AWS

AWS Direct Connect now exposes BGP route details for virtual interfaces, letting administrators see accepted and advertised routes alongside AS paths and community values. This data is available via the console or the ListVirtualInterfaceRoutes API. The feature is designed to streamline troubleshooting, verify route propagation, and monitor hybrid connectivity health.

• View accepted and advertised BGP routes directly in the Direct Connect console.
• Access route details programmatically using the ListVirtualInterfaceRoutes API.
• Inspect AS path and BGP community values to debug routing issues.
• Verify route propagation across private, transit, and public VIFs.

AWS has moved the IAM Policy Simulator into the main IAM console, replacing the standalone site to centralize identity management workflows. The update enables testing against Service Control Policies (SCPs), allowing teams to validate how organizational boundaries interact with identity and resource policies. Additional API capabilities provide greater flexibility for modeling complex permission scenarios used by security and platform teams.

• Simulator is now native to the IAM console, removing the need for a separate tool.
• New SCP testing capability reveals permission interactions across the organizational hierarchy.
• API updates allow more granular simulation of condition keys and policy interactions.
• Centralizes policy validation workflows for security and platform engineers.

AWS Transit Gateway now supports Policy-Based Routing (PBR), allowing traffic forwarding decisions based on source/destination IPs, ports, and protocols rather than just destination IP. This feature eliminates the need for complex multi-VPC architectures previously required for traffic steering or workload isolation. Network administrators can now classify and direct traffic inline within the Transit Gateway without adding extra infrastructure hops.

• PBR enables granular traffic steering based on multiple packet attributes including ports and protocols.
• Reduces operational overhead by removing the need for complex multi-VPC routing architectures.
• Allows security and network teams to direct traffic inline without additional infrastructure.
• Extends native Transit Gateway routing capabilities for better workload isolation.

Amazon Redshift has extended support for Graviton-based rg.large and rg.12xlarge instances to the trailing maintenance track, starting with patch P202. This update allows customers prioritizing production stability to leverage AWS Graviton performance, which offers up to 2.4x faster queries than RA3 instances at a 30% lower cost per vCPU. These instance types are now provisionable in all regions where Redshift RG is generally available.

• Graviton RG instances (rg.large/12xlarge) are now supported on the stable trailing track.
• Requires Redshift patch P202 or later to access these instance types.
• Delivers up to 2.4x query performance improvement over RA3 instances.
• Reduces cost by 30% per vCPU compared to previous RA3 generation.
• Available in all regions where Redshift RG is currently generally available.

Amazon MSK Express brokers have added a fully managed capability to stream Apache Kafka data into Amazon S3 general purpose buckets. This feature automates high-throughput delivery with end-to-end reliability, eliminating the need for custom self-managed connectors. The service claims up to 60% cost reduction compared to legacy self-hosted alternatives while supporting use cases like log archival and AI/ML training.

• MSK Express now natively sinks Kafka topics to S3 general purpose buckets without custom plugins.
• Automated scaling handles high-throughput workloads with guaranteed end-to-end reliability.
• Costs drop by up to 60% versus self-managed connector architectures.
• Simplifies pipelines for log archival, compliance retention, and data lake ingestion.
• Reduces operational overhead by removing the burden of managing connector infrastructure.

AWS WAF now supports pre-parse text transformations for query arguments, normalizing raw query strings before they are parsed into key-value pairs. Ten new post-parse transformations are also available to further standardize request content before inspection. These features help align WAF evaluation with application logic, mitigating evasion techniques like HTTP parameter pollution and parser differentials. Users can chain up to ten transformations within a single rule statement.

• Closes HTTP parameter pollution and parser differential evasion vectors.
• Normalizes raw query strings before WAF parses key-value pairs.
• Supports chaining up to ten transformations per rule statement.
• New options include URL decode and combining duplicate query args.
• Aligns WAF inspection logic with actual application interpretation.

Amazon EFS now supports cross-account replication within AWS GovCloud (US), enabling automatic file system replication between distinct AWS accounts. This feature allows customers to maintain up-to-date replicas in a target GovCloud region without manual setup. It addresses business continuity, disaster recovery, and compliance needs while supporting multi-account isolation strategies.

• EFS Replication now works across accounts in AWS GovCloud (US).
• Automates disaster recovery and business continuity for file data.
• Supports compliance requirements by isolating replicas in separate accounts.
• Eliminates manual setup for maintaining file system copies.