Automation / DevOps / IaC

Amazon SageMaker Notebooks now support Trusted Identity Propagation (TIP) for Athena, Redshift, and EMR Serverless within TIP-enabled projects. This feature routes individual IAM Identity Center user identities to AWS Lake Formation, enforcing granular row and column-level access control per user. It eliminates the need for broad shared execution roles while providing full CloudTrail audit attribution for data access.

• Enables per-user data boundaries in Lake Formation based on active IAM Identity Center identity.
• Removes reliance on shared broad execution roles, reducing permission sprawl and risk.
• Provides precise audit trails via CloudTrail showing exactly which user accessed specific data.
• Integrates automatically with existing compute connections, requiring no extra token management.

AWS has raised the default quota for managed policies attached to an IAM role from 10 to 20. This adjustment supports best practices for granular permission separation and simplifies onboarding to third-party AWS Partner solutions. The change applies automatically across all commercial, GovCloud, and China regions without requiring account-level action. Users needing more than 20 policies can request an increase up to 25 via Service Quotas.

• No code or config changes needed; the new limit applies automatically to existing roles.
• Reduces friction for attaching multiple vendor-specific managed policies during partner onboarding.
• Supports stricter least-privilege designs by allowing more purpose-specific policy attachments.
• Cap remains at 25 policies per role; higher limits require a Service Quotas request.

Amazon CloudWatch Centralization now copies and synchronizes log group tags from source accounts to the centralized destination log groups. This feature allows organizations to preserve cost, ownership, and compliance metadata when aggregating logs across multiple accounts and regions. Platform teams can leverage these propagated tags to scope IAM access and report on centralized logging spend by team.

• Tags from source log groups are automatically copied to destination log groups during centralization.
• Tag synchronization behavior is configurable when setting up centralization rules.
• Use propagated tags for IAM condition scoping and cost allocation reporting.
• Maintains metadata consistency across multi-account and multi-region log aggregation.

Amazon CloudWatch Pipelines has introduced three new managed processors to enrich and structure log data during ingestion. The RDS parser converts Aurora audit and error logs into structured fields, while the XML parser transforms embedded XML strings into JSON. Additionally, a GeoIP processor adds location context to IP address fields, eliminating the need for post-ingestion reprocessing.

• Parse Aurora audit and error logs directly into structured fields for immediate querying.
• Convert embedded XML strings in application logs to JSON without custom parsing logic.
• Enrich IP addresses with geolocation data automatically during the ingestion pipeline.
• Reduce infrastructure management by using fully managed processors for telemetry transformation.