The week of 5 October 2026 had two threads worth a platform team's attention: AWS Transform learned to inventory Microsoft Hyper-V estates with nothing installed on the hosts, and a run of smaller launches pushed identity and certificate controls down into layers that used to trust the network they sat on. Lambda's Kafka event source mappings accept OAuth, the IAM Identity Center directory can refuse requests that bypass your VPC endpoints, public ACME issuance runs over PrivateLink, and GuardDuty reads PostgreSQL queries rather than just logins. None of these is a headline. Together they are the week.

The migration desk: Hyper-V gets agentless discovery

On 7 October AWS published Discover and migrate Microsoft Hyper-V workloads with AWS Transform, filed as an announcement. The Transform discovery tool now registers each Hyper-V host as a source, connects over WinRM, and reads every VM's vCPU, memory, disks, network adapters, power state and failover cluster membership. Collection repeats hourly, clustered VMs are deduplicated, and System Center Virtual Machine Manager is not required. The tool ships as a VHD appliance that also collects from vCenter and CSV-imported bare metal, so a mixed estate gets one inventory. With guest credentials it adds 10-minute performance samples, network connections for dependency mapping, and SQL Server and Oracle details, feeding the usual chain: TCO case with EC2 sizing from measured utilization, wave plan, landing zone.

The move itself is still AWS Transform MGN at the guest OS layer, which means a replication agent on every source server. Discovery is agentless; migration is not, and change approvals for agent rollout are the part that eats calendar time.

Two companion posts landed the same week. When to use what: A guide to AWS Transform interfaces (9 October) is the first clear map of the console, Kiro and other AI IDEs, the atx CLI with non-interactive -x -t flags for pipelines, and the MCP server. Read it before you pick an entry point: the CLI covers custom transformations only. And Run least-privilege AWS DMS CDC migration from SQL Server (6 October) is the permissions write-up every DMS project should have started with.

OAuth reaches Lambda's Kafka consumers

On 9 October AWS Lambda added OAuth authentication for self-managed Apache Kafka event source mappings. Until now a Kafka ESM could authenticate with SASL/PLAIN, SASL/SCRAM or mTLS, nothing else. Teams whose clusters were locked to an OAuth-only IdP (Okta, Cognito) could not use the ESM at all, so they ran their own consumer fleet and lost the scaling, batching, filtering and error handling the ESM gives you for free. It works for self-hosted clusters and for Confluent Cloud, Aiven and Redpanda.

The trade-off: your consumer identity is now a token with a lifetime, so an IdP outage shows up as a stalled event source mapping instead of a login error somebody watches. Put the ESM's OffsetLag metric on an alarm before you flip the auth method, not after.

The identity and certificate plane goes private

Three launches on 5 and 6 October share one shape. IAM Identity Center now supports network access controls for Identity Store: you can require that Identity Store API calls arrive only through allowed VPC endpoints in your account or organization, and restrict the SCIM API your external IdP uses to synchronize users and groups. The directory that defines who your workforce is becomes reachable only from where you say.

ACM now supports ACME issuance through AWS PrivateLink. Create a VPC interface endpoint to the ACM ACME service and private DNS resolves your existing ACME directory URL to it, so any ACMEv2 client renews public certificates with no internet path and no client changes. For private-subnet hosts that keep a NAT route solely to renew certificates, that is a whole egress exception gone.

AWS Private CA now emits detailed certificate issuance logs: a CloudTrail service event, IssueCertificateDetails, with the full certificate content, issuing CA, requester identity and signing status for every issuance, including ones that failed before signing. The old management event gave you an ARN. If you are tracking an algorithm migration or need a certificate inventory that is not a spreadsheet, this is the source of truth you were missing.

Treat these as one change set: Identity Store and SCIM behind VPC endpoints, ACME over PrivateLink, issuance logs into the audit account. The failure mode to plan for is the break-glass path. When the endpoint policy is wrong, the SCIM sync silently stops and the error appears as "user not found" in an unrelated application two days later.

GuardDuty reads the queries, not just the logins

On 8 October GuardDuty RDS Protection expanded to detect data exfiltration and destruction on Aurora PostgreSQL and RDS for PostgreSQL. It used to look at login anomalies. Now it baselines data activity and flags unusual access using anomaly detection plus threat intelligence, with no agents and no database changes. The gap it closes is the one every post-incident report mentions: once an attacker holds valid credentials, their queries look exactly like the application's. Login monitoring sees nothing. Query-shape monitoring at least has a chance.

Also this week

The throughline

For years the pattern was: authenticate the user at the edge, then trust the network behind it. This week AWS kept moving the check inward. The directory API wants to know which VPC endpoint you came through. The certificate renewal never leaves the VPC. The Kafka consumer carries an IdP token. The database threat model assumes the credential is already stolen and looks at what the queries do. On the migration side, Transform reads Hyper-V hosts over WinRM rather than planting agents, the same instinct applied to the estate you are leaving. The number of places where "it is inside the network" counts as an answer shrank again.

Read this next

For the model and agent reading of the same week, the AI field notes live at ercan.ai. The hub, including consulting on AWS, cloud, CI/CD pipelines, Linux, GitHub/GitLab and more, is at ercanermis.com.

References