All news with #cloud security tag

🔎 This article compares self-managed PostgreSQL and managed PostgreSQL services, explaining how each model balances control, responsibility, cost, and operational effort. It highlights the operational tax of self-hosting versus the reduced platform responsibilities provided by managed services like Azure Database for PostgreSQL. The piece outlines implications for resilience, security, identity integration, backups, maintenance, and scalability to help technical decision makers choose the right operating model.

🚦Uber adopted application awareness on Cloud Interconnect to prioritize business-critical traffic across its hybrid networks. As an early design partner, Uber deployed the feature in multiple locations to classify and queue application traffic using DSCP marking, protecting low-latency services during congestion. The approach improved bandwidth utilization, reduced the need for costly overprovisioning, and enabled safer migration of strategic workloads to Google Cloud.

🛡️ This post announces an independent assessment showing how Landing Zone Accelerator on AWS (LZA) can deploy multi-account environments with coverage for Australian Government ISM controls. The analysis, performed by AWS Partner gwi.digital, evaluates LZA Universal Configuration against 1,081 ISM controls and introduces the Controls Acceptance Testing Suite (CATS) for automated validation. Results highlight that LZA addresses 256 addressable controls, achieving Full or Partial coverage for 234, and offers mappings and tooling to accelerate IRAP assessment readiness for Australian customers.

🔍 The US National Institute of Standards and Technology (NIST) has warned organisations about unique cybersecurity and compliance challenges in multi-cloud environments, where using multiple cloud service providers complicates consistent policy enforcement, controls and authentication. The report, published on August 21, identifies 23 specific challenges across identity and access, vulnerability management, incident response and data protection. NIST calls for improved governance, automation and standardisation and is seeking public comment until October 5, 2026.

⚙️ AWS Direct Connect announced inbound prefix controls that let customers allocate and manage inbound route-prefix allocations for private and transit virtual interfaces (VIFs) based on workload needs. You can now assign up to 1,000 prefixes each for IPv4 and IPv6 on dedicated and hosted connections, up from a 100-prefix limit. New prefix capacity pools exist at the dedicated connection and Direct Connect gateway (DXGW) levels, and allocations are configurable via the console or CLI/API. This feature is available at no extra cost in all commercial AWS Regions, AWS GovCloud, and the China Regions operated by Sinnet and NWCD.

🔒 Airlock Digital announced completion of an independent IRAP assessment at the PROTECTED classification, conducted by an ASD-endorsed assessor against the Australian Government ISM. The assessment gives Australian organisations additional independent evidence of Airlock Digital’s security controls and alignment with expectations such as the ISM and PSPF. Airlock Digital supports flexible deployment across cloud, on-premises and constrained environments and positions allowlisting as a governance-led, organisation-owned control.

🔎 Today AWS expanded Amazon Bedrock's Web Search to support an external_web_access parameter, allowing models to fetch live public web content while preserving control over data egress. Grant the bedrock-websearch:ExternalWebAccess IAM permission to enable live fetches; leaving the parameter false restricts results to Amazon's in-AWS index. The capability is available in US East (N. Virginia), US East (Ohio), and US West (Oregon).

🔔 Amazon CloudWatch Centralization now copies log group tags from source accounts to destination log groups created by centralization rules. Tag propagation preserves cost, ownership, and compliance tags so teams can scope access and report spend centrally. The feature syncs tags based on propagation behavior chosen in the centralization rule and is available in all Regions where CloudWatch Centralization is offered.

🔒 Japanese cloud provider Sakura Internet disclosed unauthorized access to its sales management system storing customer contract and membership data. The company said the incident was discovered during a separate investigation into a smaller breach at its Sakura Rental Server service and that up to 1,360,563 accounts may have been affected. Sakura reported no confirmed data exfiltration, noted stored passwords are hashed and no credit card data is kept in the compromised system, and is notifying affected customers and authorities.

🔒 Microsoft has been named a visionary leader in Frost & Sullivan’s Frost Radar™: Cloud Workload Protection Platforms, 2026. The report highlights a market shift from isolated scanning to a unified runtime security model that connects code, cloud resources, identities, and SOC workflows. Frost & Sullivan cites Microsoft Defender for Cloud’s scale, deep runtime telemetry, and integration with Defender XDR, Sentinel, GitHub, and Copilot as key strengths. This positioning reflects Microsoft’s estimated >22% share of the global CWPP market and emphasizes runtime depth, container and Kubernetes security, and AI workload protection.

🚀 AWS has added a fourth Availability Zone to the Europe (London) Region (eu-west-2), increasing capacity for cloud compute and AI/ML workloads. The new zone provides next-generation accelerated instances such as Trn3 and P6, plus general-purpose EC2, enabling customers to run training and inference locally within the London region. It improves fault isolation for resilient, highly available architectures and is accessible via the AWS Console, APIs, and existing workflows at standard regional pricing.

🛠️ The blog explains how legacy Apache Hive Metastores become bottlenecks as enterprises scale their data lakes and adopt multiple query engines. It introduces the Google Cloud Lakehouse runtime catalog, a serverless metadata registry built on the Apache Iceberg REST Catalog specification that supports both legacy Hive tables and modern table formats. The post outlines common pain points — scaling, governance, and operational TCO — and describes a migration path that extracts Hive table definitions and registers them into the serverless catalog. The result is unified governance, zero-data-copy access across engines, and reduced operational overhead.

🔒 AWS Storage Gateway now supports FIPS 140-3 validated endpoints over AWS PrivateLink for Tape Gateway and Volume Gateway. Previously restricted to the public internet, FIPS traffic can now stay on the private AWS network, simplifying use for regulated workloads. To use it, create a FIPS interface VPC endpoint and choose the FIPS option when activating your gateway; gateways must run software version 3.2.7 or later. The feature is available in eight Regions, including US East, US West, and AWS GovCloud.

🔎 Amazon S3 Metadata and annotations are now available in AWS GovCloud (US-East) and AWS GovCloud (US-West), enabling faster discovery, understanding, and enrichment of S3 data. S3 Metadata captures system-defined details like object size and source and stores them in Amazon S3 Tables for near real-time tabular queries. Annotations let you attach rich business context in JSON, XML, or YAML (up to 1 GB per object) that travels with the object and follows durability and consistency properties.

🔒 Amazon OpenSearch Service now supports automatic semantic enrichment for VPC-enabled domains, allowing customers with private network configurations to use AI-powered semantic search without exposing domains to the public internet. The feature converts keyword searches into context-aware retrieval, handling all semantic processing automatically and removing the need to manage ML models. It requires OpenSearch version 2.19 or later and is available across 11 Regions globally.

🔒 Cloudflare announces new Cloudflare One capabilities to detect and control Model Context Protocol (MCP) traffic. These features let administrators identify which users and servers are generating MCP requests, distinguish Portal-mediated connections from direct ones, and block unauthorized direct connections on managed network paths. The update combines Gateway protocol signals with MCP Server Portals to help teams find shadow MCP servers and enforce Portal-only access to trusted MCP endpoints.

🔒 Amazon Quick now lets administrators set per-user limits on index storage and agent hours to control subscription costs. With limits management, admins can create limit profiles that cap individual consumption and assign them at the user, role, or account level with a priority hierarchy. When a user reaches their limit, new consumption is blocked but existing content is preserved. The feature is available for Professional and Enterprise plans in supported AWS Regions.

🔒 Landing Zone Accelerator now has an independent assessment report for C5:2020 available on AWS Artifact, evaluating how LZA's baseline implements nearly 200 native security controls. The report, prepared by AWS partner Schellman, maps LZA's Universal Configuration and security control baseline to C5:2020 technical criteria and describes architecture, best practices, and scoping considerations. LZA supports standard multi-account and container deployments in the AWS European Sovereign Cloud and is accompanied by a Compliance Workbook to help customers accelerate evidence collection and assessment preparation.

🔒 Google Cloud publishes an updated roadmap to migrate its infrastructure and services to post-quantum cryptography by 2029, addressing risks like Store Now, Decrypt Later and signature forgery. The plan prioritizes API endpoints, load balancers, Cloud KMS, and key management while collaborating on standards such as NIST and IETF. Google outlines domain-specific timelines through 2027–2028 and emphasizes shared responsibilities with customers for operational readiness.

📥 AWS Clean Rooms now supports exporting privacy-enhanced analysis logs for SQL analyses to an S3 bucket, giving customers improved optimization and troubleshooting capabilities. Collaboration owners can grant members permission to export logs when creating a collaboration or via change requests for existing collaborations. After a query runs, privacy-enhanced Spark execution details can be exported to a chosen S3 path to help identify issues like data skew and reduce resolution time and costs.