Home Resume
Home› Blog› AWS Weekly Intelligence #2 - 10-14 August 2026
AWS Weekly Intelligence AWS

10–14 August 2026

Forty-one announcements across five working days, plus four security bulletins and around seventy blog posts. The theme was permissions: three separate launches changed how you grant, audit or diagnose access.

Aug 15, 2026 14 min read
Verified against current vendor documentation on 14 August 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.
AWS Weekly Intelligence #2

15 August 2026 · Everything AWS shipped, 10–14 August

On this page

The week in one paragraph

Forty-one announcements, spread evenly rather than clustered: 9 on Monday, 9 Tuesday, 6 Wednesday, 8 Thursday and 3 on Friday. If the week had a theme it was permissions, from three directions at once — IAM began creating roles for you, S3 began explaining which policy denied you, and Amazon Quick moved to deny-by-default. That is unusual. Access control normally changes one narrow piece at a time.

The other pattern worth naming is that two of the week's most consequential launches carry a cost or a lock-in that the announcement does not lead with. EKS control plane tuning is free except for the one parameter that requires a paid control plane tier and prevents you leaving it. IAM role manager is free, and the role it creates for Lambda carries PowerUserAccess. Neither is hidden — both are documented plainly — but neither is in the headline.

Covered in depth this week

Four daily posts covered announcements from this week's window, each carrying the detail its announcement left out.

AnnouncedTopicThe part the announcement omitted
Mon 10 EC2 application status checks Billed per managed ENI-hour per AZ, driven by subnet and security group combinations rather than instance count. Exceeding 5,000 targets stops monitoring silently.
Wed 12 IAM role manager Where permissions cannot be known up front — Lambda — the template attaches PowerUserAccess, a NotAction allow covering every service except IAM, Organizations and account settings.
Wed 12 EKS control plane parameters The HPA sync period needs Provisioned Control Plane, cuts supported object capacity by about a third, is not validated against your object count, and blocks the cluster from returning to Standard mode.
Thu 13 S3 access denied policy detail An implicit deny can never carry a policy ARN, bucket policies are not on the ARN list at all, and when several policy types deny, only one is named.

One daily published during the week falls outside it: reading S3 backups without a restore went out on 12 August but covers a 6 August announcement, already inventoried in the previous roundup. It is linked here so it is not lost between the two.

Security and identity

Beyond the two covered above, three launches are worth knowing about.

IAM account access manager streamlines assigning IAM roles to workforce users. Read it alongside role manager: both reduce the manual work of getting a principal the access it needs, and both make the resulting grant something you should audit rather than assume.

Secrets Manager added managed external secrets for Jenkins and SonarQube. This is the quiet operational win of the week — rotation for third-party CI credentials with no custom Lambda to write and maintain. Anyone running Jenkins with a long-lived token in a credential store should look at this.

Amazon Quick moved to deny by default for custom permissions, and separately added data loss prevention through Microsoft Purview. Deny-by-default is the correct posture and a breaking change in temperament; if you run Quick with custom permissions, check what stops working before it stops working.

Compute and containers

AWS Client VPN gained CLI support, administration controls and faster connections. The CLI is the part that matters operationally — a VPN you can script is a VPN you can put in a runbook.

Spot Placement Score now includes Local Zones, which extends capacity planning to the places where capacity is tightest and least predictable.

Region and instance expansions continued at the usual rate: EC2 R8a in Canada (Central), High Memory U7i in São Paulo. OpenSearch Serverless raised collections per collection group to 10,000, a limit increase large enough to change how people partition tenants.

On the blogs, two pieces stood out. Forensic container checkpointing on EKS is a genuinely useful incident-response technique — capturing a running container's state for analysis rather than killing it and losing the evidence. And Burst to Region covers overflowing Outposts workloads to EC2, which is the hybrid capacity question most Outposts users eventually hit.

Data, analytics and cost

AWS Billing and Cost Management introduced Managed Dashboards — five preconfigured, read-only dashboards with your account data already populated, covering cost trends, compute and database spend, and reservation and Savings Plan performance over 12 months with forecasts. No setup, no cost, all commercial Regions. For anyone who has meant to build a Cost Explorer dashboard for two years, this removes the excuse.

AWS Certificate Manager now supports switching from e-mail to DNS validation on an existing certificate. Small, and it removes a genuine annoyance: e-mail-validated certificates previously had to be reissued to move to DNS validation.

Clean Rooms had a strong week, adding both exportable privacy-enhanced analysis logs for SQL and minimum aggregation thresholds in custom analysis rules. The second is the more interesting: a minimum aggregation threshold is what stops a query returning a result specific enough to identify an individual.

RDS for MariaDB added 12.3, and Bedrock extended IAM principal cost allocation to the bedrock-mantle endpoint — useful if you are trying to attribute model spend to teams rather than to one account-level line.

Security bulletins

Four bulletins this week, two worth immediate attention:

  • CVE-2026-19311 — missing authorization in the OpenSearch Alerting plugin.
  • CVE-2026-18428 — async query validation bypass in the OpenSearch SQL plugin.
  • CVE-2026-19642 and CVE-2026-19643 — memory-safety issues in the Base64 decoder in the AWS SDK for C++.

Two OpenSearch plugin issues in one week, both authorization or validation bypasses, is a pattern rather than a coincidence. If you run OpenSearch with the Alerting or SQL plugins enabled, read both bulletins rather than assuming your managed version is unaffected.

What I would act on

1. Decide on IAM role manager before someone enables it. In an organization, an SCP controls whether member accounts can enable or use it. That decision is much easier to make once, centrally, than to unwind across eleven accounts that each turned it on. If you allow it, schedule the scope-down work against the 90 days of free Access Analyzer unused-access analysis — which starts when you disable role manager, not when you enable it.

2. Read the two OpenSearch bulletins. Authorization bypasses in plugins are the kind of thing that is fine until it is not.

3. Open the new cost dashboards. They cost nothing, need no setup, and the reservation and Savings Plan performance view is the one most organisations never got round to building.

4. If you run EKS, read the control plane parameters before anyone tunes them. Three of the four are safe and useful. The fourth can make autoscaling slower while looking like it should make it faster, and it locks the cluster into a paid tier until reset.

Complete inventory: all 41 announcements

Every AWS What's New announcement from 10 to 14 August, with AWS's own one-line summary, newest first. Nothing filtered.

Friday 14 August — 3 announcements

Thursday 13 August — 9 announcements

Wednesday 12 August — 9 announcements

  • Amazon Quick now supports approval policies for sharingAmazon Quick now offers approval policies, giving administrators governance controls over how assets are shared within their organization.AWS's own link for this announcement returns 404 — recorded here for completeness.
  • Amazon Quick now supports per-user resource limitsAmazon Quick now enables administrators to set per-user limits on index storage and agent hours, giving them direct control over subscription costs.AWS's own link for this announcement returns 404 — recorded here for completeness.
  • AWS Global View now offers an interactive map view for AWS Regions and AWS Local ZonesToday, AWS announces the addition of an interactive map view to AWS Global View in the AWS Management Console, providing a visual way to explore AWS Global Infrastructure.
  • AWS IAM now provides role manager to set up IAM roles automaticallyToday, AWS announces the general availability of role manager, a capability in AWS Identity and Access Management (IAM) that automatically sets up the IAM roles your AWS services need.
  • Amazon EKS now supports advanced Kubernetes control plane configuration parametersAmazon Elastic Kubernetes Service (Amazon EKS) now supports configuring parameters for Kubernetes control plane components including the scheduler, controller manager, and API server.
  • Amazon Quick adds deny by default for custom permissionsAmazon Quick custom permissions now include deny by default, a governance setting that automatically restricts new AI capabilities before they reach users.AWS's own link for this announcement returns 404 — recorded here for completeness.
  • Amazon Connect Customer supports manual assignment of queued agent-first callbacksAmazon Connect Customer now lets agents view and self-assign queued agent-first callbacks alongside emails, tasks, and chats.
  • Amazon Quick now supports data loss prevention with Microsoft PurviewAmazon Quick now integrates with Microsoft Purview to enforce data loss prevention (DLP) policies across your Quick environment.AWS's own link for this announcement returns 404 — recorded here for completeness.
  • Amazon Nova Multimodal Embeddings is now available in AWS GovCloud (US-West)We are excited to announce the general availability of Amazon Nova Multimodal Embeddings, a state-of-the-art embedding model for agentic RAG and semantic search, in AWS GovCloud (US-West).

Tuesday 11 August — 10 announcements

Monday 10 August — 10 announcements

Official AWS references

Part of the AWS Weekly Intelligence series — everything AWS shipped that week, in one place, built from the raw feed rather than summarised.

Topics: AWS Weekly Intelligence AWS

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent