener Rules for custom traffic routing
The Application Load Balancer has had listener rules since basically launch, so the network-layer cousin finally getting them feels less like innovation and more like AWS returning a library book, which they also describe as “innovation.” Also, it collapses your two-NLB IPv4/IPv6 workaround into one, sparing you a load balancer you were of course paying for.
AWS Organizations increases RCP quota to 2,000 per organization
Doubling the limit from 1,000 to 2,000 tells you two things: 1, someone just hit 1,000, and 2, that customer’s governance model is a screaming multi-account hellscape held together with JSON, prayers, and duct-tape. Which kinda doesn’t narrow it down very much.
AWS now supports automatic credit memo application preferences
Somewhere, an accounts-payable team just wept tears of joy over a checkbox that decides which invoice your credit memo attacks first. Original, next, or oldest unpaid: choose your weapon. Most folks have no idea what I’m talking about, except for a few of you out there; I see you. Your reconciliation spreadsheet has become a war crime; this fixes it.
AWS Secrets Manager now publishes secret update notifications to Amazon EventBridge
Turns out you no longer need to reverse-engineer three CloudTrail events like a detective piecing together a ransom note (“leave the money in the bag or your SOC2 audit gets it in the back of the skull”) just to learn a secret changed. Now Secrets Manager tells you directly, on the default bus, at no extra cost past the already usurious 40¢ per month per secret pantsing they’re already giving you. Shocking generosity. Enjoy it before someone in pricing notices.
JVM memory, CPU, and classpath best practices for Java containers on AWS
Your app that “passed every test” detonating after a routine kernel patch, with zero code changes, is Java’s love language. The fix is knowing your container shares the host kernel and that wildcard classpaths resolve in whatever order `readdir()` feels like today. This serves as a depressingly useful post. Also, a haunting reminder that “it works on my machine” now includes the kernel. GOOD LUCK!
Connection pooling strategies in Amazon Aurora DSQL
The “serverless” database that handles operational complexity by making it billing complexity also disconnects you hourly, throttles you at 100 connections per second, and requires a four-strategy checklist to not fall over on you. Serverless apparently means you still babysit the connections, just with extra IAM tokens. At least PgBouncer gets a vacation?
Custom OS installation now available on AWS DeepRacer devices
A bootloader for a service AWS already killed off, so the toy cars stuck on end-of-life Ubuntu 16.04 can run something modern. Sweet gesture, letting the community keep the corpse warm. Nothing says commitment like unlocking custom firmware and blinking “DEVELOPER MODE” in Morse code as your parting gift. That’s not a joke; it actually does that.
Thermodynamic sampling of disordered materials with an analog Hamiltonian Rydberg simulator
QuEra’s Aquila neutral-atom rig gets repurposed by Braket as a Boltzmann-weighted RNG-as-a-Service: they map carbon/nitrogen graphene dopant sites onto ground/Rydberg states, regress the Hamiltonian against classical DFT energies, then apply a global rescaling factor (αV) because their coupling constants ran hotter than the hardware’s dynamic range — physics FinOps, basically. The “imperfect” part of the annealer (finite temp, noise, sloppy adiabaticity) is reframed as the actual feature, since it’s what makes it sample Boltzmann distributions instead of just chasing a ground state. Bonus: nearest-neighbor atom spacing is now a literal temperature dial, so you’re autoscaling thermodynamics by moving atoms 0.5 μm. 1000 shots beat brute-force Monte Carlo in the correlated regime.
Unlocking data residency use cases with Amazon S3 in AWS Local Zones
Compliance mandates say your data must stay in Athens, so naturally the fix is single-zone storage with no redundancy inside the boundary. Lose that one zone and your geographic residency requirement becomes a geographic incident report. Regulators wanted the data local; they didn’t specify “and also occasionally gone.” Someone’s in for a treat someday.
This week’s bulletin pile is a tour through every promise the industry made and then broke, opening with a four-year-old SQL injection hiding in table names that Athena’s Synapse connector trusted like a golden retriever trusts strangers, followed by the path traversal in a HIPAA-eligible linter, a tool whose literal job is catching mistakes and whose actual talent is letting attackers write files anywhere they please. The running gag, though, is Rust, the language everyone swore would end our suffering, which just learned you can abort the process with nested JSON and, in a separate humiliation, that Slowloris still flattens the memory-safe HTTP server using an attack older than the iPad, because memory safety was never the part of your stack that needed limits. The TLS library AWS built to out-safe everyone chips in two bugs whose only cures are downgrading to TLS 1.2 or the ancient off-and-on-again ritual, while an MCP security policy that fails open on startup decided that when it can’t load its rules, the responsible move is to shrug and wave everyone through. And to cap it off, the Bedrock AgentCore package installer wants you to stop letting your AI agent pass model-generated input to the thing that installs software, which is adorable given that passing model-generated input to things is the entire reason the agent exists; patch to 1.18.1 and pretend the sandbox was ever a sandbox. Eight bulletins, leading to one lesson nobody will absorb: your shiny new tools fail in the oldest possible ways, and the patch notes still expect you to be grateful.
… and that’s what happened Last Week in AWS.
