Home Resume
Home› Blog› AWS Weekly Intelligence #1 - 3-7 August 2026
AWS Weekly Intelligence AWS

Everything AWS Shipped This Week, Ranked

Sixty-six announcements across five working days. Five got a full write-up, the significant ones are explained here, and every single one is listed at the end with a summary and a link. One page, the whole week.

Aug 8, 2026 25 min read
Verified against current vendor documentation on 13 August 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.
AWS Weekly Intelligence · 3–7 August 2026
66 announcements 6 daily posts all 66 listed and linked every link checked

In This Post

  1. The week in one paragraph
  2. Covered in depth this week
  3. Storage and backup
  4. Compute and containers
  5. AI and agents
  6. Security and identity
  7. Data and analytics
  8. Everything else
  9. Beyond the announcements: blogs and events
  10. What I would act on
  11. Complete inventory — all 66, with summaries
  12. Official AWS references

The week in one paragraph

Sixty-six announcements in five days, unevenly spread: 14 on Monday, 13 Tuesday, 8 Wednesday, a startling 21 on Thursday, and 10 on Friday. The theme, if there is one, is AWS filling in operational gaps rather than launching new services: vector search arriving inside a database people already run, GPU capacity sold in eighths instead of whole units, backup data readable without a restore, and route-hijack protection folded into the tool that already holds your address inventory.

Two things stood out as genuinely architectural rather than incremental. DynamoDB vector search removes an entire component from a common RAG design. ECS fractional GPU scheduling changes the unit of purchase for inference. Both are covered in full below.

One pattern worth naming: several of this week's launches are gated in ways the announcements do not lead with. Lambda's bandwidth increase needs a Service Quotas request. IPAM's route protection needs the Advanced Tier. ECR's larger layers only apply on one of two upload paths. If you skim announcements, you will over-estimate what you actually get.

Covered in depth this week

Six daily posts published this week, each carrying the detail its announcement left out. The day column is when AWS announced the change, not when the post went out — the daily series runs a day behind the news, so Monday's post covers the previous week.

DayTopicThe part the announcement omitted
Mon Lambda SQS Provisioned Mode reaches 10,000 event pollers Provisioned Mode and the Maximum concurrency setting are mutually exclusive — enabling one silently removes a protective control.
Tue RFC 9151 CNSA 1.0 TLS policies on ALB and NLB Selecting any RFC 9151 policy pins backend connections to the most permissive one. The strict policy does not give you an end-to-end compliant path.
Wed DynamoDB adds real-time vector search For Cosine and Euclidean, a lower score means more similar. Threshold logic ported from any other vector store keeps the worst matches.
Thu ECS fractional GPU scheduling on G6f The fraction belongs to the instance, not the container. And 3 GB of GPU memory at one-eighth is the real constraint, not compute.
Fri IPAM BGP route protection and delegated RPKI Deleting an Internet Registry Association deletes every ROA under it, silently. Traffic keeps flowing; the prefixes just stop being protected.
30 Jul Policy-Based Routing on AWS Transit Gateway Associating a policy table with a VPN or Connect attachment stops BGP advertisement to that peer entirely. Published Monday, covering the previous week — the series opened mid-cycle.

The last row is the exception worth explaining: that post published on Monday but covers a 30 July announcement, so it falls outside this roundup's news window. It is listed because it published this week, and it is worth reading if you run centralised traffic inspection.

That is every Daily Intelligence post published to date — the series began this week. From next week, each roundup covers the dailies published since the previous one, and the full Daily Intelligence archive always holds every post.

Storage and backup

AWS Backup for S3: read backup data without restoring it

The strongest item that did not get its own post. You can now create an S3 Access Point against a recovery point and read backup data with ordinary S3 calls — AWS names GetObject, HeadObject and ListObjectsV2 — without initiating a restore. It works with snapshot and continuous point-in-time recovery points, in standard or logically air-gapped vaults, including recovery points shared across accounts.

This changes three workflows that previously all began with "restore it somewhere and wait": targeted single-file recovery, compliance sampling, and forensic investigation after an incident.

One operational catch worth knowing before you build on it: while an access point is active, the associated recovery point is protected from deletion. That is helpful during an investigation and awkward if it collides with a vault lifecycle policy expecting recovery points to age out.

ECR raises the image layer limit to 200 GB — on one path only

The maximum single layer size goes from 50 GB to 200 GB, which matters if you embed model weights or large datasets directly in an image rather than fetching them at runtime.

The asymmetry is the story. Only docker push gets 200 GB. Images pushed with the AWS SDK or CLI, via the UploadLayerPart API, remain limited to 50 GB. If your build pipeline uses the SDK path — and plenty of CI systems do — nothing changed for you.

Compute and containers

Lambda network bandwidth scales to 3,000 Mbps, with three conditions

Bandwidth now scales with memory: 625 Mbps at 2 GB, up to 3,000 Mbps at 10 GB, proportionally in between. No additional charge, all commercial Regions.

Three conditions the headline does not carry, and any one of them can rule you out:

  • It applies only to functions outside a VPC. Functions in a VPC are not eligible — which excludes most enterprise Lambda estates.
  • It needs 2 GB of memory or more.
  • It is not on by default. You must request it through Service Quotas under "Network bandwidth per execution environment". Once enabled it applies automatically to all qualifying functions in the account.

Aurora Serverless scales faster from idle

Aurora Serverless now reaches up to 12 ACUs within a second and continues to 256, aimed at agentic and bursty workloads with long idle windows. Automatically enabled on clusters running platform versions 3 or 4; versions 1 and 2 can upgrade to version 4.

AI and agents

Bedrock AgentCore runtime instances go GA

Agents can now run on EC2 instances with sessions lasting up to 14 days, against 8 hours on the existing microVM-based serverless runtime. AWS manages provisioning, patching, scaling and lifecycle. Nine Regions. Management fees apply on top of EC2 costs.

The 8-hour ceiling was a real constraint for long-running agent work. This is the answer, at the cost of running instances rather than paying per invocation.

AgentCore adds temporal policies and per-user rate limiting

Stateful authorization rules and per-user traffic limits for agent deployments. Under-covered relative to its importance: as soon as agents act on behalf of users, "what may this agent do, for whom, and how often" becomes a real access-control question, and this is the first native answer.

Bedrock Web Search for GPT models

Grounds GPT model responses against a web index operated by Amazon, with a built-in knowledge graph, through OpenAI's standard tool-use interface — one API parameter. AWS states data residency is maintained within your AWS environment with zero data egress, which is the point for anyone who could not use a third-party search API for compliance reasons. Three US Regions.

1M token context for GPT-5.6, and full fine-tuning on SageMaker

GPT-5.6 Sol, Terra and Luna now support 1 million token context windows on Bedrock, with prompt caching discounts on repeated context. Separately, SageMaker AI serverless model customization added full fine-tuning — updating all parameters rather than the LoRA-style subset — across 25+ open models including gpt-oss, Gemma, Llama, Nemotron and Qwen. Four Regions.

Security and identity

Security Hub adds supply chain security as a tenth category

Curated partner solutions from Chainguard and Socket to detect and block malicious dependencies before they are built into applications, bringing the Extended plan to 23 partner solutions. GA in all commercial Regions where Security Hub operates, pay-as-you-go.

Dependency-confusion and typosquatting attacks are a live problem and most organisations have no control at this layer at all. The announcement is thin on how it integrates with CI/CD, which is the question that decides whether it is useful.

Network Firewall Forward Proxy — Preview, one Region

Network Firewall can now act as an explicit forward proxy in a new "no-source-preservation" deployment mode, so a single policy covers both explicit-proxy and transparent inspection with feature parity — managed rule groups, active threat defence, geo-IP filtering, URL and domain category filtering, and container attribute rules for EKS and ECS.

Architecturally the most interesting thing AWS shipped this week. But it is public preview in US East (Ohio) only, so it is one to design against later rather than adopt now. Free during preview.

MSK delivers Kafka authorizer logs

Denied authorization requests, with the client IP and the API attempted, delivered to CloudWatch Logs, S3 or Data Firehose. No additional cost, all Regions with MSK Provisioned except the European Sovereign Cloud. Small feature, disproportionately useful the first time you debug a permissions problem on a Kafka cluster.

IAM Identity Center: two steps toward easier multi-Region

Account access management became optional for new organization instances — when disabled, the service-linked role is not provisioned into member accounts, reducing exposure. Then a one-click multi-Region option arrived, which creates the customer managed multi-Region KMS key and replicates the instance for you, replacing a multi-step manual process. Both apply to new organization instances only.

Data and analytics

Glue Data Quality anomaly detection is now free

ETL anomaly detection moves to no additional cost, with improved prediction accuracy through observation mode. A price going to zero is the cheapest possible reason to revisit something you previously rejected on cost.

Config adds 15 resource types — and possibly to your bill

New coverage across Bedrock, OpenSearch Serverless, SageMaker, AppSync, Connect and Glue, usable with Config rules and aggregators. Worth noting: if you record all resource types, Config tracks these automatically. Broader governance coverage, and a cost increase nobody chose.

EMR on EC2 gains Spark Connect

Interactive Spark development from SageMaker notebooks and IDEs against persistent session contexts, rather than submitting jobs and waiting.

Everything else

Ranked Medium or below, listed for completeness and searchability.

ServiceWhat shipped
AWS TransformContinuous modernization GA — repo-wide technical debt analysis that opens pull requests; separately, post-launch migration actions now automate through Systems Manager
OrganizationsMaximum account quota and its utilisation now visible in Service Quotas, no support ticket needed. us-east-1 only
WAFMiggo Security managed rule groups for emerging threats and AI/ML application protection
S3S3 Vectors available in the European Sovereign Cloud (Germany)
RDSVisibility into storage volume initialization status after a restore — answers "why is my restored database slow?"
ElastiCacheGraviton4 M8g, R8g and C8gn nodes, up to 47% higher throughput and 43% lower P99 latency than the previous generation
Timestream for InfluxDBOn-demand and automated backup and restore, with incremental backup support
LambdaConsole-to-IDE integration extended to Kiro and Cursor
SESAn isBotEvent field distinguishes automated opens and clicks from human ones — email engagement metrics get meaningfully more honest
CognitoAvailable as a skill in the Agent Toolkit for AWS, so coding agents can set up and troubleshoot it

Beyond the announcements: blogs and events

The What's New feed is not the whole picture. AWS also publishes longer engineering write-ups on the News Blog, and event news lands separately again.

AWS News Blog, this week

Three posts, two of them deep dives on announcements listed above. Worth reading if either is relevant to you — they carry design detail the announcement pages do not.

Events and conferences

No event or conference announcements this week. Nothing in the What's New feed and nothing on the News Blog.

The one date worth holding: re:Invent 2026 runs 30 November to 4 December in Las Vegas, with early-bird registration open. I will not repeat that every week — it appears here because this is the first roundup, and again only when something about it actually changes.

What I would act on

Most weeks produce a handful of things worth doing something about now, as opposed to knowing about. This week, four.

  1. Check whether your Lambda estate can even use the bandwidth increase. If your functions run in a VPC — most enterprise ones do — the answer is no, and it is better to know that than to plan around it. If they qualify, the Service Quotas request is the blocker, and requests take time.
  2. Audit your Config recording scope. If you record all resource types, 15 new ones started being tracked this week without a decision from you. Worth confirming the cost impact rather than discovering it on the invoice.
  3. Look at your BYOIP RPKI posture, using the free tier. IPAM route discovery costs nothing and answers a question most teams cannot answer: are our advertised prefixes actually protected? The findings that tell you whether they are protected need Advanced Tier, but the inventory is free.
  4. If you run AWS Backup for S3, revisit your recovery runbook. "Restore and wait" may no longer be the first step for targeted recovery or investigation. Check the access-point deletion-protection interaction with your vault lifecycle before relying on it.

And one to watch rather than act on: Network Firewall Forward Proxy. Preview in one Region, but it is the launch most likely to change egress inspection design once it reaches GA.

Complete inventory: all 66 announcements

Everything AWS announced this week, in full, grouped by day. Nothing is omitted — regional expansions, marketplace changes and minor features are all here, because the point of this page is that you should not have to look anywhere else.

Each entry carries AWS's own one-line summary rather than my paraphrase, so you can trust it without taking my word for it, and every link goes to the official announcement. All 66 were checked and resolve.

Friday 07 August — 10 announcements

Thursday 06 August — 21 announcements

Wednesday 05 August — 8 announcements

Tuesday 04 August — 13 announcements

Monday 03 August — 14 announcements

AWS Weekly Intelligence collects everything AWS shipped in a week, ranked by whether it changes how you would design something. The daily series covers the most significant one in depth each day.

Every technical claim here is sourced from the AWS announcements linked above.

Topics: AWS Weekly Intelligence AWS

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent