AWS | Techlist.io

awsMay 4, 20264 min readCurated summary

AWS Weekly Roundup: What’s Next with AWS 2026, Amazon Quick, OpenAI partnership, and more (May 4, 2026) | Amazon Web Services

The AWS weekly roundup highlights a major shift toward agentic AI across Amazon’s products and its partnership with OpenAI. The biggest announcements include expanded Amazon Quick capabilities, four specialized Amazon Connect solutions, and OpenAI models and Codex becoming available through Amazon Bedrock. AWS also introduced new EC2 instances, agent optimization tools, Ruby 4.0 support for Lambda, and a transition plan from Amazon Q Developer to Kiro. ## What’s Next with AWS 2026 - AWS and OpenAI executives presented new ways businesses are using AI agents to automate operations. - The announcements centered on Amazon Quick, Amazon Connect, and deeper integration with OpenAI through Amazon Bedrock. ## Amazon Quick Expands Beyond Chat - A new desktop app, currently in preview, connects Quick to local files, calendars, and communications without requiring a browser. - Users can sign up with a personal email or Google, Apple, GitHub, or Amazon credentials; an AWS account is not required. - Quick can generate: - Documents - Presentations - Infographics - Images - New integrations include Google Workspace, Zoom, Airtable, Dropbox, and Microsoft Teams. - The preview “Build custom apps with Quick” feature lets users create intelligent applications, dashboards, and web pages using natural-language instructions. ## Amazon Connect Becomes Four Agentic AI Products - **Amazon Connect Decisions** applies Amazon’s operational expertise and supply-chain tools to help organizations move from reactive crisis management to proactive planning. - **Amazon Connect Talent** provides AI-led interviews, science-backed assessments, and consistent candidate evaluations for large-scale hiring. - **Amazon Connect Customer**, the renamed customer-service product, supports personalized voice, chat, and digital experiences, with conversational AI that can be configured in weeks. - **Amazon Connect Health** supports patient verification, appointment management, patient insights, ambient documentation, and medical coding. ## OpenAI Partnership Expands Through Amazon Bedrock - OpenAI models, including GPT-5.5 and GPT-5.4, are coming to Bedrock in limited preview. - Customers can use existing Bedrock APIs with AWS security, governance, and cost controls, without managing new infrastructure. - **Codex on Amazon Bedrock** brings OpenAI’s coding agent into AWS environments: - Authentication uses AWS credentials. - Inference runs through Bedrock. - Usage can count toward AWS cloud commitments. - Initial access includes the Codex CLI, desktop app, and Visual Studio Code extension. - **Bedrock Managed Agents powered by OpenAI** combines OpenAI models with AWS infrastructure and the OpenAI harness for long-running, production-oriented agent workflows. ## New EC2 Instance Families - **M8in and M8ib** instances are generally available, offering up to 43% higher performance than M6in and M6ib. - M8in provides up to 600 Gbps of network bandwidth. - M8ib provides up to 300 Gbps of EBS bandwidth. - **R8in and R8ib** target memory-intensive workloads such as commercial databases, data lakes, and SAP HANA. - **C8ine and M8ine** provide up to 2.5 times higher packet performance per vCPU and up to twice the internet-gateway throughput of their predecessors. - These network-optimized instances are designed for virtual firewalls, load balancers, security appliances, and 5G user-plane workloads. ## AgentCore and Lambda Updates - Bedrock AgentCore Optimization, in preview, adds: - Production-trace analysis - Recommendations for system prompts and tool descriptions - Batch evaluations - A/B testing against live traffic - Recommendations require human approval before deployment. - AWS Lambda now supports Ruby 4.0 as a managed runtime and container base image. - Ruby 4.0 support includes advanced logging features such as structured JSON logs, configurable log levels, and custom CloudWatch log groups. ## Amazon Q Developer Moves Toward Kiro - Amazon Q Developer IDE plugins and paid subscriptions will reach end of support on April 30, 2027. - New signups will be blocked beginning May 15, 2026. - Existing subscriptions can continue adding users until then. - Opus 4.6 will leave Q Developer Pro on May 29, 2026, while newer coding models such as Opus 4.7 will be exclusive to Kiro. - Q Developer experiences in the AWS Console, documentation, mobile app, Slack, and Microsoft Teams are unaffected. AWS’s direction is increasingly centered on managed AI agents integrated into everyday business workflows. Organizations adopting these services should evaluate the new Bedrock, Quick, and Connect capabilities while also planning migration from Q Developer to Kiro before the announced support deadlines.

Read original

AWS AI Agents Amazon Bedrock Amazon Ec2+3

awsApr 28, 20263 min readCurated summary

Top announcements of the What’s Next with AWS, 2026 | Amazon Web Services

The 2026 “What’s Next with AWS” event focused on how AI agents are reshaping business operations. Major announcements included Amazon Quick, an AI work assistant; four specialized Amazon Connect solutions; and an expanded AWS–OpenAI partnership bringing OpenAI models and Codex to Amazon Bedrock. Together, these offerings emphasize integrated agents that can connect to existing systems, make decisions, and execute tasks within enterprise-controlled infrastructure. ## Amazon Quick Becomes a Broader AI Work Assistant - Amazon Quick connects to workplace information, learns user preferences, and takes action on users’ behalf. - A new desktop app, currently in preview, can access local files, calendars, and communications without requiring a browser. - Free and Plus plans are available without an AWS account. Users can register with a personal email or Google, Apple, GitHub, or Amazon credentials. - Quick can generate documents, presentations, infographics, and images directly within chat. - New native integrations include Google Workspace, Zoom, Airtable, Dropbox, and Microsoft Teams. ## Amazon Connect Expands into Four Agentic AI Products AWS is repositioning Amazon Connect as a portfolio of solutions for specific business workflows: - **Amazon Connect Decisions:** A supply-chain planning and intelligence platform using AI teammates, Amazon’s operational expertise, and more than 25 specialized tools to support proactive planning. - **Amazon Connect Talent:** A hiring solution in preview that provides AI-led interviews, science-backed assessments, and standardized evaluations for large-scale recruiting. - **Amazon Connect Customer:** The renamed customer-experience product, supporting voice, chat, and digital channels. New configuration tools aim to let organizations deploy conversational AI in weeks rather than months. - **Amazon Connect Health:** Automates patient verification, appointments, patient insights, ambient documentation, and medical coding to improve access to care and reduce administrative workloads. ## AWS and OpenAI Expand Their Partnership The companies announced several limited-preview offerings that bring OpenAI capabilities into AWS environments: - **OpenAI models on Amazon Bedrock:** Models including GPT-5.5 and GPT-5.4 will be accessible through existing Bedrock APIs, with AWS security, governance, and cost controls. - **Codex on Amazon Bedrock:** Organizations can run OpenAI’s coding agent using AWS credentials and infrastructure, with usage counting toward AWS cloud commitments. Initial access includes the Codex CLI, desktop app, and Visual Studio Code extension. - **Bedrock Managed Agents powered by OpenAI:** This service combines OpenAI models with AWS-managed infrastructure and the OpenAI harness for building production-ready agents capable of reasoning through long-running tasks. AWS’s announcements point toward a future in which AI agents are embedded directly into workplace tools, operational systems, customer-service platforms, and cloud development environments. Organizations looking to adopt these capabilities should evaluate the available previews, integrations, governance controls, and workflow fit before moving to production.

