AWS

Amazon SageMaker Feature Store now supports updating specific feature values within a record without rewriting the entire entity. This feature-level write capability replaces the traditional read-modify-write pattern, reducing both latency and storage costs. Multiple pipelines can now concurrently update distinct features in the same record, enabling efficient hybrid streaming and batch workflows.

• Eliminates read-modify-write cycles by updating only changed features
• Lowers write latency and storage costs compared to full record rewrites
• Enables concurrent multi-pipeline updates on the same feature group
• Simplifies integration for streaming jobs and nightly batch pipelines

Amazon GuardDuty introduces Custom Detection Rules, a library of 35 prebuilt rules targeting CloudTrail management events. These opt-in detections cover 26 unique finding types mapped to 10 MITRE ATT&CK tactics, allowing engineers to flag context-specific activities like external AMI sharing or MFA bypass without managing log ingestion. This feature enables precise tuning of threat detection to match organizational baselines rather than relying solely on default alerts.

• Enables 35 prebuilt rules for CloudTrail management events to extend threat coverage.
• Covers 26 finding types mapped to 10 MITRE ATT&CK tactics for better context.
• Allows opt-in activation for specific TTPs like AMI sharing or MFA absence.
• Eliminates need for manual log ingestion, normalization, or storage for these rules.

AWS has enabled custom Python plugins for managed InfluxDB 3 Core and Enterprise instances in Amazon Timestream. Users can host code in their own repositories and trigger execution for data transformations, alerts, and aggregations directly within the database. The managed environment provides standard library access and vetted packages, eliminating the need for external infrastructure to handle workload-specific logic.

• Run custom Python plugins in managed InfluxDB 3 Core and Enterprise editions.
• Host plugin code in public or private repositories you control.
• Triggers allow data transformations, alerting, and service integrations.
• Executes close to data, removing need for separate external processing.
• Environment includes standard library and Amazon-vetted Python packages.

AWS has extended S3 Object Lock to support event holds, enabling WORM protection to activate based on future triggers like contract closings. Unlike legal holds that stop immediately upon removal, event holds enforce a fixed retention duration after the trigger event occurs. This feature can be applied to individual objects or set as a bucket default to meet specific compliance windows.

• Event holds start WORM protection only after a specified trigger event occurs
• Retention duration is enforced after the event, avoiding over-retention required by policy
• Applies to individual objects or configured as a bucket-wide default setting
• Distinguishes from legal holds by maintaining protection for the full post-event duration

AWS allows AMI owners to define whitelists or blacklists of compatible instance types. Launch attempts on non-permitted instance types are automatically blocked, preventing failures due to incompatible pairings. Existing workflows remain unaffected unless these restrictions are explicitly applied.

• AMI owners can now enforce instance type compatibility via whitelists or blacklists.
• Incompatible launch attempts are blocked automatically, reducing operational failures.
• Default behavior remains unchanged; restrictions must be explicitly configured.
• Feature is available globally in all AWS Regions at no additional cost.