Home Resume
Home› Blog› AWS Weekly Intelligence #3 - 17-21 August 2026
AWS Weekly Intelligence AWS

17–21 August 2026

Sixty-three announcements across five working days, plus around seventy blog posts. One major platform release, and a long run of changes whose common property is that they tell you what is actually happening.

Aug 22, 2026 19 min read
Verified against current vendor documentation on 22 August 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.
AWS Weekly Intelligence #3

22 August 2026 · Everything AWS shipped, 17–21 August

On this page

The week in one paragraph

Sixty-three announcements, up half again on last week's forty-one, and the distribution was unusual: one substantial platform release in AWS Glue 6.0, and then a long tail of small changes that share a property worth naming. Network Firewall started counting rule hits. Direct Connect gained controls over what a customer gateway may advertise. CloudWatch log centralization began propagating log group tags. Amazon Quick added deny by default. DynamoDB Streams gained attribute-based access control. None of those is a headline feature, and all of them answer the same class of question — what is this thing actually doing, and who can make it do that — which has been the harder problem in most estates for some time.

Covered in depth

Every working day this week produced a deep-dive. Each one is linked below with the detail the announcement itself omitted.

NewsPostWhat the announcement left out
Mon 17 #12 — The sign-in page changed A visual redesign that only automation notices, because the entry point and the flow between pages moved.
Tue 18 #13 — Policy Autopilot reads your Terraform plan It reads the plan, not the runtime — so it sees intent rather than behaviour, which is a different and narrower thing.
Wed 19 #14 — Twenty managed policies per role Roles doubled to 20, raisable to 25. Users stayed at 10, and groups stayed at 10 with a maximum of 10, so there is no increase to request there at all.
Thu 20 #15 — Rule hit counts, and why zero does not mean unused Counts come from alert logs, so pass rules and stateless rules report zero while fully live. The allow-list is invisible to the counter.
Fri 21 #16 — Glue 6.0 and the reach of Iceberg v3 Athena cannot read v3 tables. The new types need Spark DataFrames, not DynamicFrames. And it is a Spark 4 migration underneath.

Visibility and control

The largest group this week, and the one most worth a Monday morning.

  • Network Firewall rule hit count — on by default, free, everywhere except Middle East (UAE) and Middle East (Bahrain). Covered above; read the caveat before pruning anything.
  • Direct Connect inbound prefix controls and higher prefix scale — filtering what a customer gateway is permitted to advertise, plus more room. Prefix limits are a constraint hybrid designs hit in practice, and advertisement filtering changes who is able to break your routing.
  • CloudWatch log centralization now propagates log group tags — centralised logs previously arrived stripped of the tags that told you whose they were. This is a small change with a direct effect on cost allocation and access scoping.
  • CloudWatch pipelines adds GeoIP, RDS and XML processors — transformation moving into the pipeline rather than into a Lambda somebody maintains.
  • Aurora DSQL supports CloudWatch Database Insights — DSQL has been notably thin on observability, so this closes a real gap.
  • WorkSpaces Applications gains in-console monitoring, and Deadline Cloud now tracks automatic download status in its monitor.
  • AWS Security Agent, now part of AWS Continuum, adds budget controls and finding revalidation — revalidation matters more than it reads, because a findings list nobody re-checks becomes a list nobody trusts.
  • Client-side network failure visibility with NEL (Network Error Logging) on CloudFront — the failures that never reach your logs because the request never arrived. Blog post rather than a launch, but the most interesting thing published on Friday after Glue.

Data platform

AWS Glue 6.0 dominates, and the summary is that the price cut is the least consequential part of it. Spark 4.1.1, Scala 2.13.17, Python 3.13, Iceberg 1.11.0. EMRFS is gone, AWS SDK for Java v1 is gone, Scala 2.12 JARs must be recompiled, and ANSI mode is on by default so overflows throw where they used to write NULL. The Iceberg v3 support is real but narrower than it sounds: v3 tables cannot be read by Athena, and the new types work only with Spark DataFrames.

  • Redshift long-term system table retention with S3 Tables — system tables have always aged out on a fixed window, which makes retrospective analysis of a slow-building problem impossible. Landing them in Iceberg changes what you can ask.
  • SageMaker Unified Studio adds data profiling and anomaly detection.
  • MWAA Serverless now supports PythonOperator and BashOperator — their absence was the main reason Serverless was not a drop-in for an existing DAG.
  • OpenSearch Ingestion reaches GovCloud, and S3 Metadata and annotations reach GovCloud (US).
  • PostgreSQL 19 Beta 3 in the RDS Database Preview Environment.

Networking and footprint

  • CloudFront Origin Access Control for S3 Multi-Region Access Points — OAC and MRAP were previously mutually exclusive, which forced a choice between multi-Region resilience and the recommended way to lock a bucket to a distribution.
  • A new Availability Zone in Europe (London), and a new Local Zone in Las Vegas.
  • Lambda MicroVMs in five additional Regions.
  • EC2 AMI creation from local snapshots on Outposts — narrow, but it removes a round trip to the parent Region for anyone running a genuine edge estate.
  • MediaConnect Router configurable recovery latency modes.
  • Instance Region expansions: C8gd/M8gd/R8gd, P6-B300 in Seoul, R8a in Taipei, R8i in Tel Aviv, U7i High Memory in Zurich.

Identity and access

A third consecutive week where permissions is the busiest theme.

  • IAM: 20 managed policies per role by default — covered in depth above, including the three limits that did not move.
  • IAM Policy Autopilot supports Terraform plan files — also covered above.
  • DynamoDB Streams supports attribute-based access control — tag-based authorisation reaching a surface that previously needed named-resource policies.
  • SageMaker notebooks support trusted identity propagation — the user's identity reaching the data, rather than the notebook's execution role standing in for everyone.
  • Amazon Quick adds deny by default for custom permissions — a default worth having and worth checking, because flipping a default changes existing behaviour.
  • Storage Gateway supports FIPS-compliant private connectivity for Tape and Volume Gateway over PrivateLink — a long-standing gap for regulated estates, and one this backlog has been holding for weeks.
  • IAM identity federation to external services in the AWS European Sovereign Cloud.
  • Amazon Corretto August 2026 critical security patch updates — patch, do not read.

One note on tracking AWS security bulletins yourself: the bulletins RSS feed stamps every entry with the feed's own generation time rather than the bulletin's publication date, so the dates it reports are not the dates the bulletins were issued. Read the Published: line in each bulletin body instead.

AI and agents

Bedrock had its usual heavy week, and most of it is model and Region availability rather than capability.

  • AgentCore payments reaches GA — the one with real consequences, since an agent that can transact needs authorisation boundaries designed before it is switched on rather than after.
  • External web access for web search on Bedrock, and Web Search in AgentCore gains domain and published-date filtering, expanding to Europe and Asia Pacific. Date filtering is the useful half: an agent grounding on undated web content is grounding on nothing in particular.
  • Grok 4.6 with cross-Region inference, OpenAI models in India, expanded API support and cross-Region inference for OpenAI models, and reduced pricing for GPT-5.6 Sol.
  • Cost Anomaly Detection supports third-party models on Bedrock, and Generative AI Inference Recommendation reaches SageMaker AI Studio.

What I would act on

  1. Pin format-version to 2 on Iceberg tables before anyone upgrades a Glue job. The Glue 6.0 default path is attractive and the failure is downstream and delayed: a table written at v3 is one Athena refuses with Cannot read unsupported version 3. Decide this deliberately rather than discovering it when an analyst reports a broken query.
  2. Inventory your Glue jobs for Scala JARs and AWS SDK v1 imports now, whether or not you plan to upgrade. Both are removed in 6.0, and the work is the same whenever it happens. Run one representative job with spark.sql.ansi.enabled left at its new default while you are there — that is the change that alters results rather than failing loudly.
  3. Look at Network Firewall hit counts, but count your pass rules first. The feature is on and free, and the temptation to prune is immediate. Establish what fraction of your ruleset it cannot see before you act on a zero.
  4. Check whether CloudWatch log centralization tag propagation changes your cost allocation. Tags arriving on centralised log groups where none existed before is a change to how those logs are attributed, and that is worth knowing before the invoice explains it.

Complete inventory: all 63 announcements

Every AWS What's New announcement from 17–21 August 2026, grouped by day, straight from the feed. Sixty-three items, every link checked.

Validating 63 links...

Friday 21 August — 6 announcements

Thursday 20 August — 13 announcements

Wednesday 19 August — 20 announcements

Tuesday 18 August — 12 announcements

Monday 17 August — 12 announcements

Official AWS references

Part of the AWS Weekly Intelligence series — everything AWS shipped each week, ranked, with the detail the announcements leave out.

Topics: AWS Weekly Intelligence AWS

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent