Home› Blog› AWS Weekly Intelligence #12 - 19-23 October 2026
AWS Weekly Intelligence AWS

AWS Weekly Intelligence #12 - 19-23 October 2026

Oct 24, 2026 17 min read
Verified against current vendor documentation on 24 October 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.

Fifty-four announcements across five working days. The week’s shape was infrastructure plumbing rather than headline launches: a NAT capability landing on two network services at once, a managed ingress for ECS, a replica you can finally detach, and two separate identity changes that only matter if you have been bitten by them.

On this page

The week in one paragraph

Networking and containers carried it. Transit Gateway and Cloud WAN both gained “managed one-to-one network address translation (NAT) directly on their attachments”, which addresses the overlapping-CIDR problem people have been working around for years; ECS got a managed ingress of its own in ECS Gateway; and DynamoDB global tables learned to disassociate a replica. On the identity side, two quiet but real items: Identity Center simplified changing identity source from Active Directory, and its identity store gained optimistic locking. The AI announcements kept arriving at the same pace as the previous week — SageMaker AI three times, Bedrock four times, Neuron twice — and the one price cut was EMR on EKS, down “30 percent in the EMR charge added to EKS”.

Covered in depth this week

Five daily posts, one per working day, each on an announcement from that day’s news.

PostAnnouncementWhat the announcement did not say
#57 EC2 Image Builder integrates with Auto Scaling for faster image builds Your recipe still names a base image, and in this mode it is no longer the thing being used.
#58 CloudWatch Alarms support tags in the alarm actions payload The exclude list only knows the tags that exist today, so a tag added later arrives in the payload.
#59 Network Firewall supports Route 53 Resolved IP Validation Every VPC associated with the rule group contributes resolutions — including VPCs that send it no traffic.
#60 Serverless model customization for Muse Glimmer, Qwen3.8 and Ministral 3 The sequence-length ceiling belongs to the model-technique-training-type cell, and reverses direction between rows.
#61 Bedrock Web Search gains domain filtering and user location The allow-list shapes grounding; a separate parameter and IAM permission decide whether anything leaves AWS.

Not written up, grouped by domain

Networking

1:1 NAT on Transit Gateway and Cloud WAN attachments is the week’s most consequential networking item and the one I would have written if a slot had been free. It arrives “through integration with Regional Private NAT Gateway”, which is the detail worth chasing — it means the translation is a NAT Gateway you can reason about rather than a new opaque mechanism. AWS Interconnect — last mile entered preview with Megaport, and Direct Connect added 100G in both Bangalore and Manchester.

Containers and compute

Amazon ECS Gateway is “a managed ingress solution for your ECS services” — the obvious question is how it sits against an Application Load Balancer and against the VPC Lattice path, and the announcement does not answer it. Lambda MicroVMs reached four more Regions.

Databases and caching

DynamoDB global tables support disassociating replicas, which is the operation people have been working around with table rebuilds. ElastiCache Serverless for Valkey gained “online migration with zero downtime”. Aurora and RDS picked up On-Demand Capacity Reservations, and RDS for SQL Server can now take snapshots on read replicas.

Identity and security

Two Identity Center items, both small and both the kind of thing that has cost someone a weekend: simplified identity source changes from Active Directory, and “optimistic locking for users and groups in its identity store” — which is a concurrency control, and worth reading if you write to that store from automation. GuardDuty added “optional threat detection rules for Runtime Monitoring”, and AWS Continuum for code vulnerabilities went generally available with a News Blog post alongside it. AWS Service Reference Information now supports “global condition keys, service names, and data plane classification” — a machine-readable source for exactly the kind of policy detail this series keeps verifying by hand.

AI and machine learning

SageMaker AI appeared three times: serverless customization for three model families (written up as #60), custom sequence lengths for those jobs, and training session APIs for writing your own training loop without managing GPUs. Bedrock appeared four times: Web Search controls (#61), structured outputs for Claude models, Guardrails Standard tier for contextual grounding checks, and prompt shortening in Advanced Prompt Optimization. AWS Neuron 2.33 and TorchNeuron both landed — see the note below. Polly’s Generative engine was upgraded with “more natural speech, 14 new voices, and 2 new languages”, and Clean Rooms added Databricks as a data source.

Operations, data and cost

CloudFormation simplified stack update rollback operations, which is a quiet entry for something that matters during an incident. OpenSearch gained intelligent ingestion for logs and documents in S3, and Serverless moved to a 5-second default refresh interval. MSK Connect can now pause and resume connectors. EMR on EKS cut its EMR charge by 30 percent — the week’s only price reduction. AWS Transform appeared three times, covering storage migration assessments for S3, EBS, EFS and FSx; building new networks and modernising security groups; and expanded support for existing landing zones.

Media, end-user computing and the rest

MediaConnect Router added high bitrate modes with “two new tiers: 250 Mbps and 500 Mbps”. WorkSpaces simplified AI agent access to cloud desktops. Amazon Connect had four separate items, three about the agent workspace and one about Global Resiliency persistent chat. Regional expansions: MWAA in Mexico (Central), Amazon Quick in Singapore, CloudWatch Omni in eight more Regions, Cognito multi-Region replication into GovCloud, Grok 4.7 on Bedrock in GovCloud, and S3 server access log delivery to CloudWatch Logs in five more Regions. Amazon Corretto shipped its October quarterly updates. Fifteen security bulletins were published during the window.

One item from this week is written and not published

AWS Neuron 2.33 and TorchNeuron both landed on 20–21 October and are genuinely significant — native PyTorch support for Trainium is a real change in how that hardware is programmed. The post exists and its quotes are verified, but the substantive documentation lives on a host outside the allowlist this series checks claims against, and no equivalent page exists on docs.aws.amazon.com. It publishes when that is resolved. Nothing about the material is in doubt; the gap is in the checking rule rather than in the source.

What I would act on

  1. Read the 1:1 NAT announcement if you have ever joined two networks with overlapping CIDRs. This is the item most likely to remove an existing workaround rather than add a new capability, and it landed on Transit Gateway and Cloud WAN at the same time.
  2. Check whether Identity Center’s optimistic locking changes your provisioning code. If you write users or groups from automation, a concurrency control is only useful once your client handles the conflict it now surfaces.
  3. Point your policy tooling at AWS Service Reference Information. Global condition keys and data plane classification becoming machine-readable is the kind of thing that quietly replaces a hand-maintained list.
  4. If you run EMR on EKS, the 30 percent reduction applies without action — but it is worth re-running your EMR-on-EKS against EMR-on-EC2 comparison, because a 30 percent cut to one side can move the answer.
  5. If you enabled Bedrock Web Search on the strength of a security review, re-read that review. Domain filtering is new, useful, and not the egress control: external_web_access and the matching IAM permission are, and AWS’s own guidance for sensitive data is to leave the parameter off.

Complete inventory

All 54 What’s New announcements published between Monday 19 and Friday 23 October 2026, most recent first, with AWS’s own one-line summary for each. Built from the raw feeds rather than summarised, and every link checked: 54 announcements, 54 unique links, all returning 200.

Friday 23 October — 6 announcements

Thursday 22 October — 13 announcements

Wednesday 21 October — 12 announcements

Tuesday 20 October — 14 announcements

Monday 19 October — 9 announcements

Looking for one service rather than a whole week?

Every AWS, Azure and Google Cloud announcement is browsable by service and date, each linked to the vendor’s own page — and the other weekly roundups are collected in one place.

Browse announcements →
Topics: AWS Weekly Intelligence AWS

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent