All news with #serverless security tag

🚀 AWS Lambda durable functions are now available in the AWS GovCloud (US-West) and AWS GovCloud (US-East) Regions. These features extend the Lambda programming model with primitives like step and wait, enabling checkpointing, automatic recovery from failures, and paused executions without compute charges for on-demand functions. Government and regulated customers can now orchestrate complex workflows while meeting compliance and security requirements. Durable functions can be enabled for supported Python, Node.js, Go, .NET, and Java runtimes via API, console, SDKs, or infrastructure-as-code tools.

🛠️ Cloud Run worker pools now support pull-based Temporal workers, enabling managed scaling for Temporal Cloud. Worker pools provide steady CPU allocation, can scale to zero, and eliminate prior HTTP-listener workarounds. Temporal controls pool size based on task-queue backlog latency and supports worker versioning so running workflows remain deterministic across deployments.

🔔 AWS announced Lambda Web Functions, a serverless compute primitive that allows application code to listen on a port and handle HTTP requests directly using familiar frameworks (for example, Express or Hono) with no adapters. The feature targets workloads such as AI inference endpoints, SSR apps, streaming APIs, microservices, and webhooks, and charges for active CPU time and memory rather than idle CPU waiting on downstream services. Today it supports Node.js, enables multiple concurrent requests per warm execution to reduce cold starts, supports native HTTP streaming, VPC connectivity, multi-Region routing, and is configurable via the Lambda API, toolkits, console and IaC tools. Existing Lambda functions are being renamed to Lambda Event Functions with no code changes required, and Web Functions are available in select AWS Regions.

📣 Today Cloudflare announced K2, a public beta serverless event streaming primitive on the Developer Platform. K2 stores events as an ordered, partitioned durable log built on R2 object storage, enabling independent consumers to read at their own pace and supporting long-term retention. It targets high-scale data movement and fan-out consumption, with higher produce latency due to object storage writes. K2 integrates with Workers, supports subscriptions for parallel reads, and is available now for Workers Paid accounts with beta limits and no usage billing.

🚀 Today Cloudflare announced Workers KV Instant, a new mode for Workers KV that uses Quicksilver to deliver globally replicated key-value data with immediate availability and dramatically reduced read latency. KV Instant targets infrequently updated configuration and feature-flag data, offering p99 read latencies under two milliseconds and writes replicating to the edge in ~250ms for 99% of writes. It preserves the Workers KV API with a few differences in metadata, list pagination, and a one-write-per-namespace-per-second restriction, and is launching in private beta with distinct pricing tailored to read-heavy workloads.

🔔 The updated Amazon EventBridge Custom event bus is a serverless event broker that enables scalable, decoupled event-driven applications. It supports cross-account sharing via AWS Resource Access Manager, strict ordering, CloudEvents JSON formats, built-in retention up to one year, and advanced transformations. A new Subscriber resource can filter and deliver events to over 250 AWS services, and a revised pricing model charges for data transfer rather than per-event.

🛡️ AWS Lambda durable functions are now available in the AWS European Sovereign Cloud, enabling developers to build reliable multi-step applications and AI workflows within the Lambda developer experience. These functions introduce primitives like step and wait to checkpoint progress, recover from failures, and pause executions without incurring on-demand compute charges. Support covers new Python (3.13, 3.14), Node.js (22, 24), and Java (17+) runtimes, and activation is possible via the AWS Lambda API, Console, SDKs, and IaC tools such as AWS CloudFormation, AWS SAM, and AWS CDK.

🚀 AlloyDB now offers PostgreSQL for agents (preview), enabling sandboxed, serverless PostgreSQL instances that provide up-to-the-second read-only access to production data while isolating agent workloads. These instances spin up in seconds, leverage Colossus-backed unified storage for sub-millisecond I/O and massive scan throughput, and scale down to zero to control costs. The engine remains fully PostgreSQL-compatible with vector, full-text, and spatial search plus strong Google Cloud security integrations.

🚀 Amazon Managed Workflows for Apache Airflow (MWAA) Serverless is now available in AWS GovCloud (US-East) and AWS GovCloud (US-West). The service removes operational overhead by automatically provisioning and scaling compute resources for Apache Airflow workloads. It uses a pay-per-use model that bills only for actual workflow run time. For supported regions and setup guidance, consult the Amazon MWAA Serverless documentation.

🐍 Amazon SageMaker Unified Studio Workflows now includes PythonOperator and BashOperator, allowing you to run custom Python functions and shell commands inside serverless workflows without provisioning separate compute. Configure operators by adding your script files in workflow settings and pointing each operator to the function or command. This feature is available in all Regions where SageMaker Unified Studio runs.

🚀 Starting today, AWS Lambda supports SnapStart for functions packaged as container images, cutting startup times from several seconds to sub-second for latency-sensitive workloads. SnapStart snapshots an initialized execution environment at deployment and resumes from the cache on invocation, avoiding full reinitialization. The feature is opt-in and available in most commercial AWS Regions, and can be enabled via Console, CLI, APIs, and IaC tools.

🔍 In 2024–2025 research, Cloudflare reassessed remote Spectre attacks against Cloudflare Workers and tested defenses introduced in 2021, notably Dynamic Process Isolation (DyPrIs). The team rebuilt a production proof-of-concept showing a reliable remote Spectre leak under production workloads, found a DyPrIs limitation, and implemented further mitigations including the V8 Sandbox and in-process isolation. The report emphasizes the attack was mitigated in production and no active exploitation was observed in the past three years.

🚀 This technical guide explains Google Cloud’s Managed Service for Apache Spark, contrasting traditional managed clusters with serverless deployment modes and execution models (interactive sessions and batches). It covers resource and cost optimization techniques including history-based autotuning, tuning cores/memory, dynamic allocation caps, and shuffle partition sizing. The article also demonstrates integrated troubleshooting using Gemini Cloud Assist to diagnose runtime failures and generate resilient PySpark fixes.

🆕 Amazon Managed Workflows for Apache Airflow (Amazon MWAA) Serverless now supports running custom Python functions and shell scripts directly in the serverless runtime using PythonOperator and BashOperator. Package your Python modules or shell scripts as code packages, upload them to Amazon S3, and reference them when creating or updating a workflow. The service snapshots your code at workflow creation time and uses that snapshot for all subsequent runs, ensuring execution consistency. This capability is available in all AWS Regions where MWAA Serverless is offered.

📢 The AWS Glue Schema Registry is now available in ten additional regions, including New Zealand, Thailand, Hyderabad, Osaka, Malaysia, Melbourne, Mexico (Central), Israel (Tel Aviv), Taipei, and Canada West (Calgary). The serverless, free registry supports Apache Avro, JSON, and Protobuf formats to validate and manage streaming data evolution. It serves as a centralized repository that reduces validation logic and cross-team coordination, improving data quality and lowering downstream failures. The registry integrates with C# and Java apps for Apache Kafka/MSK, Amazon Kinesis Data Streams, Apache Flink/Managed Flink, and AWS Lambda.

🚀 AWS Lambda increases the maximum event pollers for Provisioned Mode SQS event source mappings from 2,000 to 10,000, enabling up to 100,000 concurrent invocations per ESM. This change helps developers build highly responsive, large-scale event-driven applications for use cases like real-time order processing, financial pipelines, IoT telemetry ingestion, and fan-out workloads. The feature is generally available in all AWS Commercial Regions and is configurable via the ESM API, Console, CLI, SDKs, CloudFormation, and SAM. Billing for pollers continues to use the Event Poller Unit (EPU) pricing model.

📣 AWS Lambda now sends logs for Lambda Managed Instances (LMI) capacity providers to Amazon CloudWatch Logs, providing visibility into scaling activity and instance lifecycle operations. LMI lets you run Lambda functions on Amazon EC2 instances while keeping serverless operational simplicity. Capacity provider logs capture structured JSON lifecycle events like launches, terminations, and health checks to help monitor, troubleshoot, and optimize managed EC2 resources. Logs are enabled by default across supported AWS Commercial Regions and incur standard CloudWatch Logs charges.

🔧 AWS announces general availability of node lifecycle actions in AWS Parallel Computing Service (PCS), letting users run custom scripts automatically at defined points in a compute node's lifecycle. Use cases include mounting shared storage, joining directory services, installing software, or setting up monitoring. Scripts are defined in compute node group configurations, sourced from Amazon S3 or HTTPS URIs, and support arguments, lifecycle stage selection, reboot re-run options, and error-handling behavior. AWS PCS writes action output to dedicated logs for visibility and the feature is available in all Regions that support PCS.

🚀 Cloud Run now supports one-command multi-region deployments with automatic failover when paired with a global or internal application load balancer. Readiness probes give instance-level health checks and Service health aggregates those checks per region, exposed via serverless NEGs to enable rapid failover. These features target both public internet and private VPC applications and are intended to reduce downtime and simplify HA architectures.

🛡️ This post from Mandiant highlights how publicly exposed serverless applications — often unauthenticated by design — are frequent targets for application-level attacks like LFI/RFI and command injection. It explains exploitation paths including file retrieval and service account token exfiltration, and demonstrates attack examples against Cloud Run Python functions. The article provides actionable hardening guidance such as using dedicated service accounts with least privilege, isolating public services in separate projects, enforcing S‑SDLC practices, and deploying Cloud Armor WAF and Layer 7 load balancing for centralized protection.