#740: AWS News: EC2 Instance Attestation, S3 Conditional Deletes, and more!

0:00This is episode 740 of the AWS podcast released on October 6th, 2025. Hello, everyone. Welcome back to the AWS Podcast. I'm Liz here with you. Great to have you back. Joined by my co-host, Gillian Ford. G'day, Gillian. How are you doing? It's always a good day when it's podcasting. This is true. I think we can lead by that. In fact, that's a coffee mug right there in the making. So we have lots of updates. I think over 70 updates today and a couple really caught our eye. It's always hard to choose a favorite. It's like having a favorite child. It can't be. But if I had to choose, I think when we're looking through, AWS announces EC2 instance attestation.

0:39Now, this is really important and really, really cool. This is generally available. And it basically makes it easier for you to validate that only trusted software is running on your EC2 instances, including instances with AI chips and GPUs. Now, before you could, you know, root of operator access, et cetera. But how do you verify that the target EC2 instance configuration is what it actually is? So now what it is, is you can cryptographically verify that your EC2 instances are running your trusted configuration and your software. So this uses the Nitro Trusted Platform module and a testable Amazon machine images.

1:17And basically you can verify whether a target EC2 instance has the same measurement as the reference measurement generated by the AMI. and this also integrates with KMS and a whole bunch of other stuff but what's really cool here is not only is this available but it just is like it doesn't cost you anything to use this is pretty important, Julian This is, yeah I can imagine there's just like a lot of like important use cases where you'd want to be able to utilize this so I'm very excited to see Yeah, it's about proving one thing with security it's one thing to say security but it's the other thing to prove to an auditor or to an inspector or to yourself to say hey am i confident that this is the thing i think it is and yeah can i attest and this is available in all adb commercial regions including the us gov cloud us regions as well so you can get super excited yeah and i think there was also one for s3 that caught our eye as well oh yes because i think a A lot of people have been afraid of deleting something just in case there might be another object that is lingering around before you delete it.

2:30And that's what this new launch is, this new feature is, now supports conditional deletes for general S3 buckets. So this helps you prevent accidental deletions in high concurrency, multiple writer scenarios. so amazon s3 they're only going to allow your delete request to succeed if you have this e tag that is provided that matches the object so i know that would give someone like me just a lot more uh safety security be able to sleep at night exactly so it's basically saying am i deleting something that i think i'm deleting as in is it the version that i think i'm deleting or did it get changed by someone else.

3:17So this is really useful when you've got lots of people changing files over time and you think you're deleting the version that you want it to delete and it's not. So this now lets you do that. You can also use the if match condition key on your S3 bucket policies to force that condition, which is pretty cool. And also it's available at no additional cost in all AWS regions. So again, it's one of those nice quality of life things that pops up and makes life easier and you don't have to worry about it. It just happens. you often forget. So let's jump into some of the other updates. As I mentioned, there's a lot.

3:50Let's start with analytics. AWS Cleanrooms now supports incremental ID mapping with AWS entity resolution. So what this does is helps you perform real-time data synchronization across your collaborators' data sets with the privacy enhancing controls of AWS Cleanrooms. And now you can populate ID mapping tables in a Cleanrooms collaboration with only the new modified or deleted records since the last analysis. So this just makes it easy to share data when you kind of don't trust each other, but you need to trust each other. Amazon OpenSearch service now supports OpenSearch version 3.1. So improvements in areas like search relevance and performance.

4:26It also introduces features to simplify development of vector driven applications for GenoI workloads. It also incorporates Lucene 10 that enables optimized vector field indexing resulting in faster indexing times and reduced indexing sizes and lots of other other benefits as well. Amazon Open Search ingestion now supports cross-account ingestion and Amazon Open Search service announces a derived source for storage optimization. So this is a new feature that can reduce the amount of storage required for your domain and it means you can skip storing source fields and dynamically derive them when required so you can in the result rather than the working files.