Read original

AWS Cloud Infrastructure Openai Codex+4

awsApr 27, 20263 min readCurated summary

AWS Weekly Roundup: Anthropic & Meta partnership, AWS Lambda S3 Files, Amazon Bedrock AgentCore CLI, and more (April 27, 2026) | Amazon Web Services

This week’s AWS news centers on deeper AI infrastructure partnerships and tools for building production-ready agents. AWS and Anthropic are expanding Claude’s integration with AWS hardware and Amazon Bedrock, while Meta is adopting Graviton for large-scale agentic AI workloads. New services for Lambda, EKS, Aurora, and Bedrock also emphasize simpler data access, hybrid networking, serverless scaling, and faster agent development. ## Anthropic and Meta Expand AWS AI Partnerships - Anthropic is training advanced foundation models on AWS Trainium and Graviton processors. - Anthropic and AWS’s Annapurna Labs are co-engineering at the silicon level to improve efficiency across the stack. - Claude Cowork is now available through Amazon Bedrock, allowing enterprise teams to collaborate with Claude while keeping data within AWS. - A unified Claude Platform on AWS is planned, offering a single experience for building, deploying, and scaling Claude applications. - Meta signed an agreement to deploy tens of millions of AWS Graviton cores for CPU-intensive agentic AI tasks, including reasoning, code generation, search, and orchestration. ## New Lambda and Kubernetes Infrastructure - AWS Lambda can mount Amazon S3 buckets as file systems using S3 Files. - Functions can perform standard file operations without downloading data first. - Built on Amazon EFS, S3 Files combines file-system access with S3’s scalability, durability, and cost model. - Multiple Lambda functions can share the same workspace, supporting AI agents that need persistent memory or shared state. - The Amazon EKS Hybrid Nodes gateway simplifies networking between cloud-based EKS resources and on-premises Kubernetes Pods. - It enables pod-to-pod traffic, control-plane webhook communication, and access to AWS services without making on-premises pod networks routable. - The gateway is available at no additional charge. ## Aurora Serverless and Bedrock Agent Development - Aurora Serverless now offers up to 30% better performance on platform version 4. - Its scaling algorithm better handles competing workloads, including busy APIs and bursty agentic AI applications. - The service continues to scale to zero during idle periods, with no additional charge for the improvements. - Amazon Bedrock AgentCore adds a managed harness in preview, allowing developers to define a model, system prompt, and tools without writing orchestration code. - Harnesses can later be exported as Strands-based code for greater control. - The AgentCore CLI supports governed, auditable deployments through AWS CDK, with Terraform support planned. - The CLI is available in 14 AWS Regions at no additional charge, and AgentCore skills support coding assistants. ## Cost Management, Operations, and Machine Learning - Granular cost attribution for Amazon Bedrock enables teams to track usage by project or organization and support detailed chargeback. - AWS DevOps Agent can work with the Salesforce MCP Server to investigate incidents, diagnose causes, and notify customers through Salesforce Service Cloud. - AWS microcredentials are now free through AWS Skill Builder in supported countries. - These hands-on assessments use simulated business scenarios and live AWS environments rather than traditional multiple-choice testing. - Amazon SageMaker AI can recommend optimized generative AI inference configurations, including instance types, containers, and inference parameters, helping reduce latency and deployment costs. ## Upcoming AWS Events - “What’s Next with AWS” is scheduled as a virtual event on April 28. - AWS Summits continue in May across cities including Singapore, Tel Aviv, Warsaw, Stockholm, Sydney, Hamburg, Seoul, Amsterdam, Bangkok, and Milan. AWS’s latest releases point toward a more integrated AI platform: specialized hardware for model execution, managed agent tooling, shared state through serverless storage, and stronger cost and operational controls. Builders should evaluate S3 Files and AgentCore for AI workflows, while teams running production inference can benefit from SageMaker recommendations and Bedrock’s improved cost attribution.

Read original

AWS Kubernetes Generative AI PostgreSQL+4

awsApr 6, 20263 min readCurated summary

AWS Weekly Roundup: AWS DevOps Agent & Security Agent GA, Product Lifecycle updates, and more (April 6, 2026) | Amazon Web Services

The April 6, 2026 AWS Weekly Roundup highlights the general availability of AWS DevOps Agent and AWS Security Agent, autonomous “frontier agents” designed to handle complex operational and security tasks. It also reviews AWS service lifecycle changes and summarizes notable product launches and technical updates from the previous week. The overall message is that AWS is expanding agentic automation while helping customers manage service transitions and adopt new capabilities. ## AWS DevOps Agent and Security Agent Reach GA - **AWS DevOps Agent** - Investigates incidents, accelerates resolution, and helps prevent recurring problems. - Works continuously across multiple steps until an operational goal is complete. - Customers report up to **75% lower mean time to resolution (MTTR)** and **3–5 times faster incident resolution**. - Western Governors University reduced resolution times from hours to minutes. - **AWS Security Agent** - Provides continuous, context-aware penetration testing during the software development lifecycle. - Operates similarly to a human penetration tester. - LG CNS reported testing that was more than **50% faster**, approximately **30% less expensive**, and produced fewer false positives. - **Deployment flexibility** - Both agents support AWS, multicloud, and on-premises environments. - They are intended to automate repetitive investigative and testing work while allowing teams to focus on higher-value activities. ## AWS Service Lifecycle Changes AWS updated its Product Lifecycle Changes guidance on March 31, 2026, including migration recommendations and alternative services. - Services with availability changes or maintenance guidance include: - AWS App Runner - AWS Audit Manager - AWS CloudTrail Lake - AWS Glue Ray jobs - AWS IoT FleetWise - Amazon Application Recovery Controller Readiness Check - Amazon Comprehend features such as Topic Modeling and Prompt Safety Classification - Amazon Rekognition streaming and batch moderation features - Amazon SNS Message Data Protection - Services listed as entering sunset include: - AWS Service Management Connector - Amazon RDS Custom for Oracle - Amazon WorkMail - Amazon WorkSpaces Thin Client - **Amazon Chime SDK Proxy Sessions** is reaching sunset. AWS recommends reviewing the relevant service documentation or contacting Support to reduce operational disruption. ## Notable AWS Launches - Amazon ECS introduced **Managed Daemons for ECS Managed Instances**. - The AWS Sustainability console now consolidates **Scope 1–3 emissions reporting**. - **Amazon Bedrock AgentCore Evaluations** became generally available. - AWS Transform added generally available automated codebase analysis. - CloudWatch introduced OpenTelemetry Container Insights for Amazon EKS in preview. - Amazon Lightsail added compute-optimized bundles with up to **72 vCPUs**. - Amazon CloudFront added **SHA-256 support** for signed URLs and signed cookies. ## Additional AWS Resources The roundup also points readers to material on: - Architecting agentic AI applications on AWS. - Reducing data-transfer costs with Network Load Balancers. - Preventing hallucinations in production AI agents. - The AWS World Sports Innovation Cup. - Exploring AWS communities through an interactive 3D globe. AWS also encourages readers to participate in Builder Center discussions, community events, AWS Summits, and developer-focused programs. AWS teams should review the lifecycle notices for services they depend on, while developers and operations groups may benefit from evaluating the new agents and launches for automation, security testing, and observability improvements.

Read original

AWS Observability DevOps Security+4

awsMar 30, 20263 min readCurated summary

AWS Weekly Roundup: AWS AI/ML Scholars program, Agent Plugin for AWS Serverless, and more (March 30, 2026) | Amazon Web Services

The March 30, 2026 AWS Weekly Roundup highlights the new AWS AI & ML Scholars program, which will offer free generative AI education to up to 100,000 people and fully funded Udacity Nanodegrees to 4,500 top participants. It also emphasizes new tools for serverless development, SageMaker IDE integration, expanded Lambda Managed Instance capacity, and streaming speech synthesis. AWS Summit and Community Day events are also scheduled worldwide. ## AWS AI & ML Scholars Program - Open to anyone aged 18 or older, with no prior AI or machine learning experience required. - Includes: - A foundational generative AI Challenge phase. - A fully funded three-month Udacity Nanodegree for the top 4,500 performers. - Applications close June 24, 2026. ## Serverless and Database Improvements - **Aurora PostgreSQL express configuration** enables serverless databases to be created and connected in seconds using preconfigured defaults. - **Aurora PostgreSQL is now part of the AWS Free Tier**, with eligible new customers receiving AWS credits. - The **Agent Plugin for AWS Serverless** adds skills, sub-agents, and Model Context Protocol servers to AI coding assistants such as Kiro, Claude Code, and Cursor. - It supports building, deploying, troubleshooting, and managing production-ready serverless applications. - The **Aurora DSQL Connector for Ruby** automatically generates authentication tokens for each connection while remaining compatible with the `pg` gem. ## SageMaker and AWS Console Updates - **SageMaker Studio** now supports remote connections from Kiro and Cursor, combining those IDEs’ coding workflows with SageMaker’s scalable compute. - The AWS Management Console now supports visual customization, including account colors and hiding unused regions or services to reduce interface clutter. ## Expanded Lambda Managed Instance Capacity - The file descriptor limit has increased from 1,024 to 4,096, supporting higher-concurrency and file-intensive workloads. - Functions can now use up to: - 32 GB of memory - 16 vCPUs - Users can select memory-to-vCPU ratios of 2:1, 4:1, or 8:1 for workloads such as data processing, media transcoding, and scientific simulations. ## Conversational Speech with Amazon Polly - Polly’s new Bidirectional Streaming API supports incremental text-to-speech generation. - Audio synthesis can begin before an LLM or other application has produced the complete response, making it better suited to conversational AI. ## Upcoming AWS Events - AWS Summits are free, in-person events covering cloud, AI, best practices, and networking. - Upcoming locations include Paris, London, Bengaluru, Singapore, Tel Aviv, and Stockholm. - AWS Community Days in San Francisco and Romania will feature community-led talks, workshops, and hands-on labs. AWS developers can follow the AWS News Blog and “What’s New with AWS” for additional announcements, while the AWS Builder Center and Events and Webinars pages provide opportunities for learning and community participation.

