Cut Cross‑AZ Costs and Improve Agent Observability: Key AWS and Bedrock Updates for Production AI

What Happened

• Amazon ECS Service Connect added zone‑aware routing to preferentially route service‑to‑service traffic to endpoints in the same Availability Zone; enabled by default for new services and requires a one‑time redeploy for existing services [1].
• AWS Billing now supports configuring automatic credit memo application preferences for customers who pay by electronic funds transfer (configurable in the Billing and Cost Management console) [2].
• Amazon RDS for MySQL added community MySQL 9.7 to the Amazon RDS Database Preview Environment (preview instances retained up to 60 days; snapshots usable only within preview) [3].
• Amazon Bedrock AgentCore now consolidates traces, prompts, structured logs and stdout into a single per‑agent CloudWatch log group; enablement for new agents is default and existing agents require UNIFIED_TRACES_DESTINATION_ENABLED=true plus ADOT v0.17.1+ [4].
• Amazon CloudWatch Logs began ingesting Application Load Balancer access, connection and health‑check logs as vended logs, enabling Logs Insights, metric filters and Live Tail; delivery options include CloudWatch Logs, Kinesis Data Firehose or S3 (optional Parquet conversion) [5].
• Amazon Elastic VMware Service (EVS) expanded to Asia Pacific (Seoul), Europe (Zurich), and Europe (Stockholm), running VMware Cloud Foundation 9.0/9.1 on EC2 bare‑metal (Nitro) [6].
• Claude Sonnet 5 (and Claude Opus 4.8) became available on Amazon Bedrock in AWS GovCloud (US) via bedrock‑runtime and bedrock‑mantle endpoints; Sonnet 5 is optimized for coding, agentic tasks and knowledge work [7].
• Amazon SageMaker AI Inference added G7e instances in Seoul, London and Tokyo (up to 8 NVIDIA RTX PRO 6000 Blackwell SE GPUs — 96 GB each — and up to 768 GB GPU memory; up to ~2.3× perf vs G6e) for single‑node inference of medium‑to‑large LLMs (FP8 up to ~70B) [8].
• Amazon SageMaker AI Inference added G6 instances in AWS GovCloud (US‑East) (up to 8 NVIDIA L4 GPUs, 24 GB each) for generative AI inference with GovCloud compliance/residency [9].
• AWS Wickr introduced a managed Data Retention Service (opt‑in, Premium customers) for serverless archiving of direct and group conversations while preserving Wickr’s end‑to‑end encryption model [10].

Why It Matters to Businesses

• Lower operational cost and latency: Zone‑aware ECS routing reduces cross‑AZ traffic (both latency and data transfer charges) without code changes, helping reduce cloud bills for chatty microservice meshes [1].
• Faster agent debugging and scoped telemetry: Unified per‑agent log groups in Bedrock simplify correlation of prompts, traces and outputs and enable per‑agent IAM and CMK scoping for exports and compliance [4].
• Improved network observability: ALB logs in CloudWatch accelerate troubleshooting via Logs Insights and Live Tail; choosing delivery target (CloudWatch vs S3/Parquet) affects cost and analysis flexibility [5].
• Inference scaling and workload targeting: G7e expands single‑node inference for larger LLMs (FP8 support up to ~70B), reducing need for multi‑node orchestration; G6 in GovCloud meets government compliance needs with optimized price‑performance [8][9].
• Compliance and retention control: Wickr’s managed retention enables enterprise archiving and auditing workflows while preserving encryption guarantees; billing preference controls reduce manual invoice adjustments [10][2].
• Migration and residency: EVS region expansion and Bedrock GovCloud model availability give more options for data‑residency, sovereign workloads and VMware‑to‑cloud migrations [6][7].
• Preview constraints to plan for: RDS MySQL 9.7 in the preview environment has 60‑day retention and snapshot portability limits—useful for testing, not for production cutover planning yet [3].

Kimbodo Engineering Perspective

These updates are incremental but operationally meaningful. Our practical takeaways:

• Zone‑aware ECS routing is a low‑friction optimization: enablement is default and there’s no application change, but remember the one‑time redeploy requirement for existing services and validate traffic patterns with VPC Flow Logs that include AZ metadata before and after the change [1].
• Unifying Bedrock AgentCore telemetry into single log groups closes a major DevOps gap for multi‑agent debugging and supports per‑agent keyable exports, but it shifts the boundary for log access — enforce strict IAM and KMS policies at the log‑group level and upgrade ADOT to v0.17.1+ to avoid telemetry loss [4].
• ALB logs in CloudWatch are great for real‑time ops, but vended log billing and per‑GB processing (Parquet conversion charges where used) can be expensive; for long‑term ML training or compliance archives prefer S3 with Parquet while using CloudWatch for incident response [5].
• Choosing G7e vs G6 (or smaller GPUs) is now a capacity planning decision: use G7e for single‑node serving of large models to reduce networking complexity; validate model precision (FP8) impact on quality and test memory residency on the 96 GB GPU before consolidating nodes [8][9].
• Preview releases (MySQL 9.7) are valuable for early compatibility testing, but treat preview snapshots and instances as ephemeral—do not rely on them for long‑term state or compliance evidence [3].
• Managed data retention in end‑to‑end encrypted systems (Wickr) eases compliance but requires clear operational controls around export access, retention windows, and legal holds to avoid inadvertent data exposure [10].

How We Would Implement It

ECS Service Connect — Enable Zone‑Aware Routing

• Audit current cross‑AZ traffic using VPC Flow Logs with AZ metadata; baseline cross‑AZ egress costs and latency.
• For existing services, schedule a one‑time redeploy during a maintenance window to activate zone‑aware routing; validate post‑deploy flows and failover behavior [1].
• Monitor with CloudWatch and Flow Logs; create alerts for unexpected cross‑AZ spikes or imbalance.

Bedrock AgentCore — Consolidated Telemetry

• For new agents: rely on default unified log groups. For existing agents: set UNIFIED_TRACES_DESTINATION_ENABLED=true and upgrade ADOT to v0.17.1+ in the runtime [4].
• Provision per‑agent CloudWatch log groups and attach customer‑managed KMS keys and least‑privilege IAM roles; configure subscription filters to forward telemetry to Kinesis or S3 for long‑term storage/analysis.
• Integrate a per‑agent observability playbook (traces, prompts, outputs) into incident runbooks to streamline debugging.

ALB Logging and Storage Strategy

• Enable ALB log delivery to CloudWatch for real‑time troubleshooting and Live Tail during incidents; configure metric filters for common error patterns [5].
• Set up parallel delivery to S3 (Parquet conversion if you need columnar analytics) for cost‑efficient long‑term retention and ML training; account for Parquet conversion cost where applicable ($0.035/GB in us‑east‑1 as an example) [5].

SageMaker Inference — Instance Selection and Validation

• Use G7e for single‑node deployments of large models (test FP8 performance and model accuracy), instrument GPU memory and latency, and enable EFA/GPU‑aware networking for multi‑node fallback [8].
• For GovCloud deployments or 24 GB memory budgets select G6 and validate compliance controls and pricing before scaling [9].

RDS MySQL 9.7 Preview

• Deploy non‑production workloads in the RDS Database Preview Environment (US‑East (Ohio) billing parity with production) and run compatibility and performance tests; export critical results because preview snapshots are not portable outside the preview [3].

Wickr Data Retention and Billing Preferences

• For organizations requiring archival audit trails, opt into Wickr’s managed Data Retention Service and align retention windows with legal and compliance teams; integrate with SIEM and eDiscovery flows [10].
• Configure automatic credit memo application preferences in Billing console to match AR workflows and reduce invoice‑processing drift [2].

EVS Region Expansion and Bedrock GovCloud Models

• If data residency or low latency drives region selection, evaluate EVS in the newly added regions and Bedrock GovCloud models (Claude Sonnet 5) as candidates for migrating VMware workloads and hosting sensitive inference workloads [6][7].
• Plan network, DR and licensing considerations for VCF 9.x running on Nitro bare‑metal instances.

Risks, Costs and Security

• Cost risks: CloudWatch vended log ingestion and Live Tail can be costly at scale; Parquet conversion and G7e/G6 instance pricing are non‑trivial — run cost projections and set budget alerts [5][8][9].
• Operational risks: The ECS redeploy requirement can cause transient disruption; test in staging and monitor AZ capacity to avoid overloading healthy AZs [1].
• Compliance/security: Unified Bedrock agent log groups centralize telemetry and therefore widen blast radius — enforce per‑log‑group IAM, KMS CMKs and audit logging on access; control export subscriptions carefully [4].
• Data residency and model governance: Using GovCloud endpoints (Bedrock models, G6) and EVS requires validating contractual and technical data‑residency guarantees and vendor model data handling [6][7][9].
• Encryption and retention: Wickr’s retention service preserves encryption guarantees but introduces a retained copy for auditing — ensure legal holds, retention policies, and access controls are properly governed [10].
• Preview limitations: RDS MySQL 9.7 preview artifacts are ephemeral and not production‑durable; do not use preview snapshots as final backups [3].

Sources

1. [1] Amazon ECS Service Connect now supports Zone-Aware routing
2. [2] AWS now supports automatic credit memo application preferences
3. [3] Amazon RDS for MySQL supports MySQL 9.7 in Amazon RDS Database Preview Environment
4. [4] Amazon Bedrock AgentCore now delivers unified observability with traces and logs in a single log group
5. [5] Amazon CloudWatch Logs now supports Application Load Balancer logs
6. [6] Amazon EVS is now available in additional Regions
7. [7] Claude Sonnet 5 is now available on Amazon Bedrock in AWS GovCloud (US)
8. [8] Announcing region expansion of G7e instances on SageMaker AI inference
9. [9] Announcing region expansion of G6 instances on SageMaker AI Inference
10. [10] AWS Wickr announces Data Retention Service feature