re:Inforce 2025: The Boring Security Wins

re:Inforce is the AWS conference where the boring, load-bearing security improvements get announced. No keynote-stealing GenAI demos, just steady incremental work on the IAM, GuardDuty, Security Hub, and detection tooling that real production AWS environments depend on.

This post covers four updates from this year’s event that we think are worth your team’s attention.

1. IAM Access Analyzer continues to mature

The trajectory of Access Analyzer over the last few years is the most consistent thing in the AWS security portfolio: each year it gets a bit better at finding overly permissive policies, and each year more teams actually adopt it.

This year’s improvements continue that pattern: better unused-access detection, more accurate cross-account exposure reports, and improved integration with policy generation flows.

If your team isn’t running Access Analyzer in unused-access mode, you’re leaving practical security wins on the table. Turn it on, fix what it finds over a few sprints, and you’ll meaningfully reduce your IAM blast radius.

2. GuardDuty improvements for runtime threats

GuardDuty’s runtime monitoring (for ECS, EKS, Lambda) keeps getting better. The signal-to-noise ratio on findings has improved noticeably over the past year, which matters because the original problem with runtime detection was that nobody could afford the alert volume.

Worth re-evaluating if you turned it off in 2023 because of noise. The math may have changed.

3. Security Hub consolidation

A theme across multiple sessions: AWS continues consolidating security findings into Security Hub. The CSPM-style features now cover a much wider range of misconfigurations than they did even a year ago, and the integration with detective controls is tighter.

For teams without dedicated security engineering, Security Hub is increasingly a reasonable starting point that covers ground you’d otherwise need a third-party CSPM tool to cover.

4. Pipeline security gets first-class attention

The most important re:Inforce theme for DevOps teams: pipeline security finally got real airtime. CodePipeline, CodeBuild, and CodeDeploy have new and improved features around:

• Approval workflows with stronger identity binding
• Artifact integrity verification
• Build-environment hardening
• Better integration with Secrets Manager for ephemeral credentials

The supply chain security story is still incomplete (there’s no AWS-native equivalent of SLSA-style provenance attestation), but the gaps are narrowing. We expect this to be a major theme at re:Invent.

What we’re recommending to clients

Three concrete actions from this re:Inforce:

Run Access Analyzer in unused-access mode if you aren’t already. Low effort, real impact.

Re-evaluate GuardDuty runtime monitoring if you turned it off for noise reasons. Pilot it on a non-critical workload and see if the signal quality has improved enough to justify enabling it broadly.

Audit your pipeline IAM and approval flows. Most teams’ CodePipeline/CodeBuild IAM was set up years ago and hasn’t been revisited. The tooling has improved enough that there’s room to tighten without breaking anything.

What we’d skip

The keynote-level announcements about new dashboards and unified consoles aren’t load-bearing. They’re useful if you’re new to AWS security tooling, but they don’t change much for teams already using these services.

Closing

Security work is rarely exciting, but it’s where the cost of falling behind is highest. re:Inforce 2025 was a reminder that the steady, unglamorous improvements are also the ones with the biggest practical payoff.

If you’d like help evaluating where your AWS security posture has room to improve, get in touch.