Home› Blog› AWS Weekly Intelligence #15 - 9-13 November 2026
AWS Weekly Intelligence AWS

AWS Weekly Intelligence #15 - 9-13 November 2026

Nov 14, 2026 25 min read
Verified against current vendor documentation on 14 November 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.

Seventy-seven announcements across five working days — the busiest week in this series so far. The flagships are agent infrastructure, but the thread that runs through the whole week is narrower and more useful: six separate launches that let an identity, a secret, a grant or a machine cross a boundary that previously needed custom code on both sides.

On this page

The week in one paragraph

Tuesday and Thursday tied for the heaviest day at nineteen announcements each, Monday brought seventeen, Wednesday twelve and Friday ten — seventy-seven in total, over fifteen a day. Agent infrastructure was the loudest theme: the next-generation AgentCore runtime became the default for new runtimes, a Web Search API reached general availability, AgentCore Identity started accepting OAuth 2.0 discovery URLs, and the DevOps Agent appeared inside the EC2 Image Builder console. Kubernetes had an unusually substantial week too, with Nitro Sandboxes for hardware-isolated pods, Dynamic Resource Allocation in EKS Auto Mode and Karpenter, security groups for Pods in Auto Mode, and a larger etcd database on the biggest Provisioned Control Plane tiers. Underneath both, the identity and cross-boundary thread described below ran from Monday to Friday. Databases shipped steadily rather than spectacularly — Graviton5 instances for Aurora and RDS, DocumentDB 8.0.3 with post-quantum TLS, two OpenSearch resilience features — and the single most broadly applicable launch of the week was an operations one that nobody will headline: account-level retention policies for CloudWatch Logs.

Covered in depth this week

Five dailies, one per working day. Four covered an announcement from the day before; Friday's AgentCore Identity launch is covered by today's daily, which publishes alongside this roundup, so the window closes cleanly with nothing orphaned on either edge.

PostAnnouncementWhat the announcement did not say
#72 Nitro Sandboxes on EKS, ECS and EC2 (Mon) The memory is hardware-isolated and the network stack is shared — isolation is per sandbox, not per network path
#73 CloudWatch PromQL alarms support EC2 and Application Auto Scaling (Tue) Bringing your own alarm means owning its silence — a PromQL alarm with no data is an alarm that scales nothing
#74 Cloud WAN supports Flow Logs (Wed) The Cloud WAN metadata — segment, Region, attachment — is documented as best-effort approximation, and subscriptions can only be created in a single home Region
#75 EC2 Image Builder console integrates the DevOps Agent (Thu) The documentation says the AI does not create or modify resources — it drafts values, validates them with a dry run, and a human submits the form
#76 AgentCore Identity supports OAuth 2.0 discovery URLs (Fri) The change is one alternation in a validation pattern, and the authorizer verifies every field you configure — so each one you add narrows access rather than widening it

The week the boundaries got doors

Six launches, six different boundaries, and in each case the previous answer was a piece of undifferentiated glue that somebody in your organisation wrote and now maintains.

The partition boundary. “AWS Security Token Service (AWS STS) now lets your workloads use their AWS Identity and Access Management (IAM) identity in one partition to get temporary credentials for an IAM role in a different” partition. This is the most structurally significant item of the week and it will get the least attention, because most accounts never touch a second partition. For anyone operating across commercial and GovCloud, or commercial and China, the partition has been an identity wall: separate IAM, separate credentials, and a long-lived secret somewhere in the middle to bridge it. Removing that removes a category of stored credential.

The delegation boundary. “Amazon Cognito now supports OAuth 2.0 token exchange (RFC 8693).” Nine words for a specification that exists precisely to let one token be traded for another with a different audience or scope — the standard answer to a service that must call a downstream service as the user. The hand-rolled version of this is a token-minting Lambda, and it is usually the least reviewed code in the system.

The account boundary, twice. “AWS Secrets Manager now supports cross-account replication, enabling you to maintain a synchronized copy of a primary secret in a secondary AWS account for cross-account access, backup, and disaster recovery” — replacing the sync Lambda that nearly every multi-account estate has written at least once. And “Amazon S3 Access Grants can now discover and list all your grants across multiple AWS accounts with a single API call, eliminating the need to query each account separately”, which turns an audit question from a fan-out script into a request.

The standards boundary. AgentCore Identity accepting OAuth 2.0 authorization server metadata, covered in #76. An authorization server that was already OAuth 2.0 compliant was excluded by the name of the document it published; now it is not.

The cloud boundary. “AWS Systems Manager Cloud Connector now extends simplified multicloud onboarding support to Google Cloud”, for centralised management of existing Google Cloud VMs. Whatever one thinks of managing another provider's machines from here, it is a boundary that used to require an agent installation story of your own.

What makes this a theme rather than a coincidence is the shape of the work it removes. Every one of these six replaces code whose only purpose was to carry something across a line AWS drew, written by people who did not want to write it, reviewed less often than the code that does the actual work, and holding a credential or a trust relationship while it waits.

The rest of the week, by domain

Operations and observability

“Amazon CloudWatch Logs now supports account-level retention policies, so you can use a single policy to set how long log data is kept across all or subset of log groups in an AWS account.” This is the week's best value per minute of effort. Retention set per log group is the most common cause of accidental log spend and of accidentally short-lived evidence; one policy fixes both, and it pairs directly with the account-level index policies this week's architecture post covers.

“Amazon Athena now offers system tables which automatically capture your usage data and make it available for observability, usage analysis, and audit use cases” — query-level attribution for a service whose costs are notoriously hard to apportion. Accelerated Compute Insights arrived for CloudWatch, and “AWS Emulator is now available for building and testing AWS applications locally”, which deserves a closer look than a one-line summary allows.

Containers and compute

A genuinely strong week. “Amazon EKS Auto Mode now supports security groups for Pods, letting you apply dedicated Amazon EC2 security group rules to individual Pods” closes one of the better-known Auto Mode gaps. “Amazon Elastic Kubernetes Service (Amazon EKS) now offers a larger 24 GB etcd database, up from 16 GB, for 4XL and 8XL Provisioned Control Plane clusters” — eight more gigabytes for the clusters large enough to have been feeling the previous ceiling. Dynamic Resource Allocation reached Auto Mode and Karpenter for NVIDIA GPUs and EFA devices, AWS Batch gained Linux capabilities, seccomp profiles and pod-level settings on EKS, and “AWS Lambda MicroVMs now supports the x86 CPU architecture, so you can run your existing x86 applications, tools, and software dependencies without recompiling or porting them”.

Networking

“Today, AWS announces next-generation firewall (NGFW) policy for AWS Network Firewall, a new policy model that provides security teams with a simpler policy structure and increased rule capacity” is the item to read properly — a new policy model in a firewall is rarely just a convenience. The detail that makes it one: “Firewall and IPS rules each have their own capacity, so you no longer trade one off against the other.” Route 53 had three launches, of which “record set protection, which helps DNS administrators prevent accidental changes to critical DNS records in their hosted zones” is the one to turn on this week. Cloud WAN added “BGP communities on Direct Connect attachments, enabling advanced routing controls for enterprise hybrid networks”, a day after its flow logs launch, and Network Security Manager reached the AWS European Sovereign Cloud.

Databases and search

Graviton5-based R9g instances arrived for Aurora and RDS, and M8id and R8id for RDS for SQL Server. “Amazon DocumentDB (with MongoDB compatibility) 8.0.3 adds hybrid post-quantum key exchange for TLS, wildcard indexes, the $unionWith aggregation stage, and new change stream events” — post-quantum TLS appearing in a database release note is worth noticing. DocumentDB Serverless claims “up to 35% higher throughput with the launch of platform version 4”. OpenSearch had the best resilience week: “managed cross-Region disaster recovery” and “clone-based upgrades, which let you validate a new OpenSearch version alongside your current one and cut over to it only when you're satisfied” — the second being the kind of feature you only appreciate after an upgrade has gone badly. And “Amazon ElastiCache Serverless for Valkey now supports vector, full-text, and hybrid search, along with aggregations”, which keeps narrowing the gap between a cache and a search engine.

Data and analytics

“AWS Glue now supports 100 new native connectors that simplify access to data in popular SaaS and REST API-based applications”, and Glue added automatic version upgrades for Spark jobs. MWAA had four launches across the week — fine-grained access control with IAM Identity Center, the native Airflow UI on MWAA Serverless, and DuckDB operators on both MWAA and MWAA Serverless. OpenSearch Serverless added intelligent ingestion for time series collections.

Resilience and storage

“AWS Backup logically air-gapped vault now supports Amazon EBS Snapshots Archive”, extending the strongest isolation Backup offers to the cheapest snapshot tier, and Backup added resource modifiers for EKS restores. The cost item of the week: “Amazon FSx for Lustre is reducing the minimum provisioned throughput capacity and metadata IOPS on Intelligent-Tiering file systems by 75%”, which moves Intelligent-Tiering Lustre from a large-estate option to something a small team can justify.

Security and governance

“Amazon Cognito now supports session management for user pools, giving you visibility into and control over the sessions your users establish when they sign in to your applications” — the ability to see and end sessions, which is the first thing asked for during a credential incident and has been awkward to answer. And “AWS Security Hub CSPM now supports AWS Organizations declarative policies”, continuing the move of guardrails from detection into prevention.

Agents and AI

Beyond the AgentCore items covered above: “Today, AWS announces the general availability of the Web Search API on Amazon Bedrock AgentCore, which lets you search the web with a single API call”, and “Starting today, new runtimes in Amazon Bedrock AgentCore use the next generation of AgentCore runtime by default” — a default change is the kind of announcement worth reading twice if you have runtimes in flight. On models: Claude Fable 5.2 landed on AWS and in GovCloud (US), Claude Mythos 5.2 reached eligible GovCloud customers, Grok 4.7 arrived on Kiro in GovCloud, DeepSeek-V4 and Ornith models appeared on SageMaker JumpStart, and Bedrock added a bedrock-runtime endpoint for Daybreak models.

What I would act on

Set an account-level log retention policy today. One policy, account-wide or by subset, and it ends the per-log-group drift that quietly costs money in one direction and destroys evidence in the other. It is the cheapest thing in this roundup and it applies to every account.

Turn on Route 53 record set protection for your critical zones. Accidental DNS change is a recurring cause of self-inflicted outage, and this is a flag on the records that matter rather than a process change.

If you run multi-account secrets sync, read the Secrets Manager replication docs and plan the deletion of your own. Replacing a bespoke sync Lambda with a managed replica removes code, an execution role and a failure mode.

If you are on EKS Auto Mode, review whether security groups for Pods changes your network design. Teams that stayed on managed node groups specifically for per-Pod security groups now have one fewer reason to.

If you operate across partitions, read the STS cross-partition federation documentation even if you have no immediate use. It changes what is architecturally possible, and the designs it makes available are the ones currently held together by a stored credential.

Complete inventory

All 77 announcements from the AWS What’s New feed for 9–13 November 2026, with AWS’s own one-line summaries. Generated by build_weekly_inventory.py, which validated every link: 77 announcements, 77 unique links, all returning 200.

Friday 13 November — 10 announcements

Thursday 12 November — 19 announcements

Wednesday 11 November — 12 announcements

Tuesday 10 November — 19 announcements

Monday 09 November — 17 announcements

Looking for one service rather than a whole week?

Every AWS, Azure and Google Cloud announcement is browsable by service and date, each linked to the vendor’s own page — and the other weekly roundups are collected in one place.

Browse announcements →
Topics: AWS Weekly Intelligence AWS

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent