AWS

Amazon EKS Auto Mode and Karpenter now allow configuration of Elastic Fabric Adapter (EFA) network devices and EC2 placement groups within node pools. This update enables precise control over network interface types, supporting both EFA-only and standard ENI modes on EFA-capable instances. These features optimize distributed training and inference workloads by managing physical instance distribution and IP address utilization in VPCs.

• Configure EFA or standard ENI interfaces on EFA-capable instances in Auto Mode and Karpenter node pools.
• Use EFA-only interfaces to avoid consuming VPC IP addresses, preserving address space for other resources.
• Leverage placement groups to control physical instance distribution for improved performance in distributed workloads.
• Optimize network performance for AI training and inference tasks with fine-grained EFA configuration options.

AWS Network Load Balancer now supports listener rules that route connections based on the source IP type. This allows a single dual-stack NLB to direct IPv6 traffic to IPv6 targets and IPv4 traffic to IPv4 targets. The feature preserves the original client IP address end-to-end, eliminating the need for protocol translation or separate load balancers.

• Route IPv4 and IPv6 traffic to separate target groups from one NLB
• Preserve original client IP without NAT or protocol translation
• Avoid running dual NLBs or relying on DNS for IP version splitting
• Simplifies dual-stack architecture while maintaining end-to-end IP fidelity

Amazon RDS now supports the latest Cumulative Updates and General Distribution Releases for SQL Server versions 2016 through 2022. These updates include specific GDR patches addressing CVE-2026-40370 alongside standard feature improvements. AWS recommends upgrading instances to apply these security and stability fixes immediately.

• Applies to SQL Server 2016 SP3, 2017 CU31, 2019 CU32, and 2022 CU25
• GDR updates specifically patch security vulnerability CVE-2026-40370
• Use AWS Console or CLI to upgrade instances to latest RDS engine versions
• Review Microsoft KB articles for detailed fix lists before applying

Fleet impact: For RDS SQL Server fleets, prioritize patching to mitigate CVE-2026-40370. Verify engine versions match the new RDS release identifiers (e.g., 16.00.4255.1.v1 for SQL 2022) during maintenance windows to ensure compliance and security posture.

AWS Secrets Manager now emits direct events to Amazon EventBridge whenever a secret value changes, eliminating the need to parse multiple CloudTrail API calls. This simplifies detection of rotation or manual updates, allowing immediate triggering of event-driven workflows. Practitioners can route these notifications to Lambda, SNS, SQS, or Step Functions to refresh cached credentials in real time.

• Replaces complex CloudTrail parsing with direct Secrets Manager events for value changes
• Enables real-time reaction to secret rotation or manual updates via EventBridge rules
• Supports routing to Lambda, SNS, SQS, and Step Functions for automated credential refresh

AWS Lambda durable functions now allow you to encrypt execution state at rest using an AWS KMS customer managed key. Previously, data was encrypted by default with an AWS-owned key, which limited control over key rotation and access policies. This update enables organizations in regulated industries to maintain direct ownership of their encryption keys for compliance purposes.

• Encrypt durable execution state with your own AWS KMS keys instead of AWS-owned defaults.
• Gain direct control over key rotation schedules and access policies for execution history.
• Meets data governance requirements for regulated sectors like finance and healthcare.
• Applies to long-running workflows using automatic state management in Lambda.

AWS Organizations has increased the limit for Resource Control Policies (RCPs) from 1,000 to 2,000 per organization. This change allows enterprises with complex multi-account structures to implement more granular centralized permissions without hitting policy caps. RCPs continue to serve as the mechanism for restricting maximum permissions available to resources across member accounts, particularly for external principals.

• RCP quota doubled to 2,000, supporting larger multi-account environments.
• Enables finer-grained centralized access control without updating individual resource policies.
• Helps enforce organization-wide guidelines for external principal access at scale.
• Reduces friction for enterprises previously constrained by the 1,000 policy limit.

Amazon SageMaker Unified Studio now integrates Amazon OpenSearch, allowing users to query search and log analytics data directly within the platform. This connection enables the correlation of operational search data with assets from Amazon Redshift, S3, and relational databases in a single governed environment. The feature supports building pipelines that join real-time search metrics with transactional data for deeper insights into system performance and user behavior.

• Unified Studio now ingests OpenSearch logs and search data alongside Redshift and S3 assets.
• Enables direct correlation of operational metrics with transactional data in one governed workspace.
• Simplifies pipeline creation for combining real-time search data with structured analytics sources.
• Reduces data movement overhead by querying OpenSearch directly within the SageMaker environment.