Cloud Security Architect: 2026-09-30
6 minutes in total
Uncover blind spots in AWS data plane operations with CloudTrail Event Coverage
AWS, 2026-09-30. Read, 2 min.
AWS CloudTrail added Event Coverage, a console view that shows which AWS services and resource types in an account or organization have data event logging enabled and which do not. Customers can subscribe to data events directly from the dashboard, and the feature is available in all commercial Regions where CloudTrail is supported.
Why it matters for this role: Open Event Coverage at the organization level and subscribe the data event sources your detections rely on, such as S3 object reads, where it shows logging off.
Amazon ElastiCache Serverless for Valkey now supports public endpoints
AWS, 2026-09-29. Read, 2 min.
Amazon ElastiCache Serverless for Valkey now supports public endpoints that make a cache reachable over the internet from outside AWS without a VPC, VPN, or bastion host. AWS says every connection uses IAM authentication over TLS 1.3, and a public endpoint requires a Valkey 9.0 or later serverless cache.
Why it matters for this role: Decide whether public cache endpoints are allowed in your accounts and add a guardrail if not, now that a Valkey 9.0 serverless cache can take one with no VPC.
Cloud SQL for PostgreSQL release notes: September 28, 2026
Google Cloud, 2026-09-28. Read, 1 min.
Google Cloud removed the cloudsql.instances.export permission from the Cloud SQL Viewer, Basic Reader, and Basic Viewer (Legacy) roles to improve security, a change its release notes label breaking. To keep export capability, principals need the Cloud SQL Editor role or a custom role that includes the permission.
Why it matters for this role: Audit custom roles for cloudsql.instances.export, the route Google names besides Cloud SQL Editor for keeping the export right that viewer roles lost.
VPC Service Controls release notes: September 30, 2026
Google Cloud, 2026-09-30. Read, 1 min.
Google Cloud made two VPC Service Controls features generally available: folders and organizations can be used as resources in ingress and egress rules, and folders can be members of a service perimeter. A folder added to a perimeter automatically protects all projects and subfolders in its hierarchy.
Why it matters for this role: Consider replacing long per-project perimeter lists with folder membership, which Google says covers every project and subfolder in the hierarchy.
Sign in to take it.