# Resource Hardening Quick Wins (July 2026)

## DMS

- [ ] Config: `dms-replication-not-public`
- [ ] Rebuild public replication instances as private + VPC endpoints

## OpenSearch

- [ ] Encryption at rest + node-to-node; TLS policy ≥ 1.2 PFS
- [ ] Unencrypted domains = migration backlog (one-way door)

## SageMaker

- [ ] Notebooks / Studio: no direct internet (`VpcOnly`)
- [ ] Training: `EnableNetworkIsolation` where compatible

## Lambda runtimes (as of July 2026)

Past / nearing end-of-support includes (verify current table): Node.js 18/20, Python 3.8/3.9, Ruby 3.2, .NET 6, older Node/Python.
Prefer **Node.js 22+**, **Python 3.12/3.13**, **.NET 8+**, pin in IaC.
Config: `lambda-function-settings-check` + Trusted Advisor.

## Counter-case

"Library X blocks upgrade" is not a security exception — upgrade the library.