amazon-ssm-agent versions before 3.3.4515.0 have a path traversal vulnerability in the aws:downloadContent plugin that lets authenticated users write arbitrary files as root. This could lead to remote code execution if sensitive files get overwritten. Yes, you need to act: upgrade to 3.3.4515.0 or later ASAP if you're running affected versions (2.0.767.0 to 3.3.4364.0).
source: [aws/security-bulletin]
Amazon Bedrock AgentCore Memory now supports fine-grained access control (FGAC), letting you enforce per-user and per-tenant memory isolation through AgentCore Gateway without writing custom auth logic. You can attach Cedar policies to restrict memory access based on user identity, namespace claims, and specific operations—moving access control from your app code straight to the infrastructure layer.
source: [aws/whats-new]
AWS just dropped Private Access for the Management Console, letting you keep your data perimeter fully isolated even when managing your cloud infrastructure. If you're running regulated workloads in finance, healthcare, or defense, you can now ditch the internet connectivity requirement for console access while staying locked down to your corporate network.
source: [aws/security-blog]
Amazon Redshift streaming just got a serious upgrade—you can now ingest 10MiB records from Amazon Kinesis Data Streams, a 10x jump from the old 1MiB ceiling. No more record splitting headaches; just pipe those beefy payloads straight into your data warehouse across all commercial AWS regions.
source: [aws/whats-new]
AWS Elastic Disaster Recovery now lets you automate multi-server application recovery with Recovery Plans—define your server launch sequence once, then execute it with a single click during disasters or drills. No more manual dependency tracking or launch order headaches; the feature handles sequential startup with configurable wait times, approval gates, and real-time monitoring across all AWS Regions at no extra cost.
source: [aws/whats-new]
Amazon Redshift now plays nice with AI agents like Claude, Kiro, and Cursor through the Agent Toolkit for AWS, letting you query, troubleshoot, and migrate data warehouses straight from your favorite code editor. The integration bundles AWS MCP Server with Redshift skills—pre-built packages covering SQL syntax, schema discovery, data loading, and full migration workflows—available at no extra cost across all AWS regions.
source: [aws/whats-new]
Single security alerts won't catch sophisticated attackers—you need to correlate signals across AWS services to spot attack patterns. Learn how to connect the dots between unusual identity activity, source IPs, and service logs to catch multi-stage attacks before they escalate.
source: [aws/security-blog]
Missed AWS's July security updates while you were out? This roundup covers the month's expert blog posts, new service capabilities, and code samples—including fresh insights on AI agent security. Cloud engineers should check out the practical guidance to keep their infrastructure secure and up-to-date.
source: [aws/security-blog]
Mountpoint for Amazon S3 now lets you cap memory usage either manually or automatically based on your environment—perfect for running it alongside heavy ML training and analytics workloads. The tool can detect container memory budgets in Amazon EKS and throttle operations gracefully under pressure, so you won't accidentally starve your other apps of RAM.
source: [aws/whats-new]