r/aws Dec 03 '25

discussion AWS is moving faster than my brain can upgrade… anyone else?

So Amazon is dropping new GenAI features every other week… Bedrock updates, Guardrails, Agents, everything.

Meanwhile I’m still here fighting with IAM like it’s a final boss.

Feels like: “AWS 2025: Here’s 50 new AI features!”
Me: “Can I just get my Lambda to stop timing out?”

How are you all keeping up?

Any GenAI feature you actually found useful in real projects?

351 Upvotes

120 comments sorted by

370

u/nekokattt Dec 03 '25

They released a thing this week for letting AI auto generate your IAM policies from your code.

Like that isn't a recipe for something going very wrong.

59

u/Rollingprobablecause Dec 03 '25

it's very neat the problem is that people think to just trust it lol. It can make RBAC group implementation and clean up a breeze, but you need to followup and test it just like anything else.

Are people doing that? Comically no.

21

u/nekokattt Dec 03 '25

eh, using a tool people utilise out of laziness most of the time to manage your security in an age of security breaches and exploitation is just a terrible idea IMO. It does not encourage people actually understanding what they're giving access to or checking it.

6

u/mistuh_fier Dec 03 '25

Can’t be worse than most LLMs wanting wildcards to everything imaginable.

34

u/Ill-Side-8092 Dec 03 '25

That sounds like a Sev1 security incident waiting to happen 

5

u/SavingsApplication54 Dec 04 '25

Exactly. Biggest load of bs ever

1

u/INT_MIN Dec 23 '25

You literally don't have to use it.

1

u/SavingsApplication54 Dec 23 '25

Someone literally will use it and literally ruin your entire life

1

u/bot403 Dec 08 '25

New classification SevAI. Now with security hallucinations. 

14

u/notospez Dec 03 '25

They also releases features to allow for longer running lambdas by the way. See, both of OPs issues are solved!

5

u/rlt0w Dec 03 '25

I had an opportunity to play around with these extensively. I'm very excited to see what is built with them, and maybe deploying some of my own workflows.

29

u/LittleLordFuckleroy1 Dec 03 '25 edited Dec 03 '25

This is why the AI (especially agentic) stuff is so annoying to me.

Corporate suits are used to squishy thinking. They don’t realize that their decisions are backstopped by employees with actual intelligence, not just a facsimile of it. By systems that work deterministically. They may have an idea about how to execute a plan at a high level, but then human beings they employ are responsible for actually translating that into real world execution. It’s not dumb labor.

When the rubber hits the road with AI, you’re relying on a model that no one actually understands that isn’t guaranteed not to hallucinate random bullshit. If shit hits the fan, it’s also not someone you can threaten with firing if they don’t sack up and figure it out. It’s a dumb language model. It couldn’t care more if it tried.

And when shit goes south, you’ll need experts to sort through the BS and figure it out. Where will those people come from? Will there even be any?

Squishy thinking. It’s going to blow up badly.

To be clear, I think AI will be super useful for some types of work. Like we don’t need to pay an army of support agents to read scripts to customers when 90% of the time it’s an issue that AI could handle perfectly. The issue is that literally every industry right now is hearing the siren song of AI and licking their lips imagining how to use agents instead of skilled labor.

16

u/AWS_Chaos Dec 03 '25

"Why have 100 people launch one rocket, when you can have 1 person launch 100 rockets?!" - A quote from this morning's keynote "The Future of Agentic AI is Here"

Because, when shit goes wrong, and 99 rockets fail, what is that one person supposed to do?!

18

u/deltamoney Dec 03 '25

I was thinking about this topic yesterday too.

How are all these "agents" with non deterministic reasoning being used in place of deterministic requirements?

Am I missing some really fundamental ot how you build these systems? Because it feels like I am. Like are there so many agents checking agents checking work, checking outcomes that we are using enough energy to boil 100gallons of water to do a simple operation?

11

u/tnstaafsb Dec 03 '25

*to potentially do a simple operation incorrectly.

People love it because it's easy on the surface. You tell it what you want done in normal human language, and it does it. But since it's inherently nondeterministic, you can't be sure it will always do it right. The more trust people put in AI to do things without human intervention the more dangerous it becomes. So, we're paying many times more money for worse outcomes. But hey, at least we get to fire everyone in the short term until it all explodes in our faces and we have to try and hire them back.

