project
AWS logging service that records API calls and resource activity for auditing and security analysis, with CloudTrail Lake offering a queryable event store.
No evidence-backed relationships are recorded.
Amazon Bedrock now runs Claude Opus 5, Sonnet 5 and Haiku 4.5 in India on a profile that routes requests only between Mumbai and Hyderabad. Teams whose data rules require processing inside India can use the three Claude models without the global cross-Region route.
Reality
EKS Pod Identity, launched at re:Invent 2023, replaces IRSA's per-cluster OIDC trust with one pods.eks.amazonaws.com principal on every IAM role. A dev.to migration guide has each role trust both paths during cutover, so teams can move and verify one workload at a time.
Reality
AWS collapsed two STS size limits into one 4,096-byte cap and now reports the assembled token's actual size in API responses, CloudWatch and CloudTrail, with a new parameter that pads tokens for testing.
Reality
A tester gave AWS DevOps Agent a broad elevated role and found its temporary session policy admits only supported actions, while an SSM document that accepts arbitrary package names still installed tmux after one approval.
Reality
AWS has published a pipeline that pulls Bedrock guardrail traces out of model invocation logs, rewrites them as OCSF Detection Findings, and lands them in the CloudWatch store where analysts already query CloudTrail and VPC Flow Logs.
Reality
The SSM agent holds a connection out to AWS, OpenSSH rides it as a ProxyCommand, and EC2 Instance Connect pushes a key that sshd forgets after 60 seconds, so the security group ingress list can stay empty.
Reality
The agent runs on Amazon Bedrock, starts its investigation when Cost Anomaly Detection fires, and posts the root cause into the Slack channel where the engineers who provisioned the resource already work. Public preview is us-east-1 only.
Reality
Wiz's walkthrough of AWS's new sandboxed sign-up finds an Organization management account and an identity account the customer cannot see, a $20 monthly budget tied to a deny policy, and six AWS security services blocked outright.
Reality
The Sysdig Threat Research Team says stolen cloud keys were checked against ten hosted model services and fronted to buyers, with the compromised tenant paying for every prompt at invocation prices.
Reality
Brain Cipher paralysed more than 230 Indonesian government services in June 2024 with under 2 percent of the data backed up. The AWS reference rebuild published on dev.to depends on two locks you cannot switch off later.
Reality
In HackerOne report #3022516 the trail was multi-region, the metric filter for unauthorised API calls existed and the alarm published to an SNS topic, while threat_detection.enabled read false. Turning it on costs one CLI call.
Reality
IAM Access Analyzer already names the unused permissions and writes the tightened policy. A new AWS pattern sorts each finding by how the role was created and files the fix as a pull request or an issue.
Reality
Two months of AWS audit logs from 125 environments went through UMAP and HDBSCAN to group more than 40,000 identities by what they actually did, and the classification rules that fell out run in plain SQL.
Reality
AWS's post on the deployment gives the sandbox defaults that decide whether it fits an inline path, among them a 15-minute session time-to-live configurable to eight hours and a choice between VPC-only and public internet access.
Reality
AgentCore Identity now hosts the redirect leg and keeps the tokens, and what you configure in exchange is an OIDC application in your corporate IdP, a service role, and AWS's callback URL inside your GitHub and Slack apps.
Reality
AWS fixed an SSRF in SSM Agent 3.3.4851.0. How much the bug actually gave an attacker depends on your IAM layout, and CloudTrail's StartSession records already show who called the vulnerable document.
Reality
AWS has made the Quick desktop assistant generally available on macOS and Windows and pitched it to IT as the sanctioned answer to shadow AI. It runs in Frankfurt, London and Ireland, and not in the Brandenburg sovereign cloud.
Reality
A policy that lets users read and manage their own IAM profile usually carries iam:AttachUserPolicy scoped to ${aws:username}. That scope is enough to attach AdministratorAccess to yourself in a single call.
Reality
A team's internal manual for running AWS deployments out of Slack, published on dev.to, documents how Amazon Q in chat applications checks each alias against an IAM role and a channel guardrail policy before it calls the SDK.
Reality
The argument AWS makes to IT for its newly general desktop assistant is that unapproved tools already move data out of controlled environments, and its answer is audit trails in CloudWatch and CloudTrail plus four named certifications.
Reality
Build · September 3, 2026 · 1 publisher
Build · September 3, 2026 · 1 publisher
Build · August 31, 2026 · 1 publisher
Security · August 31, 2026 · 1 publisher
Build · August 27, 2026 · 1 publisher
Build · August 26, 2026 · 1 publisher
Build · August 24, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Product · August 22, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Build · August 20, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher