Home› Blog› AWS Weekly Intelligence #14 - 2-6 November 2026
AWS Weekly Intelligence AWS

AWS Weekly Intelligence #14 - 2-6 November 2026

Nov 7, 2026 20 min read
Verified against current vendor documentation on 7 November 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.

Sixty announcements across five working days, and the week has an unusually coherent spine: six separate launches, in six services, all answering a version of the same question — what do I actually have, and which of it is a problem. None of them is a flagship. Together they are the most useful thing in the week.

On this page

The week in one paragraph

Thursday carried the week at seventeen announcements, Monday was next at thirteen, and Tuesday was the quiet day at nine — sixty in total, twelve a day on average. The visibility thread is the story and it ran all week: Inspector learned to scan AMIs on Monday, Config added ten resource types on Tuesday, EC2 and VPC started showing related resources for every resource type on Wednesday, EC2 published an ImdsV1Enabled metric on Thursday, and Security Hub shipped an organization-wide SBOM inventory on Friday. Underneath that, two steady currents: a large GovCloud (US) wave — Agent Registry, MSK Replicator, Security Hub Network Scanning, CodeConnections and Capacity Reservation Resource Groups all landed there — and five more Amazon Connect Customer features, which has now been the most prolific service in the feed for several weeks running. Cost tooling had a quietly significant week too, with per-snapshot billing for RDS and Capacity Blocks amortisation in Cost Explorer.

Covered in depth this week

Five dailies, one per working day, each covering an announcement from that day. Nothing fell outside the window, so there is nothing to reconcile across the edge.

PostAnnouncementWhat the announcement did not say
#67 EC2 AMIs can be scanned for vulnerabilities through Inspector (Mon) Allowed AMIs governs which AMIs you may launch, not which you may build — so the control and the scan cover different populations
#68 AWS Config supports 10 new resource types (Tue) Recording a new type is a pricing decision as much as a coverage one — periodic configuration items cost four times continuous ones
#69 New features for EC2 Capacity Manager (Wed) A supportability score is an assessment, not a reservation — a High score guarantees you nothing about capacity being there
#70 DynamoDB supports bulk put items (Thu) Consuming no table capacity is not the same as no impact — streams, metrics, DAX and CloudTrail each behave differently, and three of them lose visibility
#71 Redshift expands SUPER to 16 million bytes (Fri) CREATE TABLE with VARCHAR(MAX) still creates a 65,535-byte column — the ceiling moved in memory and in SUPER, not in a table

The week AWS shipped six ways to see what you have

This was not a coordinated launch and the six announcements share no service team. But read together they describe one direction of travel, and it is worth laying them side by side because the overlap matters when you decide which to adopt.

DayWhat shippedWhat it makes visible that was not
Mon Inspector scanning EC2 AMIs Vulnerabilities in images “without launching instances or installing additional software” — the dormant estate, which nothing was scanning
Tue Config supports 10 new resource types Configuration history for types that previously had none, “across key services including Amazon ElastiCache and Amazon QuickSight”
Wed EC2, VPC and Global View show related resources “related resources for all resource types” — previously a partial list, so an absent relationship meant nothing
Wed EC2 Capacity Manager supportability checks “real-time supportability checks and capacity fulfillment metrics” — whether a launch is likely to succeed, before it fails
Thu EC2 ImdsV1Enabled CloudWatch metric “visibility into which of their EC2 instances still have Instance Metadata Service Version 1 (IMDSv1) enabled”
Fri Security Hub SBOM inventory “a continuously updated, organization-wide view of the software” — the dependency layer, which no AWS inventory reached

The ImdsV1Enabled metric is the one I would take first, and it is the smallest of the six. IMDSv1 has been the recommended-against default for years, every hardening guide names it, and until now the honest answer to how many of our instances still allow it required either a Config rule somebody had to set up or a script walking every instance in every account. A CloudWatch metric is a graph you can put on a dashboard this afternoon and a trend line you can show to someone who asks whether the migration is finished.

The SBOM inventory is the largest in scope and the one worth planning rather than enabling. An organization-wide software bill of materials is the first AWS-native answer to are we affected by this CVE that does not start with a spreadsheet, and that question arrives without warning. It is also the announcement in this group whose value depends most on coverage — which is exactly the property #105 spent a post on.

Worth saying plainly: four of these six tell you about things you already own and had no easy way to enumerate. That is a different kind of launch from a new capability, and it is usually a better week’s work.

The rest of the week, by domain

Security and identity

IAM Roles Anywhere added automatic revocation checking using “certificate revocation list (CRL) distribution points (CDPs)”. This closes a real gap: previously a revoked certificate stayed usable for authentication unless you uploaded the CRL yourself, so revocation depended on an operational step somebody had to remember. Automatic CDP checking makes revocation mean what the word implies. If you run Roles Anywhere, this is the week’s most consequential security item.

Security Hub Network Scanning reached GovCloud (US), and SageMaker AI Studio gained IAM Identity Center multi-Region replication — “enabling you to deploy SageMaker AI Studio domains in different regions from your IdC instance’s primary region”, which removes a genuine architectural constraint for anyone whose Identity Center instance is not where their data science happens.

Databases

RDS for Oracle had four separate announcements, continuing a run that has been going for weeks: Kerberos authentication with self-managed Active Directory, option group copying during cross-Region snapshot copy, and M8i and R8i instances in more Regions. The snapshot one is the quiet improvement — copying a snapshot across Regions without its option group has been a long-standing way to discover at restore time that your options are gone.

Aurora MySQL shipped two version updates (8.4.10, and 3.14 compatible with MySQL 8.0.46), DocumentDB reached Taipei and New Zealand, and RDS for SQL Server picked up the latest Cumulative Update and GDR updates.

Storage and data

FSx for Lustre Intelligent-Tiering reached 192,000 metadata IOPS, which AWS frames as “16x higher than the previous maximum of 12,000 IOPS”. Metadata IOPS is the limit that bites on training workloads with millions of small files, and a sixteenfold increase on a tier that exists to be cheap is a better combination than it sounds.

S3 Tables added managed Hive-to-Iceberg migration — “managed migration of your Apache Hive tables to Apache Iceberg” — and Glue Data Catalog added catalog-vended credentials for Iceberg REST catalog federation. The Iceberg consolidation continues at roughly one announcement a week.

Operations and cost

Systems Manager Parameter Store added 13 new parameter data types that “automatically validate parameter values when you create or update a parameter”. Validation at write time is the right place for it: a malformed parameter discovered at deploy time is a deploy failure, and discovered at run time is an incident.

RDS now supports per snapshot billing, and Cost Explorer and CUR 2.0 now amortise the upfront fee for EC2 Capacity Blocks for ML across each reservation’s duration. Both change the shape of a bill rather than its total, which is the kind of change that silently invalidates a dashboard built on last month’s line items.

CloudFront moved to self-service quota increases for “28 CloudFront quotas from the Service Quotas console or API”, and MWAA added cost allocation tag support. Lambda raised default quotas for durable functions, and Lambda added queues for Apache Kafka in self-managed Kafka event sources, which extends the queueing model beyond MSK to Confluent Cloud and self-run clusters.

Reliability

Cognito raised its SLA to 99.99% for the Plus feature plan, “up from 99.9%”, effective 1 November 2026. An order of magnitude less permitted downtime, tied to a paid tier — worth knowing if your availability target was written against the old figure.

Networking

AWS Interconnect — last mile added a Northern Virginia metro and went into preview with Equinix. Two announcements in one week for a service that has been expanding quietly; the Equinix preview is the more interesting of the two, because a partner integration changes who can sell it.

Agents and AI

Web Answer on Bedrock AgentCore reached general availability, Agent Registry reached GovCloud (US-West), Kimi K3.1 Pro arrived on Bedrock, OpenSearch Service added agent traces including OpenTelemetry, and Amazon Q Developer in the console was renamed the AWS assistant. The rename is housekeeping; the OpenSearch trace support is the one with operational weight, because agent debugging has had no standard telemetry story.

Amazon Connect Customer shipped five more features: cases shown in contact records, pausing and resuming emails, email address prefill from linked profiles, MCP tools callable in flows via a new External Tool block, and Cases and External Tool events in the Wait block. The MCP one is the notable item — a contact flow that can call an MCP tool is a contact centre with an extension point it did not have.

What I would act on

Put the ImdsV1Enabled metric on a dashboard today. It costs nothing to look at, it answers a hardening question most organisations cannot currently answer, and it turns we think we finished the IMDSv2 migration into a number. If the number is not zero, you have found work that was already overdue.

If you use IAM Roles Anywhere, enable CRL distribution point checking. Until this shipped, revocation required you to keep uploading CRLs; a certificate you revoked and did not follow up on is still authenticating. This is the week’s one item that closes a live security gap rather than improving visibility into one.

Check whether per-snapshot RDS billing changes your snapshot economics. A billing-model change on a resource most estates hold hundreds of is worth half an hour before the next invoice, not after it. Pair it with the Capacity Blocks amortisation change if you run ML capacity — both alter how existing spend appears in Cost Explorer.

Scope the Security Hub SBOM inventory rather than enabling it everywhere. It is organization-wide by design, which makes it valuable and makes its coverage the thing to establish first. Work out which accounts are in scope and what it reports before the next CVE makes it urgent.

If you were waiting on Redshift SUPER string sizes, read the parameter page before the announcement. The opt-in needs a cluster reboot and cannot be reset to its default once set, and the table column width does not change at all. #71 has the detail.

Complete inventory

All 60 announcements from the AWS What’s New feed for 2–6 November 2026, with AWS’s own one-line summaries. Generated by build_weekly_inventory.py, which validated every link: 60 announcements, 60 unique links, all returning 200.

Friday 06 November — 10 announcements

Thursday 05 November — 17 announcements

Wednesday 04 November — 11 announcements

Tuesday 03 November — 9 announcements

Monday 02 November — 13 announcements

Looking for one service rather than a whole week?

Every AWS, Azure and Google Cloud announcement is browsable by service and date, each linked to the vendor’s own page — and the other weekly roundups are collected in one place.

Browse announcements →
Topics: AWS Weekly Intelligence AWS

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent