Your Deprecated Services Are Your Weakest Doors

✓ Human-authored analysis; AI used for formatting and proofreading.

IaC tools don't track AWS service deprecation. Terraform will deploy a resource on a frozen service forever. So deprecation tracking must be a
verifiable property in your CI/CD pipeline.

AWS deprecated 20+ services and features on June 30, 2026. One of them (Simple AD) provides authentication to IAM Identity Center. Another (Bedrock Agents Classic) runs AI agent workloads with 14 distinct security controls. A third (SageMaker Role Manager) is the tool AWS recommends for scoping IAM roles which is the tool we'd tell you to use in a remediation guide.

How many of these are still running in your accounts right now?

Terraform, CloudFormation and CDK doesn't know. They'll deploy resources on deprecated services anytime without a warning.

The deprecation nobody noticed

The June 30, 2026 AWS Service Availability update lists ~25 services entering maintenance, sunset, or end-of-support. The announcement is a blog post. There's no API that returns "this service is deprecated." No tag on the resource. No CloudTrail event.

The services that matter for security:

• Simple AD: no MFA support, no trust relationships with your authentication plane on a frozen directory
• Bedrock Agents Classic: 14 security controls, frozen, no new patches
• SageMaker Role Manager: the scoping tool itself is deprecated. The roles it created stay overprivileged longer
• IoT Device Defender Detect: your IoT monitoring just stopped evolving
• SageMaker Model Monitor: your model drift detection is frozen

Why IaC doesn't help

1. Blog post published → someone reads it (maybe)
2. Ticket created → someone files a migration task (maybe)
3. Ticket prioritized → it sits behind feature work (always)
4. Meanwhile, terraform apply keeps deploying resources on the deprecated service without a warning
5. New team member joins, doesn't know about the deprecation, creates more resources on the deprecated service
6. 18 months later: the service is still running, accumulating permissions, receiving no security patches

The IaC tool's job is to make the current configuration converge to the declared state. It has no concept of "this declared state is going away."

Deprecation as shadow IT

A deprecated service in maintenance mode is the worst kind of shadow IT:

• Sanctioned (AWS still runs it)
• Visible (it's in the console)
• Costs money (you're paying for it)
• Silently stops receiving security improvements

Nobody thinks of it as shadow IT because it's official. But from the attacker's perspective, it's a service that won't get security patches, won't benefit from AWS's evolving defaults, and sits in the account with permissions nobody reviews because "it's going away."

Making deprecation a verifiable property

The Stave approach:

• A control fires on every scan when a resource is deployed on a deprecated service
• The finding doesn't get lost in a backlog. It's a property that fails verification until the state changes
• It runs in CI/CD: stave ci gate blocks deployment of new resources on deprecated services
• It runs continuously: stave apply catches existing resources that haven't been migrated
• The remediation text links directly to the AWS migration guide

The practitioner sees the finding every pipeline run. They can choose to tackle it when they can. But it never disappears from the output until the migration is done. It's a built-in reminder, not a ticket.

Section 5 — Temporal risk: a new dimension

Most security tools measure spatial risk: "this configuration is bad right now." Deprecation introduces temporal risk: "this configuration is getting worse over time."

A Simple AD directory providing authentication today has the same security properties it had yesterday. But it's one day closer to the point where
AWS stops patching it. The risk accumulates.

Stave is the only tool that knows the difference between "this configuration is valid" and "this configuration is valid for now." The deprecation timeline isn't metadata. It's a security property with a deadline.

The compound: spatial + temporal

The strongest finding: a resource that's simultaneously near a compound breach path AND running on a deprecated service.

Example: A Simple AD directory (deprecated, no MFA support) providing authentication to IAM Identity Center, where session duration is 12 hours. Spatial risk: the authentication chain is near a compound finding. Temporal risk: the directory service stops getting security improvements. Each dimension alone is a finding. Together they describe a resource that's getting weaker over time while already close to a breach path.

Your deprecated services are your weakest doors. Because they're the doors that stop getting locks.

Quick Facts:

• 25+ services in the June 2026 deprecation wave
• 14 Bedrock Agents Classic controls affected
• 5 Simple AD controls affected
• 4 IoT Device Defender Detect controls affected
• 2 + 1 chain for SageMaker Role Manager
• 2 for SageMaker Model Monitor
• Zero IaC tools provide deprecation warnings
• Zero AWS APIs return "this service is deprecated"