--- title: "The Week AWS Was Wrong, Not Broken" id: "15466" type: "newsletter" slug: "the-week-aws-was-wrong-not-broken" published_at: "2026-09-28T13:30:00+00:00" modified_at: "2026-09-28T13:30:00+00:00" url: "https://www.lastweekinaws.com/newsletter/the-week-aws-was-wrong-not-broken/" markdown_url: "https://www.lastweekinaws.com/newsletter/the-week-aws-was-wrong-not-broken.md" excerpt: "If you (well, not you, but probably the saddest looking person on your finance team) are tracking commitments in spreadsheets and hoping your discount strategy still makes sense, you're not alone. Most teams are cobbling together strategies/tools that weren't designed..." --- About the Author Corey is the Chief Cloud Economist at Duckbill, where he specializes in helping companies improve their AWS bills by making them smaller and less horrifying. He also hosts the "Screaming in the Cloud" and "AWS Morning Brief" podcasts; and curates "Last Week in AWS," a weekly newsletter summarizing the latest in AWS news, blogs, and tools, sprinkled with snark and thoughtful analysis in roughly equal measure. Sign up for the Newsletter Stay up to date on the latest AWS news, opinions, and tools, all lovingly sprinkled with a bit of snark. "*" indicates required fields ## [Good Morning](https://x.com/QuinnyPig/status/2102842666400760193) ! If you (well, not *you*, but probably the saddest looking person on your finance team) are tracking commitments in spreadsheets and hoping your discount strategy still makes sense, you’re not alone. Most teams are cobbling together strategies/tools that weren’t designed for the scale and complexity of modern cloud environments. That’s why we’re building Skyway over at [Duckbill](https://www.duckbillhq.com) —to take you away from all that. Now the exclusive sponsor of Last Week in AWS, and also the company I co-founded. Cloud contract issues? Get in touch. ## Things I Found on the Internet AWS recently spun up a new user experience that features, among other things, spend controls. Scott Piper [has a deep dive into the new user experience](https://www.wiz.io/blog/exploring-the-new-aws-sign-up-experience) . [Bee Private Compute: How Bee keeps your conversations private](https://bee.computer/blog/private-ai) Bee, an ambient AI recording assistant, is a surprisingly useful product that Amazon acquired last year. This writeup on how they protect user data is fascinating. ## What AWS Has For Us This Time [AWS Network Security Manager is now generally available in US East (N. Virginia) Region](https://aws.amazon.com/about-aws/whats-new/2026/09/network-security-manager-us-east-va/) Thing thing has a baseline hourly charge of 35¢, which doesn’t help solve the ambiguity of “is this ‘Manager’ a service or a person on Amazon’s payscales.” More usefully, or I suppose less usefully, it’s currently only available in us-east-1, so I suppose it’s “any network you’d like, as long as it’s in Virginia.” Lastly, sweating the details is super important to both networking and security success, so I’m less than thrilled that the initial version of this announcement (since corrected) misspelled the service it touches as “Sheild.” [AWS PrivateLink announces Tunnel Endpoints to access network segments](https://aws.amazon.com/about-aws/whats-new/2026/9/privatelink-tunnel-endpoint/) Ooh, this is similar to the concept of Tailscale’s subnet routers (a fantastic pattern), if Tailscale charged you both per hour and per gigabyte (an obnoxious pattern). Still, this feature means that now PrivateLink works the way I thought it did when it launched, only to be disappointed in my discovery. It helps customers also get away from multiple per-resource charges at scale, now that they can just share the network. Good change, and I’m glad to see it. [Wrong, not broken](https://aws.amazon.com/blogs/aws-insights/wrong-not-broken/) To my knowledge this is the first public blog post that Amazon boomerang Dr. Matt Wood has published since his return to AWS, and if it’s a sign of things to come let me just say “yes please, keep going.” Unlike virtually every blog post AWS puts out that Jeff Barr didn’t author, the writer’s personality conveys super well without being stomped flat by committee into an approximation of Corporate Voice. (That’s not a slight to any blog author at AWS, but rather at a messaging philosophy that seems terrified that someone’s personality might possibly ever come through on their blog. Very few people have the organizational juice to override that tone management, in my experience.) In an era where everyone magically writes like Claude all of a sudden, this is wildly refreshing. Tone aside, the point of view is novel, and it’s also a delight to see AWS talking about the “why” and not just the “what” about a new service launch. Even the title shocks the awareness. Just a pleasure of a post from start to finish. [Introducing Amazon CloudWatch Omni: AI-powered observability for generative AI and agentic workloads](https://aws.amazon.com/blogs/aws/introducing-amazon-cloudwatch-omni-ai-powered-observability-for-generative-ai-and-agentic-workloads/) This is the last time I will be calling the service “Omni,” since the obviously correct name is “AWS Infinidash.” I have [vented my spleen](https://www.lastweekinaws.com/blog/cloudwatch-omni-infinidash-review/) about this at length on this very newsletter. Since I wrote that post, my opinion has clarified: I still maintain the onboarding has a lot (and I mean a LOT) of work to do to get to a point of being broadly acceptable, and also that I’ve implemented it into the Duckbill SaaS product because the service is kinda delightful once you bandage the sharp cuts it’s given you. Expect to hear more from me on this. [Introducing enhanced custom event buses in Amazon EventBridge for enterprise-scale event-driven applications](https://aws.amazon.com/blogs/aws/introducing-enhanced-custom-event-buses-in-amazon-eventbridge-for-enterprise-scale-event-driven-applications/) This is a delightful improvement, only marred by its positioning as “being for enterprise.” I didn’t realize I was an enterprise, because I have an AWS estate that is about to massively benefit from this thing. Even the pricing, clocking in at a somewhat hefty 18¢ per GB ingested, isn’t particularly “Enterprise.” It’s high, but not unreasonable unless you’re doing something profoundly weird with EventBridge. I will say, it’s a marked improvement from the last AWS custom event bus: [Adding custom domains to AWS Lambda MicroVMs with Application Load Balancer](https://aws.amazon.com/blogs/compute/adding-custom-domains-to-aws-lambda-microvms-with-application-load-balancer/) I like the capability very much, but I’m perhaps unreasonably annoyed that getting a custom domain for an ephemeral Lambda microVM apparently requires going back to 2018 for an old-world load balancer instead of an API gateway which feels a lot more Lambda-aligned. [Running self-hosted AI agent sandboxes with AWS Lambda MicroVMs](https://aws.amazon.com/blogs/compute/running-self-hosted-ai-agent-sandboxes-with-aws-lambda-microvms/) MicroVMs are inching closer to being something I can use in place of my rather unfortunate sandbox setup (do not ask, I promise you will not like the answer). They’re not there yet, but it’s clear they’re on the right path. Should someone on that team care, I’m maintaining a checklist of what I’m waiting to see; hit reply and let my problems become your problems. [How BMW Group detects cost anomalies across 14,000 cloud accounts](https://aws.amazon.com/blogs/machine-learning/how-bmw-group-detects-cost-anomalies-across-14000-cloud-accounts/) There was a time I’d have thought that 14K accounts would be ridiculous, but now it’s middle of the road for the customers I find myself talking to. No, the questions I have about this post are a bit deeper. First, AWS’s Cost Anomaly Detection had much room for improvement at launch, but those improvements have come, so why is it insufficient about its current state for BMW’s needs? Secondly, the customer was able to orchestrate this via Step Functions, a service so inscrutably arcane that getting it working at all nominates them for whatever the cloud equivalent of the Fields medal is, so why didn’t they tell that story instead? Third, I’m having a lot of trouble imagining that the compute cost of “the whole setup costs around $50 per month in compute, or less than half a cent per account per month” is something a customer with 14K accounts gives the slightest toot about, but why did they only price the compute portion of it? That’s almost certainly a drop in the ocean of CUR storage, for example. Just a great post, and a glimpse of the future: what today is a custom solution at BMW is the general shape of first-party products in a few years. Four security bulletins dropping back to back is either a productive quarter for the security org or a rough one for everybody else, depending on your mood. The Connect-Salesforce Lambda spent its life [handing out AWS API calls without checking who was asking](https://aws.amazon.com/security/security-bulletins/2026-115-aws/) , which is a bold interpretation of “integration.” Meanwhile s2n-quic will [fall over if you configure it to send Retry packets](https://aws.amazon.com/security/security-bulletins/2026-116-aws/) , a bug that at least has the decency to require you opting into it first. Then Kiro, the agentic IDE, turns out to be [writing global configs from untrusted workspaces](https://aws.amazon.com/security/security-bulletins/2026-117-aws/) , because the threat model apparently got drafted sometime after the launch demo. Capping the set is [type confusion in a Postgres extension escalating to RCE](https://aws.amazon.com/security/security-bulletins/2026-118-aws/) . The AI coding tools are now producing CVEs on roughly the same cadence as features, which is at least consistent with their training data. … and that’s what happened ***Last Week in AWS.*** ## You might also like [More Newsletter Issues](https://www.lastweekinaws.com/newsletter/) Issue No.490 ### [T8i Instances: Bursting With Mild Enthusiasm](https://www.lastweekinaws.com/newsletter/t8i-instances-bursting-with-mild-enthusiasm/) [Read More about T8i Instances: Bursting With Mild Enthusiasm](https://www.lastweekinaws.com/newsletter/t8i-instances-bursting-with-mild-enthusiasm/) Issue No.489 ### [Lambda Slowly Becomes EC2, One Feature at a Time](https://www.lastweekinaws.com/newsletter/lambda-slowly-becomes-ec2-one-feature-at-a-time/) [Read More about Lambda Slowly Becomes EC2, One Feature at a Time](https://www.lastweekinaws.com/newsletter/lambda-slowly-becomes-ec2-one-feature-at-a-time/) Issue No.488 ### [Claude Fable 5.1 and Other Bedtime Stories](https://www.lastweekinaws.com/newsletter/claude-fable-5-1-and-other-bedtime-stories/) [Read More about Claude Fable 5.1 and Other Bedtime Stories](https://www.lastweekinaws.com/newsletter/claude-fable-5-1-and-other-bedtime-stories/) Issue No.487 ### [Happy 20th Birthday EC2, You Beautiful Disaster](https://www.lastweekinaws.com/newsletter/happy-20th-birthday-ec2-you-beautiful-disaster/) [Read More about Happy 20th Birthday EC2, You Beautiful Disaster](https://www.lastweekinaws.com/newsletter/happy-20th-birthday-ec2-you-beautiful-disaster/)