What happened
AWS Lambda now lets developers point functions directly at their own Amazon S3 buckets for code storage, bypassing the intermediate copy Lambda previously created on their behalf. The change eliminates the platform's historical code storage quotas and trims function activation latency by removing that copy step from the create-and-update workflow. Separately, Cloudflare documented how a failed DNSSEC key rollover knocked the Albanian country-code top-level domain (.AL) offline, forcing the company to deploy a Negative Trust Anchor (NTA) to restore resolution for affected users. This time, Cloudflare's 1.1.1.1 resolver returned Extended DNS Error code 33 alongside the response, giving downstream clients a machine-readable signal that DNSSEC validation had been deliberately bypassed rather than silently overridden.
Why it matters for your business
For engineering teams that have hit Lambda's code storage ceiling or manage large deployment artifacts, self-managed S3 storage is a meaningful operational unlock — packages, layers, and versioned builds can now live in a bucket governed by existing IAM policies, lifecycle rules, and audit trails without duplicating assets inside Lambda's own storage. Faster activation after updates also tightens CI/CD feedback loops. The Cloudflare development carries a different but equally practical implication: any application that depends on third-party domains or external APIs is quietly exposed to TLD-level DNS outages, and most monitoring stacks won't distinguish a DNSSEC bypass from a clean resolution. Teams should verify that their DNS clients and observability tooling can parse EDE codes so that an NTA event — however well-intentioned — shows up as an anomaly rather than a silent pass.
What to watch next
AWS is likely to extend self-managed storage options deeper into the Lambda configuration surface, particularly around layers and container image sources, as customers consolidate artifact management. On the DNS front, broader adoption of Extended DNS Error codes across resolvers and monitoring vendors will determine how quickly EDE 33 becomes a useful signal in practice rather than a curiosity. Organizations running DNSSEC-signed zones should also audit their own key-rollover procedures in light of the .AL incident — automated rollovers remain a common failure point.