Home› Blog› AWS Weekly Intelligence #5 - 31 August-4 September…
AWS Weekly Intelligence AWS

31 August – 4 September 2026

Seventy-two announcements across five working days, and seven security bulletins — nearly all of them in AWS's own developer tooling rather than in its services. The week gave agents a governance layer and then demonstrated why they need one.

Sep 5, 2026 21 min read
Verified against current vendor documentation on 5 September 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.
AWS Weekly Intelligence #5

5 September 2026 · Everything AWS shipped, 31 August – 4 September

On this page

The week in one paragraph

Seventy-two announcements, up from fifty-four, with Monday alone carrying twenty. The headline features were good and mostly quiet — Lambda SnapStart reaching container images, Aurora MySQL gaining delayed replication, AWS Agent Registry going generally available, Amazon Linux 2027 entering preview, and a ninth Graviton generation spreading across Regions. The thing that actually characterised the week was underneath all of that: seven security bulletins in five days, and almost none of them in an AWS service. The SageMaker Python SDK, the CodeCatalyst blueprints SDK, the FPGA development kit, ion-java, ion-c, and two AWS-published MCP servers. This was a bad week for the code AWS ships to your build machines, which is precisely the code most teams do not patch on a schedule. The same week, AWS shipped the catalogue and consent portal that agent tooling has been missing — and then published two bulletins showing what happens when an agent tool's guardrail is a list of things not to allow.

Covered in depth

Every working day produced a deep-dive. Each is linked with the detail the announcement itself left out.

NewsPostWhat the announcement left out
AWS Agent Registry reaches general availability #22 — The approval queue becomes an allowlist Only approved records are discoverable, and agents are among the readers — so the curator's queue is the list of tools an agent can find, and the reviewer is doing security work.
CVE-2026-83551, cleartext HMAC key in the SageMaker Python SDK #23 — Upgrading the SDK is only half the fix The fix is a scheme change, not a patch, so existing pipeline definitions keep the cleartext key until each is re-upserted. Every tool checks the SDK version; none inspects a pipeline definition.
Lambda SnapStart supports container image functions #24 — One snapshot becomes every environment Initialisation runs once and is copied, so unique IDs, secrets and the entropy behind pseudorandomness are duplicated. The failure appears at concurrency, not on the first call.
Aurora MySQL adds delayed and multi-source replication #25 — An hour of lag becomes a recovery window It is the only mechanism that survives a valid destructive statement — and it is configured by stored procedure only, so it is invisible to IaC and lost when a replica is rebuilt.
Four bulletins, two in AWS's own MCP servers #26 — The list of bad things was not complete A read-only mode enforced by a denylist of SQL. AWS's own remediation moves the guarantee to the database role, where being wrong costs nothing.

Seven bulletins, and where they were

This is the story of the week, and it is easier to see as a list than as prose.

DateBulletinComponent
1 SepCVE-2026-83551SageMaker Python SDK — cleartext HMAC signing key
2 SepCVE-2026-84851ion-c — uncontrolled recursion in the Ion reader
3 SepCVE-2026-85012CodeCatalyst blueprints SDK — OS command injection
3 SepCVE-2026-85028FPGA Development Kit — insecure temporary file permissions
4 SepCVE-2026-85654dynamodb-mcp-server — code injection in the CDK generator
4 SepCVE-2026-85781EFS CSI Driver — unverified access point ownership
4 SepCVE-2026-85786ion-java — incomplete fix for CVE-2026-75936
4 SepCVE-2026-85787postgres-mcp-server — incomplete disallowed-input list

Count the categories rather than the bulletins. One is in a driver. The other seven are in libraries, SDKs and developer tools that AWS publishes and that your build machines install — the SageMaker SDK, the CodeCatalyst SDK, the FPGA kit, both Ion parsers, and two MCP servers.

That distinction matters because of where the patching responsibility sits. An AWS service is patched by AWS. A pypi or npm package that AWS publishes is patched by you, on your schedule, if it is in your dependency scanning at all — and developer tooling routinely is not, because nobody classifies a code generator as production software. The CodeCatalyst and DynamoDB flaws both execute on a build host, which is a machine with deployment credentials.

Two of them are also worth reading as a pair, because they say the same thing. CVE-2026-85787 is an incomplete list of disallowed inputs in the SQL validation component, and CVE-2026-85786 is an incomplete fix for CVE-2026-75936. One enumerated the bad inputs and missed some; the other enumerated the cases to fix and missed some. There is a full write-up in #26, but the short version is that the durable fix is never a longer list.

Agents got a governance layer in the same week they needed one

Monday brought AWS Agent Registry to general availability — a private, governed catalog and discovery layer for agents, tools, skills, MCP servers, and custom resources within your organization — along with its integration into Amazon Quick. Tuesday added a managed consent portal to Bedrock AgentCore Identity. Wednesday brought MCP sync for Quick connectors. Friday added a serverless capability to the AWS MCP Server for Lambda functions.

