AWS Weekly Intelligence #7 - 14-18 September 2026

The week in one paragraph

Forty-seven announcements in the What's New feed for the week, and the five worth your time share a shape: each moves a boundary that something else was already built against. Root user sign-in became resilient across three Regions — and took its audit event with it, away from the single-Region alarm most security baselines still use. STS collapsed several opaque session limits into one measurable 4,096-byte ceiling, and deprecated the element your tooling reads. Glue zero-ETL started tracking which integration owns a target table, which is a way of saying that until Monday two pipelines could write to one table unnoticed. Elastic Beanstalk moved the unit of infrastructure from the application to the pool. And SNS quadrupled its payload ceiling behind an attribute that quietly restricts which protocols may subscribe. Four of the five fail silently if you do nothing.

Covered in depth

Each of these got a full post this week:

Glue zero-ETL ownership and conflict detection — The table had two writers and no owner
Root user sign-in regional resiliency — The root alarm was watching one Region
STS session token size limits and monitoring — The limit you could hit but never measure
Elastic Beanstalk Cluster Mode — The environment per application was the ceiling
SNS 1 MiB payloads — Four times the payload, a fraction of the fan-out

The one that makes a security control stop working without failing

Root user sign-in “is now served across US East (N. Virginia), US East (Ohio), and US West (Oregon), with sign-in traffic distributed across all three Regions.” Unambiguously good: the credential of last resort no longer depends on one Region being healthy.

The consequence is in the same announcement. “ConsoleLogin events for root user sign-ins are recorded in the Region that processed the sign-in request”, and the CloudTrail reference confirms the set: “us-east-1, us-east-2, or us-west-2.”

Alerting on root sign-in is in the CIS benchmark and in essentially every security baseline ever written, and a very large number of those implementations are scoped to us-east-1 because that is where the event reliably landed. Those rules did not break. They simply stop seeing two-thirds of the possible sign-ins, and a quiet root alarm is indistinguishable from a healthy account.

AWS names the action: extend monitoring to all three Regions. The better fix is to alert off a multi-Region or organisation trail so the next routing change does not require another edit.

A limit that became measurable, and a field that became wrong

STS “now enforces a single 4,096-byte size limit on session tokens”, replacing separate limits on the token and on what you passed into it. More usefully, it now returns “response elements indicating session token size and percentage utilization relative to the token size limit”, logged in CloudTrail and published to CloudWatch.

That turns a cliff into a gauge. Session tags, session policies and federation attributes all spend a budget that previously could not be read, and the failure mode — a request rejected by a proxy for an oversized header — never looked like an STS problem.

The action item is not in the announcement. The IAM quota reference carries it: “The PackedPolicySize response element is deprecated. Use SessionTokenUtilization instead.” The two do not measure the same quantity — one was the packed size of policies passed, the other is percentage of the token limit consumed. Anything alarming on the old element is reading a deprecated field about a different thing, and it will keep returning data while it does.

Two services moved the unit of sharing

Beanstalk and SNS made the same kind of change in different places, and both are pooling decisions dressed as features.

Cluster Mode “runs multiple applications on pooled infrastructure in your account, powered by Amazon EKS, instead of a dedicated environment per application.” The constraint it relieves is structural rather than financial: the default quota is 200 environments per account per Region, and “the limit applies across applications, not per application” — so an estate running production and staging per service spends two of those per application.

The economics are conditional, and the pricing sentence says so in both halves: no charge for Cluster Mode, and “you pay for the AWS resources your applications consume, including the EKS cluster and EKS Auto Mode charges.” A standing cluster cost is a fixed component the per-application model never had, which is why the saving is framed as arriving as application count grows.

SNS raised payloads to “1 MiB, a 4x increase from the previous 256 KiB limit” — behind an opt-in attribute that changes what the topic is. “Topics with MaximumMessageSize set above 256 KiB support Amazon SQS, Amazon Data Firehose, and AWS Lambda subscriptions, with up to 100 total subscriptions per topic.” Against a standard-topic default of 12,500,000 subscriptions, and with HTTP/S, email, SMS and mobile push excluded, that is not a bigger topic. It is a different one.

And one that tells you what was previously possible

Glue zero-ETL now “associates the resulting table properties with the owning integration, so two integrations can no longer be pointed at the same target table without your knowledge.”

Read that backwards. Until this week, two managed replication pipelines could write into one table and nothing in the service would mention it — producing wrong data rather than a failed job, which is the category that does not page anyone and surfaces as a figure that will not reconcile.

The detection is described at create-and-modify time, and nothing states what happens to pairs that already overlap. Audit rather than assume.

Quieter, and worth knowing

Also in the feed this week, not covered in depth: AWS Direct Connect flat-rate pricing for dedicated connections and CloudFront flat-rate pricing plans — two pricing model changes in one week is worth a look if either is a material line item. A Detected Anomalies widget arrived in Billing and Cost Management dashboards, which pairs with the anomaly detection covered in Architecture #51. PrivateLink Tunnel Endpoints for reaching network segments, Transfer Family source IP preservation behind an NLB, ECS Express Mode on Graviton, and Resilience Hub added three capabilities.

What I would act on

1. Extend root sign-in alerting to three Regions — this week. It is a named control in most audit scopes, the gap is open now, and the failure is silence. Confirm the trail is multi-Region, then confirm the alarm reads from the trail rather than a Region-scoped log group. Event history covers 90 days and costs nothing to search, so you can also check retrospectively — three searches, since a search returns one Region.

2. Grep for PackedPolicySize. Ten minutes, a definite answer, and it finds every dashboard, log parser and test assertion now reading a deprecated element that measured something else.

3. Audit zero-ETL integrations for duplicate targets. Finite and mechanical. The new detection fires on create and modify, so it does not tell you about the overlap you may already have.

4. Before setting MaximumMessageSize, list subscriptions by protocol. Anything that is not SQS, Firehose or Lambda has to move or stay behind, and the 100-subscription ceiling is low enough for an automated subscriber process to reach.

5. Count your Beanstalk environments, not your applications. If you are near 200, that is the concrete argument for Cluster Mode. If you run a handful of applications, the standing EKS cost will not amortise and this is not for you yet.