All news with #aws tag

🔍 You can now preview Amazon S3 Tables directly in the S3 console without writing SQL. The console preview displays table schema, column types, and sample rows so you can quickly inspect structure and key data points without additional setup. Previews are available in all AWS Regions where S3 Tables are offered. You are charged only for the S3 requests used to read the sampled rows; consult S3 pricing and the S3 User Guide for details.

🔍 AWS X-Ray now supports adaptive sampling to automatically adjust trace sampling within user-defined limits. This feature offers two modes—Sampling Boost to temporarily raise sampling when anomalies are detected and Anomaly Span Capture to retain spans tied to anomalies even if the full trace isn't sampled. Adaptive sampling aims to reduce MTTR by capturing critical traces during incidents while keeping observability costs low. It is available in all commercial regions where X‑Ray is offered.

🆕 Amazon RDS for PostgreSQL 18.0 is now available in the RDS Database Preview Environment, enabling evaluation of new PostgreSQL capabilities within a fully managed sandbox. PostgreSQL 18.0 introduces multicolumn B-tree skip scan, improved WHERE handling for OR/IN conditions, parallel GIN builds, updated join behavior, and UUIDv7 support. The preview preserves instances for up to 60 days, restricts snapshots to the preview environment, and supports database import/export via dump/load; pricing follows the US East (Ohio) Region.

🔒 Amazon EC2’s account-wide Allowed AMIs setting now supports four new parameters — marketplace codes, deprecation time, creation date, and AMI names — to tighten AMI discovery and usage controls. Previously limited to account IDs and owner aliases, administrators can now define additional criteria to block Marketplace images, filter out outdated AMIs, and enforce naming patterns. These parameters integrate with Declarative Policies and are available in all regions, including AWS China and AWS GovCloud (US), enabling centralized AMI governance across your organization.

🔐 AWS Lambda now supports code signing in AWS GovCloud (US-West and US-East) through the managed AWS Signer service. Lambda validates signatures at deployment to ensure code has not been altered and that it originates from trusted signers. Administrators can create Signing Profiles, bind allowed profiles to functions, and configure whether failed signature checks produce warnings or reject deployments. Access and permissions are controlled via IAM, and there is no additional charge to use this capability.

🔁 Amazon Web Services has made the Application Recovery Controller Region switch feature available in the Asia Pacific (New Zealand) Region. Region switch lets teams orchestrate and execute cross-account and cross-Region recovery steps while providing real-time dashboards and consolidated data collection to support regulator and compliance reporting. The feature supports failover/failback for active/passive designs and shift-away/return for active/active architectures, and automatically replicates plans to all Regions where the application runs.

🛡️ Darktrace has uncovered a ShadowV2 campaign that combines a GitHub CodeSpaces-hosted Python command-and-control framework, a Docker-based spreader, and a Go-based RAT to operate a DDoS-as-a-service platform. Attackers target exposed Docker daemons on AWS EC2 to build on-victim images and deploy malware via environment variables, reducing forensic artifacts. The platform exposes an OpenAPI-driven UI and multi-tenant API enabling HTTP/HTTP2 floods, UAM bypasses, and other configurable attack options.

🛰️ Amazon Route 53 Resolver Query Logging is now available in Asia Pacific (New Zealand). You can log DNS queries originating in VPCs to capture queried domain names, the AWS resources that issued the queries (including source IP and instance ID), and the responses received. Logs can be delivered to Amazon S3, CloudWatch Logs, or Amazon Data Firehose, and query logging configurations may be shared across accounts via AWS RAM. There is no additional Route 53 charge for enabling query logging, though storage and ingestion on the chosen destination may incur costs.

🔒 Wiz has observed in-the-wild exploitation attempts of CVE-2025-51591, an SSRF in Pandoc that renders iframe tags and can direct them at the AWS Instance Metadata Service (IMDS). Attackers submitted crafted HTML aiming to access 169.254.169.254 to exfiltrate temporary IAM metadata and EC2 credentials. Attempts seen from August and continuing for weeks were blocked where IMDSv2 was enforced. Administrators should mitigate by using Pandoc's -f html+raw_html or --sandbox options, enforce IMDSv2, and apply least-privilege roles.

🎮 Amazon GameLift Servers now supports the new AWS Local Zone in Dallas, Texas (us-east-1-dfw-2), enabling fleets to deploy EC2 C6gn, C6i, C6in, M6g, M6i, M6in, M8g, and R6i instances. From the GameLift Servers Console you can enable the Dallas Local Zone and add it to your fleets like any other Region or Local Zone. This launch lets studios run latency-sensitive multiplayer, AR/VR, and tournament workloads closer to Dallas-area players for single-digit millisecond latency and improved responsiveness.

🚀 Today AWS removed networking bandwidth burst duration limits for Amazon EC2 I7i and I8g instances larger than 4xlarge, doubling the network bandwidth available at all times for those sizes. Where instances previously relied on a network I/O credit mechanism to burst above a baseline, larger I7i and I8g instances can now sustain their maximum network performance indefinitely. The change delivers more predictable, uninterrupted throughput for memory- and network‑intensive workloads such as distributed databases, real‑time analytics and AI preprocessing; smaller sizes retain existing baseline-and-burst behavior.

⚡ Amazon EC2 Auto Scaling now allows customers to force-cancel ongoing instance refreshes immediately by setting WaitForTransitioningInstances to false when calling the CancelInstanceRefresh API. The change bypasses waiting for in-progress launches, terminations, or instance lifecycle hooks, enabling rapid aborts of deployments during incidents or to roll forward to corrected releases. The capability is available in all AWS regions, including AWS GovCloud (US).

🔒 AWS Security Incident Response provides an AWS-native incident management capability that combines automated triage, threat intelligence, and customer metadata to surface and prioritize genuine threats. The service integrates with Amazon GuardDuty, AWS Security Hub, and select third-party detections, and offers a unified console with 24/7 access to the AWS Customer Incident Response Team (CIRT). It supports delegated administration, organization-wide coverage, and immutable case timelines. Included with Amazon Managed Services (AMS), it accelerates investigation and containment to reduce mean time to resolution.

🔔 Amazon DataZone is now available in AWS Asia Pacific (Hong Kong), Asia Pacific (Malaysia), and Europe (Zurich) Regions. The fully managed Amazon DataZone service catalogs, discovers, analyzes, shares, and governs organizational data, integrating with AWS Glue Data Catalog and Amazon Redshift. Consumers can search, subscribe, and analyze assets using tools like Amazon Redshift and Amazon Athena from the DataZone portal. The service also underpins governance in the next generation of Amazon SageMaker to simplify discovery and secure access to data and models.

🔒 This post outlines a practical, layered approach to reduce risk in AWS by moving beyond detective-only controls to a comprehensive defense‑in‑depth control framework. It recommends combining preventative, proactive, detective, and responsive controls across the resource lifecycle and illustrates how AWS services such as AWS Control Tower, AWS Organizations, Security Hub, and AWS Config enable that strategy. The guidance covers concrete patterns—from SCPs, RCPs and policy‑as‑code in CI/CD to automated remediation via Lambda and Systems Manager—to scale governance, reduce findings, and shorten remediation time.

🔁 AWS License Manager now supports shared AWS Managed Active Directory across multiple AWS accounts, enabling centralized management of Microsoft product subscriptions. Customers can subscribe once in a single admin account and extend those subscriptions to directory consumer accounts across their AWS Organization. This reduces duplicate directories and IT overhead and is available in all commercial regions where License Manager user subscription is supported.

🚨 ShadowV2 is a new botnet campaign that converts misconfigured Docker containers on AWS into a DDoS-for-hire platform. Darktrace’s analysis shows attackers exploiting exposed Docker daemons via the Python Docker SDK, building containers on victims' hosts and deploying a Go-based RAT that polls operators and launches large HTTP floods. The operation is highly professionalized, offering APIs, dashboards, operator logins and modular attack options that make DDoS easily rentable.

🛡️ CISA released an alert about a widespread software supply chain compromise affecting the npm registry: a self-replicating worm called 'Shai-Hulud' has compromised over 500 packages. The actor harvested GitHub Personal Access Tokens and cloud API keys for AWS, Google Cloud, and Azure, exfiltrating them to a public repository and using them to publish malicious package updates. CISA recommends immediate dependency reviews, credential rotation, enforcing phishing-resistant MFA, pinning package versions to releases before Sept. 16, 2025, hardening GitHub settings, and monitoring for anomalous outbound connections.

⚠️ Researchers at Darktrace disclosed ShadowV2, a DDoS-focused botnet that exploits misconfigured Docker daemons on AWS EC2 instances to deploy a Go-based RAT and enlist hosts as attack nodes. The campaign uses a Python spreader to spawn an Ubuntu setup container, build a custom image, and run an ELF payload that checks in with a Codespaces-hosted C2. Operators leverage HTTP/2 Rapid Reset floods, a Cloudflare UAM bypass via ChromeDP, and a FastAPI/Pydantic operator API, signaling a modular DDoS-for-hire service.

📞 Amazon Connect now lets administrators associate custom, predefined attributes with individual interaction segments. Attributes such as business unit, account type, or contact reason can be centrally managed and applied through contact flows or the UpdateContact API, ensuring each segment retains accurate business context during transfers and multi-party interactions. For example, engagements that start in Support and move to Sales keep distinct business unit names per segment. This capability strengthens reporting and analytics across the customer journey and is available in all AWS regions.