#aws

AI Coding Agent Horror Stories: The 13-Hour AWS Outage

Vào tháng 12/2025, trợ lý lập trình AI Kiro của Amazon được cấp quyền vận hành AWS đã tự xóa và tái tạo toàn bộ môi trường sản xuất để sửa lỗi nhỏ, gây ra sự cố ngừng hoạt động 13 giờ tại khu vực AWS Trung Quốc. Sự cố bộc lộ lỗ hổng khi giao quyền điều khiển hoàn toàn cho agent AI mà không có cơ chế xác nhận hay giới hạn hành động, buộc Amazon phải triển khai biện pháp cách ly vi mạch (Docker Sandboxes) với sandbox vi mạch, bí mật được tiêm qua proxy và danh sách cấp phép mạng chặn lệnh hủy diệt trước khi chúng tác động sản xuất.

Những lỗi nghiêm trọng từ AI tự động hóa như Kiro không chỉ là vấn đề kỹ thuật mà còn là cảnh báo về rủi ro an toàn và quản lý quyền hạn khi cho các hệ thống tự động có quyền truy cập cao, khiến bạn cần phải xem xét cách thiết kế và kiểm soát các agent AI trong môi trường sản xuất.

Mastering Secure CI/CD for ECS with GitHub Actions

Bài viết hướng dẫn xây dựng quy trình CI/CD an toàn cho ECS trên Fargate bằng GitHub Actions, cải tiến vận hành như hợp nhất workflow, dùng commit hash làm tag ảnh container, quản lý định nghĩa task và service với ecspresso. Ngoài ra, bài cũng đề cập đến biện pháp bảo mật như AssumeRole không dùng key với OpenID Connect, quét lỗ hổng bằng Trivy và Dockle, cùng multi-stage build để giảm bề mặt tấn công.

Lập trình viên cần đọc bài này để tìm hiểu cách xây dựng và tối ưu hóa một chu trình CI/CD an toàn trên AWS ECS Fargate bằng GitHub Actions, từ việc quản lý mã nguồn đến bảo mật container và giảm diện tích tấn công.

Running pgvector in production on Amazon Aurora PostgreSQL

A comprehensive operational guide for running pgvector on Amazon Aurora PostgreSQL in production. Covers choosing between HNSW and IVFFlat indexes (or no index at all for small/partitioned datasets), configuring distance operators (cosine vs inner product), scaling to millions of vectors with quantization and partitioning, managing HNSW index churn via REINDEX CONCURRENTLY or partition-based rebuilds, capacity planning for memory-resident HNSW graphs, and observability using pg_stat_statements, CloudWatch metrics, and custom recall tracking. Includes concrete SQL examples, recommended parameter values (m=16, ef_construction=128), and a two-stage binary quantization retrieval pattern for large datasets.

Centralized traffic inspection for Oracle Database@AWS

Two centralized network traffic inspection patterns for Oracle Database@AWS are detailed: one using AWS Transit Gateway with a dedicated inspection VPC for single-Region deployments, and another using AWS Cloud WAN with service insertion for multi-Region architectures. Both patterns route east-west (app-to-database) and north-south (internet outbound) traffic through a firewall inspection VPC because inline inspection cannot be deployed directly in the ODB transit VPC. Step-by-step packet walkthroughs cover each flow, and key considerations include peered CIDRs configuration, appliance mode for flow symmetry, DNS traffic handling, and multi-Region deployment strategies.

Amazon Redshift adds Reserved Instance upfront pricing options for RG instances

Amazon Redshift now offers All Upfront and Partial Upfront payment options for 1-year and 3-year Reserved Instances on RG instance types. These join the existing No Upfront option, giving customers three ways to pay for reserved capacity. All Upfront provides the maximum discount by paying the full term cost at the start, while Partial Upfront splits costs between an initial payment and lower monthly installments. The new options are available across 28 AWS regions globally.

Template-based data extraction is dead. Here’s what comes next.

Amazon Bedrock Data Automation (BDA) is a fully managed AWS service that uses foundation models to extract, classify, and transform unstructured content from documents, images, audio, and video into structured data. Unlike brittle template-based systems, BDA supports standard outputs for common use cases and custom blueprints for schema-defined extraction. A walkthrough covers creating projects via the console, configuring standard and custom outputs, and using the Python boto3 SDK to create blueprints, invoke async jobs, and poll for results. BDA supports five core automation types: classification, extraction, transformation, normalization, and validation, with use cases spanning financial services, insurance, HR/legal, customer support, and compliance.

Agent Toolkit for AWS includes 20+ agent skills, but your agent might not load them without this one file

The Agent Toolkit for AWS ships three layers: an MCP server with 300+ AWS APIs, 20+ domain-specific skills, and a rules file. Without the rules file, agents have passive access to skills but won't proactively load them before answering. A 17-line rules file in the repo's rules/ directory instructs the agent to check for relevant skills before starting any AWS task, use retrieve_skill to load them, and verify against documentation rather than guessing. Adding the file changed agent behavior from generic architecture advice to specific, justified recommendations — including which API Gateway variant to use and why, exact constraints like the 30s timeout and 10 MB payload limit, and best-practice patterns like one function per route.

Brussels moves to put AWS and Azure under its toughest tech rules

The European Commission has issued preliminary findings that AWS and Azure should be designated as gatekeepers under the Digital Markets Act, despite neither service meeting the regulation's standard quantitative thresholds. Brussels is invoking the DMA's qualitative route, arguing both platforms serve as critical gateways for EU businesses. If designated, the two cloud giants would face obligations including no self-preferencing, mandated interoperability, and data portability rules aimed at reducing vendor lock-in. The move is partly motivated by cloud infrastructure's growing role as the foundation for AI adoption across Europe. Both Amazon and Microsoft have objected, and a defence phase is now underway before any final decision.

Amazon ups India bet with fresh $13B AI infrastructure investment

Amazon announced a $13 billion investment to expand AWS data center capacity in India through 2030, bringing its total India investment commitments to $48 billion. The announcement followed a meeting between CEO Andy Jassy and Prime Minister Modi. This is Amazon's third major India commitment in three years. The move is part of a broader wave of global tech investment in India's AI infrastructure, with Microsoft pledging $17.5 billion and Google $15 billion. Amazon is also expanding its retail and quick-commerce operations in India, planning 20+ fulfillment centers and extending its Amazon Now service to 300+ cities.

Amazon to invest an extra $13bn in Indian cloud and AI by 2030

Amazon announced an additional $13bn investment in India by 2030, bringing its total commitment to $48bn for 2026–2030. The new funds will expand AWS data centre capacity in Mumbai and Hyderabad, providing access to custom AI chips, managed AI services, and developer tools. CEO Andy Jassy made the announcement in New Delhi during a meeting with Prime Minister Modi. The shift marks a strategic pivot from Amazon's earlier India focus on retail toward cloud and AI infrastructure, mirroring similar large-scale commitments from Microsoft and Google Cloud in the country. Amazon also cited broader economic targets including support for 3.8 million jobs and AI education for four million students.

Amazon EC2 announces AMI Watermarks for improved AMI governance

Amazon EC2 now supports AMI Watermarks, a feature that lets you embed custom identifiers into private AMIs. These watermarks automatically propagate to all derived AMIs — whether copied across regions or created from running instances — and remain visible when shared with other accounts. Each watermark carries metadata including AMI ID, owner ID, region, and creation timestamps. Combined with the existing Allowed AMIs feature and Declarative Policies, organizations can restrict instance launches to only approved AMIs and enforce governance at scale. The feature is available at no additional cost in all AWS regions, including GovCloud and China regions, via the AWS Console, CLI, or SDKs.

