Home / The Industry Wire / The AWS Wire
Industry news, read from a vault · beta
The AWS Wire
Everything AWS announced, filtered by the stack you declare in data/stack.json: what is new, what is insecure, what is being retired, what costs more, and what tooling changed for the services you actually run. Everything else is still listed, as withheld, with the reason. Each story with where it came from and who else covered it, corrected where it is read, live from the wire's vault. A beta, with one named reader by their agreement.
The wires: The Industry WireThe AWS WireThe OWASP Wire
Opening the vault…
What was in the vault at v0.12.14
Edition of 2026-10-13: 88 stories, 24 sources. A snapshot, kept for when the vault cannot be reached and for readers without a script; the live edition is the vault.
Security
- [AWS general] Enforcing post-quantum ML-DSA signing policy in KMS with SCPs and IAM (kms:KeySpec) · 2026-10-12 · AWS Security Blog
- AWS's own SAR Lambda (AmazonConnectSalesforceLambda) ran arbitrary AWS API calls under its role for anyone with invoke rights, CVE-2026-94384 · 2026-10-11 · shattered.io
- [AWS general] Security Hub can export findings to S3 as CSV or OCSF JSON · 2026-10-09 · Amazon Web Services
- CVE-2026-107332: AWS Toolkit for VS Code cached CodeCatalyst bearer tokens world-readable (fixed 4.10.0) · 2026-10-08 · AWS Security Bulletins
- CVE-2026-107608: aws-cdk-lib Docker asset bundling could pull symlinked files into deploy artefacts; fixed in 2.267.0 · 2026-10-08 · AWS Security Bulletins
- [AWS general] Bedrock AgentCore Starter Toolkit: code injection and SSRF on agent import (CVE-2026-105812/106032) · 2026-10-06 · AWS Security Bulletins
- CVE-2026-105811: QnABot's Amazon Q Business Lambda hook sample let authenticated users read arbitrary S3 objects · 2026-10-06 · AWS Security Bulletins
- [AWS general] IAM Identity Center adds network access controls (VPC endpoint / IP allowlists) for Identity Store and SCIM APIs · 2026-10-05 · Amazon Web Services
- AWS pattern: protect MCP servers at the edge with CloudFront + WAF (tool allowlists, SSRF/SQLi rules, per-tool rate limits) · 2026-10-05 · AWS Networking & Content Delivery Blog
- CVE-2026-104020: Amazon Ion Python reader DoS via deeply nested input; upgrade to 0.15.0 · 2026-10-01 · AWS Security Bulletins
- Guide: encrypting Lambda durable function state with customer-managed KMS keys · 2026-09-29 · AWS Compute Blog
- [Context] API Gateway REST APIs can present ACM certificates for mutual TLS to backends · 2026-09-08 · Amazon Web Services
Deprecations and end of support
- Python 3.10 on Lambda reaches end of support on 31 Oct 2026, 18 days away · 2026-10-13 · AWS Documentation
- AWS Q3 service availability update: Infrastructure Composer standalone console ends 7 Dec 2026; DevOps Guru, Managed Blockchain to sunset · 2026-09-29 · Amazon Web Services
Releases for your stack
- CloudFront adds Lambda Web Functions as an origin, with a new OAC signing mode 'always-amz-auth' · 2026-10-12 · Amazon Web Services
- AWS Lambda launches Web Functions: run Express/Hono-style HTTP servers directly, existing functions renamed 'Event Functions' · 2026-10-12 · Amazon Web Services
- Lambda metadata endpoint: token-protected in-sandbox API exposes the function's AZ ID; Powertools Python wraps it · 2026-10-09 · AWS Compute Blog (Daniel Abib)
- Lambda Kafka event source mappings can now authenticate with OAuth (OAUTHBEARER) and IAM · 2026-10-09 · Amazon Web Services
- Pattern: cross-account canary releases with API Gateway stage canaries and VPC Lattice (via a forwarder Lambda) · 2026-10-07 · AWS Networking & Content Delivery Blog
- How-to: Lambda SnapStart for container images, including Python 3.12+ base images · 2026-10-06 · AWS Compute Blog
- Amazon S3 Vectors adds metadata pre-filtering (ENHANCED index mode) at no extra cost · 2026-09-30 · AWS News Blog (Daniel Abib)
- [Context] Lambda network bandwidth now scales with memory, from 625 Mbps up to 3 Gbps at 10 GB (non-VPC) · 2026-09-28 · AWS Compute Blog
- [Context] API Gateway REST execution logs grow from 1 KB to 1 MB, deliverable to your own CloudWatch, S3 or Firehose · 2026-09-10 · Amazon Web Services
