re:Invent 2020: Changes Worth Knowing

AWS re:Invent 2020 ran as a free virtual event from 30 November to 18 December. Hundreds of features were announced. This post picks the ones that change how a small DevOps team works, and says what is generally available and what is only a preview.

What matters, grouped by area

flowchart TB
  RI[re Invent 2020] --> ST[Storage]
  RI --> CO[Containers]
  RI --> SV[Serverless]
  RI --> OB[Operations]
  RI --> SE[Security and network]
  ST --> S3C[S3 strong read-after-write consistency]
  ST --> GP3[EBS gp3 volumes]
  CO --> ECRP[ECR Public and public gallery]
  CO --> ANY[ECS Anywhere and EKS Anywhere preview]
  SV --> LCI[Lambda container images up to 10 GB]
  SV --> LMS[Lambda 1 ms billing and 10 GB memory]
  OB --> DG[DevOps Guru preview]
  OB --> PR[Managed Prometheus and Grafana previews]
  SE --> NFW[Network Firewall generally available]

Storage

S3 now gives strong read-after-write consistency for all object operations (new objects, overwrites, deletes and listings) at no extra cost, announced 1 December. Workarounds for eventual consistency (such as S3Guard for Hadoop, or sleeps and retries after overwrites) can be retired over time. Check each application before removing code, since cached listings elsewhere may still lag.
EBS gp3 volumes (1 December): about 20% lower price per GB than gp2, a baseline of 3,000 IOPS and 125 MB/s independent of size, and IOPS and throughput that you can raise separately. They can be changed in place without detaching:
```
aws ec2 describe-volumes --filters Name=volume-type,Values=gp2 --query 'Volumes[].[VolumeId,Size,Iops]' --output table
aws ec2 modify-volume --volume-id vol-0abc123 --volume-type gp3
aws ec2 describe-volumes-modifications --volume-ids vol-0abc123
```
Large gp2 volumes with high burst IOPS (above 3,000) need explicit IOPS settings on gp3, so check before converting, and update CloudFormation or Terraform to avoid drift.

Containers

Amazon ECR Public and a public gallery (public.ecr.aws) let you publish and pull images without Docker Hub’s pull limits. A good place to host your own base images and to find mirrored official ones.
ECS Anywhere, EKS Anywhere and EKS Distro extend AWS container management to your own hardware (announced; availability in 2021).
Lambda and ECR both gain stronger tooling for scanning and image signing roadmaps; verify what is generally available before relying on any of it.

Serverless

Lambda supports container images up to 10 GB. Package functions with your usual Docker tooling using AWS-provided base images, and push to ECR. Better for large dependencies (ML libraries) and for teams already building images in CI.
Lambda billing moves to 1 ms granularity (from 100 ms), which lowers cost for short functions, and the memory ceiling rises to 10 GB (with up to 6 vCPUs).
Functions in a VPC and other limits changed earlier in the year; read the Lambda quotas page when sizing.

Operations and observability

Amazon DevOps Guru (preview) uses machine learning to detect anomalous operational behaviour.
Amazon Managed Service for Prometheus and Amazon Managed Grafana were announced in preview, aimed at teams running Kubernetes who want managed observability.
AWS Proton (preview) lets platform teams define standard infrastructure and deployment templates for developers.
AWS CloudShell (preview) provides a browser-based shell with the AWS CLI preinstalled.

Security and networking

AWS Network Firewall (generally available since 17 November) adds managed, stateful network filtering for VPCs.
EC2 Mac instances brought macOS to the cloud for build and test workloads.
Several new security findings in Security Hub and GuardDuty; the baseline advice (MFA, least privilege, logging) is unchanged.

What to do in the next month

Convert non-critical gp2 volumes to gp3 after checking IOPS needs; track savings in Cost Explorer.
Pull base images from ECR Public or mirror them to your private ECR to avoid Docker Hub limits.
Review S3-related retry and consistency workarounds, and note them in a backlog item.
Read about Lambda container images if you ship large functions.
Treat previews as experiments: do not put production workloads on them, and expect pricing and API changes.

Reading the announcements critically

“Announced” is not “available in your region”: check the region table, the pricing page and the documentation before planning. Pilot with one workload, measure, and keep rollback paths. The big idea of the year is simplification: fewer workarounds, fewer knobs to tune, and more managed pieces around containers and serverless.