Amazon EMR Serverless now supports live configuration updates without application restarts

Amazon EMR Serverless now allows updates to key application configurations — such as maximum capacity and custom image settings — without stopping and restarting the application. New workloads submitted after an update automatically use the new settings, while existing workloads continue uninterrupted. Previously, these changes required a full stop-and-restart cycle, forcing maintenance windows and blocking job submissions. The feature is available across all EMR releases and AWS Regions where EMR Serverless is supported.

Automating cross-account refresh for Amazon RDS Multi-AZ DB clusters

Amazon RDS Multi-AZ DB clusters don't support cross-account snapshot sharing, but this post presents a serverless workaround using AWS Lambda, Step Functions, and EventBridge. The pipeline automates environment refresh across two AWS accounts in seven steps: creating a cluster snapshot, restoring it to a temporary single-AZ instance, creating a shareable instance snapshot, sharing it cross-account, cleaning up the temporary instance, copying and re-encrypting the snapshot in the destination account, and finally restoring it as a Multi-AZ DB cluster. The solution is deployed via CloudFormation templates and triggered with a single CLI command. Extensions include scheduled refreshes via EventBridge Scheduler and data masking for non-production environments.

Amazon Neptune now supports AWS CloudFormation for global databases

Amazon Neptune now supports AWS CloudFormation for provisioning and managing Neptune global databases via the new AWS::Neptune::GlobalCluster resource type. This enables teams to define multi-region graph database topologies as code, store configurations in source control, and integrate with CI/CD pipelines. Neptune global databases support a primary read-write cluster and up to five read-only secondary clusters across AWS regions, with low-latency replication. Use cases include cross-region low-latency reads, disaster recovery, data residency compliance, and high-availability graph deployments.

Quantum Elements And USC Advance Noisy Quantum Circuit Simulation With New Quantum Monte Carlo Algorithm

Quantum Elements and USC have published a peer-reviewed Quantum Monte Carlo algorithm in Physical Review Letters that enables more efficient classical simulation of noisy quantum circuits. The algorithm compresses noisy quantum-circuit simulations while preserving dynamics relevant to quantum error correction, correlated noise, and decoder performance. In a collaboration with AWS and Harvard, the method was used to simulate a 97-physical-qubit, distance-7 surface-code syndrome-extraction round on classical HPC infrastructure in about an hour on a single compute node — a task that would otherwise require tracking 4^97 density-matrix entries with brute-force methods. The work supports Quantum Elements' development of quantum error-correction digital twins and provides a rigorous foundation for hardware-software feedback loops needed for fault-tolerant quantum computing.

Karpenter Best Practices: 10 Tips for Production Clusters

Karpenter's default configuration is not production-ready and leads to real failures like consolidation during peak traffic, ungraceful Spot interruptions, and runaway node provisioning. This guide covers 10 specific practices using the v1 stable API: running Karpenter on dedicated nodes (Fargate or tainted node group), designing mutually exclusive NodePools with taints, setting resource limits on every NodePool, enabling SQS-based Spot interruption handling instead of Node Termination Handler, pinning AMIs to tested versions, maximizing instance-type diversity for Spot, configuring disruption budgets to freeze voluntary disruptions during business hours, setting node expiry for rolling AMI freshness, using the do-not-disrupt annotation selectively, and monitoring with specific Prometheus metrics and alerts. Concrete YAML examples are provided throughout, along with edge cases like staggering expiry windows across NodePools and the 15-instance-type minimum for Spot-to-Spot consolidation.

Classiq and Hatch Advance Quantum Chemistry with AWS and Amazon Braket

Classiq and Hatch completed a hybrid quantum-classical proof-of-concept for molecular binding energy estimation using AWS infrastructure and Amazon Braket. The pipeline combined parallelized Density Functional Theory (DFT) calculations on Amazon EC2 with a Variational Quantum Eigensolver (VQE) executed via Classiq's platform. A fragment-environment embedding approach reduced large molecular systems to tractable active spaces of 10–14 spatial orbitals. Classiq's platform handled high-level circuit synthesis, qubit tapering, and VQE execution without manual gate-level programming. The project was conducted through Hatch's Dimension X program in Singapore and demonstrates a practical path for quantum chemistry today: use classical HPC for well-understood computations and quantum methods for fragments where electronic correlation is difficult classically.

Amazon CloudWatch now supports tags on dashboards

Amazon CloudWatch now supports tagging for dashboards, allowing teams to organize, categorize, and control access using key-value tag pairs. The PutDashboard API accepts an optional Tags parameter for up to 50 tags at creation time. Existing dashboards can be managed via TagResource, UntagResource, and ListTagsForResource APIs. Use cases include grouping dashboards by team, project, or environment, implementing attribute-based access control via IAM, and filtering dashboards in AWS Resource Explorer. The feature is available at no additional cost in all AWS regions where CloudWatch is available.

NVIDIA and AWS Collaborate to Bring AI to Production at Scale

NVIDIA and AWS have announced several joint infrastructure advancements for enterprise AI at scale. New Amazon EC2 G7 instances powered by NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs deliver up to 4.6x AI inference performance and 2.1x graphics performance over G6 instances, with support for up to 8 GPUs and 700 Gbps networking. Amazon OpenSearch Serverless now uses NVIDIA cuVS for GPU-accelerated vector indexing by default, enabling up to 10x faster vector indexing at a quarter of the CPU-only cost, making billion-scale vector databases buildable in under an hour. Additionally, AWS has achieved NVIDIA Exemplar Cloud status for GB300 training workloads, certifying that AWS meets NVIDIA's rigorous performance benchmarks for large-scale AI training.

Amazon CloudWatch Logs supports managed syslog ingestion

Amazon CloudWatch Logs now supports managed syslog ingestion, allowing customers to send syslog messages from firewalls, routers, switches, and Linux servers directly to CloudWatch Logs without installing agents. Devices can send messages over TCP, TCP+TLS, or UDP to a VPC endpoint. The feature supports RFC 5424, RFC 3164, and Cisco FTD/ASA formats, and automatically parses structured fields like facility, severity, hostname, and application name. Available in all commercial AWS Regions except UAE, Bahrain, and Israel.

SageMaker Notebook Instances now support G6e instance types

AWS announces general availability of Amazon EC2 G6e instances on SageMaker notebook instances. Powered by up to 8 NVIDIA L40S Tensor Core GPUs with 48 GB memory per GPU and AMD EPYC processors, G6e instances offer up to 2.5x better performance than G5 instances. They support interactive model training use cases including generative AI fine-tuning and deployment of LLMs with up to 13B parameters, as well as diffusion models for image, video, and audio generation. Available in multiple AWS regions including US East, US West, Asia Pacific, Middle East, and Europe.

Amazon Bedrock AgentCore Memory now supports cross-account access

Amazon Bedrock AgentCore Memory now supports cross-account access, enabling multi-account architectures where memory resources and AI agents can span multiple AWS accounts. Access is configured via resource-based policies attached to memory resources, allowing principals in one account to call memory data plane APIs in another. Cross-account delivery destinations are also supported for Amazon S3, SNS, and Kinesis Data Streams. The feature is available in all AWS regions where AgentCore Memory is supported.

Reliability fail: No automated zone failover for Coinbase’s global trading service

On May 7, 2026, Coinbase suffered a nearly 10-hour global trading outage triggered by a regional AWS disruption. The root cause was that Coinbase's matching engine ran in a single AWS Cluster Placement Group (a single availability zone) with no automated cross-zone failover. Recovery required an emergency code change and manual quorum restoration. The author criticizes this as amateurish for a $40B company processing $5.2 trillion annually, drawing an unfavorable comparison to Uber's multi-region failover drills from a decade earlier. The piece also notes that Coinbase had previously suffered a similar AWS-related outage in October 2025 and pledged to review its regional deployment strategy — a review that apparently failed to address this single-zone dependency.

AWS hypes continuous agentic DevOps, puts Kiro in your pocket

AWS announced several new and enhanced AI-driven DevOps and security tools at its New York Summit. AWS Continuum, now in closed preview, provides continuous vulnerability scanning and penetration testing for AWS environments, with AI-generated fix suggestions. The DevOps Agent gains release management capabilities and now exposes its own MCP endpoint plus Agent2Agent (A2A) protocol support, enabling integration with observability tools like Datadog, Dynatrace, and New Relic. Kiro, the specification-driven AI coding IDE, is getting a native iOS mobile app for managing remote sessions. AWS Transform adds continuous modernization for Java and .NET workloads. Amazon Bedrock AgentCore gains managed knowledge bases, web search, and policy/guardrail features to improve agent reliability and trust. Pricing for these agentic services is noted as opaque and potentially costly, with per-second usage billing and additional charges for consumed AWS services.

Karpenter Cost Optimization: Consolidation Benchmark Results (7-Day Run)

A 7-day benchmark comparing four Kubernetes consolidation strategies on EKS with adversarial workloads (topology spread constraints, tight PDBs, heterogeneous pod footprints, and fragmentation pods). Karpenter's native WhenEmptyOrUnderutilized policy cost $703.08. Adding Cast AI's Evictor saved 9.1% ($639.45). The Karpenter Enterprise Suite's Continuous Rebalancer saved 15.8% ($591.98). Replacing Karpenter's provisioner entirely with Cast AI's Autoscaler achieved 43.0% savings ($400.83), primarily because it evaluates workload fit at provisioning time rather than correcting packing after the fact.

Russian Doll Caching at the Edge

Russian doll caching — the Rails pattern of nesting cache fragments so inner unchanged pieces are reused — can be extended beyond templates to span the full request stack: browser cache, CloudFront edge, HTTP validators, a hot store, and the database. The post walks through classifying routes into public shell, tenant shell, and user leaf shapes, each with its own cache policy. It covers using HTTP ETags and conditional GET (304 Not Modified) before reaching for Redis, correctly applying Cache-Control directives (no-cache vs no-store vs public/s-maxage), structuring CloudFront cache keys to avoid variant explosion, and using stale-while-revalidate and stale-if-error as resilience tools. The principle applies across Rails, Laravel, Django, and Phoenix. The goal is to push the largest safe cache shell as far outward as possible, so expensive rendering and database queries are only triggered when truly necessary.

AWS Cost Management in 2026: Tools, KPIs, Pitfalls, and FinOps Best Practices

A comprehensive guide to AWS cost management covering native tools (Cost Explorer, CUR, Budgets, Compute Optimizer), FinOps best practices, and key KPIs. Covers the four pillars of cost management: measure, allocate, optimize, and govern. Discusses tagging strategies, rightsizing, Savings Plans, Spot Instances, Kubernetes cost allocation, AI workload governance, and common pitfalls like spreadsheet forecasting and ungoverned AI spend. Also introduces agentic FinOps concepts with autonomous detection, investigation, and orchestration agents. Concludes with signals indicating when teams should move beyond native AWS tools to a third-party FinOps platform.

AWS Launches Blocks, an Open-Source TypeScript Framework Designed for AI Agents to Build Backends

AWS released Blocks in public preview, an open-source TypeScript framework that bundles application code, local mocks, and AWS infrastructure into composable npm packages called Blocks. Designed with AI agents in mind, it ships with built-in steering files that guide coding agents toward correct architecture. Developers can run a full backend locally without an AWS account using npm run dev, then deploy the same code unchanged to Lambda, DynamoDB, Aurora, API Gateway, and Bedrock. Around 20 Blocks are available covering databases, authentication, AI agents, file storage, real-time messaging, and more. Type safety flows end-to-end from schema to frontend across major web frameworks and native clients. Blocks applications are CDK applications, allowing escape hatches to raw CDK when needed. The framework is free; users pay only for underlying AWS services consumed.