Good Morning!
I'm in London this week; if you're around Thursday evening, come by Singer Tavern and let me buy you a drink. If you're in Dublin, I'll see you next week with a similar event!
Things I Found on the Internet
Cloudonaut replaced Kit (curiously, what this newsletter uses) with their own serverless solution. The issues they encounter is why this newsletter still uses Kit despite its shortcomings over the years. Email is hard, yo.
I love that Team Cymru has gotten its long-running free IP-to-ASN mapping service working over the One True Database, DNS. My thanks to Paul Vixie for the tip.
So many things have changed. It's reassuring to know that some things don't, like Shut up and take our money: Amazon plows $1B+ into quashing datacenter dissent, particularly to the general public. "Datacenters are good, actually" is almost guaranteed to go over like a lead balloon with folks who know very little about them, but here they are trying it anyway. It's... not how I would have approached the (very real) problem they're confronted with, but I wasn't consulted.
Nandini Ramani, former AWS VP of Observability And Other Things has taken a new role as the New Relic CEO. It's interesting how CloudWatch serves as a hiring pipeline for vendors people pay to not have to deal directly with CloudWatch...
Simon Willison is absolutely correct when he says we’re going to need default hard budget caps on pretty much everything. I've been saying this for years, and we're only getting it from AWS now that it looks like not having them might be an impediment to agents selecting them as a potential provider. I hate this timeline.
It's kinda nuts how Amazon went from talking about sustainability to not giving the slightest toss about it once AI became a thing. This analysis is rather on the nose.
The latest roundup of AWS Managed Policy Changes of managed IAM policy changes is important, because IAM is basically AWS's least-managed disclosure channel once you get past "deprecations."
What AWS Has For Us This Time
Amazon ElastiCache Serverless for Valkey now supports public endpoints
It's rare you get to see a CVE before it's even issued. This is gonna make it easy for some agents to talk to it, but man, a database being directly accessible to the broader internet is generally the sort of thing you read about in incident postmortems.
AWS Billing and Cost Management now provides billing context for your account through a new API
FINALLY, you don't have to go digging into arcane nonsense to figure out whether a given AWS account is part of an organization, is a payer account, a member account, or something... different.
Uncover blind spots in AWS data plane operations with CloudTrail Event Coverage
Given the absolutely insane pricing of CloudTrail data events (an S3 GET request costs over 20x less than the CloudTrail data event recording it!) it's hard to see this as anything other than a thinly disguised margin grab. "You could be paying us more money, Why aren't you?"
AWS Service Availability Updates
The quarterly update to the AWS Service Graveyard doesn't have anything I'm actually going to miss this time? Managed Blockchain was always a sop to the vanity of some odious clowns, DevOps Guru wasn't ever useful, and the rest aren't even relevant enough to MENTION here.
Amazon CloudWatch Logs Insights now lets you estimate bytes scanned before running a query
Ooooh. This is great! "Surprise, that dumb question just cost a thousand bucks" is the wrong part of the process to surface that "fun" fact.
AWS Budgets now supports email verification for notification subscribers
Aw man, you mean that until now I could have spammed all of you with inane budget reports without you agreeing to receive them? A lost opportunity to bother people...
Running multi-day AZ evacuation drills with ARC Zonal Shift
"Running a multi-day Availability Zone evacuation drill with ARC Zonal Shift is an effective way to prove your application can withstand a sustained impairment." No it freaking is not, because unless your application is one of the vanishingly rare workloads with zero third party dependencies, you aren't having all of your vendors test this at the same time. It catches SOME scenarios, but it's far from comprehensive. Still, this is neat.
DuckDB support comes to Aurora PostgreSQL, and the great unwashed hordes of database folks who have yet to discover the One True Database: Route 53.
"Evaluates your environment as an experienced cloud architect would," is now being offered through the magic of AI® to accounts that can't get a solutions architect on the phone. If this thing works, what are 5,000 undifferentiated AWS "Partners" left to do?
Introducing filtered export from Amazon DynamoDB to Amazon S3
This replaces... a fairly straightforward Lambda function at best. Still, good on AWS for doing it.
What’s next for Research and Engineering Studio on AWS
Based on nothing other than this headline, it's pretty clear it's being taken behind the shed and given the Old Yeller treatment.
Routing UDP to on-premises Network Load Balancer targets
"On-premises migrations to AWS rarely finish in one wave" opens this blog post, which is a statement that has never once been uttered in an cloud migration pitch meeting.
Introducing the Dogwood Local Engine: temporal governance for agent actions
Okay, I'm going to call it: a lot of folks I respect are excited about this, but I do not understand what this release means. Help?
AWS European Sovereign Cloud: Demonstrating an independent operation
What I'm curious about is while it's good that they can disconnect it from the AWS global network for short periods, can it survive longer disruptions without things like IAM going out of sync? Can it withstand its third party dependencies also being severed from the US networks? And can its employees withstand Andy Jassy calling them up and saying "grant the US government access to this thing or you're fired?" So many questions...
Somewhere in Seattle there's a design review that keeps skipping the part where the input is hostile, and this week's roundup is the inevitable consequence. We start with a pair of CVEs in Multi Model Server, which is apparently the box you handed your inference traffic to, then widen out to four more bulletins with one shared root cause: smuggled mount options, a parser with no recursion depth limit, and a redaction library that hands back the unredacted fields when it hits an error. Many AIs make all bugs shallow?
… and that’s what happened Last Week in AWS.