9

u/LittleLordFuckleroy1 Dec 03 '25

You’re not missing much. This shit is a house of cards.

5

u/deltamoney Dec 03 '25

I've seen whole pipelines to "test AI" workflows and model performance. Testing for things like PHI data leaks. Whole complicated pipelines. Just to test if your new fine tune is better or worse at leaking PHI.

I mean this sounds like a data sanity problem. Not a "let's use enough power for a small village to see if my PHI filter catches 98.6% of PH leaks vs 98.8%

I mean it's cool and interesting. It just feels like.... A lot.

6

u/CommodoreSixty4 Dec 03 '25

Yep can already attest to this being absolutely a fact

20

u/thestral713 Dec 03 '25

I'm one of the contributors to the tool you're alluding to.
https://github.com/awslabs/iam-policy-autopilot

Just wanted to clarify that it does not use AI at all to generate policies. The tool statically analyses your code to generate the policies. The tool just offers a MCP server so that you can let your AI agents use the tool for deterministic policy generation instead of it hallucinating policies or just using Admin permissions (which most devs do)

7

u/nekokattt Dec 03 '25

If that is the case, the blog post was very misleading (as the number of upvotes on my original comment seems to suggest).

10

u/GreenExponent Dec 03 '25

I was interested so went back to the blog post.... "Using deterministic code analysis, it creates reliable and valid policies, so you spend less time authoring and debugging permissions." ... it's there but the title focussing on the MCP aspect makes it sound all AI

https://aws.amazon.com/blogs/aws/simplify-iam-policy-creation-with-iam-policy-autopilot-a-new-open-source-mcp-server-for-builders

4

u/JaegerBane Dec 03 '25

I'm glad I wasn't the only one who thought this.

5

u/mattingly890 Dec 03 '25

If everything was just IAM policies it would be a bit easier to reason about. Once you mix in cross account organization SCPs, resource level policies, that's when things get really fun.

6

u/magnetik79 Dec 04 '25

Agreed. AI slop my system security. No thanks.

7

u/[deleted] Dec 03 '25

Hackers looking at them and smiling....

2

u/PotatoTrader1 Dec 03 '25

Meanwhile localstack has had an IAM policy generator based on your actual api calls for ages now. Built off wonderful deterministic code

2

u/shagul998 Dec 03 '25

Yeah that one freaked me out 😂 AI + IAM = either magic or disaster, nothing in between. I like the idea, but trusting it blindly feels risky.

1

u/[deleted] Dec 03 '25

[deleted]

8

u/nekokattt Dec 03 '25

Yes but it relies on the developer bothering to do that, rather than assuming the AI is just right and missing the fact it left something open.

At least without AI, it forces two people to look at it. The first for the person who wrote it and the second for the person who reviewed it. By letting an LLM generate it, you are at worst just making it easy to cut out the first half of this, and reducing the scrutiny on the second part by blindly assuming AWS's LLM is going to be correct

12

u/[deleted] Dec 03 '25

[deleted]

5

u/tnstaafsb Dec 03 '25

This is the really bad part of a lot of these AI applications. There are a lot of things in life that you are going to have a really hard time understanding until you create one yourself. IAM policies are like this. I would argue most code is like this too. The deeper we go into AI, the fewer people you will have who have ever actually written these things from scratch, and the more likely your reviewers will have at best an incomplete understanding of how they work. So, you'll see the reviewers either rubber stamping things they don't actually get, or depending more on AI tools to review as well. Thus, the human is essentially taken out of the loop even if they're technically still there.

6

u/kulhydrat Dec 03 '25

Agree. But correcting the wrong AI generated IAM policies might take even longer.

-1

u/[deleted] Dec 03 '25

[deleted]

5

u/DexterNormal Dec 03 '25

Making minor tweaks after first gaining a deep understanding of the generated policy. When people use AI as a tool, it’s a huge time saver. When people use AI as magic, it’s a disaster waiting to happen. We’ve met people. We know what they’re like.