5:07Amazon OpenSearch Serverless now supports disk optimized vectors so this allows you to implement high quality vector search capabilities while significantly reducing cost. This is a big deal so you can choose between memory optimized and disk optimized vector storage options and disk optimized gives you the same accuracy and recall rates by cost less. Now you make it slightly higher latency so it's good when you don't need sort of those sub millisecond response times so things that are a little bit more batchy can really fit in there. And the OpenSearch team has been very busy because Amazon OpenSearch Service now supports AI-powered forecasting, so this can later power insights into trending infrastructure utilization and events, applications and business metrics and more.

5:52And Amazon OpenSearch Service has announced Star Tree Index. This is a new feature that significantly improves aggregation performance for high cardinality and multidimensional queries. This index pre-aggregates data across configured dimensions and metrics at ingestion time, which enables sub-second response times for frequent aggregations. Now, Star Tree Index is designed for real-time analytics, I should say, and requires no changes to query syntax, so this is good. OpenSearch automatically uses the optimized path when supported queries are detected. And early benchmarks show faster aggregation performance on large data sets, so this is going to be a really interesting new capability.

6:31It works best with append-only data and builds during segment refresh merge. Amazon Redshift also announces the general availability of multi-dimensional data layouts, or MDDL. These dynamically sort data based on actual query filters, accelerating query performance. So unlike traditional sorting methods that sort data based on fixed columns, MDDL sorts data based on query filters. So like things like sales in the US, for example, which can give you up to 10 times better end-to-end performance compared to using only optimal single column sort keys for query workloads with repetitive query filters.

7:09So this is a really interesting thing. If you live in this world of data warehouses, that'll be interesting to you. Up next, we've got application integration. Amazon EventBridge now extends KMS customer managed key support to event bus rule filter patterns and input transformers. This capability enables you to use your own encryption keys to protect sensitive information in your event filtering and transformation logic to meet stringent security and compliance requirements. AWS X-Ray introduces adaptive sampling for automatic optimized error detection. This helps development teams reduce mean time to resolution during incidents by providing comprehensive trace data for root cause analysis while maintaining cost-efficient sampling rates during normal operations.

8:06Adaptive sampling supports sampling boost and anomaly span capture.

8:15AWS Step Functions now supports additional data sources and new observability metrics for distributed map. AWS Step Functions is definitely one of the most underrated. I'm a huge fan of Step Functions. If you are not familiar with it, if you've got a workflow, there's a good chance that it is a good use case for Step Functions. you can orchestrate over 14 000 api actions from over 220 aws services to build distributed applications and data processing workloads like i said if you have a workflow type of architecture there's a good chance that step functions would be a really good fit and and it's a lot easier to use than it used to be and it has a visual visual interface as well and using llms it's even easier to build stuff.

9:06So I'm literally using it now and I haven't used it for a while. I'm like, oh, this is so easy because I don't have to know anything about it. It just does the thing. Just does the thing. And speaking of step functions, we've got, it now supports IPv6 with dual stack endpoints. Proving once again that 2025 is the year of IPv6. Let's talk about artificial intelligence. No updates in this, but not only joking. Plenty of updates. Stability AI Image Services is now available in Amazon Bedrock. So this gives you a comprehensive suite of nine specialized imaging editing tools designed to accelerate your professional creative workflows.

9:46So this gives you granular control over image editing with a range of tools, which means you can go from concept to finished tool very quickly. So things like, you know, remove background, edit objects, search and replace, search and recolor, in paint, a whole bunch of stuff so very powerful. We're happy to announce on-demand deployment for custom Meta Llama models in Amazon Bedrock so this is an on-demand version of Meta Llama 3.3 that's been fine-tuned or distilled in Bedrock. DeepSeq version 3.1 model is now available as a fully managed option within Amazon Bedrock so again if that's a flavor that you want to use you can.

10:26open ai open weight models have expanded to new regions on amazon bedrock now this expansion brings these really powerful ai models closer to customers in different parts of the world now this means that you can use state-of-the-art ai models while keeping your data where you want them to be and it means you get access to the open ai open weight models that also excel in certain spaces and one of the things we're learning with foundation models and frontier models is that they all do different things slightly better or worse than each other. And so it's not kind of one model to rule them all. It's lots of models.

11:00And so that's why people like having choice. Speaking of which, QIN3 models are now available fully managed in Amazon Bedrock. So this gives you again, access to four QIN3 open weight foundation models that are available as fully managed serverless offerings. Amazon Bedrock Agent Core Runtime Browser and Code Interpreter have added support for VPC, AWS PrivateLink, CloudFormation and tagging. So this means you can integrate it into your automated infrastructure as code. Now, just as a reminder, Agent Core Runtime enables you to deploy and scale dynamic AI agents securely using any framework, protocol or model.

11:38So that gives you lots of choice. Amazon Lex provides generative AI-based enhanced natural language understanding in eight new languages. So you get Chinese, Japanese, Korean, Portuguese, Portuguese, Catalan, French, Italian, and German. So eight entire languages that I can't speak. So you've got a lot more capability there. And Amazon Lex has also provided enhanced confirmation and currency built-in slots for 10 additional languages as well. So more understanding for Portuguese, Catalan, French, Italian, German, Spanish, Mandarin, Cantonese, Japanese, and Korean. So this all helps with having more natural conversations with Lex.

12:17We're happy to announce That's Adabuse Neuron SDK 2.26.0. This release introduces support for PyTorch 2.8 and JAX 0.6.2, as well as enhanced inference capabilities on Trinium 2 instances. Now this is really important for deep learning workloads, et cetera. This allows you to deploy optimizations, parallelism support, mixture of expert models, et cetera. You can also now deploy Flux 1-dev image generation models along with Llama for Scout and Maverick variants in beta on training two instances. So lots of options for those smaller, more nifty models. Amazon Nova Act extension now has a build and test AR agents within your IDE.

13:05This is a tool that transforms how you build with Nova Act by bringing the entire agent development experience directly into IDs like Visual Studio Code, GitKyro and Cursor. And the Nova Act extension consolidates natural language based script creation, granular scripting precision and robust browser testing into a single unified user interface so you have to switch between things. The Nova Act extension is built on top of the Nova Act SDK which has been available in research preview since March of 2025. And this really addresses feedback we received from developers saying, put it all in one place in the IDE.

13:42So now it is. Amazon Q developer CLI, probably the place I spend most of my time these days on doing development because that's just how I roll. I was just thinking that. I bounce between Cairo and Q CLI. It now has support for remote MCP servers. So remote MCP servers improve scalability and security of the tools you use within your development tasks. So it reduces the use of compute resources by moving it to a centralized server. And it also helps you manage access and security. So you can integrate with things like Atlassian, GitHub, and others that support HTTP and support OAuth-based authentication.

14:18So you can plug it in and get going. Simon, I think this is the first time I've seen an update where I've really only thought about my own self-interest. Usually I think about our customer when I get excited about interest, but usually with QDeveloper CLI, I mean, if you talk to anyone at AWS, they're probably using it to hack around with their own internal productivity projects. So I'm sure a lot of people are going to be using this and just like super pumped for it. It's almost become the operating system. It really has, yeah. Just sit there and do stuff there. And then when the team adds new stuff, I'm like, oh, it now does this, now it does that.

14:53That's right. Pretty cool. Amazon SageMaker HyperPod now supports autoscaling using Carpenter. So that means you can automatically scale your clusters to meet dynamic inference and training demands. Amazon SageMaker HyperPod also announces health monitoring agent support for Slurm clusters. So if that's the clusters you're using, you can use it. It's still my favorite cluster name as well. You've got to love a cartoon reference in the name of a service. I miss the cartoon restaurant. I just heard you talking about cartoons. Hang on. So Slurm comes from, from, uh, not, uh, the guy that created, um, the Simpsons then also created a follow on one, um, where they're in space.

15:41Futurama. There we go. Whoa. Oh wow. That one. Yeah. Yeah. I love a cartoon reference. So that was a, you know, Futurama, they're drinking Slurm and someone thought that'd be a good name for a clustering system. And there you go. Slurm is open source. I like it. Speaking of other things that we like, let's talk about business applications. Amazon Connect Flow Designer now supports analytics mode. With Amazon Connect Flows, you can now create end-to-end self-service and automated customer experiences such as interactive voice response, step-by-step guides, and back office process tasks. tasks. So now with this flow designer, you can view aggregate metrics on how customers move through each step in the flow, including where they run into errors or abandon the experience.

16:35For example, you can see how many conversational AI interactions result in transfers to agent queues or when customers end up in the wrong queue because an error in the flow configuration. That's super useful, especially as more companies are really thinking about how to integrate these conversational AI agents into their conversational workflow. So I think this one's definitely one to bookmark if you're using Amazon Connect. Another one for Amazon Connect, you can now use custom attributes with interaction segments, ensuring reporting and analytics always reflect the true customer journey. Attributes such as business unit name, account type, or contact reason can be centrally managed.

17:21Amazon Connect Contact Lens now provides sensitive data redaction from voice and chat conversational analytics in seven additional languages. Amazon Connect launches the ability to search contacts using agent hierarchy filters. Amazon Connect Cases now supports filtering by date ranges in the case list view, enabling contact center managers and agents to efficiently manage their case workloads. Let's talk compute. The AWS Compute Optimizer now supports 99 new Amazon EC2 instance types. So again, this helps you identify additional savings opportunities across your EC2 instances without specialized knowledge or manual analysis.

18:05My reminder, if you're not checking every three months your EC2 fleet for opportunities, you're probably missing out. So you should take a look at that. It's different to the old world where you bought a server and that was your server. Not the case anymore. So obviously lots of chance to improve things. Speaking of improvement, now generally available Amazon EC2 R8GN instances. These instances are powered by Graviton 4 processors. They give you up to 30 % better compute performance than Graviton 3. and these feature the latest generation, sixth generation AWS Nitro cards and they give you up to 600 gigabits per second network bandwidth.

18:41This is the highest network bandwidth amongst network optimized EC2 instances. The other ones that are generally available are the R8GB instances and these are also available with up to 150 gig of EBS bandwidth. So again, more of a disk-based approach as well. Amazon EC2 supports detailed performance stats on all NVMe local volumes. I like this one. This gives you real-time visibility into the performance of your Nitro system-based EC2 instance store NVMe models, volumes, I should say, make it easier to monitor your storage health, et cetera. So you get 11 comprehensive metrics at one second granularity.

19:20So you can see what's going on, including things like queue depth, IO throughput, detailed IO latency histograms. These are things that you're probably used to seeing for EBS. This helps you monitor stuff that's running on the machine. itself. Amazon EC2 auto-scaling now supports forced cancelization of instance refreshes. So this means you can cancel it without waiting for any in-progress instance launches or terminations to complete. So again, this is about greater control, especially during emergency situations where you go rapidly roll forward to a new application deployment. So this gives you even more control.

19:53Amazon EC2's allowed AMI setting adds new parameters and enhanced AMI governance. There are now four new parameters, marketplace codes, deprecation time, creation date, and AMI names. So this allows you to define criteria to reduce the risk of launching things that aren't compliant in your environment. We're happy to announce unlimited network burst duration on EC2 i8G and i7i instances. So these, and this relates to sizes larger than 4x large. Basically, it allows you to burst permanently. So you can burst as much as you want within the limit that you've got. So you can deliver up to 100 gig of network performance bandwidth and 60 gig of dedicated bandwidth for EBS.

20:36So it's a honking great amount of throughput that you can get and you can stop bursting as in starts and stops and now just goes. Amazon EVS, the elastic VMware service, now allows you to securely migrate and stretch your layer-to networks from your on-premises data center to Amazon EVS environments over the public internet. So this adds to the existing capability of doing that through private connectivity like AWS Direct Connect or VPNs. Now you can just use elastic IP addresses and have a stable endpoint. So this can be really useful if you've got to move fast, maybe your licensing has run out, you need to upgrade, etc.

21:10You can move as quickly as you need. The Research and Engineering Studio on AWS version 2025.09 is now available. So this gives you things like fractional GPUs, simplified AMI management, and enhanced deployment flexibility. It also includes more regions as well. Basically, this is an open source solution that gives you a web-based portal for administrators to create and manage secure cloud-based research and engineering environments. We're happy to announce the availability of second generation AWS Outposts Racks in 52 more countries. And no, I will not say what those countries are. You can look at that yourself.

21:47And Adibus Parallel Computing Service, PCS, now supports Amazon EC2 capacity blocks for machine learning. So this means you can use that natively in your PCS clusters, and this makes it easier to get up and running. Let's talk about databases. Amazon RDS for MySQL now supports Community MySQL Innovation Release 9.4 in the RDS preview environment. Amazon RDS for MySQL announces extended support miner 5.7.44. Amazon RDS for Postgres 18 is now available in the RDS database preview environment. Amazon RDS for DB2 now offers reserved instances. Amazon RDS announces cross-region and cross-account snapshot copy.

22:34This launch allows you to copy snapshots across regions and accounts directly without outperforming it sequentially as two separate copies. Customers use cross-region and cross-account snapshot copies for managing the risk of incidents such as ransomware attacks and region outages affecting their production account or primary regions. And let's do a quick update in the topic of developer tools. Amazon Correto 25 is now generally available. Now, if you don't know what this is. Amazon Correto is a no-cost multi-platform production-ready distribution of OpenJDK. So if you're using Java, this is a thing you want because it gives you support for Linux, Windows, and Mac OS.

23:16And this is a long-term support version as well. So it means that you get on-term support. So this is a good thing for you to use if you live in that world. It's always good to stay up to date. So version 25 is now available. A few updates in end-user computing. Amazon AppStream 2.0 is enhancing the end-user experience by introducing support for local files, redirection on multi-session fleets. Amazon AppStream 2.0 announces support for Graphics G6 instances with fractionalized GPU sizes. Adibus end-user messaging now supports cloud formation for SMS. Let's do a little update on the Internet of Things.

24:01Adibus launches SiteWise MCP server for simplified modeling. This is available in the Adibus Labs MCP open source repository. This MCP server simplifies industrial data modeling by providing built-in domain validation and automated modeling capabilities, which means you don't need to have extensive API knowledge. The server supports existing Adibus IoT SiteWise functionality through familiar tools while adding new conversational interfaces for enhanced user interaction. The year of IPv6 and the MCP-ification of things. Ification, I like it. Next topic we've got is management and governance. AWS Budgets now supports custom time periods.

24:45And I think this is also a good service announcement that if you are not using AWS Budgets, it is so simple to set and forget. And if it's one of those things where hopefully you don't need to use it, but if you do need to utilize it, you will be thankful that you'll be notified that you are close to your budget. Amazon CloudWatch now supports resource tags when monitoring vended metrics. DevOps engineers and cloud administrators can now create dynamic monitoring views that align with their organizational structure using their existing AWS resource tags. Amazon CloudWatch launches cross-account and cross-region log centralization.

25:28This is a good one. I'm really excited about this. This capability seamlessly integrates with AWS organizations, enabling efficient aggregation of logs from workloads that span multiple accounts and regions into a single account without the need to manage custom solutions. The log centralization feature provides the ability to scope the centralization rules to copy log data from their entire organization, specific organizational units, or selected accounts into a single account. So for those of you who are thinking, oh my gosh, that could be a ton of logs if we're all centralizing them. No, this is a way that you can be strategic of which logs do centralize in one place.

26:11So you might not necessarily need to retain all of those logs. AWS announces the general availability of new capabilities within AWS billing and cost management that enables customers to manage their AWS spend across multiple organizations through a single AWS account. Customers can now share custom billing views containing cost management data with other AWS accounts outside their organization. AWS License Manager announces support for shared AWS Managed Active Directory across multiple accounts, simplifying Microsoft license management on AWS. AWS Organizations now provide account state information for member accounts.

26:55This launch allows you to have a more granular account state information such as suspended for AWS-enforced suspension, pending closure for in-process closure requests, and closed for accounts in their 90-day reinstatement window, and more. AWS Organizations now offers full IAM policy language support for service control policies, enabling you to write service control policies with the same flexibility as IAM-managed policies. With this launch, service control policies now support use of conditions, individual resource ARNs, and the not action element and allow statements. Next topic is security, identity, and compliance.