SDKs and tooling
- boto3/botocore 1.43.105-1.43.112 ship near-daily; minimum Python is now 3.10 · 2026-10-12 · PyPI
- AWS CLI 2.37.6-2.37.13: 'aws lambda-web deploy', OAC always-amz-auth, credential-cache fix, s3 --no-follow-symlinks honoured · 2026-10-12 · Fossies (mirror of aws/aws-cli)
- AWS CDK v2.273.0: CloudFront distributions now redirect HTTP to HTTPS by default; s3-deployment path-escape fixed · 2026-10-08 · GitHub aws/aws-cdk
Pricing and cost
- New Lambda pricing dimension: Web Functions billed per active vCPU-second plus memory-held time · 2026-10-12 · Amazon Web Services
- [AWS general] Cost Explorer and Budgets can now break down Bedrock spend by model, provider, inference type and feature · 2026-10-08 · Amazon Web Services
Events and videos
- re:Invent 2026 (30 Nov-4 Dec, Las Vegas): catalog live, reserved seating open, full-refund cutoff 16 Oct · 2026-10-08 · Amazon Web Services
Everything else AWS announced (What's New)
- Amazon OpenSearch Service now supports index-level encryption · 2026-10-12 · AWS What's New
- Amazon EMR now supports native data quality checks in Apache Spark jobs · 2026-10-12 · AWS What's New
- Amazon ElastiCache for Valkey introduces ElastiCache Insights · 2026-10-12 · AWS What's New
- AWS Secrets Manager adds managed external secrets support for Databricks and Twilio · 2026-10-12 · AWS What's New
- AWS Transfer Family supports custom ports for public SFTP servers · 2026-10-12 · AWS What's New
- Amazon Connect Customer now prefills step-by-step guides for after contact work · 2026-10-12 · AWS What's New
- Amazon EC2 G7 instances now available in Europe (Frankfurt) and Europe (Stockholm) Regions · 2026-10-12 · AWS What's New
- AWS now lets customers sign up for AWS and pay invoices using ACH direct debit · 2026-10-11 · AWS What's New
- TwelveLabs Pegasus 1.5 model now available on Amazon Bedrock · 2026-10-09 · AWS What's New
- Amazon SageMaker Unified Studio now supports custom Tooling blueprints · 2026-10-09 · AWS What's New
- Amazon Quick now supports brand templates for on-brand presentations and documents · 2026-10-09 · AWS What's New
- Amazon Connect Customer now provides automated checks to improve performance evaluation forms · 2026-10-09 · AWS What's New
- Anthropic Claude Sonnet 5.5 and Claude Opus 5.5 are now available on Kiro in AWS GovCloud (US) · 2026-10-09 · AWS What's New
- Amazon Bedrock now supports reasoning summaries for OpenAI models · 2026-10-09 · AWS What's New
- Amazon EC2 R8g instances now available in additional regions · 2026-10-09 · AWS What's New
- Amazon EC2 R8gd instances are now available in additional regions · 2026-10-09 · AWS What's New
- Amazon GuardDuty RDS Protection now detects data exfiltration and destruction in Aurora and RDS databases · 2026-10-08 · AWS What's New
- Amazon GameLift Servers adds CPU burstability for container fleets · 2026-10-08 · AWS What's New
- AWS Network Firewall adds wildcard support for container attribute filters · 2026-10-08 · AWS What's New
- Amazon RDS for Oracle now supports minor version upgrade prechecks and a new RDS event to help reduce patching downtime · 2026-10-08 · AWS What's New
- OpenAI GPT-6.1 Sol now supports Ultrafast mode on Amazon Bedrock · 2026-10-08 · AWS What's New
- Claude Haiku 5.5 is now available on AWS GovCloud (US) · 2026-10-07 · AWS What's New
- Claude Haiku 5.5 is now available on AWS · 2026-10-07 · AWS What's New
- AWS Config now supports 77 new resource types · 2026-10-07 · AWS What's New
- AWS Capabilities by Region now offers availability notifications for individual features and advanced filters · 2026-10-07 · AWS What's New
- Amazon EC2 C8gb instances now generally available in additional regions · 2026-10-07 · AWS What's New
- AWS Certificate Manager now supports ACME issuance through AWS PrivateLink · 2026-10-06 · AWS What's New
- AWS Batch now publishes job metrics to Amazon CloudWatch · 2026-10-06 · AWS What's New
- Announcing Amazon Nova 2.5 Sonic with improved reasoning for voice agents · 2026-10-05 · AWS What's New
- AWS Private CA now provides detailed certificate issuance logs · 2026-10-05 · AWS What's New
- AWS Batch now supports Amazon EKS access entry authentication · 2026-10-05 · AWS What's New
- AWS Client VPN now supports device posture assessment · 2026-10-05 · AWS What's New
- AWS Advanced Ruby Driver Wrapper is generally available · 2026-10-05 · AWS What's New
- Amazon EC2 introduces shared tags for Amazon Machine Images · 2026-10-05 · AWS What's New
- AWS Continuum for Penetration Testing now supports continuous penetration testing integrated directly into your CI/CD pipeline · 2026-10-05 · AWS What's New
- AWS Control Tower AFT now supports plan-only customization runs · 2026-10-05 · AWS What's New
- Amazon EC2 Hpc8a instances are now available in Asia Pacific (Singapore) · 2026-10-05 · AWS What's New
- GLM 5.3 by Z.ai is now generally available on Amazon Bedrock · 2026-10-05 · AWS What's New
- Amazon Redshift adds support for creating and refreshing Apache Iceberg materialized views · 2026-10-05 · AWS What's New
- GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan · 2026-10-02 · AWS What's New
- Amazon ElastiCache for Valkey now supports OpenTelemetry metrics and detailed monitoring · 2026-10-02 · AWS What's New
- AgentCore Gateway supports private TLS certificates for VPC endpoints · 2026-10-02 · AWS What's New
- The AWS MCP Server is now available in six additional AWS Regions · 2026-10-02 · AWS What's New
- Amazon OpenSearch Service introduces validation advisory for domain configuration changes · 2026-10-02 · AWS What's New
- AWS Brazil automates distribution of non-Brazilian software product licenses to Brazilian customers · 2026-10-02 · AWS What's New
- Amazon Aurora DSQL now supports partial indexes · 2026-10-02 · AWS What's New
- Amazon EKS and Amazon EKS Distro now support Kubernetes version 1.37 · 2026-10-02 · AWS What's New
- AWS Health introduces the version catalog for software lifecycle management · 2026-10-02 · AWS What's New
- Amazon ECS adds Amazon VPC Lattice support for blue/green, linear, and canary deployments · 2026-10-02 · AWS What's New
- Amazon Corretto 8 September 2026 Patch Updates · 2026-10-01 · AWS What's New
- Amazon DynamoDB introduces filtered export to Amazon S3 · 2026-10-01 · AWS What's New
- Amazon Q Developer now delivers enhanced visualizations in the AWS Management Console · 2026-10-01 · AWS What's New
- Amazon Redshift now supports cross-Region queries for your data lake · 2026-10-01 · AWS What's New
- AWS Well-Architected Agent is now available in preview · 2026-10-01 · AWS What's New
- Amazon Aurora PostgreSQL now supports direct querying of Apache Iceberg and Parquet data in your data lake · 2026-09-30 · AWS What's New
- Amazon S3 Tables now support all Apache Iceberg V3 data types · 2026-09-30 · AWS What's New
- OpenAI GPT-6 Astra now supports UltraFast mode on Amazon Bedrock · 2026-09-30 · AWS What's New
- OpenAI GPT-6.1 Sol is now generally available on Amazon Bedrock · 2026-09-29 · AWS What's New
- Amazon Bedrock Managed Agents, powered by OpenAI, is now available in preview · 2026-09-29 · AWS What's New
What this is
Everything AWS announced, filtered by a declared stack: what is new, what is insecure, what is being retired, what costs more and what tooling changed for the services the named reader runs, with everything else still listed as withheld, with the reason. The stack is a file in the vault (data/stack.json: the services, their aliases and the deadlines that matter), and this page draws it: the deadlines at the top of the edition, each service with the items that touched it. For every story: where it came from, who else covered it, one exact quote with its source, and why it matters. The stories are found, grouped and written by agents, from a registry of sources with a licence tier each (the sources), and every story says what it is: ai-generated, unreviewed until a person has reviewed it. The current edition is of 2026-10-13: first edition: two weeks of AWS, filtered by your stack (Lambda, S3, API Gateway, CloudFront, boto3). Each edition adds what happened and keeps the earlier stories, so the page is the whole wire so far, not one edition of it.
Corrections propagate. When the desk fetches a primary source it could not reach, or finds a story wrong, it corrects the story in the vault and records the correction, dated, in the story’s own changes; this page draws them under the story, in blue, for as long as the vault keeps them, and the edition’s header carries the desk’s note of what was corrected. The vault’s release notes name the stories added and updated in each publish, and the page flags them Updated. A corrected story is corrected where it is read, which is the argument this site makes of every publication.
Read it as an inbox. The bar above the stories says what is new since your last visit, how much of it is for you and how much is not under the lens you read as, and what the wire’s desk says changed in the vault: its release notes, one per publish (data/releases.json), newest first since your last visit. At each story, one tap: Done, Read later, Follow up, Not for me, More like this or Wrong; the story leaves your inbox, and the filters bring it back. Your decisions and what you have seen are kept in this browser first and reach your own vault when you press Update the vault; until then the bar and the Vault button say what is only here. Each wire keeps its own inbox, its own visit and its own lens. How it works.
Read as someone. The same stories reach different readers. Choose a persona and the edition shows what reached them, through which concern, and what was withheld, with the reason. That join is recorded in the vault by the wire’s own code (pipeline/join.py), not computed here; the page shows the record. If you are reading this site as one of its personas, the lens follows it.
The stack. The vault carries the 5 services its named reader runs (data/stack.json: each with its aliases, what to watch it for, and 4 dated deadlines), and the join turns each service into a concern, so under that reader’s lens a story reaches them when it names a service they run and is withheld, with the reason, when it does not. The page draws the deadlines at the top of the edition with the days left, and each service with the items that touched it. To change what reaches the reader, the desk edits the file in the vault; nothing on this site changes.
Where it comes from. The data is not on this site. It is in an encrypted vault that the wire’s agents write to, and this page opens it in your browser with a published read key: v202bla5 on dev.send.sgraph.ai. A commit to the vault is on this page within two minutes, with no release of the site. Anyone can read the whole vault, and its history, with sgit clone sgit_public_read_ad5c3f9e1f4d7632db06cd27f6ee6a256063300c426f4a94e7de33cf5a53e892:v202bla5. How the wire works has the contract and the wire’s own documents, read from the same vault.
For an agent
The AWS Wire on newsroom.sgit.ai (wire/aws/), one of 3 wires that share one code and one contract. The edition page reads as an inbox: what is new since the reader's last visit, for them and not under their lens, the vault's release notes (data/releases.json, wire-releases/v1, latest 2026-10-13.1: 'First edition: two weeks of AWS, filtered by your stack' at 2026-10-13T13:30:00Z), and one decision per story kept as a note in the reader's browser and carried to their own vault on Update (admin/notes/2026-10-13__the-wire-as-an-inbox.md). Corrections propagate: a corrected story carries its changes[] ({at, what}) under the story and the edition's header carries the desk's corrections note; stories named updated by a release or by brief.updated_in_edition are flagged Updated. The data is in a public-read sgit vault, not on this site: vault v202bla5 on https://dev.send.sgraph.ai, read key sgit_public_read_ad5c3f9e1f4d7632db06cd27f6ee6a256063300c426f4a94e7de33cf5a53e892:v202bla5 (read-only, published on purpose). Clone it with `sgit clone sgit_public_read_ad5c3f9e1f4d7632db06cd27f6ee6a256063300c426f4a94e7de33cf5a53e892:v202bla5` and read data/bundle.json (beats, stories, sources, personas, brief, docs, stack), data/deliveries.json (story × persona: reached or withheld, with the reason) and docs/*.md. https://newsroom.sgit.ai/wire/aws/snapshot.json holds the headlines, primary links, corrections and the latest release note as of this site's last release. The wire is a beta; its named reader (Dinis Cruz) agreed to be one, and the persona and personal brief of that name in the vault are theirs. Every story is marked ai-generated, unreviewed until a person reviews it; 0 of the 88 stories in the edition of 2026-10-13 have a primary source the research agent did not fetch, and those stories say so.