Four announcements building the same thing: a place to register agent tooling, a way to consent to what it does, and a way to run it. That is what the ecosystem has been missing, and it arrived in one week.

It arrived alongside two bulletins in AWS's own MCP servers, which is a coincidence of timing with a useful lesson in it. A registry answers which tools exist and who approved them. It does not answer what happens when an approved tool's guardrail turns out to be a denylist. Both questions need answering, and the second is the one the week actually tested.

A processor generation, rolling

Graviton5 instances spread noticeably. R9g and R9gd memory-optimised instances became generally available on Monday, with a News Blog post of their own. C9g and C9gd reached Tokyo and M9g and M9gd four more Regions on Thursday, and C8g added Regions on Friday.

Nothing here needs action this week. It is worth noting only because instance-family expansion is the least interesting news to read and the most reliable signal of where price and performance are going — a generation reaching R, C and M families across several Regions in one week is a rollout, not a launch.

Databases and lifecycle

Aurora MySQL had the week's most consequential database change: 8.4.8 became generally available, and with it multi-source replication and delayed replication. Delayed replication is covered in #25 and is the rare feature that addresses a failure nothing else does — a valid, correctly replicated, destructive statement.

Elsewhere: DocumentDB gained direct major version upgrades to 8.0, removing a dump-and-restore from a migration path. Redshift added Apache Iceberg v3 tables and IAM Identity Center authentication with enhanced VPC routing, and rg.large instances now support single-node clusters. AWS Config added 60 new resource types, which is worth a moment's thought for anyone recording all supported types: those start being recorded automatically, and the bill moves without anyone deciding it should.

The lifecycle item is Amazon Linux 2027 in public preview. No end-of-life dates are attached yet, so there is nothing to plan around this week — but a new major release is what eventually starts the clock on the current one, and that is the sort of date worth capturing when it appears rather than when it is close.

Deployments and failure handling

A cluster of small changes with a common theme: making failure and deployment less noisy.

  • CloudWatch alarms gained warm-up periods, which finally separates "do not alarm while this is starting" from "raise the evaluation threshold", two things teams have been conflating by lengthening evaluation periods and losing detection latency in the process.
  • ECS introduced Early Success Criteria for service deployments, and separately Managed Daemons now support non-critical daemons — a sidecar that can fail without taking the task with it.
  • Gateway Load Balancer supports TCP Reset, so appliance failover stops waiting for connection timeouts.
  • Kinesis Data Streams added a dry run to validate API requests without executing them, which is quietly useful for testing IAM policies against real calls.
  • Lambda recursive loop detection reached all commercial Regions, and Transfer Family SFTP Connectors can now continue transfers during credential rotation.

None of these is a headline. Together they are the kind of week that makes an on-call rotation measurably better six months later.

What I would act on

  1. Upgrade the two MCP servers, then remove the reason it mattered. postgres-mcp-server to 1.1.7 and dynamodb-mcp-server to 2.1.6, on CI runners as well as laptops. Then give the postgres server a database role holding only CONNECT, USAGE and SELECT, which is AWS's own recommendation and the part that survives the next bulletin.
  2. Finish the SageMaker SDK remediation if you started it. The upgrade to 3.11.0 or 2.256.0 is half of it; existing pipeline definitions keep the cleartext symmetric key until each one is re-upserted, and no dependency scanner will tell you that.
  3. Put AWS-published developer tooling into your dependency scanning. Seven of this week's eight bulletins were in libraries and tools rather than services. If your SBOM covers application dependencies but not the SDKs and generators your pipeline installs, this week is the argument for widening it.
  4. Decide whether a delayed Aurora replica is worth an instance to you. The test is simple: if someone dropped a table at 14:12 and you noticed at 14:40, what is your RTO today? If the answer is hours, this converts it to minutes.
  5. Check what AWS Config's 60 new resource types do to your bill. An account recording all supported types picked them up automatically this week. That is the right default and it is still a cost change nobody approved.

Complete inventory: all 72 announcements

Every AWS What's New announcement published between 31 August and 4 September 2026, grouped by day, taken from the raw feed rather than summarised. Each links to AWS's own page, and every link was checked.

Friday 04 September — 9 announcements

Thursday 03 September — 18 announcements

Wednesday 02 September — 11 announcements

Tuesday 01 September — 14 announcements

Monday 31 August — 20 announcements

Looking for one service rather than a whole week?

Every AWS, Azure and Google Cloud announcement is browsable by service and date, each linked to the vendor’s own page — and the other weekly roundups are collected in one place.

Browse announcements →
Topics: AWS Weekly Intelligence AWS

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent