All news with #serverless security tag

🔍 In 2024–2025 research, Cloudflare reassessed remote Spectre attacks against Cloudflare Workers and tested defenses introduced in 2021, notably Dynamic Process Isolation (DyPrIs). The team rebuilt a production proof-of-concept showing a reliable remote Spectre leak under production workloads, found a DyPrIs limitation, and implemented further mitigations including the V8 Sandbox and in-process isolation. The report emphasizes the attack was mitigated in production and no active exploitation was observed in the past three years.

🚀 This technical guide explains Google Cloud’s Managed Service for Apache Spark, contrasting traditional managed clusters with serverless deployment modes and execution models (interactive sessions and batches). It covers resource and cost optimization techniques including history-based autotuning, tuning cores/memory, dynamic allocation caps, and shuffle partition sizing. The article also demonstrates integrated troubleshooting using Gemini Cloud Assist to diagnose runtime failures and generate resilient PySpark fixes.

🆕 Amazon Managed Workflows for Apache Airflow (Amazon MWAA) Serverless now supports running custom Python functions and shell scripts directly in the serverless runtime using PythonOperator and BashOperator. Package your Python modules or shell scripts as code packages, upload them to Amazon S3, and reference them when creating or updating a workflow. The service snapshots your code at workflow creation time and uses that snapshot for all subsequent runs, ensuring execution consistency. This capability is available in all AWS Regions where MWAA Serverless is offered.

📢 The AWS Glue Schema Registry is now available in ten additional regions, including New Zealand, Thailand, Hyderabad, Osaka, Malaysia, Melbourne, Mexico (Central), Israel (Tel Aviv), Taipei, and Canada West (Calgary). The serverless, free registry supports Apache Avro, JSON, and Protobuf formats to validate and manage streaming data evolution. It serves as a centralized repository that reduces validation logic and cross-team coordination, improving data quality and lowering downstream failures. The registry integrates with C# and Java apps for Apache Kafka/MSK, Amazon Kinesis Data Streams, Apache Flink/Managed Flink, and AWS Lambda.

🚀 AWS Lambda increases the maximum event pollers for Provisioned Mode SQS event source mappings from 2,000 to 10,000, enabling up to 100,000 concurrent invocations per ESM. This change helps developers build highly responsive, large-scale event-driven applications for use cases like real-time order processing, financial pipelines, IoT telemetry ingestion, and fan-out workloads. The feature is generally available in all AWS Commercial Regions and is configurable via the ESM API, Console, CLI, SDKs, CloudFormation, and SAM. Billing for pollers continues to use the Event Poller Unit (EPU) pricing model.

📣 AWS Lambda now sends logs for Lambda Managed Instances (LMI) capacity providers to Amazon CloudWatch Logs, providing visibility into scaling activity and instance lifecycle operations. LMI lets you run Lambda functions on Amazon EC2 instances while keeping serverless operational simplicity. Capacity provider logs capture structured JSON lifecycle events like launches, terminations, and health checks to help monitor, troubleshoot, and optimize managed EC2 resources. Logs are enabled by default across supported AWS Commercial Regions and incur standard CloudWatch Logs charges.

🔧 AWS announces general availability of node lifecycle actions in AWS Parallel Computing Service (PCS), letting users run custom scripts automatically at defined points in a compute node's lifecycle. Use cases include mounting shared storage, joining directory services, installing software, or setting up monitoring. Scripts are defined in compute node group configurations, sourced from Amazon S3 or HTTPS URIs, and support arguments, lifecycle stage selection, reboot re-run options, and error-handling behavior. AWS PCS writes action output to dedicated logs for visibility and the feature is available in all Regions that support PCS.

🚀 Cloud Run now supports one-command multi-region deployments with automatic failover when paired with a global or internal application load balancer. Readiness probes give instance-level health checks and Service health aggregates those checks per region, exposed via serverless NEGs to enable rapid failover. These features target both public internet and private VPC applications and are intended to reduce downtime and simplify HA architectures.

🛡️ This post from Mandiant highlights how publicly exposed serverless applications — often unauthenticated by design — are frequent targets for application-level attacks like LFI/RFI and command injection. It explains exploitation paths including file retrieval and service account token exfiltration, and demonstrates attack examples against Cloud Run Python functions. The article provides actionable hardening guidance such as using dedicated service accounts with least privilege, isolating public services in separate projects, enforcing S‑SDLC practices, and deploying Cloud Armor WAF and Layer 7 load balancing for centralized protection.

🛡️ Cloud Run sandboxes are now in public preview, offering a native, secure, and ultra-fast runtime to execute untrusted code and agent workloads in milliseconds. These lightweight, isolated execution boundaries can spawn within existing Cloud Run service instances and enforce credential isolation, deny-by-default network egress, and a safe read-only filesystem overlay. Enabling sandboxes requires a single deployment flag and integrates with the Agent Development Kit and ComputeSDK for streamlined use.

