In the week of 21 September AWS redrew two core primitives around the organization instead of the account: CloudWatch Omni is a team-scoped observability experience reachable over SSO without console access, and the relaunched EventBridge custom bus is a single RAM-shared broker with ordering, retention, and a pricing model built for the hub-and-spoke pattern everyone already runs. DynamoDB global tables with multi-Region strong consistency reached 15 Regions and cross-continent configurations, Elastic Disaster Recovery added Graviton source servers, and Security Hub started inventorying self-hosted AI on Azure VMs.

CloudWatch Omni: telemetry organized by team, not account

On 23 September Amazon CloudWatch Omni went generally available. You create spaces in a central account that see telemetry across accounts and Regions, and across other clouds including Azure workloads. Omni auto-discovers services, maps dependencies, surfaces golden metrics, and pulls the AWS DevOps Agent into investigation sessions to correlate signals. It is built on OpenTelemetry, so existing instrumentation shows up without reconfiguration. The part that changes org design: it is a standalone web experience with SSO for the whole team, no AWS console access required, plus an IDE extension and Agent Toolkit access.

This is AWS building what Datadog and Grafana have sold for a decade: one URL, one login, every account, with the vendor's AI doing the first pass. The difference is that the telemetry never leaves CloudWatch, which for many regulated shops is the whole decision.

The trade-off is an identity one. "No console access" means Omni authorization is an SSO mapping to spaces, not an IAM policy on log groups. That is the right model for a developer who should see their service's traces and nothing else, but it is a second access-control system next to the one you already audit. Decide which spaces hold production telemetry, who gets mapped into them, and how that mapping is reviewed, before the first team self-serves a space. And check pricing for the cross-account and cross-cloud ingestion paths before you point the Azure estate at it.

EventBridge relaunches the custom bus for the enterprise

On 24 September EventBridge relaunched custom event buses. The enhanced bus can be shared across every account in the organization through AWS RAM, so publishers write straight to the central bus. A new publishing API accepts open formats like CloudEvents without rewriting the schema. Buses keep 24 hours of events by default, extendable to a year, so you can replay after a bug or hydrate a new consumer from history. A new Subscriber resource bundles filtering, targets, and retries; there is content-based deduplication, strict ordering where you ask for it, and synchronous invocation for targets like Lambda. Existing buses continue unchanged as "classic". The News Blog post adds that an ingress/egress pricing model replaces the compounding cross-account routing charges of the multi-bus pattern.

The pattern this replaces is a bus per account, forwarding rules into a central bus and back out, and a charge at every hop. One shared bus with Subscribers is simpler and, for most topologies, cheaper. The retention and ordering features are the ones that previously forced teams to put Kinesis or Kafka in front of EventBridge; a lot of that glue can now go.

Do not migrate the hub overnight. Model the ingress/egress cost against your current per-rule charges first, because "cheaper for most" is not "cheaper for all". Then move one producer and one Subscriber, keeping the classic bus forwarding in parallel, and compare delivery counts for a week. Ordering is opt-in and will have throughput implications; turn it on per subscription where a consumer actually needs it, not globally.

DynamoDB strong consistency across continents

On 23 September DynamoDB global tables with multi-Region strong consistency added five Regions (Canada Central, Stockholm, Spain, Mumbai, Singapore) for 15 in total, and any three-Region configuration across them is now allowed, including ones that span North America, Europe, and Asia Pacific. You pick three replicas, or two replicas plus a witness Region, and get a recovery point objective of zero.

RPO zero across continents is a real capability and it is also physics. A strongly consistent write across Frankfurt, Virginia, and Singapore pays an intercontinental round trip before it acknowledges, every time. The cross-continent option is for the data where that is worth it (entitlements, order state, inventory, the things where a stale read is a correctness bug) and not for the session table next to it. Keep MRSC tables small and deliberate; everything else stays on eventually consistent global tables with local write latency.

Migration and security corner

On 25 September AWS Elastic Disaster Recovery added Graviton-based (arm64) source servers. DRS detects arm64 and recovers onto Graviton instances, nothing extra to configure, no additional cost. This closes a gap that blocked Graviton adoption where "has a DR plan" is an audit requirement. It is the week's only migration-tooling news; nothing from AWS Transform or DMS shipped.

On 22 September Security Hub AI Inventory started discovering AI assets on self-hosted Azure VMs, using Inspector's SBOM analysis to find inference endpoints, models, and agents (Ollama, vLLM, Hugging Face TGI, and others) and correlate them with findings. Included in Security Hub Essentials. If you are consolidating security posture into AWS while an Azure estate winds down, this is the inventory step you otherwise do by hand.

And on 25 September IAM outbound identity federation gained interface VPC endpoints for its OIDC discovery and JWKS endpoints. A verifying workload in a VPC with no internet path can now fetch the keys to validate STS-issued JWTs privately. If you adopted outbound federation to get rid of long-lived keys, this removes the last reason some private subnets could not.

Also this week

The throughline

Omni, the EventBridge relaunch, Network Security Manager, and the billing context API all assume the unit of operation is an AWS Organization with a central account, not a single account with a console. The cost of that catch-up is that each one introduces an org-level control plane (spaces, shared buses, security policies) with its own access model, and the platform team's job becomes keeping those access models coherent. The DRS and OIDC endpoint changes are the quieter version of the same story: capabilities finally reaching the configurations real estates are in, arm64 fleets and VPCs with no internet, so the exceptions list gets shorter.

Read this next

For the AI and agent reading of the same week, see ercan.ai. If your team needs hands-on help with AWS, cloud architecture, CI/CD pipelines, Linux, GitHub or GitLab, and the platform work around them, the consulting side lives at ercanermis.com.

References