Home Resume
Home› Blog› AWS Weekly Intelligence #4 - 24-28 August 2026
AWS Weekly Intelligence AWS

24–28 August 2026

Fifty-four announcements across five working days, three security bulletins, and EC2's twentieth birthday. The week's centre of gravity was identity — who may act, on whose behalf, and how you would know.

Aug 29, 2026 20 min read
Verified against current vendor documentation on 29 August 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.
AWS Weekly Intelligence #4

29 August 2026 · Everything AWS shipped, 24–28 August

On this page

The week in one paragraph

Fifty-four announcements, down from last week's sixty-three, and unusually concentrated: identity and access accounted for a larger share than any other domain, and it did so from five different directions at once. Lambda functions gained full IAM resource-based policies. EKS accepted multiple external OIDC providers per cluster. Cognito gained an admin operation to reset a user's TOTP configuration. IAM Roles Anywhere shipped a Java plugin. Bedrock AgentCore Memory gained per-tenant isolation, in two announcements published the same day. Then three security bulletins landed, and all three were failures of exactly the same kind — a boundary that existed on paper and not in the code underneath it. The rest of the week was solid and unspectacular: a large database patch wave, orchestrated recovery in DRS, managed runtimes in preview, and EC2 turning twenty.

Covered in depth

Every working day this week produced a deep-dive. Each is linked below with the detail the announcement itself left out.

NewsPostWhat the announcement left out
EKS supports multiple external OIDC identity providers per cluster #17 — Ten OIDC providers, and prefixes stop being cosmetic With one provider a username prefix was housekeeping. With several it is the only thing keeping two identity domains from colliding on the same Kubernetes subject.
Lambda functions support full IAM resource-based policies #18 — A real resource policy, and one call that erases every trigger The old per-statement API was a safety rail. A full policy document means a single PutResourcePolicy replaces the whole document, including every trigger permission added by a console wizard.
Cognito adds an admin API to reset user TOTP configurations #19 — Whoever holds that permission owns the account Resetting the second factor is indistinguishable from bypassing it. The permission belongs in the same review as password reset, and usually is not.
Aurora DSQL supports foreign key constraints #20 — Every child insert now watches the parent row DSQL has no locks, so it enforces the constraint against the transaction snapshot. Adding a foreign key widens the conflict surface between transactions that never touch the same table.
CVE-2026-81849, path traversal in the SSM Agent #21 — Scoping SendCommand was never a privilege boundary The premise is a caller who was already restricted. Document-scoped ssm:SendCommand bounds intent, not blast radius, because the plugin underneath runs as root.

Identity and access

Four of the five deep-dives above are identity stories, which was not a choice about what to write — it is what the week contained. Three more landed underneath them.

IAM Roles Anywhere now provides a Java plugin for the AWS SDK. Roles Anywhere exchanges an X.509 certificate for temporary AWS credentials, and until now the Java path meant shelling out to the credential helper or writing the exchange yourself. A first-party plugin removes the most common reason teams left long-lived access keys on non-AWS hosts, which is that the alternative was awkward in the language they happened to use.

Secrets Manager adds managed external secrets support for Cisco Security Platform and Netskope. The interesting part is the direction of travel rather than the two vendors: Secrets Manager increasingly rotates credentials it does not own, for systems outside AWS. Every addition to that list is one fewer static API key living in a parameter somewhere.

SageMaker MLflow now supports customer managed keys. Experiment tracking data is training data by another name, and it was previously encrypted with a key you did not control. This is the ordinary compliance unlock that moves an ML platform from a sandbox into a regulated estate.

And Bedrock AgentCore Memory gained fine-grained access control and flexible namespace variables on the same day. These are one story told in two announcements: namespaces give agent memory a tenancy shape, and the access control enforces it. Anyone building a multi-tenant agent has been writing that isolation by hand.

Three bulletins, one theme

Three security bulletins in one week is more than usual, and the coincidence worth noticing is that all three describe the same failure: a control that a reader of the configuration would reasonably believe was enforced, and that the code underneath did not enforce.

BulletinComponentAffectedFixed in
CVE-2026-81849 amazon-ssm-agent, aws:downloadContent 2.0.767.0 to 3.3.4364.0 3.3.4515.0
CVE-2026-81838 awsdac (diagram-as-code) 0.10 through 0.23 0.24
CVE-2026-78379 strands-agents-tools, python_repl before 0.8.5 0.8.5

The SSM Agent issue is the one to act on first and has its own post. The Strands one deserves a mention here because it is the newest shape of an old problem: the python_repl tool requires human approval before running code, and a malicious prompt could pass the non_interactive_mode parameter through the batch tool to skip that approval. The consent gate was real; it just was not reachable from every path into the tool. If you run agents over untrusted input, upgrade to 0.8.5, and in the meantime disable either the batch or the python_repl tool.

Recovery and backup

AWS Elastic Disaster Recovery introduced Recovery Plans, which automates the sequential launch of multi-server applications during recovery and drills. You group servers into sequential steps with configurable wait times between them, and it is available in all AWS Regions where AWS DRS is offered at no additional cost beyond standard DRS usage.

This is a bigger deal than its announcement suggests. DRS could always bring servers back; what it could not do was bring them back in an order. Every real application has one — directory before application, database before the service that connects to it, queue consumers last — and until now that order lived in a runbook that someone followed at three in the morning. Moving it into the tool means the drill exercises the ordering as well as the recovery, which is where the failures actually are.

Backup had a quieter week in the same direction: FSx for NetApp ONTAP gained cross-Region and cross-account backup copy, with the corresponding AWS Backup support announced alongside it, and AWS Backup added cross-Region copy and logically air-gapped vault support for DocumentDB in nine additional Regions. Cross-account is the part that matters: a backup in the same account as the thing it protects is a backup an account compromise takes with it.

Databases: the patch wave

Six database version announcements in five days, which is a quarterly rhythm rather than news, but worth reading as a block because it sets the maintenance window agenda for the next month.

  • Aurora PostgreSQL — 18.4, 17.10, 16.14, 15.18 and 14.23.
  • RDS for PostgreSQL — 18.6, 17.11, 16.15, 15.19 and 14.24.
  • Aurora MySQL 3.13, compatible with MySQL 8.0.45, generally available.
  • RDS for MySQL — minor version 8.4.11.
  • RDS for Oracle — the July 2026 Release Update, for 19c, 21c and 26ai.
  • RDS for SQL Server — the latest Cumulative Updates.

Elsewhere in data: Redshift streaming can now ingest 10MiB records from Kinesis Data Streams, which removes a real constraint for anyone streaming documents rather than events; MSK Replicator gained OAuth 2.0 authentication for replication from external Kafka clusters, closing the gap for on-premises and other-cloud sources that do not do mTLS; and Glue added catalog federation for remote Iceberg REST catalogs in GovCloud.

Compute and runtimes

Lambda introduced managed runtimes in public preview for Node.js 26 and Python 3.15, available in all AWS commercial Regions, AWS GovCloud (US) Regions, and China Regions. Read the caveat before you plan around it: because public preview managed runtimes may receive breaking changes during the preview period, they are not covered by the Lambda SLA or AWS Technical Support plans and should not be used for production workloads. The useful part is that the preview uses the same runtime identifier as the eventual GA release, so a function pinned to it graduates on its own — which is convenient and is also exactly how a preview runtime ends up in production by accident.

AWS Batch now supports Amazon ECS Managed Instances, where AWS handles AMI updates, security patching, and instance lifecycle automatically, eliminating the operational overhead of customer-managed EC2 infrastructure. It is supported in all AWS Regions where AWS Batch is available. For GPU batch estates this removes the least interesting recurring job in the platform team's week.

Also this week: Lambda MicroVMs now support PrivateLink; ECS automatically detects and repairs container instances with impaired agent connectivity, which quietly removes a common source of silent capacity loss; Capacity Reservation Resource Groups gained support for Capacity Blocks and interruptible reservations; and ParallelCluster 3.16 added an on-node diagnostics tool.

And EC2 turned twenty. The birthday post is worth ten minutes for anyone who has only worked in a world where a server was always an API call away.

AI and agents

Beyond the AgentCore Memory pair, the week's AI news was mostly distribution rather than capability: OpenAI GPT-5.6 Terra and Luna reached Bedrock in GovCloud (US), SpaceXAI Grok 4.6 followed on Friday, AgentCore expanded to two new Regions, and JumpStart added the Cosmos3 family alongside Muse-Glimmer-30B and Qwen 3.8-27B.

Two items are more than availability. SageMaker HyperPod enhanced its support for Ray, with built-in observability, resilient training and managed development environments — resilient training being the one that matters at cluster scale, where the question is not whether nodes fail but what happens to a run when they do. And Redshift integrated with the Agent Toolkit for AWS for AI-assisted warehouse management, which is part of a pattern worth tracking: the toolkit is arriving service by service, and the security question it raises is the same each time — what can the agent do that the person driving it could not.

What I would act on

  1. Upgrade amazon-ssm-agent to 3.3.4515.0 or later, today. Affected versions run from 2.0.767.0 to 3.3.4364.0, which is most fleets, and there is no workaround. While you are there, list who holds ssm:SendCommand — that list is a root-access list.
  2. Upgrade strands-agents-tools to 0.8.5 if you run agents over untrusted input. A consent gate that can be skipped by a parameter passed through another tool is not a consent gate, and agent frameworks are where this class of bug is going to keep appearing.
  3. Audit Lambda resource policies before adopting PutResourcePolicy. The new full-document API is a genuine improvement and it replaces the entire policy in one call. Capture the current policy of every function first, because the statements a console wizard added years ago are not written down anywhere else.
  4. Put your recovery ordering into a DRS Recovery Plan. It costs nothing beyond standard DRS usage, and it converts the part of your DR plan that lives in a document into the part the drill actually exercises.
  5. Decide your position on preview runtimes now. Node.js 26 and Python 3.15 share an identifier with their GA versions, so an SCP or a CI check is the only thing between "we are evaluating it" and "it is in production and not covered by the SLA".

Complete inventory: all 54 announcements

Every AWS What's New announcement published between 24 and 28 August 2026, grouped by day, taken from the raw feed rather than summarised. Each links to AWS's own page.

Validating 54 links...

Friday 28 August — 8 announcements

Thursday 27 August — 13 announcements

Wednesday 26 August — 6 announcements

Tuesday 25 August — 16 announcements

Monday 24 August — 11 announcements

Topics: AWS Weekly Intelligence AWS

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent