Automation / DevOps / IaC

AWS Control Tower Account Factory for Terraform now supports plan-only execution, allowing administrators to preview Terraform changes without applying them. This update addresses the previous limitation where customization runs always triggered a full apply, making it difficult to validate outcomes or detect drift beforehand. The new capability enables safe pre-rollout validation and better integration into CI/CD pipelines.

• Preview global and account customizations without applying changes
• Detect configuration drift before broad rollout execution
• Integrate AFT customizations safely into CI/CD workflows
• Validate expected Terraform outcomes prior to actual apply

Amazon ECS now integrates with Amazon VPC Lattice to enable managed traffic shifting during service updates. Users can deploy using blue/green, linear, or canary strategies to control how traffic moves to new versions. This allows teams to validate releases with test traffic before committing to production shifts.

• Native integration removes need for custom scripts to manage VPC Lattice traffic shifting during ECS updates.
• Supports blue/green, linear, and canary strategies for controlled rollout and rollback capabilities.
• Enables validation steps and manual approvals before full production traffic migration.
• Simplifies cross-VPC and cross-account service communication updates via VPC Lattice.

Amazon ElastiCache for Valkey now publishes OpenTelemetry metrics to CloudWatch, enabling filtering and aggregation via PromQL. The service introduces two modes: standard monitoring at 60-second intervals with a core metric set, and detailed monitoring at 15-second intervals with full metric coverage. These enhancements allow for finer-grained visibility into node connection limits, error breakdowns, and resource forecasting.

• OpenTelemetry metrics support PromQL for advanced filtering and aggregation in CloudWatch.
• Standard mode adds core OTel metrics at 60s intervals at no extra charge.
• Detailed mode enables 15s granularity with the full set of OpenTelemetry metrics.
• Improved visibility aids in detecting connection limits and forecasting resource usage.

AWS Continuum for Penetration Testing, formerly the Security Agent, now supports continuous penetration testing integrated directly into CI/CD pipelines. This public preview feature shifts security validation left, allowing teams to run tests as part of the deployment workflow rather than as an external, on-demand event. Developers will receive immediate findings with severity levels and affected endpoints to accelerate remediation.

• Integrates pentesting directly into CI/CD pipelines for deploy-time validation
• Eliminates need for third-party vendor contracts for continuous testing
• Shifts security left by embedding findings into developer workflows
• Provides severity and endpoint details for faster remediation
• Currently available in public preview