🔧 Amazon Managed Workflows for Apache Airflow (Amazon MWAA) Serverless now supports shared VPC subnets, removing a prior validation error when creating Serverless workflows with subnets shared via AWS Resource Access Manager (AWS RAM). This change aligns MWAA Serverless subnet ownership validation with MWAA Provisioned environments, enabling centrally managed network architectures to launch workflows in member accounts without workarounds. The update also benefits customers using Amazon SageMaker Unified Studio Workflows with shared VPC networking and is available in all Regions where MWAA Serverless is supported.

🔧 Amazon EMR Serverless now permits live updates to key application configurations, such as maximum capacity and custom image settings, without stopping or restarting the application. New workloads submitted after a configuration change automatically use the updated settings while existing jobs continue under their original configuration. This removes the previous need to coordinate maintenance windows and restart applications when adjusting scaling boundaries or deploying updated custom images.

🚀 AWS announces Lambda MicroVMs, a new serverless compute primitive delivering VM-level isolation, near-instant launch and resume speeds, and up to 8 hours of state preservation. Built on Firecracker, MicroVMs let developers provide each user or job a dedicated, secure execution environment without managing virtualization infrastructure. MicroVM images are created from Dockerfiles and support HTTP/2, gRPC, and WebSockets, with regional availability and pay-for-use pricing.

🐍 BigQuery now supports fully managed Python User-Defined Functions (UDFs) in GA, enabling data teams to run custom Python code securely inside BigQuery using SQL or BigQuery DataFrames. The service runs on BigQuery-managed serverless infrastructure that auto-scales and removes the need to manage containers. It provides access to popular Python libraries, vectorized PyArrow processing, configurable container resources, concurrency controls, and streaming logs for observability. Billing is integrated with BigQuery SKUs and supports spend commitments and cost monitoring.

🧭 AWS Glue Interactive Sessions now supports Apache Spark Connect, enabling development and execution of Spark applications from managed notebooks like Amazon SageMaker Unified Studio or IDEs such as Jupyter and VS Code while running on AWS Glue's serverless infrastructure. The thin client architecture decouples client dependencies from the server-side Spark runtime, enabling ad hoc exploration, iterative debugging, and incremental PySpark development. Observability includes real-time Spark UI monitoring, History Server tracking, and session management via the AWS Glue API, CLI, or SDK. This capability is available across multiple AWS regions.

🚀 Amazon SageMaker AI now supports serverless customization for Nvidia Nemotron 3 Nano via supervised fine-tuning (SFT) and reinforcement fine-tuning (RFT). This open-weight 30B-parameter model can be deployed and adapted to specific domains and workflows directly within SageMaker. Serverless customization handles infrastructure and training orchestration, enabling teams to focus on data and evaluation while paying only for usage. The feature is available in US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), and Europe (Ireland), and can be launched from SageMaker Studio or via the SageMaker Python SDK.

📣 Amazon Managed Workflows for Apache Airflow (MWAA) Serverless now publishes workflow and task state change events to Amazon EventBridge, enabling event-driven automation for Airflow pipelines. Previously, teams relied on custom polling or manual monitoring; this capability lets MWAA Serverless emit events for workflow states (started, running, succeeded, failed) and task states (scheduled, succeeded, failed, up for retry). Use cases include alerting on failures, triggering downstream pipelines when upstream workflows succeed, and logging state transitions for compliance.

⚙️ This announcement details Google Cloud’s updates to Managed Service for Apache Spark, now offered as Managed Spark clusters with serverless and managed modes. Key enhancements include Lightning Engine, a native C++ vectorized execution engine delivering up to 4.9x faster Spark performance, Flexible VMs for improved capacity resilience, and FinOps features like zero-scale clusters and scheduled stops. The release also adds the Model Context Protocol server and Data Agent Kit integrations to connect LLMs and developer tools securely to clusters, plus Lakehouse interoperability and Cluster Image 3.0 with Spark 4.1 preview.

🚀 Managed Service for Apache Spark runtime 3.0 reduces setup and startup friction for Spark workloads. It automates IAM, networking, and API provisioning to shorten the time to first job and cuts startup latency by 75% for standard and premium tiers. The runtime adds support for GPU obtainability via Dynamic Workload Scheduler Flex Start, enhanced multi-zonal execution with no cross-zone network charges, and compatibility with upcoming Spark 4.x features like Spark Connect.

🚀 The next generation of Amazon OpenSearch Serverless is now generally available, offering a fully managed search and vector engine optimized for agentic workflows. It auto-scales up to 20x faster and provisions resources in seconds, supports scale-to-zero and pay-per-usage pricing, and can reduce costs by up to 60% versus provisioning clusters for peak loads. New features include a shared storage layer that decouples compute and storage, two resource-based endpoints for simplified network connectivity, and native integrations with AI development platforms and OpenSearch Agent Skills.