Home› Blog› AWS Weekly Intelligence #13 - 26-30 October 2026
AWS Weekly Intelligence AWS

AWS Weekly Intelligence #13 - 26-30 October 2026

Oct 31, 2026 18 min read
Verified against current vendor documentation on 31 October 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.

Sixty-two announcements across five working days, and for once the week has a clear spine: post-quantum cryptography stopped being a single service’s preview and turned up in three places at once — key management, a database engine, and the CDN that can now tell you which viewers are already using it.

On this page

The week in one paragraph

Monday and Wednesday carried fourteen announcements each, Tuesday was the quiet day at nine, and the week closed with twelve. The post-quantum trio is the story: KMS added ML-KEM, Aurora PostgreSQL added PQ‑TLS key exchange, and CloudFront started reporting the post-quantum TLS details of the viewers hitting your distribution. Underneath that, two smaller currents — lazy container loading reached both SageMaker training jobs and Lambda Managed Instances in the same week, and the agent tooling kept filling in: Step Functions workflows became agent tools, the AgentCore CLI hit 1.0, and Agent Registry picked up four Regions. AWS Backup had a notably good week too, which is convenient timing for today’s architecture post.

Covered in depth this week

Five dailies, one per working day, each covering an announcement from that day. Nothing fell outside the window this week, so there is nothing to reconcile across the edge.

PostAnnouncementWhat the announcement did not say
#62 EC2 Auto Scaling Launch Before Terminate at account level (Mon) The account setting applies to the groups that do not override it, so an estate with per-group settings changes less than the announcement implies
#63 ECS GPU sharing with NVIDIA MPS (Tue) MPS packs by memory and shares everything else — there is no compute isolation between the processes sharing a GPU
#64 Lambda durable functions telemetry exporter (Wed) What it exports includes step input and output — the business payload, not metadata about it — and redaction is something you configure
#65 Step Functions workflows as AI agent tools (Thu) The determinism is inside the workflow; all three execution models are exposed to a caller that can decide to retry
#66 RDS for Oracle drops the AMVU requirement for four options (Fri) The upgrade did not become optional, the obligation did — and the documented reason to want it off is that a Multi-AZ engine upgrade takes both nodes at once

The post-quantum week

Three separate services, three days apart, and together they look like a programme rather than a coincidence.

KMS added the primitive. “AWS Key Management Service (KMS) now supports Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), a post-quantum cryptography standard under NIST FIPS 203, which enables two parties to establish a shared secret.” Naming the FIPS standard matters — this is the ratified algorithm rather than an experimental suite, which is what makes it something a compliance programme can reference.

Aurora added it to the wire. “Amazon Aurora PostgreSQL-Compatible Edition introduces support for post-quantum TLS (PQ-TLS) key exchange, providing you with post-quantum cryptography options for encrypting your data in transit.” Database connections are a sensible early target: long-lived sessions carrying data with a long confidentiality horizon are exactly the harvest-now-decrypt-later case.

CloudFront added the measurement. It “can now forward two new optional headers to your origin”, carrying viewer ISP and post-quantum TLS details. This is the one worth noticing, because visibility is what you need after you have enabled something — it says AWS expects customers to be tracking adoption across a client population they do not control.

If post-quantum has been on your roadmap as a 2028 item, this is the week it became a thing you can turn on and measure rather than plan for.

The rest of the week, by domain

Resilience and backup

“AWS Backup restore testing now supports Amazon Redshift” — one more resource type in the list that decides whether a restore testing plan covers your estate, and worth reading alongside today’s post on what a restore test does and does not establish. Redshift also got “automated cross-region snapshot copy”, and AWS Backup added cross-account management and cross-account backup in the European Sovereign Cloud.

Container and function start times

Seekable OCI landed twice in one week. SageMaker AI now supports “Seekable OCI (SOCI)-indexed container images for training and processing jobs, so your jobs start running your code sooner”, and Lambda “now supports Seekable OCI (SOCI) for lazy loading Event Functions packaged as Open Container Initiative (OCI) images running on Lambda Managed Instances”. ECR added replication backfill for existing images, which is the kind of thing you want before you depend on images being present in a second Region.

Agents

Beyond Step Functions as tools: the AgentCore CLI reached “version 1.0 (@aws/agentcore 1.0.0), rebuilt with faster startup, a consistent command structure, and support for more AgentCore resources”, and “AWS Agent Registry … is now available in four additional AWS Regions: Europe (London) eu-west-2, Europe (Frankfurt) eu-central-1, US East (Ohio) us-east-2, and Canada (Central) ca-central-1”. Quick added smart approvals for agentic actions — the human-in-the-loop piece that most agent deployments reach for second.

Identity

IAM Identity Center added cross-Region trusted identity propagation. AWS’s description of what TIP is remains the clearest one-liner for why it matters: “Trusted identity propagation carries a user’s identity with their request, so AWS services can grant permissions based on who the user is and their underlying group associations, and log that user’s access for auditing.” The Identity Store also began emitting change notifications through EventBridge, which is the hook anyone building joiner-mover-leaver automation has been waiting for.

Databases and analytics

Aurora Serverless raised its ceiling to 384 ACUs. Neptune added online index rebuild to reclaim storage. ElastiCache for Valkey can change durability on existing clusters. MSK added TLS 1.3 and MSK Connect allowed plugin and worker configuration updates in place. Glue Data Catalog added OAuth for the Iceberg REST Catalog APIs, and Iceberg table optimization reached US West (N. California).

Everything else worth a glance

EKS Auto Mode picked up the Kubernetes Gateway API and the EKS Dashboard gained fleet-wide visibility into certificate authority rotation. ECS Managed Instances added cross-instance and Spot consolidation. Amazon Connect had its usual busy week — six items, mostly around flow testing, versioning and outcome metrics. SageMaker AI added GPU partitioning for real-time endpoints, which is the inference-side sibling of the ECS MPS story from Tuesday.

What I would act on

Put post-quantum on this quarter’s list rather than next year’s. With KMS offering a FIPS 203 algorithm, Aurora offering PQ-TLS on the wire and CloudFront reporting who is negotiating it, the three pieces you need — a primitive, a place to use it, and a way to measure adoption — all exist now. Start with the measurement: enable the CloudFront headers and find out what your viewers already support before deciding anything.

Check whether Redshift belongs in a restore testing plan. The resource list is what decides coverage, and a new entry on it is a cheap win — provided you read what a restore test establishes before reporting it as evidence your backups work.

Wire the Identity Store change notifications. Identity lifecycle automation built on polling is the common pattern and the fragile one; an EventBridge event for directory changes replaces a scheduled diff with something that fires when the thing actually happens.

If you run large training containers, measure a SOCI-indexed start. Both the SageMaker and Lambda items are about the same cost — time spent pulling an image before any of your code runs. It is one of the few optimisations that needs no change to the application.

Complete inventory

All 62 announcements from the AWS What’s New feed for 26–30 October 2026, with AWS’s own one-line summaries. Generated by build_weekly_inventory.py, which validated every link: 62 announcements, 62 unique links, all returning 200.

Friday 30 October — 12 announcements

Thursday 29 October — 13 announcements

Wednesday 28 October — 14 announcements

Tuesday 27 October — 9 announcements

Monday 26 October — 14 announcements

Looking for one service rather than a whole week?

Every AWS, Azure and Google Cloud announcement is browsable by service and date, each linked to the vendor’s own page — and the other weekly roundups are collected in one place.

Browse announcements →
Topics: AWS Weekly Intelligence AWS

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent