AWS

Amazon RDS for SQL Server now allows restoring Transparent Data Encryption-enabled databases on Multi-AZ instances and same-region read replicas. Previously, this operation was restricted to Single-AZ configurations, forcing users to disable TDE or migrate. The process requires backing up the TDE certificate to Amazon S3 and restoring it to the target instance before performing the database restore.

• Eliminates the need to disable TDE or switch to Single-AZ for encrypted database restores
• Supports restore operations on Multi-AZ instances and same-region read replicas
• Requires pre-storing the TDE certificate in Amazon S3 for restoration
• Maintains encryption posture during disaster recovery and replication scenarios

Fleet impact: Enables seamless encrypted restores for SQL Server workloads on RDS Multi-AZ and read replicas, removing the operational friction of disabling TDE or migrating to Single-AZ. Ensure TDE certificates are securely stored in S3 and accessible to the target RDS instance to avoid restore failures.

Amazon Neptune now allows administrators to use AWS resource tags and IAM principal tags as conditions in IAM policies and Service Control Policies. This tag-based access control eliminates the need to enumerate specific cluster ARNs when governing access to Neptune data-plane operations. The feature supports dynamic, attribute-based enforcement of organizational access boundaries for customers managing multiple clusters at scale.

• Enable dynamic access control by matching IAM principal tags to Neptune cluster tags in policies.
• Simplify policy management for large fleets by avoiding static ARN enumeration in IAM rules.
• Scope Neptune-db:* actions to specific clusters using tag conditions in IAM or SCPs.
• Leverages existing VPC, TLS, and IAM authentication layers for comprehensive security.

AWS has removed the mandatory Self-Managed License (SML) prerequisite for creating Host Resource Groups (HRGs) on EC2 Dedicated Hosts. This change simplifies setup for customers seeking hardware isolation or running EC2 Mac instances, eliminating the need for AWS License Manager configuration. BYOL workloads can still use SMLs for strict AMI restriction and license tracking if desired.

• HRGs can now be created without Self-Managed Licenses, reducing configuration overhead.
• Ideal for hardware isolation needs or EC2 Mac instances where BYOL is not applicable.
• BYOL customers retain the option to use SMLs for AMI restriction and license tracking.
• Disable the 'Restrict to AMIs' option or use license-conf to bypass SML requirements.

Amazon Kinesis Data Streams extends its On-demand Advantage mode to allow proactive scaling down of ingest capacity via warm throughput. Users can set a lower warm throughput value to reduce write throughput, though the stream ensures it maintains at least the capacity required for peak ingest over the last hour. This feature provides full control over both up and down scaling of stream write throughput.

• Warm throughput now supports scaling down, not just up, for On-demand Advantage mode.
• Set a lower warm throughput value to proactively reduce stream write capacity.
• Stream retains capacity needed for peak ingest in the last hour as a safety floor.
• Enables granular control over Kinesis stream costs and performance during traffic drops.