[Last Week in AWS] Issue #496: A Price Cut Appears, Network Nerds Rejoice

Heads up, if you remediated your /etc/ssl/ssl.pem certs on your Mac or Macs, the latest macOS update (27.2) reverts it to trust the old compromised certs because Apple is apparently too busy not shipping Apple Intelligence to issue security patches, but not so busy that they can't find time to revert your own mitigation work. I am not happy.

A fun demo from Localstack (disclosure: I am an investor in Localstack) on how to Give Every AI Agent Its Own Ephemeral Instance.

Amazon Is Gutting Its AI Division After Sustained Failure, and the absolute last people to find out about this will inevitably be AWS Marketing.

How fast can you actually patch Ruby? It seems like a standard question, but when there are significant vulnerabilities in an Lambda runtime and AWS takes over four days to roll patches to those runtimes? It kinda shakes your faith in Amazon's vaunted Operational Excellence. I get scale is hard. I get patching is hard. That is why we pay the managed service upcharge: so that Amazon can solve this for us.

This is a solution to your IP numbering mistakes of yesteryear; who was to know you'd be buying that company that ALSO used the 10/8?! Hindsight. In any case, this can now be mitigated via... the usual Managed NAT Gateway data processing charge, a villain more played out than Lex Luthor.

Holy crap an actual price cut? When's the last time we saw one of these without a nasty caveat? Good job; it's additive to the underlying compute, so it's a surcharge reduction, sure--but a welcome one.

Note that this is not unified billing; software will land on your AWS bill, but toilet paper for your office will not. Big news for procurement departments, finance folks, and a couple office supply people who are now about two clicks away from a world of massive confusion. "What the hell is a Snyk, and do we need one for the office?"

The fact that you need a blog post to explain how to understand a Savings Plan recommendation is a leading indicator that the UX for the Savings Plan Recommendations is bad and should be improved. You'll know you've gotten there when the blog post is "read the goddamned webpage." There's no blog post on how to understand the credit card entry form on your website; that's what you're aiming for.

A migration partner, Aurora PostgreSQL, Bedrock, Claude, and dunking on Oracle: I do believe this blog post is an Enterprise Bingo!

If the re:Invent keynote livestream doesn't go off flawlessly, this blog post is gonna vanish faster than your account manager when there's a problem with a service they don't get paid a bonus for selling.

The one question I have isn't answered by this post: does this add latency to DNS lookups? It's unclear, and I'd like very much to know the answer. That said, if this takes off it's going to take a whack at egress-monitoring vendors in the fullness of time.

This week's nine security updates read like a map of where Amazon has been spending its engineering attention lately. The old-school entries are almost comforting: two bugs in Multi Model Server from the era when "AI infrastructure" meant a Flask app wearing a stupid hat like it's a chihuahua, plus remote code execution in a Brotli decoder that also leaks memory, because compression libraries have been writing checks the CPU apparently have been failing to cash since 1992. Then their handling of the eMudhra shenanigans sitting in AWS trust bundles, and Private CA Connector mishandling issuer resolution on Kubernetes, which is two separate reminders that you apparently all need that certificates are only as good as whoever signed them, and who your system trusts. SQL injection in a custom resource handler in the year 2026 is a choice. But the real pile of nonsense is the agent stack: the run_script sandbox that doesn't quite validate, an OAuth audience check the MCP server skipped, and pandas trusting an Athena bucket it never bothered to verifiy. Capping it off, Strands Agents Tools is printing secrets it promised to mask. Autonomous agents, shipping at the speed of trust nobody earned, as Earn Trust continues to devolve from an Amazonian Leadership Principle into apparently "words on a webpage used to haze interview candidates."