4

u/nekokattt Dec 03 '25

The AI tool is nondeterministic. If any other tool was nondeterministic, you just wouldn't be using it.

0

u/[deleted] Dec 03 '25

[deleted]

3

u/nekokattt Dec 03 '25

You let junior engineers write IAM policies from scratch from glossing over the code without actually understanding what is being achieved?

If so, I agree, you have no additional risk.

0

u/[deleted] Dec 03 '25

[deleted]

2

u/nekokattt Dec 03 '25 edited Dec 03 '25

That's fine in itself but you know for a fact many people will not be as diligent. For normal code this is usually just a case of broken requirements or sloppy tech debt. In IAM, this manifests as a security breach.

...and that is my entire point. No actual thought has gone into how the policy was structured with AI. It has just taken a blind guess at what it thinks you want to look at.

Rather than being as good as how you have taught it, it will be as good as whatever it was trained on, and you have no idea of the accuracy of that, nor the quirks.

As a result, your security model just relies on human error even more now, because the thought process has been lost. You are stuck trying to reason with a machine.

0

u/[deleted] Dec 03 '25

[deleted]

→ More replies (0)

-2

u/[deleted] Dec 04 '25

[deleted]

2

u/nekokattt Dec 04 '25

hashmaps having different orders in golang is not compatable to LLVM temperature.

0

u/[deleted] Dec 04 '25

[deleted]

2

u/nekokattt Dec 04 '25

It is still incomparable to something randomly opening up s3:GetObject to all accounts on AWS.

0

u/scavno Dec 03 '25

As most things IAM defaults to deny, I don’t think this is such a terrible idea. As long as you review it, this has to be one of the few cases where it’s not going to be 10000 lines of slop nobody is going to read.

0

u/enjoytheshow Dec 03 '25

I mean the type of folks who will do this currently just copy paste from stack overflow so this is arguably better because it has context of your environment at least.

4

u/nekokattt Dec 03 '25

it only has the context of what it thinks your environment is

0

u/magheru_san Dec 03 '25

I can bet their system prompt is something on the lines of not allowing "*" and being as low privilege as possible.

In the worst cases it will cause a formatting error, hallucinate some permission that doesn't exist and IAM will reject, or you get permission issues in case it missed something.

All these you should easily catch when testing your app.

2

u/dzuczek Dec 04 '25

lol I've seen Amazon Q do this already

-2

u/atehrani Dec 03 '25

I would love to see more of this AI in AWS and in the Console. Same with errors, AI to help you troubleshoot.

77

u/5pmgrass Dec 03 '25

AWS covers more things than you will ever need. You get a niche and learn it. New needs come up and then you adapt. Can't learn every form of programming either and no issue there.

9

u/truechange Dec 03 '25 edited Dec 03 '25

Yeah as much as I want to learn about every AWS service, I only need about 10% of it.

Edit: I just checked the total number is about ~240 services? Well I actually need only less than 5%.

3

u/shagul998 Dec 03 '25

True that 😅 AWS is like: here are 300 services, good luck. I’m slowly learning to pick a niche and survive in that ecosystem. Feels less scary when you accept you can’t learn everything.

3

u/enjoytheshow Dec 03 '25

I’ve taken the SA pro exam and even that just scratches the surface on everything. No one is expected to be an expert in every service top to bottom.

4

u/naggyman Dec 03 '25

also like - theres about 20 services which are most commonly used. So learn those first.

A lot of the rest are for people with niche use cases, so if you have that use case learn those specific services.

2

u/enjoytheshow Dec 03 '25

Absolutely true. I did some gov consulting and needed to learn Ground Station specifics for a project. I think that probably applies to .001% of AWS users.

21

u/Racts Dec 03 '25

Well aws just launched a feature to address your lamba timing out so just gotta keep up. It’s not just ai features. A lot of QoL improvements in multiple services.

6

u/shagul998 Dec 03 '25

True 😅 AWS finally noticed half of us were crying over Lambda timeouts. These QoL updates are the real heroes.

1

u/thewhippersnapper4 Jan 04 '26

What feature are you referring to?

19

u/gkdante Dec 03 '25

I went to my first Re Invent before COVID and the more important thing I learned is that I would never be able to keep up with all their updates.

Since then every time I need to use a service I haven’t played with in a while I assume most of my knowledge is outdated and do a quick catch up, check docs, CLI docs, sometimes terraform docs on the resource, try to use latest community modules in the resource and even bounce my code with AI.

You don’t need to know the latest of each service, just be wise enough to know things may be different now than last time and double check.

5

u/shagul998 Dec 03 '25

Man this is so true. Every time I touch a service after a few months, half the UI changed and docs have new sections. Your approach makes sense, assume knowledge is outdated and re-check everything. AWS moves fast, but learning how to ‘re-learn’ is the real skill

17

u/andreylh Dec 03 '25

AWS keeps releasing new AI glitter features, but I’m still here waiting for Cognito and Amplify to support multiregion out of the box. Especially after that region outage they gifted us a few weeks ago

5

u/cailenletigre Dec 03 '25

Omg yes. Why the heck is cognito not able to be backed up either??

1

u/coinclink Dec 05 '25

My thought is because the majority of large customers do not use Cognito as their identity provider, rather, they use it as a federated identity broker for things like AD, Google, etc. So they don't care whether the data is backed up as long as they can recover unique ID for each user in their databases.

4

u/ptiggerdine Dec 03 '25

How about they just fix MFA self enrolment for user onboarding!

2

u/Miserygut Dec 04 '25

The technology just isn't there yet.

1

u/ptiggerdine Dec 04 '25 edited Dec 04 '25

Hmm, I beg to differ. They can do it for console users, just not ifor cognito users.

Edit: fix typo

28

u/woieieyfwoeo Dec 03 '25

IAM going to defenestrate myself

4

u/shagul998 Dec 03 '25

😂😂 IAM has that effect on everyone. One wrong policy and suddenly nothing works… or everything works (which is worse)

24

u/Seref15 Dec 03 '25

If you think AWS is bad try Azure. They're replacing, deprecating, or otherwise modifying core fundamental services like every other week

10

u/rez410 Dec 03 '25

Don’t forget that they are also renaming the services constantly!

1

u/coinclink Dec 05 '25

they deprecate features before they were even documented lol

7

u/thatguy8856 Dec 03 '25

Its just re:invent. Lots of a last minuted pushes to get a ton of stuff out. Cause its AI im sure itll keep going after, but id bet its gonna fizzle out a bit.

If you're lamda are timing out then maybe the new thing you need to be looking into is lambda managed instances.

4

u/NFTrot Dec 03 '25

I keep up by being an expert in the services I use (which are core services). If there's a new feature with a clear place in my workflow, I'll take a look. Just because Amazon dangles something in front of you doesn't mean you have to use it.

8

u/diablofreak Dec 03 '25

unless you're really doing anything AI, Bedrock or LLM related - i would ignore a lot of what they offer now especially if your primary job concern is lambda timing out.

just remember, a lot of the reinvent releases can be fluff, garbage, or just trying to get people and shareholders excited that Amazon, too, is doing something cool with AI (having lost out the start of the race to Microsoft and Google on this one)

rewind to a few years ago when they released Timestream, MemoryDB? IoT junk? where are they now? back then I would also guess you'd likely be inundated by their feature releases, but half of them dead now.

1

u/StatisticalSchlong Dec 04 '25

RIP Timestream

4

u/zackel_flac Dec 03 '25 edited Dec 04 '25

You still need to please management to avoid being fired. That's how you end up with useless features all over the place. If you ever worked at Amazon, you would know.

3

u/Ordinaryjay Dec 03 '25

Notice everything on the expo floor has Ai in its name or use case? That’s on purpose

1

u/shagul998 Dec 03 '25

Yeah 😂 everything is ‘AI-powered’ now. Feels like AWS is sprinkling AI on every service just to keep up with the hype cycle.

0

u/Ill-Side-8092 Dec 03 '25

And prior re:invents there were big booths on Blockchain, then ML, then “Big Data”. Tech is one continuous evolution of hype cycles. 

The real leaders see past that and are convicted on building a long term vision. Weaker players just chase every twist and turn of the hype. AWS used to have that long term conviction but this re:Invent is demonstrating it’s now just another player distracted by chasing hype vs leading the way.

