All news in category “Vendor and Hyperscaler Watch”

🧭 Amazon SageMaker Notebooks now support Trusted Identity Propagation (TIP) with Amazon Athena, Amazon Redshift, and Amazon EMR Serverless, enabling per-user access control for data analytics. When connected to a TIP-enabled compute in a TIP-enabled Project, each notebook user's IAM Identity Center identity flows through to AWS Lake Formation, ensuring they see only the tables, columns, and rows their permissions allow. TIP provides per-user data boundaries, full audit attribution with CloudTrail, and reduces admin friction by automatically propagating identity through existing compute connections without extra logins or role management. The feature is available in all Regions where Amazon SageMaker Unified Studio is available.

🔧 Amazon CloudWatch pipelines now includes three new processors: an Amazon RDS log parser, an XML parser, and a GeoIP enrichment processor. These processors parse and enrich logs as they are ingested, turning RDS Aurora audit and error logs into structured fields, converting XML strings into JSON, and adding geographic context to IP addresses. They are available at no extra charge where CloudWatch pipelines is GA; standard ingestion and storage rates still apply.

🔒 AWS Security Agent (part of AWS Continuum) now offers two capabilities for its on-demand AI-driven penetration testing service: a configurable maximum task-hours limit and selective revalidation of findings. Teams can set preset or custom hour caps so tests stop gracefully when the limit is reached while preserving discovered findings and keeping billing tied to actual task-hours used. Individual findings from completed runs can be re-tested against the live application to confirm an Active or Resolved status, with full revalidation history linked to the original finding.

🔧 AWS Elemental MediaConnect Router now lets customers set internal recovery latency per output. Customers can choose between balanced mode (default behavior) and low-latency mode to optimize recovery time for latency-sensitive workflows. The setting is configurable via the MediaConnect API, AWS Management Console, or AWS CLI, and a new CloudWatch metric, RouteFabricRecoveryLatency, exposes recovery latency per route. This feature is available in all regions where MediaConnect Router is deployed.

🔍 AWS Cost Anomaly Detection now monitors spend for third-party foundation models on Amazon Bedrock, including provider-hosted models like Anthropic Claude. The service uses machine learning to detect and alert on unusual spend, and this update extends automatic anomaly detection to Bedrock model usage. Alerts include a ranked root-cause breakdown by dollar impact across service, account, Region, and usage type, and the feature is available in all commercial AWS Regions except GovCloud and China.

🔔 Starting today, Amazon OpenSearch Ingestion is available in AWS GovCloud (US-East) and AWS GovCloud (US-West), enabling secure ingestion into Amazon OpenSearch Service managed clusters and serverless collections. OpenSearch Ingestion is a fully managed data ingestion tier that offers a no-code experience to filter, transform, redact, and route data. It automatically provisions and scales resources to handle variable workloads and is now generally available across 19 AWS regions.

🔒 Microsoft has been named a visionary leader in Frost & Sullivan’s Frost Radar™: Cloud Workload Protection Platforms, 2026. The report highlights a market shift from isolated scanning to a unified runtime security model that connects code, cloud resources, identities, and SOC workflows. Frost & Sullivan cites Microsoft Defender for Cloud’s scale, deep runtime telemetry, and integration with Defender XDR, Sentinel, GitHub, and Copilot as key strengths. This positioning reflects Microsoft’s estimated >22% share of the global CWPP market and emphasizes runtime depth, container and Kubernetes security, and AI workload protection.

🛡️ This post demonstrates patterns for propagating user authorization context when building AI agents with Amazon Bedrock AgentCore, ensuring each user only sees data they’re allowed to access. It explains how to embed department or custom claims in tokens via Amazon Cognito pre token generation triggers and how the AgentCore Runtime inbound JWT authorizer validates those claims before invoking agent code. The guidance shows moving enforcement into infrastructure—using STS session tags, per-request AssumeRoleWithWebIdentity for DynamoDB, metadata filters for Bedrock Knowledge Bases, and on‑behalf‑of token exchange for external SaaS—to reduce risk from compromised agents.

🛠️ Customers can now deploy eligible AWS Marketplace AMIs directly on Amazon Lightsail. Lightsail offers simple, predictable pricing with instance bundles that include compute, storage, and data transfer at a fixed monthly rate. When subscribing to supported products — such as Microsoft Windows Server, Microsoft SQL Server Express, Ubuntu, cPanel & WHM, and Plesk — users may choose Amazon Lightsail in addition to Amazon EC2. The "Launch on Lightsail" option opens the Lightsail console with the AMI and region pre-configured for fast deployment.

🚀 AWS has added a fourth Availability Zone to the Europe (London) Region (eu-west-2), increasing capacity for cloud compute and AI/ML workloads. The new zone provides next-generation accelerated instances such as Trn3 and P6, plus general-purpose EC2, enabling customers to run training and inference locally within the London region. It improves fault isolation for resilient, highly available architectures and is accessible via the AWS Console, APIs, and existing workflows at standard regional pricing.

🟦 AWS has added a fourth Availability Zone (eu-west-2d) to the Europe (London) Region, expanding capacity for AI, ML, and general-purpose compute. The new zone provides next-generation accelerated instances such as Trn3 and P6, enabling local model training and inference. Customers can distribute workloads across four zones for improved fault tolerance, accessible via the Console, APIs, and existing workflows at standard regional pricing.

🚀 AWS Lambda MicroVMs are now available in five additional Regions: Asia Pacific (Mumbai), Asia Pacific (Singapore), Asia Pacific (Sydney), Europe (Frankfurt), and Europe (Stockholm), bringing availability to 10 Regions in total. Lambda MicroVMs deliver VM-level isolation, near-instant launch and resume speeds, and state preservation so developers can run isolated, stateful workloads without managing virtualization. Developers create a MicroVM image from a Dockerfile and launch per-user or per-job MicroVMs with dedicated HTTPS URLs supporting HTTP/2, gRPC, and WebSockets via the Lambda console, CloudFormation, CDK, or Agent Toolkit for AWS.

🛠️ The blog explains how legacy Apache Hive Metastores become bottlenecks as enterprises scale their data lakes and adopt multiple query engines. It introduces the Google Cloud Lakehouse runtime catalog, a serverless metadata registry built on the Apache Iceberg REST Catalog specification that supports both legacy Hive tables and modern table formats. The post outlines common pain points — scaling, governance, and operational TCO — and describes a migration path that extracts Hive table definitions and registers them into the serverless catalog. The result is unified governance, zero-data-copy access across engines, and reduced operational overhead.

🚀 This technical guide explains Google Cloud’s Managed Service for Apache Spark, contrasting traditional managed clusters with serverless deployment modes and execution models (interactive sessions and batches). It covers resource and cost optimization techniques including history-based autotuning, tuning cores/memory, dynamic allocation caps, and shuffle partition sizing. The article also demonstrates integrated troubleshooting using Gemini Cloud Assist to diagnose runtime failures and generate resilient PySpark fixes.

🔒 Amazon Quick now offers a deny by default governance setting for custom permissions, automatically blocking new AI capabilities until administrators explicitly allow them. Previously, new capabilities were enabled for all users on release, requiring reactive controls. Administrators can apply the restriction per custom permissions profile for users, roles, or the entire account via the Amazon Quick console or AWS CLI. The setting is available in all Regions where Amazon Quick is offered and also restricts existing capabilities within a restricted category.

🔒 The Linux Foundation, OpenSSF and 20+ founding members launched the Akrites coalition to defend open-source software from AI-enabled threats. Members include major AI labs, cloud providers, cybersecurity vendors and enterprises, each contributing engineers and fees. Akrites will create a shared SIRT and a standardized CVD process, with tooling based on CMU’s VINCE and LLM-driven capabilities for deduplication and patch creation. The platform is expected to go live and accept automated reports in September.

🔒 AWS Identity and Access Management (IAM) has increased the default quota for managed policies attached to a role from 10 to 20. This change reduces the need to request Service Quotas when adopting best practices such as separating permissions into purpose-specific policies or when onboarding AWS Partner products that attach additional managed policies. If more than 20 managed policies are needed, customers can request a quota increase up to 25 via Service Quotas. The update is applied automatically across all commercial AWS Regions, AWS GovCloud (US), and China Regions with no customer action required.

📊 Administrators can now monitor Amazon WorkSpaces Applications directly in the service console with real-time session-level metrics, instance resource data, and network performance metrics. This native experience removes the need for third-party tools or custom CloudWatch dashboards and requires no configuration. Fleet-level capacity views, customizable session tables, correlated graphs for frame rate, input latency, bandwidth, and CPU/memory/GPU usage are provided, with metrics also exported to Amazon CloudWatch for flexibility.

🔒 AWS Storage Gateway now supports FIPS 140-3 validated endpoints over AWS PrivateLink for Tape Gateway and Volume Gateway. Previously restricted to the public internet, FIPS traffic can now stay on the private AWS network, simplifying use for regulated workloads. To use it, create a FIPS interface VPC endpoint and choose the FIPS option when activating your gateway; gateways must run software version 3.2.7 or later. The feature is available in eight Regions, including US East, US West, and AWS GovCloud.

🛡️ Microsoft warned that Windows 11 version 24H2 Home and Pro editions will stop receiving security and preview updates on October 13, 2026. Enterprise and Education editions of 24H2 remain supported until October 2027, and Microsoft recommends upgrading to Windows 11 25H2, widely available since September 2024. unmanaged Home and Pro devices will auto-upgrade to 25H2, though users can postpone restarts; administrators should use Settings > Windows Update to check availability.