Read original

AWS AI Database Design PostgreSQL+4

awsMar 26, 20262 min readCurated summary

Customize your AWS Management Console experience with visual settings including account color, region and service visibility | Amazon Web Services

AWS has expanded User Experience Customization (UXC) to let administrators tailor the Management Console by account color, visible Regions, and visible services. These settings help teams distinguish accounts and reduce clutter by showing only relevant resources. They affect console appearance only and do not restrict access through the CLI, SDKs, APIs, or Amazon Q Developer. ## Account Color Customization - Administrators can assign a color to an AWS account through **Account display settings**. - The color appears in the console navigation bar to make account purpose easier to recognize. - Teams can use colors such as: - Orange for development - Light blue for testing - Red for production ## Region Visibility - Administrators can configure which AWS Regions appear in the console’s Region selector. - They can either show all available Regions or select a specific list. - After saving, only the chosen Regions appear in the navigation bar. - This reduces unnecessary scrolling and helps users focus on approved or relevant Regions. ## Service Visibility - Administrators can select which AWS services appear in the **All services** menu and console search results. - Services can be searched for or selected by category, such as Popular services. - Hidden services are removed from the console interface but remain accessible through programmatic tools. ## Programmatic Configuration - Account customization can be managed through the `AWS::UXC::AccountCustomization` CloudFormation resource. - The resource supports: - `AccountColor` - `VisibleServices` - `VisibleRegions` - Example configurations can expose services such as `s3`, `ec2`, and `lambda`, while limiting Regions to `us-east-1` and `us-west-2`. - Templates can be deployed with the AWS CLI using `aws cloudformation deploy`. AWS administrators can use these settings to create a clearer, more focused console experience without changing permissions or underlying account access.

Read original

AWS API Cli Cloudformation+3

awsMar 19, 20264 min readCurated summary

20 years in the AWS Cloud – how time flies! | Amazon Web Services

AWS’s 20-year evolution reflects a shift from foundational cloud infrastructure to managed services for AI, automation, and agentic applications. The author argues that AWS’s most important innovations come from responding to customer needs rather than chasing every fashionable technology. Personal experiences with AWS and its community illustrate how cloud services have enabled developers, researchers, and businesses to pursue previously impractical projects. ## AWS’s Impact on the Author’s Career - The author met AWS blogger Jeff Barr in Seoul in 2006, shortly after Amazon began promoting API-based services. - Inspired by Barr, the author began building APIs for third-party developers and later used AWS for large-scale academic research. - The author’s company became one of Korea’s earliest AWS customers in 2014. - AWS helped make advanced computing capabilities accessible to individuals, startups, researchers, and enterprises. ## Innovation Driven by Customer Needs - AWS has grown to more than 240 cloud services and launches thousands of features each year. - The author highlights the importance of distinguishing genuine technological trends from temporary distractions. - AWS’s evolution spans deep learning, generative AI based on large language models, and today’s agentic AI. - The central innovation principle is to listen to customers and solve their most important problems, rather than adopting technology simply because it is fashionable. ## Major AWS Milestones The article recalls foundational services from AWS’s first decade, including: - Amazon S3 and EC2 in 2006 - Amazon RDS and VPC in 2009 - DynamoDB and Redshift in 2012 - WorkSpaces and Kinesis in 2013 - AWS Lambda in 2014 - AWS IoT in 2015 ## Containers and Serverless Databases - Amazon ECS, launched in 2014, simplified running containers across managed EC2 clusters. - Amazon EKS later added managed Kubernetes, while AWS Fargate enabled serverless container deployment. - Amazon Aurora provided highly available relational databases at scale. - Aurora Serverless evolved from version 1 to version 2, which can scale down to zero. - Aurora DSQL, launched in 2025, extends the serverless model to distributed SQL workloads requiring continuous availability. ## Making Machine Learning More Accessible - Amazon SageMaker, launched in 2017, provided an end-to-end managed environment for building, training, and deploying ML models. - In 2024, AWS introduced the next-generation SageMaker platform for data, analytics, and AI, along with SageMaker AI for model development and deployment. - AWS also developed specialized hardware: - Inferentia for low-latency inference - Trainium for high-performance AI training - Trainium3 UltraServers for improved economics in generative AI workloads ## Improving Cloud Price Performance - EC2 A1 instances introduced AWS Graviton processors based on Arm architecture. - Later Graviton generations expanded price-performance benefits across services such as ECS, EKS, Lambda, RDS, ElastiCache, EMR, and OpenSearch Service. - More than 90,000 customers have reportedly adopted Graviton-based infrastructure. ## Hybrid Cloud and Edge Computing - AWS Outposts brings AWS infrastructure and services into customer data centers and edge locations. - Available configurations range from 1U and 2U servers to 42U racks and multi-rack deployments. - Customers use Outposts for low-latency access, local processing, data residency, and applications with on-premises dependencies. ## Generative AI and Agentic Development - Amazon Bedrock provides access to multiple AI models and managed capabilities for building secure generative AI applications. - Bedrock AgentCore extends the platform to deploying and operating agents at scale. - More than 100,000 customers use Bedrock for personalization, workflow automation, and insight generation. - Amazon CodeWhisperer evolved into Amazon Q Developer, adding conversational assistance, project-based generation, and code transformation. - The service later evolved into Kiro, an agentic development tool centered on spec-driven development and autonomous coding tasks. - AWS expanded model choice through Amazon Titan and Amazon Nova, including services for building frontier models and browser-automation agents. AWS’s history suggests that the strongest path forward is to use AI and cloud services to address concrete customer and business challenges. The author’s examples present AWS as an evolving platform whose value comes not only from individual launches, but from steadily making advanced infrastructure, machine learning, and autonomous software development more accessible.

Read original

AWS Database Design Machine Learning Kubernetes+4

awsMar 18, 20262 min readCurated summary

Our First 2026 Heroes Cohort Is Here! | Amazon Web Services

AWS has announced its first 2026 Heroes cohort, recognizing Maurizio, Ray Goh, and Sheyla Leacock for combining technical expertise with community leadership. Their work spans cloud architecture, generative AI, machine learning, and cybersecurity, while emphasizing mentorship, education, and meaningful human connections. Together, they demonstrate how technology leaders can expand access to skills and strengthen communities globally. ## Maurizio – Pignola, Italy - CTO and organizer of the AWS User Group Basilicata. - Has spent more than a decade developing cloud communities and technology ecosystems in areas where they previously did not exist. - Founded an international technology conference in a small mountain village, connecting global experts with local developers. - Covers topics including cloud architecture, DevOps, and web scaling, alongside creative networking opportunities. - Mentors children, university students, and professionals transitioning into cloud careers. - Combines technical leadership with inclusive, cross-generational community building. ## Ray Goh – Singapore - AI and machine learning community leader involved in AWS programs since 2018. - Founded The Gen-C in 2024, offering public library workshops on generative AI, LLM fine-tuning, and AWS AI agents. - Has spoken at major AWS events and contributed to the AWS Machine Learning Blog. - Led DBS Bank’s AWS DeepRacer initiative, which trained more than 3,100 employees. - Trained over 1,300 ASEAN students in LLM techniques in 2025. - Supports skills-based programs teaching AI and machine learning to women, children, and young people. ## Sheyla Leacock – Panama City, Panama - IT security professional, mentor, technical writer, and international speaker. - Leads the AWS User Group in Panama and participates in AWS Community Days and regional meetups. - Has spoken at AWS Summits, AWS re:Invent PeerTalk sessions, and more than 20 international conferences. - Publishes educational content focused on AWS cloud computing and cybersecurity. - Works with universities as a guest lecturer to help develop future technology and security professionals. - Strengthens the cloud and cybersecurity ecosystem through education, knowledge sharing, and community leadership. The new cohort highlights the broader impact of community-driven technology leadership. Readers can visit the AWS Heroes webpage to learn more about the program or connect with a Hero.

Read original

AWS AI Database Design Machine Learning+4

netflixFeb 28, 20263 min readCurated summary

Mount Mayhem at Netflix: Scaling Containers on Modern CPUs

Netflix’s effort to modernize its container runtime exposed a hardware-level bottleneck rather than an application problem. Under heavy startup concurrency, containers with many image layers triggered massive mount and unmount activity, causing kernel lock contention, systemd stalls, and container startup failures. The issue was especially severe on older dual-socket NUMA instances, while newer single-socket systems scaled much more reliably. ## Container Startup at Netflix - New AWS capacity is rapidly filled with pods as applications scale. - Some nodes became unresponsive, with: - Health checks timing out for more than 30 seconds - Kubelet requests to containerd timing out - systemd processing huge numbers of mount events - The mount table taking tens of seconds to read - The problem primarily affected `r5.metal` instances running images with more than 50 layers. ## Mount Lock Contention - With user namespaces, containerd performs several mount operations for every image layer: - `open_tree()` references the layer. - `mount_setattr()` applies the container’s ID mapping. - `move_mount()` creates an ID-mapped bind mount. - These bind mounts become OverlayFS lower directories and are later unmounted. - The Linux VFS uses global mount-related locks, so concurrent container creation causes CPUs to contend on the same kernel locks. - For 100 containers with 50 layers each, containerd performs the process twice: - `100 × 2 × (1 + 50 + 50) = 20,200` mount operations - This makes startup cost depend heavily on both container concurrency and image layer count. ## Why the New Runtime Exposed the Problem - The old Docker-based runtime shifted file ownership while unpacking images. - All containers shared one host user range, avoiding repeated per-container mount work. - The new containerd-based runtime assigns each container a unique host user range for stronger isolation. - Instead of rewriting file ownership during extraction, it uses Linux ID-mapped mounts to apply ownership mappings efficiently. - This improves security and avoids expensive image copying, but creates many additional mount operations during startup. ## Differences Between AWS Instance Types Netflix compared: - `r5.metal`: 5th-generation Intel, dual-socket, multiple NUMA domains - `m7i.metal-24xl`: 7th-generation Intel, single-socket, single NUMA domain - `m7a.24xlarge`: 7th-generation AMD, single-socket, single NUMA domain Results showed: - At low concurrency—around 20 containers or fewer—all systems performed similarly. - `r5.metal` began failing at roughly 100 concurrent container launches. - Newer Intel instances maintained lower startup times and better success rates. - AMD-based `m7a` instances scaled most consistently and had the fewest failures. ## Kernel and CPU-Level Diagnosis - Profiling showed that containerd spent most of its time in Linux VFS path lookup code. - Specifically, threads were spinning in `path_init()` while waiting on a sequence lock. - Intel Topdown Microarchitecture Analysis found: - 95.5% of pipeline slots stalled on contested accesses - 57% attributed to false sharing - Cache-line bouncing and global lock contention, rather than raw CPU capacity, dominated performance. ## NUMA as a Contributing Factor - NUMA systems divide memory among processor sockets. - Local memory access is faster, while remote access crosses an interconnect and introduces additional latency. - The dual-socket layout of `r5.metal` amplified contention around shared mount-related data. - The better behavior of newer single-socket instances indicated that CPU topology and memory locality were key contributors to the container startup bottleneck. ## Practical Conclusion High-concurrency container launches can overwhelm kernel mount infrastructure, especially when using per-container ID mapping and images with many layers. Netflix’s results suggest minimizing image layers, controlling startup concurrency, and favoring newer single-socket hardware can substantially improve reliability and scaling.

