Posts

AWS Glue Data Catalog now supports OAuth for Apache Iceberg REST Catalog APIs - devamazonaws.blogspot.com

AWS Glue Data Catalog now supports OAuth 2.0 bearer token authentication for Apache Iceberg REST Catalog (IRC) APIs using AWS Sign-In. The Apache Iceberg REST Catalog specification defines OAuth 2.0 as its standard authentication mechanism, and query engines such as Apache Spark, Trino, and Apache Flink implement it natively. These engines and external integration partners can now authenticate to the Glue Data Catalog Iceberg endpoint using standard OAuth 2.0 bearer tokens, in addition to AWS Signature Version 4 (SigV4). You can now grant partners federated access to your Iceberg tables without distributing AWS credentials. Using OAuth 2.0 Token Exchange (RFC 8693), you exchange an OpenID Connect (OIDC) identity token for a short-lived, Glue-scoped bearer token and include it in IRC requests following the same standards-based pattern used across the Iceberg ecosystem. Access remains governed by AWS IAM and AWS Lake Formation permissions. Common use cases include enabling third-party ...
Post a Comment
Read more

[MS] Tune GitHub Copilot Inline Suggestions with Configurable Eagerness - devamazonaws.blogspot.com

Choose how proactively Copilot offers inline suggestions. Read the full article Post Updated on October 26, 2026 Thanks for reading from devamazonaws.blogspot.com
Post a Comment
Read more

[MS] PHP2Shell and Azure DevOps: what to check - devamazonaws.blogspot.com

On October 21, 2026, PHP disclosed two critical vulnerabilities that can allow remote code execution . Neither Azure DevOps Services , our cloud-hosted offering, nor Azure DevOps Server , our on-premises product, uses PHP to handle customer requests. PHP runtimes used by pipelines, containers, and deployed applications have their own patching requirements. Deployment scope: cloud and on-premises Azure DevOps Services (cloud). Microsoft operates and updates the service. You remain responsible for PHP installed by your pipeline steps or bundled into custom images and applications. Azure DevOps Server (on-premises). You maintain the Server installation and its host. If that host also runs a separate PHP website or tool, update that PHP runtime through its vendor or package manager. A Server product update does not patch separately installed PHP. PHP2Shell: exploitation mechanisms and remediation CVE-2026-109618 concerns invalid request state following an out-of-memory failu...
Post a Comment
Read more

[MS] The paper that split the database in four: inside Azure SQL Database Hyperscale, aka Socrates - devamazonaws.blogspot.com

Image
Under the Hood: The Research Behind Microsoft SQL, part 1 The Microsoft SQL team is always innovating. They do this in day-to-day efforts, but there are also brand new efforts that are constantly being explored, investigated, tested, and researched. Our engineering team partners closely with MSR (Microsoft Research) on some of these efforts. The team writes papers, submits these papers to conferences, and generally gets high recognition for their ingenuity in the databases and cloud space. One thing I’ve been thinking about recently is how little I actually have read the papers being written, and what scenarios they unlock for customers - could be security, performance, or availability (you know, the “meat and potatoes” of SQL Server, as Bob Ward would say). I’m starting a new blog series where I read some of the papers over the past 5-10 years, and then try to break them down so we all understand. You should know that I am not a database expert, but I love learning and this seem...
Post a Comment
Read more

[MS] .NET October 2026 Out-of-Band Security Updates - devamazonaws.blogspot.com

Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3. We recommend updating as soon as possible. Security updates This out-of-band release addresses CVE-2026-111497 , a vulnerability in the Brotli decompression algorithm . It also includes a fix for CVE-2026-114148 (Linux .NET tarball ownership) in .NET 8, 9, 10, and 11. CVE Description Affected platforms CVE-2026-111497 A buffer overflow vulnerability exists in .NET's use of the Brotli decompression algorithm. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege. All Platforms CVE-2026-114148 Unsafe ownership metadata in affected .NET tarballs could allow a local attacker to modify files and gain elevated privileges. Linux Applications may be affected if they process Brotli-compressed data through ASP.NET C...
Post a Comment
Read more

Web Search on AWS Bedrock now supports domain filtering and user location controls - devamazonaws.blogspot.com

Web Search on AWS Bedrock now supports two new controls that give you more precision over the results that ground a model's response: domain filtering and user location. Both are configured directly on the web_search tool in your existing OpenAI Responses API request. With domain filtering, you can restrict Web Search results to a set of domains you choose. Using the filters parameter, you specify up to 100 allowed_domains to limit results to trusted sources, or up to 100 blocked_domains to exclude sources you don't want. This is useful when you want responses grounded only in specific sites, or when you need to keep certain domains out of results. With user location, you can optionally specify location parameters so that Web Search can return results relevant to that geography. This helps with location-dependent questions, such as regional availability or local services. Domain filtering and user location are available in all AWS Regions where Web Search is supported: US...
Post a Comment
Read more

AWS Transit Gateway and AWS Cloud WAN now support 1:1 NAT - devamazonaws.blogspot.com

AWS Transit Gateway and AWS Cloud WAN now provide managed one-to-one network address translation (NAT) directly on their attachments, through integration with Regional Private NAT Gateway. This enables customers to connect private networks that share the same IP address ranges without renumbering either network, deploying a NAT appliance, or writing return-traffic rules. Networks with overlapping Classless Inter-Domain Routing (CIDR) blocks have long been unable to communicate, a common blocker during mergers and acquisitions, when connecting partner networks over AWS Site-to-Site VPN, in multicloud connectivity, and when independently provisioned VPCs need to interconnect. Using this capability, customers can define address-translation rules on a AWS Transit Gateway or AWS Cloud WAN attachment, specifying the private IP range each source CIDR translates to, across Amazon VPC, AWS Site-to-Site VPN, AWS Direct Connect, and SD-WAN appliances connected through Transit Gateway Connect. B...
Post a Comment
Read more