Home› Blog› AWS Weekly Intelligence #11 - 12-16 October 2026
AWS Weekly Intelligence AWS

AWS Weekly Intelligence #11 - 12-16 October 2026

Oct 17, 2026 21 min read
Verified against current vendor documentation on 17 October 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.

65 announcements across five working days — close to double the week before, with the volume in agent tooling and Region expansions, and the week's actual argument spread across four separate Lambda announcements that only add up to something when you read them together.

On this page

The week in one paragraph

Lambda had the week, in four pieces that were announced separately and belong in one sentence: Web Functions landed on Monday, where “A single warm execution environment can serve multiple concurrent requests, which reduces cold starts by orders of magnitude”; CloudFront gained them as an origin the same day; durable functions raised their “durable operation and checkpoint payload limits” on Tuesday; the “Durable Execution SDK for Go” went GA on Thursday; and durable functions reached “AWS GovCloud (US-West) and AWS GovCloud (US-East)” on Friday. Read as a release calendar that is five bullet points. Read as a direction, it is Lambda becoming a place you run a web server and a long-lived workflow rather than a place you run a function — and the concurrency change quietly retires the one-request-per-environment assumption that most Lambda advice about module-level state was written against.

Security was quieter but pointed in a consistent direction: Security Hub now “infers criticality from resource tags and resource names, with no configuration required”, which turns naming conventions into a ranking input; Security Hub CSPM added the “Cyber Risk Institute profile version 2.2”; and Transfer Family moved SFTP host keys into “AWS Secrets Manager storage”, closing a place private key material used to sit in service configuration.

Resilience got the week's most actionable item in ARC Region switch's “service quota parity checks”, and the week's most interesting operational one in Resilience Hub's DevOps Agent integration, where an AI investigation now runs alongside every resilience test on a connected service. And agent tooling appeared in six separate places — MWAA, the Agent Toolkit, Agent Registry, AgentCore twice, and Resilience Hub — which is less a theme than the current default shape of an AWS release.

Covered in depth

Five daily posts published during the week. Each took one announcement and read it against the documentation; the column on the right is what the announcement did not say.

PostAnnouncementWhat the announcement left out
#52 Lambda Web Functions (12 Oct) It breaks an invariant. AWS's own wording elsewhere — “For each concurrent request, Lambda provisions a separate instance of your execution environment” — no longer describes this function type, so module-level state written on that assumption is now shared.
#53 SageMaker AI skill in the Agent Toolkit (13 Oct) What a skill replaces, and what happens to the thing it replaced.
#54 Security Hub resource criticality (14 Oct) The inference path is the default and is “always on for all customers”. The failure is asymmetric: a critical system with a dull name gets under-ranked, and old systems with poor names disproportionately carry real risk.
#55 DevOps Agent in Resilience Hub (15 Oct) “The DevOps Agent verdict is advisory; your test run's own result remains authoritative” — and yet “test report generation completes when DevOps Agent completes the investigation”. The advisory component gates the authoritative artefact.
#56 ARC Region switch, four capabilities (14 Oct) “New plans have service quota checks enabled by default; plans that you created before service quota checks were available have them disabled by default.” The default is inverted with respect to risk, and the checks “do not adjust quotas based on current resource consumption”.

Reconciling the week. Four of the five news days got a deep-dive — 12, 13, 14 and 15 October. Friday 16 October did not: it produced eleven items, four of them End User Messaging registration improvements, and the strongest held item in the backlog beat all of them, so #56 took ARC Region switch from Wednesday instead. Friday's eleven are all in the inventory below, which is the point of the inventory.

What else shipped, by domain

Compute and serverless

Beyond the Lambda thread, ECS both added and subtracted. LiveTaskCount arrived, and “the existing RunningTaskCount metric in Amazon CloudWatch Container Insights no longer incurs a charge”. A metric becoming free is rarer than a metric appearing, and anyone who designed around the cost of RunningTaskCount made that decision under different economics. Lambda also extended recursive loop detection to EventBridge custom event buses, and EC2 brought G7 instances to Frankfurt and Stockholm and T8i to São Paulo.

Observability

CloudWatch was the week's most underrated announcement with “log routing and chained log parsers”. Parsing chained at ingest changes both what a log group costs and what a downstream query is allowed to assume about shape — and nothing about the announcement signals that. Log centralization also expanded to “AWS GovCloud (US) and 13 additional commercial Regions”.

Time Sync added microsecond-accurate time on “135 additional EC2 instance types in all commercial regions”, which matters more than it sounds for anyone correlating logs across instances during an investigation.

Data

DynamoDB Streams added “timestamp-based stream processing” — starting a consumer from a point in time rather than a shard iterator type, which is the difference between a replay you can reason about and one you script around. DataSync Enhanced mode picked up FSx for OpenZFS, NFS 4.2 and object metadata controls; RDS Proxy added SQL Server 2022; Redshift and S3 Metadata expanded Regionally; and PostgreSQL 19 RC1 appeared in the RDS Database Preview Environment.

Security and identity

Covered above, plus Route 53 adding “registrations, transfers, and renewals for Premium Domains” — a small item with a real security dimension, since a premium domain is exactly the kind of asset whose registrar-level controls deserve the same scrutiny as its DNS records.

Migration and modernisation

AWS Transform announced “the general availability of application code conversion from Azure SDK to AWS SDK”, and separately reached Singapore and added seven more Aurora cross-Region targets for full-stack Windows modernisation.

Messaging

AWS End User Messaging had four Friday announcements, of which the substantial one is “end-to-end managed one-time passcode (OTP) verification in Notify” — AWS now generating, delivering and verifying the code rather than sending one you generated.

One flag on that item, for anyone planning to adopt it this week

The announcement describes a code configuration holding the code type, length, validity window and attempt count — which are the security parameters that decide whether a managed OTP flow is sound. As of this writing those controls do not appear in the AWS End User Messaging user guide or in the SMS Voice v2 API reference, and the documented send path still has you passing the code yourself as a template variable.

That is a reason to wait rather than a reason to worry: adopting an authentication primitive whose expiry and lockout behaviour you cannot yet read is a decision made without the inputs. It is on the backlog for when the documentation lands.

What I would act on

1. Read serviceQuotaChecksEnabled on every ARC Region switch plan you own. This is the week's clearest finite task. The new parity check is enabled by default only on plans created after it shipped, and an update that omits the field leaves it alone, so every plan you already had is running without it — and accumulated quota drift is a function of how long the plan has existed. List the plans, read the boolean, set it.

2. Find out whether any Lambda function of yours is now a Web Function. Not because the feature is bad, but because the concurrency model changed underneath a very widely held assumption. Any module-level cache, connection pool or mutable global written on the premise that one environment serves one request at a time needs re-reading. This is the rare announcement that invalidates existing code without changing it.

3. Spend ten minutes on Security Hub's new criticality column. Name your five most critical systems from memory, open the Resources page sorted by criticality, and find them. Anything sitting low is a gap the inference just created in your exposure queue, and the provenance field tells you which values were guessed rather than decided.

4. GuardDuty RDS Protection data exfiltration detection, still unwritten and now past the feed horizon. Announced 9 October, flagged in last week's roundup, and it remains the strongest unaddressed security item in the backlog. It adds a detection class inside a plan many accounts enabled years ago, so nothing visibly changes until it fires — and it needs checking against suppression rules written before these finding types existed.

Complete inventory — 65 announcements

Every What's New announcement dated 12 to 16 October 2026, with AWS's own one-line summary. Built from the raw feeds by scripts/fetch_week.py and scripts/build_weekly_inventory.py, not by reading the feed by hand. All 19 feeds were audited on the Saturday morning and all returned items; the What's New feed held 5 to 16 October at audit time, so the window sits inside the feed's hundred-item cap with no truncation warning. All 65 links were fetched and all returned HTTP 200.

Friday 16 October — 11 announcements

Thursday 15 October — 20 announcements

Wednesday 14 October — 13 announcements

Tuesday 13 October — 10 announcements

Monday 12 October — 11 announcements

Looking for one service rather than a whole week?

Every AWS, Azure and Google Cloud announcement is browsable by service and date, each linked to the vendor’s own page — and the other weekly roundups are collected in one place.

Browse announcements →
Topics: AWS Weekly Intelligence AWS

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent