Key takeaways
- AWS DataSync can now copy from Google Cloud Storage and Azure Blob without stored keys. Enhanced mode uses OIDC and an IAM role to fetch short-lived credentials, so HMAC keys and SAS tokens can be retired (AWS, 4 Nov).
- Google Cloud shipped a cluster of database changes: AlloyDB Express (Preview) on PostgreSQL 18 with a 12-month free tier, BigQuery-to-AlloyDB sync now GA, and PostgreSQL 18 as the default for new AlloyDB clusters (release notes).
- Cloud Run ephemeral disk is GA, giving each instance scratch space that lasts for its lifetime, which matters for build steps, media processing and model files (docs).
- Cloud SQL for SQL Server read pools now autoscale on CPU and/or client connections, GA on 4 November (docs).
- One deprecation to calendar: Security Command Center's DSPM is closed to new organisations, and existing users lose it on 1 February 2027 (deprecations).
- No India-region-specific launches this week. Before adopting any Preview feature, confirm it is offered in Mumbai (asia-south1) or Delhi (asia-south2) if your data must stay in India.
1. The week at a glance
Most of this week's cloud news is incremental, but several items remove real operational pain. Here is everything worth a look from 2–5 November 2026, ranked by how likely it is to affect a typical Indian engineering team.
| Date | Provider | Change | Status | Who should care |
|---|---|---|---|---|
| 4 Nov | AWS | DataSync Enhanced mode: OIDC auth for GCS and Azure Blob | Available where Enhanced mode runs | Anyone migrating or syncing data across clouds |
| 4 Nov | Google Cloud | AlloyDB Express on PostgreSQL 18, 12-month free tier | Preview | Startups, prototypes, small apps |
| 4 Nov | Google Cloud | Sync BigQuery data into AlloyDB | GA | Teams serving analytics results to apps |
| 3 Nov | Google Cloud | New AlloyDB clusters default to PostgreSQL 18 | Default change | Anyone with cluster-creation scripts |
| 4 Nov | Google Cloud | Cloud Run ephemeral disk | GA | Serverless workloads that need scratch space |
| 4 Nov | Google Cloud | Cloud SQL for SQL Server read pool autoscaling | GA | .NET / SQL Server shops |
| 4 Nov | Google Cloud | Cloud Storage: pause hard deletion of soft-deleted objects | Available | Backup and compliance owners |
| 5 Nov | Google Cloud | Security Command Center DSPM deprecation | Shutdown 1 Feb 2027 | Security teams using DSPM |
2. Keyless cross-cloud transfers with AWS DataSync
Until now, pulling data from Google Cloud Storage or Azure Blob into AWS with DataSync meant creating a long-lived secret on the other side: an HMAC key for GCS or a SAS token for Azure. Those secrets end up in config files, tickets and laptops, and they rarely get rotated.
With the 4 November update, a DataSync location in Enhanced mode can instead be given an IAM role. DataSync uses that role to obtain short-lived credentials from Google Cloud or Microsoft Entra ID through OpenID Connect and refreshes them automatically during the transfer. You set it up through the AWS CLI, API or CloudFormation (DataSync user guide). AWS's announcement does not mention a separate charge for this, and it applies in every region where Enhanced mode is supported.
| Old way (HMAC / SAS) | New way (OIDC + IAM role) | |
|---|---|---|
| Secret stored on AWS side | Yes, long-lived | No |
| Rotation | Manual, often skipped | Automatic, short-lived tokens |
| Revocation | Find and delete the key | Remove the trust / role binding |
| Audit trail | Key usage only | Federated identity in both clouds' logs |
| Fits "no static keys" policies | No | Yes |
What to do:
- List every DataSync task that reads from GCS or Azure and note which keys or SAS tokens it uses.
- Set up workload identity federation on the Google side or a federated credential in Entra ID that trusts the DataSync IAM role.
- Switch one non-critical task over, run a full transfer, then migrate the rest.
- Delete the old HMAC keys and SAS tokens. The security gain only arrives once they are gone.
