Bartek Chojnacki

AWS just leveled up Kinesis Data Streams with the ability to scale down ingest capacity using warm throughput. Now you can dial back your stream's write throughput when traffic drops, keeping costs lean while maintaining peak-hour performance. It's like having a thermostat for your data pipeline—set it and forget it. Available free across all AWS regions for On-demand Advantage users.

AWS just dropped a nice quality-of-life update: you can now spin up EC2 Dedicated Host Resource Groups without the Self-Managed License hassle. Perfect for Mac Instance users and anyone needing hardware isolation without BYOL complexity. Still want license tracking? No problem—SMLs are optional now.

AWS just dropped zone-aware routing for ECS Service Connect, and it's a game-changer for cost-conscious DevOps folks. Now your service-to-service traffic automatically stays within the same Availability Zone, slashing cross-AZ data transfer costs and latency without any code changes. The system intelligently redistributes traffic when endpoints get unhealthy, keeping your apps resilient while ditching that old cost-vs-resilience trade-off. It's enabled by default and available everywhere ECS Service Connect runs—no extra infrastructure needed.

AWS Bedrock AgentCore Python SDK versions below 1.18.1 contain CVE-2026-16796, a command injection flaw in the install_packages() method that could let authenticated users execute arbitrary commands in the Code Interpreter sandbox through crafted package names. If you're using bedrock-agentcore, update to version 1.18.1 or later right away—this one needs your attention.

aws-smithy-http-server versions 0.66.4 and earlier have a nasty vulnerability (CVE-2026-16756) that lets unauthenticated attackers launch Slowloris denial of service attacks. The issue? Unlimited resource allocation in the default serve() path means attackers can tie up your server without breaking a sweat. If you're running Smithy-RS for the AWS SDK for Rust or custom services, update immediately to patch this.

AWS API MCP Server (awslabs.aws-api-mcp-server) versions 0.2.13 through 1.3.46 have a critical flaw: if the security policy fails to load on startup, the server keeps running without enforcing access controls. This means configured policy denials get bypassed for the entire process lifetime. If you're using this tool with a security policy, update to version 1.3.47 or later immediately—especially if fail-closed modes aren't enabled.

AWS Lambda durable functions now let you encrypt execution data with your own AWS KMS keys instead of relying on AWS-owned ones. Perfect for regulated industries like finance and healthcare where data governance demands customer-controlled encryption. You'll get full control over key rotation and access to execution history, while keeping this separate from function-level encryption. No extra Lambda charges—just standard KMS pricing applies.

AWS just dropped listener rules for Network Load Balancer, and it's a game-changer for dual-stack setups. Now you can route IPv6 traffic to IPv6 targets and IPv4 to IPv4 targets from a single NLB without losing the original client IP—no protocol translation shenanigans needed. Say goodbye to running two separate load balancers or DNS juggling; listener rules handle Layer 3 conditional routing like a boss. Available now across all AWS regions at no extra cost.

Amazon SageMaker AI inference now supports G7 instances powered by NVIDIA RTX PRO 4500 Blackwell GPUs, delivering up to 4.6x faster performance than previous G6 models. These beasts pack 32 GB of GPU memory per GPU, 7x better networking, and massive NVMe storage—perfect for running those chunky 7B–30B parameter models without breaking a sweat. No more painful over-provisioning or model quantizing just to fit in memory. Deploy via SageMaker console, API, or SDK and start serving generative AI models like a pro.