Read original

AWS Database Design Kubernetes Docker & Containers+4

airbnbFeb 18, 20263 min readCurated summary

Safeguarding Dynamic Configuration Changes at Scale

Airbnb’s Sitar platform is designed to make runtime configuration changes as safe and reliable as code deployments. It combines Git-based reviews, automated validation, staged rollouts, observability, and fast rollback with a highly available distribution system. Separating decision-making from config delivery, while using local caches, lets teams change behavior quickly without unnecessarily increasing outage risk. ## Requirements for a Modern Configuration Platform - Provides an end-to-end workflow for defining, reviewing, testing, and deploying configuration. - Treats configuration like code: - Versioned and reviewable - Auditable - Governed by ownership and access controls - Supports isolated local and canary testing before production rollout. - Accommodates multiple tenants with different: - Deployment triggers - Guardrails - Rollout strategies - Enables incident responders to make emergency changes while preserving auditability and visibility into who changed what, when, and which users or services were affected. ## Sitar’s Architecture Sitar consists of four major layers: - **Developer-facing layer:** Configs are usually managed through GitHub pull requests. The Sitar portal supports exceptions and administrative operations, including emergency deployments. - **Control plane:** Validates schemas, enforces ownership and authorization, selects rollout targets, manages progressive deployment, and supports rollback and targeted testing. - **Data plane:** Stores config values and versions as the source of truth, then distributes updates reliably and efficiently. - **Agents and client libraries:** An agent sidecar fetches subscribed configs and maintains a local cache. In-process client libraries read from that cache and expose values to application code, with optional fallbacks. A typical change moves from a Git workflow through validation and rollout decisions, into the data plane, and finally to sidecars and application clients. ## Git-Based Configuration Management - GitHub is the default interface because it integrates with Airbnb’s existing CI/CD systems and review practices. - Teams can use pull requests, mandatory reviewers, approval flows, and complete change history. - Related configs are grouped into tenants with defined owners, custom tests, and dedicated continuous-delivery pipelines. - The Sitar portal remains available for teams that need a UI or for urgent changes that must bypass the standard CI/CD process. ## Progressive Rollouts and Rollbacks - CI first checks schema correctness, expected structure, types, and other automated requirements. - Config changes require review and approval before deployment. - After merging, changes roll out gradually: - Start with a limited environment, AWS zone, or percentage of Kubernetes pods. - Evaluate the change at each stage. - Expand only when results are healthy. - Authors and stakeholders are notified when regressions are detected, and bad changes can be rolled back quickly. - Limiting the initial scope reduces the blast radius of configuration errors. ## Separating Control and Data Planes - The control plane decides whether and how a change should be deployed. - The data plane stores and distributes the resulting configuration. - This separation allows rollout policies and authorization logic to evolve independently from storage and delivery infrastructure. - Changes to one layer are less likely to disrupt the other. ## Local Caching and Resilient Clients - Each service runs an agent sidecar alongside its application container. - The sidecar periodically retrieves subscribed configs and persists them locally. - Client libraries read configuration from the local cache for fast, in-process access. - If the configuration backend becomes unavailable or degraded, services can continue using the last known good values. ## Practical Takeaway A reliable dynamic configuration system should combine code-like governance with runtime flexibility. Git reviews, validation, staged deployment, strong observability, plane separation, and local caching allow teams to respond quickly while keeping configuration failures contained and reversible.

Read original

AWS Kubernetes CI/CD Config As Code+4

awsFeb 16, 20263 min readCurated summary

Announcing Amazon SageMaker Inference for custom Amazon Nova models | Amazon Web Services

Amazon SageMaker Inference now generally supports deploying and scaling full-rank customized Amazon Nova models. The feature gives production workloads more control over instance types, autoscaling, context length, concurrency, and batch settings while improving cost efficiency through optimized GPU utilization. Customers can train Nova Micro, Nova Lite, and Nova 2 Lite models with SageMaker Training Jobs or HyperPod, then deploy them as managed real-time or asynchronous endpoints. ## Custom Nova Model Support - Supports customized Nova Micro, Nova Lite, and Nova 2 Lite models. - Models can use: - Continued pre-training - Supervised fine-tuning - Reinforcement fine-tuning - Custom models can be trained through Amazon SageMaker Training Jobs or Amazon HyperPod. - SageMaker Inference provides managed deployment, scaling, and HTTPS access for production workloads. - GPU utilization and inference costs can be optimized with Amazon EC2 G5 and G6 instances instead of relying exclusively on P5 instances. - Autoscaling can respond to five-minute usage patterns. - Configurable context length, concurrency, and batch size help balance latency, cost, and accuracy. ## Deploying Through SageMaker Studio - In SageMaker Studio, users select a trained Nova model from the Models menu. - Choosing **Deploy**, **SageMaker AI**, and **Create new endpoint** starts deployment. - Deployment settings include: - Endpoint name - Instance type - Initial and maximum instance counts - Permissions - Networking configuration - Supported launch instance types vary by model: - Nova Micro: G5, G6, and P5 options, including `g5.12xlarge` through `g6.48xlarge` and `p5.48xlarge` - Nova Lite: `g5.48xlarge`, `g6.48xlarge`, and `p5.48xlarge` - Nova 2 Lite: `p5.48xlarge` - Provisioning takes time because SageMaker must create infrastructure, download model artifacts, and initialize the inference container. - Once the endpoint is `InService`, users can test it in the Studio Playground using chat prompts. ## Deploying with the SageMaker SDK - Deployment requires two SageMaker resources: - A model object referencing the Nova artifacts and inference container - An endpoint configuration specifying the instance type and count - Model artifacts can be stored in Amazon S3 and referenced with an S3 prefix. - Environment variables configure inference behavior, including: - `CONTEXT_LENGTH` - `MAX_CONCURRENCY` - `DEFAULT_TEMPERATURE` - `DEFAULT_TOP_P` - The endpoint configuration creates a real-time endpoint, such as one using an `ml.g5.12xlarge` instance. - SageMaker supports network isolation and execution roles for secure deployment. ## Inference and Request Configuration - Endpoints support synchronous real-time inference in streaming or non-streaming modes. - Asynchronous endpoints are available for batch-style processing. - Requests can configure: - Maximum output tokens - Temperature - Top-p and top-k sampling - Log probabilities - Streaming usage statistics - Reasoning effort, with `low` and `high` options - The example request asks the model to compare quarterly spending against budget and identify variances above 10 percent. SageMaker Inference provides a complete path from Nova customization to production deployment. Teams should select instance types and tune context length, concurrency, batching, and sampling parameters based on their workload’s latency, cost, and accuracy requirements.

Read original

AWS Machine Learning Amazon Ec2 Fine Tuning+3

netflixFeb 12, 20263 min readCurated summary

Automating RDS Postgres to Aurora Postgres Migration

Netflix standardized on Amazon Aurora PostgreSQL after finding that PostgreSQL already supported most relational workloads and that Aurora offered stronger scalability, availability, elasticity, and ecosystem alignment. To migrate nearly 400 RDS PostgreSQL clusters efficiently, Netflix built a self-service workflow that automates replication, traffic quiescence, validation, and cutover while minimizing downtime and eliminating data loss. The Aurora read-replica method is preferred over snapshot migration because it keeps the target nearly synchronized while production continues running. ## Why Netflix Chose Aurora PostgreSQL - PostgreSQL already supported the majority of Netflix’s relational workloads. - Internal evaluations found Aurora PostgreSQL could support more than 95% of workloads running on other relational database systems. - PostgreSQL benefits from: - A broad open-source ecosystem - Strong community adoption - Compatibility with modern data platforms - Aurora’s distributed, cloud-native architecture provides: - Better scalability and elasticity - High availability - Support for globally distributed applications - The migration effort began with RDS PostgreSQL and is intended to expand to other relational systems. ## Database Migration Requires More Than Data Copying A safe migration must move both data and database functionality while preserving correctness, availability, and performance. - **Data replication:** Copy existing data and continuously apply source changes to the destination. - **Quiescence:** Stop writes to the source so the destination can catch up completely. - **Validation:** Confirm that source and destination data are synchronized. - **Cutover:** Redirect applications to the new Aurora database as the system of record. ## Operational and Technical Challenges - Manually migrating almost 400 PostgreSQL clusters would be slow, error-prone, and operationally expensive. - Coordinating downtime across dependent services is difficult. - Netflix therefore created a self-service workflow that handles orchestration, safety checks, and correctness guarantees automatically. - The system must guarantee: - Zero data loss - Extremely short downtime, especially for critical services - No performance degradation during or after migration - Migration of related resources such as parameter groups, read replicas, and replication slots - Application teams control database clients, so the platform cannot depend on them manually pausing writes. - The migration system must provide control-plane mechanisms to halt traffic safely during validation and cutover. - The workflow must operate without obtaining RDS credentials from users, since databases may be tightly secured and the migration platform may lack direct database access. - Because non-experts operate the process, the experience must be self-guided and require minimal user effort. ## Snapshot-Based Migration The snapshot approach is straightforward but requires stopping writes before migration. - Halt write traffic to the RDS PostgreSQL source. - Create a manual snapshot. - Convert the snapshot into an Aurora-compatible format. - Create an Aurora PostgreSQL cluster from the converted snapshot. - Validate the new cluster. - Redirect applications to the Aurora endpoint. This method is simple but can involve a longer interruption because the target is not continuously updated while the snapshot is created and converted. ## Aurora Read-Replica Migration The read-replica approach reduces downtime by continuously replicating the RDS database into Aurora. - Create an Aurora PostgreSQL read replica from the RDS source. - Stream changes asynchronously from RDS to Aurora while applications continue using the source. - Provision and validate Aurora configuration, connectivity, and performance in advance. - When replication lag is sufficiently low, briefly pause writes. - Allow the replica to catch up fully. - Promote it to a standalone Aurora PostgreSQL cluster. - Redirect application traffic to the Aurora endpoint. This approach keeps the destination nearly synchronized before cutover, making it substantially less disruptive than snapshot-based migration. Netflix’s automation focuses on making the read-replica migration process safe, repeatable, and self-service, with the platform handling replication, traffic control, validation, and cutover rather than relying on manual application-team coordination.

Read original

AWS Database Design PostgreSQL Database Migration+4

awsFeb 9, 20263 min readCurated summary

AWS Weekly Roundup: Claude Opus 4.6 in Amazon Bedrock, AWS Builder ID Sign in with Apple, and more (February 9, 2026) | Amazon Web Services

The February 9, 2026 AWS roundup highlights updates across infrastructure, security, databases, and AI. Major announcements include new EC2 instances, cross-account DynamoDB replication, improved identity controls, CloudFront mutual TLS, Claude Opus 4.6 in Bedrock, and structured model outputs. AWS also announced AWS Community Day Romania for April 23–24, 2026. ## Compute, Networking, and Configuration - **New EC2 C8id, M8id, and R8id instances** - Powered by custom Intel Xeon 6 processors. - Deliver up to 43% higher performance and 3.3× more memory bandwidth than previous-generation instances. - **AWS Network Firewall price reductions** - Reduces hourly and data-processing costs for NAT Gateways service-chained with Network Firewall secondary endpoints. - Removes additional data-processing charges for Advanced Inspection and TLS inspection. - **Amazon ECS Network Load Balancer support** - Enables managed linear and canary deployments for applications using NLBs. - Supports TCP/UDP workloads, low-latency services, long-lived connections, and static IP requirements. - **Expanded AWS Config coverage** - Adds support for 30 resource types across services such as Amazon EKS, Amazon Q, and AWS IoT. - Improves resource discovery, auditing, assessment, and remediation. ## Databases and Operations - **Cross-account DynamoDB global table replication** - Allows multi-Region, multi-active tables to replicate across AWS accounts. - Improves resilience, account-level workload isolation, and independent security and governance controls. - **Improved Amazon RDS connection experience** - Generates connection snippets for Java, Python, Node.js, `psql`, and other tools. - Adjusts examples automatically for authentication settings, including IAM token-based authentication. - Adds CloudShell integration for connecting to databases directly from the RDS console. ## Identity and Security - **AWS Builder ID adds Sign in with Apple** - Apple users can access services such as AWS Builder Center, Training and Certification, re:Post, AWS Startups, and Kiro. - Complements the existing Google sign-in option. - **More identity-provider claim validation in AWS STS** - Supports selected claims from Google, GitHub, CircleCI, and OCI. - These claims can be used as condition keys in IAM trust policies and resource control policies for more precise federated-access controls and data perimeters. - **Account names in the AWS Management Console** - Displays the account name in the navigation bar, making it easier to distinguish between authorized AWS accounts. - **CloudFront origin mutual TLS** - Lets CloudFront authenticate to origins using certificates. - Helps restrict backend access to verified CloudFront distributions across AWS, on-premises, third-party cloud, and external CDN environments. ## AI and Amazon Bedrock - **Claude Opus 4.6 available in Amazon Bedrock** - Anthropic’s latest model targets complex coding, agentic tasks, enterprise workflows, and professional work requiring deep reasoning and reliability. - **Structured outputs in Amazon Bedrock** - Models can return responses matching developer-defined JSON schemas. - Reduces the need for prompt-based JSON enforcement and additional validation, making production integrations more predictable. ## Upcoming AWS Event - **AWS Community Day Romania — April 23–24, 2026** - Features more than 10 technical sessions from AWS Heroes, Solutions Architects, and industry experts. - Includes networking opportunities for developers, architects, entrepreneurs, and students. These updates emphasize stronger infrastructure performance, better multi-account governance, more secure authentication, and more reliable AI application development. Teams should evaluate the new services based on their networking, resiliency, identity, and structured-output requirements.

Read original

AWS Generative AI Amazon Bedrock Amazon Ec2+4

tossFeb 9, 2026Original article

From Perimeter Security to Zero (opens in new tab)

Toss Payments transformed its security infrastructure from a vulnerable, single-layered legacy system into a robust "Defense in Depth" architecture spanning hybrid IDC and AWS environments. By integrating advanced perimeter defense, internal server monitoring, and container runtime security, the team established a comprehensive framework that prioritizes visibility and continuous verification. This four-year journey demonstrates that modern security requires moving beyond simple boundary protection toward a proactive, multi-layered strategy that assumes breaches can occur. ### Perimeter Defense and SSL/TLS Visibility * Addressed the critical visibility gap in legacy systems by implementing dedicated SSL/TLS decryption tools, allowing the team to analyze encrypted traffic for hidden malicious payloads. * Established a hybrid security architecture using a combination of physical DDoS protection, IPS, and WAF in IDC environments, complemented by AWS WAF and AI-based GuardDuty in the cloud. * Developed a collaborative merchant response process that moves beyond simple IP blocking; the system automatically detects malicious traffic from partners and provides them with detailed vulnerability reports and remediation guides (e.g., specific SQL injection points). ### Internal Network Security and "Assume Breach" Monitoring * Implemented **Wazuh**, an open-source security platform, in IDC environments to monitor lateral movement, collect centralized logs, and perform file integrity checks across diverse operating systems. * Leveraged **AWS GuardDuty** for intelligent threat detection in the cloud, focusing on malware scanning for EC2 instances and monitoring for suspicious process activities. * Established automated detection for privilege escalation and unauthorized access to sensitive system files, such as tracking instances where root privileges are obtained to modify the `/etc/passwd` file. ### Container Runtime Security as the Final Defense * Adopted **Falco**, a CNCF-hosted runtime security tool, to protect Kubernetes environments by monitoring system calls (syscalls) in real-time. * Configured specific security rules to detect "container escape" attempts, unauthorized access to sensitive files like `/etc/shadow`, and the execution of new or suspicious binaries within running containers. * Integrated **Falco Sidekick** to manage security events efficiently, ensuring that anomalous behaviors at the container level are instantly routed to the security team for response. ### Zero Trust and Continuous Verification * Shifted toward a Zero Trust model for the internal work network to ensure that all users and devices are continuously verified regardless of their location. * Focused on implementing dynamic access control and the principle of least privilege to minimize the potential impact of credential theft or device compromise. Organizations operating in hybrid cloud environments should move away from relying on a single perimeter and instead adopt a multi-layered defense strategy. True security resilience is achieved by gaining deep visibility into encrypted traffic and maintaining granular monitoring at the server and container levels to intercept threats that inevitably bypass initial defenses.

AWS Kubernetes Zero Trust Hybrid Cloud+4

awsJan 26, 20263 min readCurated summary

AWS Weekly Roundup: Amazon EC2 G7e instances, Amazon Corretto updates, and more (January 26, 2026) | Amazon Web Services

AWS’s January 26, 2026 roundup highlights new GPU infrastructure, Java updates, container optimization, expanded observability, and more flexible Amazon Connect workflows. The main launch is EC2 G7e, powered by NVIDIA Blackwell GPUs and designed for demanding AI inference, spatial computing, and scientific workloads. AWS also announced regional expansions and upcoming community and re:Invent-focused events. ## Amazon EC2 G7e Instances - Generally available in US East (N. Virginia) and US East (Ohio). - Powered by NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs. - Deliver up to 2.3× the inference performance of G6e instances. - Provide twice the GPU memory and support configurations with up to eight GPUs and 768 GB of total GPU memory. - Can run medium-sized models of up to 70 billion parameters using FP8 precision on a single GPU. - Target generative AI inference, spatial computing, and scientific computing. ## Amazon Corretto Security Updates - AWS released January 2026 quarterly security and critical updates for supported OpenJDK versions. - New releases include: - Corretto 25.0.2 - Corretto 21.0.10 - Corretto 17.0.18 - Corretto 11.0.30 - Corretto 8u482 - Updates provide current security patches and performance improvements for Java applications. ## Amazon ECR Layer Sharing - Amazon Elastic Container Registry now supports cross-repository layer sharing through blob mounting. - Common image layers can be reused across repositories rather than uploaded repeatedly. - This can speed up image pushes and reduce storage costs by storing shared layers once. ## CloudWatch Database Insights Expansion - On-demand Database Insights is now available in: - Asia Pacific (New Zealand) - Asia Pacific (Taipei) - Asia Pacific (Thailand) - Mexico (Central) - The machine-learning-powered feature helps identify database performance bottlenecks and recommends remediation steps. ## Amazon Connect Guided Experiences - Step-by-Step Guides now support conditional logic and real-time data updates. - Managers can configure interfaces that show or hide fields, change default values, and modify required fields based on earlier inputs. - Automatic refreshes from Amazon Connect resources help agents work with current information. ## Upcoming AWS Events - **Best of AWS re:Invent:** A free virtual event on January 28–29 featuring curated announcements, technical sessions, leadership insights, and live Q&A. - **AWS Community Day Ahmedabad:** A free, community-led conference on February 28, 2026, with technical talks, demos, networking, and real-world use cases. - AWS encourages builders to use the AWS Builder Center to discover additional virtual and in-person events. AWS customers working with AI should consider evaluating G7e instances, while Java teams should apply the latest Corretto updates. ECR users can also benefit from shared layers to improve container delivery efficiency and reduce costs.

Read original

AWS Generative AI Amazon Ec2 Amazon Cloudwatch+4