What Happened
Two AWS product updates were announced on 2026-08-07 and became effective in AWS regions starting 2026-08-08:
- Amazon EC2 R8i and R8i‑flex instances (Europe – Milan): AWS launched the R8i family and the first memory‑optimized Flex family (R8i‑flex) in the Europe (Milan) region, powered by custom Intel Xeon 6 processors. AWS claims up to 15% better price‑performance, 2.5× memory bandwidth versus prior Intel instances, and roughly 20% higher overall performance than R7i, with workload‑specific gains (PostgreSQL up to 30%, NGINX up to 60%, AI recommender models up to 40%). R8i provides 13 sizes (including two bare‑metal and a new 96xlarge); R8i‑flex supports common Flex sizes (large to 16xlarge). R8i is SAP‑certified (142,100 aSAPS). Purchase options include Savings Plans, On‑Demand and Spot [1].
- Amazon VPC IPAM — BGP route protection monitoring and delegated RPKI for BYOIP: VPC IP Address Manager (IPAM) now supports BGP route protection monitoring (shows RPKI validity, ROA strength and route‑overlap detection) and delegated RPKI management for Bring‑Your‑Own‑IP (BYOIP) prefixes. After a one‑time setup with your Regional Internet Registry (ARIN/RIPE/APNIC/LACNIC), IPAM can automatically create and renew ROAs across accounts and regions; feature is available in all commercial AWS Regions except AWS GovCloud (US) and China (Beijing/Ningxia) [2].
Why It Matters to Businesses
These two updates address immediate operational needs:
- Cost‑effective large memory/CPU capacity: R8i and R8i‑flex let enterprises reduce cost per GB and improve throughput for memory‑heavy databases, in‑memory caches, large ML inference/recommender workloads, and SAP systems that demand certified hardware. The Flex variant offers more granular sizing to avoid overprovisioning.
- Improved routing security and operational automation for BYOIP: Delegated RPKI and central route monitoring reduce the risk of IP prefix hijacks and automate ROA lifecycles across accounts and regions, which is critical for enterprises that bring their own IP space to the cloud and run multi‑account networking at scale.
Kimbodo Engineering Perspective
Practical trade‑offs and judgments we make when adopting these features:
- Benchmark first, trust second: AWS performance claims are useful but workload‑specific. Measure PostgreSQL OLTP, NGINX/TCP stack, and your recommender/inference pipelines with realistic data and concurrency to validate the advertised gains before fleet changes.
- Choose R8i vs R8i‑flex by workload predictability: Use R8i (including bare‑metal/96xlarge) where high per‑CPU performance or SAP certification matters. Use R8i‑flex where memory footprint is dominant but peak CPU needs are modest — the Flex sizes reduce idle memory waste and lower cost.
- Operational complexity vs security for delegated RPKI: Delegated RPKI reduces manual ROA management but introduces dependency on RIR delegation and robust identity/IAM controls. It should be paired with monitoring, alerting, and least‑privilege roles to avoid accidental ROA changes or outages.
- Region and compliance constraints: R8i availability in Milan is useful for EU data locality or latency requirements, but you must verify region parity if you have multi‑region needs. The IPAM features exclude GovCloud and China; accounts subject to those regions require alternate RPKI strategies.
How We Would Implement It
Adopting R8i and R8i‑flex
- Run a short, reproducible benchmark suite in the target region (Milan): pgbench for PostgreSQL, wrk/ab or httperf for NGINX, and your production model inference/recommendation tests. Compare R7i, R8i (multiple sizes including 96xlarge), and R8i‑flex to measure cost‑performance [1].
- Create hardened AMIs for the chosen instance types with tuned kernel and memory settings, NUMA-aware placement, and any Intel microcode updates required by the Xeon 6 platform.
- Use mixed‑instance Auto Scaling groups with capacity‑optimized Spot allocation and on‑demand fallbacks. For long‑running SAP workloads, favor R8i bare‑metal or large reserved capacity and Savings Plans; measure aSAP requirements against the R8i SAP certification [1].
- Validate licensing, virtualization and telemetry (CloudWatch, X‑Ray) and run soak tests at target load. Automate deployment via IaC (Terraform/CloudFormation) and CI pipelines for AMI baking.
Enabling IPAM Delegated RPKI and BGP Monitoring
- Inventory BYOIP prefixes and mapping to AWS accounts/regions. Identify stakeholders and establish an RIR relationship (one‑time delegation required with ARIN/RIPE/APNIC/LACNIC) [2].
- Perform a test delegation for a non‑production prefix: configure IPAM delegated RPKI, verify automatic ROA creation, and simulate common scenarios (ROA expiry, overlapping prefixes, ROA misconfiguration) to validate alerts and remediation paths [2].
- Integrate IPAM monitoring into your observability stack: forward BGP route‑protection events and ROA validity/strength metrics to CloudWatch/Datadog/Splunk and create automated runbooks (SNS → Lambda/Step Functions) for remediation.
- Harden cross‑account permissions: create narrowly scoped IAM roles for IPAM actions, require MFA and approval workflows for any manual ROA changes, and store RPKI delegation credentials in secure secrets management with audit logging.
- Operationalize into CI/CD: treat ROA lifecycle as code where possible — include ROA creation/updates in provisioning templates and test renewals during periodic maintenance windows.
Risks, Costs and Security
- Cost considerations: New instance families usually have different on‑demand and spot pricing; run TCO models including Savings Plans or Reserved usage for steady state. R8i‑flex can lower memory waste but may complicate instance sizing decisions. IPAM RPKI features may carry per‑region pricing — consult the IPAM pricing page when modeling costs [2].
- Operational risk — ROA misconfiguration: Incorrect ROAs can cause legitimate routes to be rejected. Mitigate with staged rollouts, canary prefixes, alerting on ROA validity changes, and documented rollback procedures before enabling automatic ROA changes.
- Delegation and trust dependencies: Delegated RPKI ties your ROA lifecycle to RIR processes and to AWS’s delegated management. Ensure clear authority boundaries, key‑management policies, and an incident plan if delegation needs revocation or emergency modification.
- Region and compliance constraints: R8i availability and IPAM features vary by region. For regulated workloads in GovCloud or China regions, verify alternate plans for compute sizing and RPKI management because these features are excluded there [1][2].
- Security controls: Enforce least‑privilege IAM for IPAM operations, enable CloudTrail for all IPAM/BGP and EC2 actions, and restrict who can change AMIs or instance launch configurations. Maintain a separate emergency access process for ROA and routing changes.
Sources: AWS announcements for EC2 R8i/R8i‑flex and Amazon VPC IPAM BGP route protection / delegated RPKI [1][2].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice. Wondering what it would cost for your organization? Get a preliminary range, timeline and architecture in about a minute.
