AWS This Week: EventBridge's New Event Bus, Network Security Manager and Cross-Continent DynamoDB (Video)

The week’s AWS announcements that actually matter for architects — in 80 seconds, with the “so what” for your architecture. This week belongs to platform teams: one event backbone shared across the whole organisation, network security policy defined once, strong consistency across continents, and a stream that spreads its own load. Watch first, details below.

This week’s picks

1. Amazon EventBridge relaunches the custom event bus — a new enhanced Custom event bus built for event-driven architectures at organisation scale. You create one bus and share it with accounts, OUs or the whole organisation through AWS RAM, instead of wiring cross-account rules and bus-to-bus hops; publishers send events without knowing who consumes them, and each consumer owns a single Subscriber resource that bundles filtering, target, retry policy and dead-letter destination (default quota: 10,000 Subscribers per bus). Events that share an EventGroupId are delivered in order to Subscribers that choose ordered delivery, while other Subscribers on the same bus stay asynchronous, and synchronous invocation of targets like Lambda removes the usual SQS buffer between bus and function. Content-based deduplication drops retries of the same payload that arrive within five minutes, JSONata expressions reshape events per Subscriber, Avro and Protobuf payloads can be deserialized for filtering, and 24 hours of retention are built in, extendable up to one year for replay. Architect’s notes: (a) the pricing changes shape — the new bus bills per GB published and per GB delivered, with each event rounded up to 1 KB, instead of per event. At the pricing page’s example rates ($0.18/GB in for the first 5 TB, $0.05/GB out), a million 1 KB events delivered to one Subscriber cost about $0.23, against $1.00 per million on a classic bus before any bus-to-bus hop is billed again; a million 10 KB events cost about $2.30. Model your real event sizes and fan-out before you migrate. (b) Nothing is forced: existing buses are renamed Custom event bus – classic and keep working, with every existing API unchanged. (c) Fourteen launch Regions across the US, Europe and Asia Pacific — Paris and London are not in the list. (announcement, News Blog, pricing)

2. AWS Network Security Manager is generally available — a new service to define network security policy once and enforce it across your AWS Organization. At GA it drives AWS WAF rules (Application Load Balancers, API Gateway, CloudFront distributions) and AWS Shield Advanced protections (ALB, Classic Load Balancers, Elastic IPs, CloudFront), with AWS Network Firewall support announced as next. Policies are hierarchical — central security sets the organisation baseline, application teams add their own rules inside those guardrails — scoped by account, OU, resource type, tags or resource attributes, and applied automatically to new resources as they appear. Drift is detected and remediated automatically, or left for manual action if you prefer; changes stay in draft until published, every published version is immutable, rollback is one click, and rules can be generated from a natural-language description. Architect’s notes: (a) policies are Region-specific and GA is US East (N. Virginia) — map your Region footprint before you plan a rollout; (b) the service has its own meter on top of the WAF and Shield charges it deploys: $0.35 per hour per account per Region where policies are created (about $252 a month in the pricing example), plus $0.004 per protected asset-hour. (announcement, product page, pricing, FAQ)

3. DynamoDB multi-Region strong consistency now crosses continents — MRSC global tables add Canada (Central), Europe (Stockholm), Europe (Spain), Asia Pacific (Mumbai) and Asia Pacific (Singapore), for 15 supported Regions, and a table can now use any three of them — including configurations that span North America, Europe and Asia Pacific. The shape is unchanged: exactly three Regions, either three replicas or two replicas plus a DynamoDB-managed witness, each write synchronously replicated to at least one other Region before it returns, and a recovery point objective of zero. Architect’s note: consistency is paid in latency. Write and strongly consistent read latency depend on the round trip between the Regions you pick, so a cross-continent trio buys global resilience for user profiles, inventory, order state or entitlements at a price your p99 will show. Load-test the exact Region trio before committing; when lower write latency matters more than global read consistency, multi-Region eventual consistency (MREC) remains the other mode. (announcement, how global tables work)

4. Kinesis Data Streams picks the partition key for you — On-Demand Standard and On-Demand Advantage streams now accept records without a partition key: the service distributes them across its warm capacity. It replaces the usual workaround of random partition keys (UUIDs), which still produce uneven throughput across shards and throttle some keys while the stream has aggregate capacity to spare. Architect’s notes: (a) it is for workloads that do not need ordering — log aggregation, metrics collection, IoT telemetry — because per-key ordering is exactly what the partition key gives you; keep explicit keys wherever the order of one entity’s events matters; (b) there is no additional cost, it is available in all commercial Regions, and adopting it means upgrading to the latest AWS SDK or Kinesis Producer Library. (announcement, Kinesis Data Streams concepts)

Industry signal — Amazon opened Seller Central to outside AI agents. Seller Assistant, built on Amazon Bedrock with Anthropic’s Claude models, gained persistent memory and always-on workflows, and a selling partner plugin now brings its data and actions into Amazon Quick and Anthropic’s Claude — in beta for sellers in Amazon’s U.S. stores. The reason given is blunt: 90% of Amazon selling partners already use third-party AI tools to run their businesses, so the platform goes to the agent the seller already uses. The takeaway for architects is the guardrail triplet Amazon lists for every plugin interaction: clear boundaries on what the agent can access, human approval on actions, and complete audit trails. If your own platform is about to be called by your customers’ agents, those three belong in the API design from day one, not in a later security review. (Amazon announcement)

Which one changes your roadmap? The video also runs on LinkedIn — previous edition: September 7. If the Network Security Manager item caught your eye, the governance side of the problem is in Your CSPM Won’t Save You; and if agents are about to call your APIs, here is how an MCP gateway enforces policy on agent tool access.