AWS Security Digest·Week 30 of 2026·Jul 20-26, 2026·12 items
A GuardDuty Investigator on Demand, and Agentic Tooling Patches Again
GuardDuty gets an on-demand investigation agent in public preview, Secrets Manager starts publishing secret-change events to EventBridge, and CloudTrail learns to filter network activity logging by identity. Five more bulletins close out July, including a TLS 1.3 record-drop flaw in s2n-tls and a third AgentCore SDK patch this summer.
In this issue4high4medium4info
Highlights
3 items
$ tail -f /var/log/aws-security.log
high/Feature Launch/
GuardDuty Investigation Agent: On-Demand AI Threat Assessment in Public Preview
Amazon GuardDuty introduced its investigation agent in public preview on July 20: an on-demand agent that investigates findings and returns structured assessments with risk levels, confidence scores, MITRE ATT&CK mappings, and prioritized recommendations.
The preview is free with limits of 10 investigations per account daily and 100 cumulative during the preview, in 10 Regions (N. Virginia, Ohio, Oregon, Canada Central, Frankfurt, Ireland, London, Paris, Stockholm, Tokyo). It adds three IAM permissions: guardduty:CreateInvestigation, GetInvestigation, and ListInvestigations, and is accessible via console, CLI, SDKs, and the AWS MCP server.
Add the new IAM actions to your SOC role policies deliberately, not via wildcard.
GuardDutyIAM
medium/Feature Launch/
Secrets Manager Now Publishes Secret-Change Events to EventBridge
AWS Secrets Manager now automatically publishes events to the default EventBridge bus when secret values change, including rotation, announced July 22. No opt-in is required and there is no additional cost, in all Regions where Secrets Manager operates.
Events can route to Lambda, SNS, SQS, or Step Functions. Teams no longer need to parse CloudTrail to trigger credential-refresh or anomaly workflows when secrets change.
Secrets ManagerEventBridge
medium/Feature Launch/
CloudTrail Network Activity Events Can Now Be Filtered by Identity
CloudTrail advanced event selectors can now filter network activity events for VPC endpoints by the IAM user identity making the call, announced July 20, combinable with existing fields like eventName or vpcEndpointId.
Example: log only VpceAccessDenied events from identities not on a safe list. Available in all Regions supporting network activity events, via console, CLI, and SDKs.
Data-perimeter monitoring becomes affordable when you log only the suspicious endpoint traffic instead of everything.
CloudTrailVPC
CVEs & Vulnerabilities
5 items
$ cat /var/reports/CVE_REPORT.txt
high/CVE/
CVE-2026-16317 / CVE-2026-16318: s2n-tls Let a MITM Silently Drop TLS 1.3 Records
AWS bulletin 2026-062-AWS covers two flaws in s2n-tls.
CVE-2026-16317: the outer content_type byte on TLS 1.3 encrypted records was hardcoded in authenticated data instead of validated from the wire, letting a man-in-the-middle silently drop individual application data records undetected. All TLS 1.3 connections are affected; TLS 1.2 and QUIC are not. Amazon assigns it CVSS 4.0 8.3. CVE-2026-16318 is a memory leak in the QUIC transport parameters extension handler during HelloRetryRequest exchanges, degrading long-running QUIC-enabled servers.
Upgrade to s2n-tls v1.7.6.
Affected
s2n-tls <= v1.7.5
Fixed In
s2n-tls v1.7.6
high/CVE/
CVE-2026-16584: AWS API MCP Server Could Run With Policy Checks Silently Disabled
AWS bulletin 2026-063-AWS covers a fail-open flaw in the AWS API MCP Server.
If security-policy enforcement data failed to initialize at startup, the server kept running with the per-request policy check skipped for the lifetime of the process, letting an actor execute AWS API operations the policy was set to deny or gate. IAM permissions were still enforced. Amazon assigns it CVSS 4.0 7.3.
Update to 1.3.47, keep the server on least-privilege IAM credentials, and restart it after connectivity issues.
Affected
awslabs.aws-api-mcp-server >= 0.2.13 and < 1.3.47
Fixed In
awslabs.aws-api-mcp-server 1.3.47
IAM
high/CVE/
CVE-2026-16796: AgentCore SDK install_packages() Patched Again
AWS bulletin 2026-065-AWS covers a command injection in the Bedrock AgentCore Python SDK, a distinct follow-on to June's CVE-2026-12530 in the same install_packages() path.
An authenticated remote user can inject arbitrary commands into the Code Interpreter sandbox via manipulated package name parameters.
Upgrade bedrock-agentcore to 1.18.1. Never pass untrusted or model-generated input to install_packages(), and validate names against strict PyPI naming conventions.
Affected
bedrock-agentcore < 1.18.1
Fixed In
bedrock-agentcore 1.18.1
Bedrock
medium/CVE/
CVE-2026-15957: Stack-Exhaustion DoS in smithy-rs Generated Deserializers
AWS bulletin 2026-061-AWS covers uncontrolled recursion in the JSON, CBOR, and XML deserializer functions smithy-rs generates for recursive model shapes.
A small crafted request with deeply nested structures can cause stack exhaustion and process termination. There is no workaround.
Update AWS SDK for Rust crates to release-2026-06-02 or later.
Affected
aws-sdk-rust crates before release-2026-06-02
Fixed In
aws-sdk-rust release-2026-06-02
medium/CVE/
CVE-2026-16756: Slowloris DoS in aws-smithy-http-server
AWS Organizations increased the resource control policy quota from 1,000 to 2,000 per organization on July 22, applied automatically at no additional cost in all Regions where Organizations is supported.
One less scaling ceiling for data-perimeter enforcement in large multi-account estates.
AWS Lambda durable functions now support encrypting durable execution data with a customer-managed KMS key, announced July 22, operating independently of the function-level key protecting environment variables and SnapStart snapshots.
No additional Lambda charges beyond standard KMS costs, in all Regions where durable functions is available. Regulated workloads gain independent key control over long-running workflow state.
LambdaKMS
info/Feature Launch/
AWS WAF Adds Dynamic Label Interpolation
AWS WAF now supports dynamic interpolation of labels and synthetic data, described in a Security Blog deep dive published July 21: client IP, request ID, and JA3/JA4 fingerprints can be injected into custom headers and block or challenge pages.
The post also notes Bot Control now identifies more than 650 bots and agents. Downstream applications get WAF's verdict context without a second lookup.
WAF
info/Compliance/
2026 ISO and CSA STAR Certificates Published, Two Services Added
AWS published its 2026 ISO and CSA STAR certificates on July 20, adding AWS Skill Builder and Amazon Nova Act to scope.
Coverage spans seven ISO standards plus CSA STAR CCM v4.0. The EY CertifyPoint onboarding audit for the newly added services completed with no findings; certificates are dated May 31, 2026.
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
The pattern of the whole seven weeks crystallizes here: agentic tooling is where the vulnerabilities live, and the bedrock-agentcore SDK just took its third patch of the summer, so get to 1.18.1 and pin your update process. On the defense side, wire Secrets Manager's new EventBridge events into rotation-verification workflows: it is the easiest win of the month.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