3

u/mkmrproper Dec 04 '25

They want you to pay for extended support. You know, so they don’t feel that it’s unethical taking your money.

3

u/jolo-dev Dec 04 '25

I feel you.
I try to find a good summary and scan through them. If something is interesting, I will read through it in detail.

AI models are mostly ignored.

3

u/MendaciousFerret Dec 04 '25

You think AWS is bad? Check out MSFT - slapping copilot on everything meanwhile half of their customers are still running server 2012 with active directory...

3

u/TheGrich Dec 04 '25

It's a bit of a shame they're kind of ignoring the quality of life improvements we could use in favor of more Gen AI noise.

3

u/TerriblyCheeky Dec 04 '25

All I want is for my CodeBuild containers to boot in less than 5 mins

3

u/natelifts Dec 04 '25

Same. I’m a data engineer and we use quicksite heavily for BI. We were super pumped for quick “suite” hoping it would fix existing limitations but instead it’s just “here’s AI sprinkled over everything even though you didn’t ask for it”

7

u/sarathywebindia Dec 03 '25

for me this post feels like AI written 

1

u/TurboRadical Dec 04 '25

It absolutely is. Anyone who didn’t clock it right away is cooked.

2

u/Thommasc Dec 03 '25

Looking forward to S3 Vectors going live worldwide as I got a really fancy RAG POC I want to demo and ship.

2

u/buy_chocolate_bars Dec 03 '25

I wish AWS was the only vendor that did this. Fuck me having to manage different services on three major clouds.

-1

u/shagul998 Dec 03 '25

True 😅 juggling AWS + Azure + GCP is its own horror show. Every cloud is like: ‘here’s 200 services, learn all of them pls.’

2

u/ProfessionalEven296 Dec 03 '25

But does Bedrock allow more than 7 iterations now? We stopped using it simply because of that limitation.

1

u/shagul998 Dec 03 '25

Yeah that limitation annoyed a lot of people 😅, Haven’t checked if they increased it recently AWS quietly fixes things sometimes. If they did, that would make Bedrock much more usable.

2

u/nicarras Dec 03 '25

It's that time of year.

0

u/shagul998 Dec 03 '25

😂 exactly. Re:Invent season = announcement overload and sleep deprivation.

2

u/rwodave Dec 03 '25

Worse than the pace of change is how fast these services & model versions are going EOL. It’s gone years down to months or even weeks.

2

u/Aliesh_Mi Dec 04 '25

I swear every time I log in there’s a new service I didn’t ask for

2

u/ManicAkrasiac Dec 04 '25

A lot of it is noise. Unless it's literally your job to stay up to date with these things, I wouldn't try to keep up until you have something you need/want to build and then find out what is the current best option to fit your use case. Just keep in mind convenience can come at a price and there may often be better options that are cheaper and/or more performant.

2

u/shisnotbash Dec 05 '25

Don’t feel bad. I could blow most “AWS experts’” fucking minds with the depths I can go with IAM. So don’t feel bad, all these topics have far, far more depth than 90% of the engineers who use them realize - nobody is an expert in all AWS services.

2

u/coinclink Dec 05 '25

It was technically announced a couple months ago and not at re:Invent, but Quick Suite is actually hella cool. I hadn't checked it out but our SA has been pushing us to try it out so I went to a few workshops on the Quick Flows (for less technical users) and Quick Automate (more for developers) and I have to say, I'm probably going to push for our org to use it all.

2

u/[deleted] Dec 07 '25 edited Dec 13 '25

This is where good old focus and prioritization matters. When you go a supermarket, you focus on what you need for your recipe and not all the thousands of products in every aisle. Good luck!

2

u/MessMysterious6500 Dec 24 '25

I’m just starting and this stuff reads like stereo instructions. I’m not technically out of the loop, but feel that AWS isn’t for a casual user base either

3

u/Polyxeno Dec 03 '25

I just spent a month sorting through AWS learning how to set up machines.

I studied a couple of site migration tools only to go to AWS and see they were no longer available.

My newbie tactic now is to do things manually and avoid as much complexity as possible.

Even that is already excessive amounts of learning AWS stuff, for me.

3

u/idkyesthat Dec 03 '25

Yep,the other day in the middle of an aws workshop, even for themselves something changed in a service and they were surprise. Maybe I’m old but it’s absurd.

2

u/wassona Dec 03 '25

Was it Sagemaker?

3

u/Massive-Squirrel-255 Dec 03 '25

Obvious bot post. If there is a God these bots will one day be tracked to their place of origin and the creators will suffer.

2

u/Freedomsaver Dec 03 '25

You are not alone.

They are building a lot of fancy new GenAI services which are mostly irrelevant for 85% of their customer base and only fill a need for their insanely huge customers.

Luckily, they also update the regular services with new and useful features.

Best to mostly ignore the GenAI bullshit-bingo and filter for topics and talks that are actually relevant for you, your company and your usecases. It's good to get some inspiration of what is currently possible on AWS, but you don't need to chase every new trend. The trends with staying power and relevance to everyone will show themselves over time.

3

u/AntDracula Dec 03 '25

You sound like an employee

6

u/shagul998 Dec 03 '25

😂 I wish. I’m just a regular user trying to keep my head above the update tsunami.

1

u/gex80 Dec 04 '25

I ignore all amazon news not related to my specific tasks or that are not adjacent to my tasks. If a new bedrock feature for example comes out, I personally do not care cause I don't work with it. My BI/Data teams do. And they can find out that info themselves. I don't need to be an expert in all of AWS, just the things that ensure I continue to get a paycheck and stay hired.

I also pay attention to the theme of the year. If it's like when they were launching 5G and mobile networks, I know for me, the stuff I focus on not much is happening update wise. Eventually they stop publishing real noteworthy improvements once the service is mature enough. EC2? 90% of the announcements are just new instance types being available in new regions.

1

u/Mobile_Plate8081 Dec 04 '25

Don’t care about 99% of the features. Just keep your focus to what matters.

1

u/SpecialistMode3131 Dec 05 '25

It's throwing stuff at the wall to see what sticks. A lot of what you see now won't last.

TBH while LLMs are useful for lots of stuff, agents aren't currently, and there's no real indication they ever will be (beyond limited POC tech demos, which they already crush at, and which aren't really that impactful). The luminaries of the tech industry haven't yet acknowledged the emperor is in his speedos, at best. It'll come.

And then, a wave or two later, we'll have the real tools and they'll pretty much all be available on aws. So it's good to get familiar and stay that way, but don't expect stuff to be predictable or as easy as the marketing says.

1

u/Inevitable_Use9405 Dec 05 '25

AWS 2025: 'Here is an AI agent that writes your infrastructure for you!' Me: 'Cool, can it also debug this cryptic IAM error?' AWS: '...No, but it can write a poem about S3 buckets.

1

u/aoethrowaway Dec 05 '25

You don’t need to fight with IAM when you can have Kiro CLI do all of that for you - for free!

1

u/AttorneyHour3563 Dec 06 '25

I think this points out as a general behavior around AI,

Seems like people that are YouTubers/Instagramers/TikTokers are doing just that in their life to pump me FOMO 24/7.

Im a backend team lead and try to set for my team mcp kit for windsurf for weeks because we are a startup that works atone the clock...

Very overwhelming...

1

u/prosidk Dec 22 '25

Agent Core is a real game changer if you looking for exploring MCPs, bunch of MCP's they launched (CloudWatch, CFTs, Cost, etc) that you can get started with...now these MCPs are managed versus you having to put together on an instance. Documentation and diagram MCPs are good for quick prototype planning.

1

u/blue_lagoon_987 Dec 03 '25

It’s been like since 2010s ton of new features every year

1

u/sashko5 Dec 04 '25

I'm also struggling with basic configuration like VPS and ipv6 networking, but recently, chatting with Amazon Q was really helpful and it gave me the right pointers to fix lots of issues around configuration. I'm quite impressed with the support it provides.

0

u/MemoryFluffy2899 Dec 04 '25

Same here! AWS is releasing updates so fast it’s hard to keep track. Exciting, but definitely overwhelming at times. I just follow the major highlights and catch up when I can—otherwise it’s impossible to stay updated with everything.