India angle: CERT-In's 2022 directions require cyber incidents to be reported within six hours, and the DPDP Act puts the onus on the data fiduciary to protect personal data. Leaked static storage keys are one of the most common ways cloud buckets get exposed. Removing them is cheap insurance, and it gives you a cleaner story in any audit.
3. AlloyDB Express and PostgreSQL 18
Google's managed PostgreSQL-compatible database, AlloyDB, got three related changes:
- AlloyDB Express (Preview) runs PostgreSQL 18, scales to zero, and comes with a monthly free tier for the first 12 months, according to the release notes. That makes AlloyDB a realistic option for prototypes and low-traffic apps that previously defaulted to a small Cloud SQL instance or a VM running Postgres.
- New AlloyDB clusters now default to PostgreSQL 18 (version policy). If your Terraform or scripts do not pin a version, the next cluster you create will be on 18.
- BigQuery data can now be synced into AlloyDB (GA) (docs), so results computed in the warehouse, such as recommendations, scores or aggregates, can be served from an operational database without a hand-built ETL job.
| Option for a small Postgres app | Good for | Watch out for |
|---|---|---|
| AlloyDB Express (Preview) | Prototypes, spiky or idle workloads | Preview terms, no SLA, check region availability |
| Cloud SQL for PostgreSQL | Steady production apps | Always-on instance cost |
| Self-managed Postgres on a VM | Full control, lowest unit cost at scale | You own patching, backups and failover |
What to do: pin database_version explicitly in infrastructure code today. Test your extensions and ORM against PostgreSQL 18 before you let new clusters pick it up. Treat Express as a place for pilots, not for production data with an uptime commitment, until it reaches GA. If you must keep data in India, confirm Express is offered in asia-south1 or asia-south2 before building on it.
4. Serverless and SQL Server improvements
Cloud Run ephemeral disk (GA). Cloud Run instances can now mount a disk volume that persists for the lifetime of the instance. This covers services, jobs and worker pools (docs). Previously, scratch files counted against memory through the in-memory filesystem. That forced teams to over-provision RAM just to unpack a model, transcode a video or build a large PDF. Move these workloads to the disk and you may be able to cut the memory setting, which is usually the bigger part of the Cloud Run bill.
Cloud SQL for SQL Server read pool autoscaling (GA). Read pools now add and remove nodes on CPU utilisation, client connections, or both (docs). For Indian e-commerce and fintech apps with sharp evening and sale-day peaks, this replaces the habit of sizing read replicas for Diwali traffic all year round. Set a sensible maximum so a runaway query cannot scale you into a surprise bill.
Cloud Storage: pause hard deletions. You can now pause the permanent deletion of soft-deleted objects per bucket (docs). Add this to your ransomware and accidental-deletion runbook. During an incident it buys time before recoverable objects are purged.
5. Deprecations and housekeeping
- Security Command Center DSPM is no longer available to new organisations. Existing users keep it until 1 February 2027. If you rely on it for data-security posture reports, start evaluating a replacement now. Three months is short once procurement is involved.
- API Gateway: the planned deprecation of negative backend deadline values, announced on 23 October, has been withdrawn (docs). If you began changing configs because of it, you can stop.
- Google Cloud SDK: the release notes list SDK 592.0.0 as a breaking release that affects emulator Java support and the Docker images. Pin your SDK image version in CI and read the notes before you upgrade.
6. A 30-minute checklist for this week
| Task | Owner | Time |
|---|---|---|
| Inventory HMAC keys / SAS tokens used by DataSync | Cloud / security | 10 min |
| Pin PostgreSQL version in AlloyDB / Cloud SQL Terraform | Platform | 5 min |
| Check Cloud Run services with high memory used only for temp files | Backend | 10 min |
| Put 1 Feb 2027 DSPM shutdown in the security calendar | Security | 2 min |
| Pin the gcloud SDK image version in CI | DevOps | 3 min |
None of these are emergencies. Together they remove one class of leaked-credential risk, one surprise version upgrade, and some wasted memory spend. That is a good return for half an hour.
Planning a cross-cloud migration or a tidy-up of your AWS and Google Cloud estate? See our public cloud setup and migration services or work out transfer times with our bytes and bandwidth converter.