AWS

AWS Transfer Family now supports source IP preservation for SFTP servers behind a Network Load Balancer using Proxy Protocol v2. Previously, the NLB masked the client's actual IP, forcing logs and identity providers to see only the load balancer's private address. This update enables administrators to retain visibility of the true client IP for auditing, access controls, and compliance requirements.

• Enables Proxy Protocol v2 to pass original client IP through NLB to Transfer Family SFTP endpoints.
• Restores ability to perform IP-based auditing and logging with accurate source addresses.
• Allows custom identity providers to authorize users based on their true source IP instead of the NLB IP.
• Supports stricter compliance and security policies requiring granular access control by client origin.
• Applies specifically to VPC-hosted SFTP endpoints placed behind an NLB.

AWS has released general availability for T8i instances, featuring custom sixth-generation Intel Xeon 6 processors and AWS Nitro hardware. These new micro, small, medium, and nano sizes offer up to 30% better price performance than T3 instances, alongside significant gains in compute, network, and EBS bandwidth. They are optimized for low-to-moderate CPU workloads such as small databases, CI/CD pipelines, and event-driven functions.

• T8i instances provide up to 70% higher compute performance compared to previous T3 generations.
• Network bandwidth increases by 1.25x and EBS bandwidth by 2.4x over prior burstable options.
• Available in nano, micro, small, and medium sizes for cost-sensitive, variable workloads.
• Ideal for small databases, CI/CD pipelines, and low-traffic microservices requiring burst capacity.

AWS Direct Connect now offers a single fixed monthly price for 10 Gbps and 100 Gbps dedicated connections, eliminating per-gigabyte data transfer out charges within the selected tier. This model addresses the unpredictability of costs for workloads with large, sustained data egress, replacing the previous pay-as-you-go structure. The change targets network architects and FinOps teams seeking stable, predictable networking expenses without long-term contracts.

• Flat-rate pricing removes variable DTO charges for 10G and 100G dedicated connections.
• Monthly costs become predictable for workloads with large, sustained data egress volumes.
• No upfront commitment or long-term contracts required for this new pricing tier.
• Ideal for FinOps teams stabilizing network spend on high-throughput hybrid architectures.

AWS has updated root user authentication to route traffic across US East (N. Virginia), US East (Ohio), and US West (Oregon), eliminating the single-region dependency on N. Virginia. The system automatically handles this distribution transparently, requiring no changes to how users sign in. ConsoleLogin events are now logged in whichever of these three regions processes the request, shifting the logging location from a fixed point to a dynamic one.

• Root sign-in is now distributed across three regions to improve resilience during outages.
• CloudTrail ConsoleLogin events for root users now appear in the processing region.
• Update monitoring and alerting to cover N. Virginia, Ohio, and Oregon for full visibility.
• No action is required to change sign-in behavior as routing is automatic.

AWS Glue zero-ETL now tracks which integration owns target table properties, preventing accidental overlaps across Amazon S3 Tables and SageMaker Lakehouse catalogs. When a user attempts to create or modify an integration that conflicts with an existing one, the service identifies the owner and guides resolution. This ensures predictable control over data landing zones and keeps pipelines isolated.

• Glue now associates table properties with the owning zero-ETL integration for better governance.
• Conflicts are detected when multiple integrations target the same table without coordination.
• Support spans both Amazon S3 Tables and SageMaker Lakehouse catalogs.
• Users receive guidance to choose different targets or update existing integrations.
• Data teams gain predictable control over where source tables land in the catalog.

AWS STS now enforces a unified 4,096-byte limit on session tokens, replacing previous separate caps for tokens and input parameters like inline policies. The service returns token size and utilization metrics in responses, logging them to CloudTrail and publishing them to CloudWatch. An optional API parameter allows generating tokens up to the new limit to test infrastructure readiness.

• Unified 4,096-byte limit replaces separate caps for tokens and inline policies.
• CloudTrail and CloudWatch provide visibility into token size and utilization.
• New API parameter enables testing larger tokens against application limits.
• Simplifies capacity planning for complex session policy combinations.