New AI and AWS Product Updates You Need to Act On — model versions, API changes, and deployment steps

What Happened

• Amazon Bedrock added IAM principal cost-allocation for the bedrock-mantle endpoint — extend existing bedrock-runtime support so you can attribute inference costs to IAM users/roles and export caller identity in CUR 2.0 for line-item analysis [1]. (Announced 2026-08-11.)
• SageMaker JumpStart added new large models: NVIDIA LocateAnything-3B; Qwen-AgentWorld-35B-A3B; and Qwen3.5-122B-A10B (122B total params, 10B active per token, 262K context) — deployable via the SageMaker console or Python SDK [2]. (Announced 2026-08-11.)
• NVIDIA Nemotron 3.5 Lightning added to SageMaker JumpStart — a 30B-parameter hybrid MoE with ~3B active per pass, up to ~410 tokens/sec, ~30% faster task completion vs comparable models, and support for up to 1M-token context via DFlash speculative decoding [3]. (Announced 2026-08-11.)
• AWS Glue now offers one-click access to SageMaker Unified Studio from Glue (and from S3 Tables, Athena, EMR, Redshift consoles), including inline IAM policy setup to open SageMaker Unified Studio with the same role [4]. (Announced 2026-08-11.)
• AWS Secrets Manager added managed external secrets for Jenkins API Tokens and SonarQube tokens with built-in rotation types (self-rotation and admin-assisted) — no custom rotation code required [5]. (Announced 2026-08-11.)
• Amazon Connect Customer launched a Cases performance dashboard exposing volumes, avg resolution time, first-contact resolution %, and SLA achievement with dimensional breakdowns (regions listed in vendor docs) [6].
• AWS Clean Rooms can now export privacy-enhanced SQL analysis logs (Spark execution details) to S3; collaboration owners must grant export permission to members [7].
• Amazon RDS for MariaDB now supports MariaDB 12.3 (LTS) and minor 12.3.2 — adds TO_DATE() compatibility, IS JSON predicate, and optimizer improvements; upgrade options: Blue/Green, in-place, snapshot restore, or AWS DMS migration [8]. (Announced 2026-08-11.)

Why It Matters to Businesses

• Cost visibility and chargeback: Bedrock IAM principal allocation lets finance and engineering teams produce accurate showback and per-team inference cost reports, reducing billing disputes and enabling optimization by workload owner [1].
• Faster access to new models: JumpStart availability for LocateAnything, Qwen variants, and Nemotron 3.5 Lightning shortens the path from evaluation to production for multimodal, agentic, and high-throughput use cases — reducing integration overhead vs self-hosting third-party weights [2][3].
• Operational efficiency: Glue → SageMaker workflow integration speeds data science iteration (catalog browsing → notebooks → pipelines) and removes friction in permission setup, reducing time to prototype and deploy models on cataloged data [4].
• Secrets automation and security posture: Managed external secret rotations for Jenkins and SonarQube cut developer ops work and lower secret exposure windows compared with manual rotations or custom scripts [5].
• Compliance and troubleshooting: Clean Rooms log exports let collaborators diagnose query skew and performance problems without exposing raw data, accelerating joint analytics and reducing cost overruns from inefficient queries [7].
• Database modernization: RDS support for MariaDB 12.3 simplifies migrations from Oracle (TO_DATE compatibility) and improves JSON handling and optimizer behavior — valuable for lift-and-shift and modern app migrations [8].

Kimbodo Engineering Perspective

These releases prioritize operational observability, managed infrastructure, and higher-efficiency model options. From our experience building production AI systems, three practical trade-offs matter:

• Choose active-parameter efficiency for production agents: Models with large parameter counts but low activated parameters (Nemotron, Qwen hybrid architectures) can deliver throughput and cost advantages, but require careful benchmarking on your workload and attention to long-context memory requirements [2][3].
• Integrate cost attribution early, but with governance: Enabling IAM principal attribution in Bedrock-mantle provides precise cost signals — but tagging hygiene, IAM governance, and CUR schema design are prerequisites to reliable reports [1].
• Prefer managed rotations and cataloged access: Using Secrets Manager managed rotations and Glue→SageMaker linkage reduces custom code and privilege sprawl. However, automation must be accompanied by testable rollback and incident playbooks to avoid production outages when tokens are rotated [4][5].

How We Would Implement It

1) Enable Bedrock IAM principal cost allocation

• Action steps: Tag IAM users/roles with team/project/cost-center attributes → activate those tags in AWS Billing and Cost Management → enable IAM principal attribution for bedrock-mantle in the Bedrock console or via API → configure CUR 2.0 to include caller identity fields and export to an S3 billing bucket [1].
• Validation: Run sample inference workloads, verify Cost Explorer reports and line-item CUR exports include IAM principal columns, and build automated cost dashboards (lambda/Glue → Athena) for showback.

2) Evaluate and deploy JumpStart models (LocateAnything, Qwen, Nemotron)

• Quick start: Use SageMaker JumpStart via console or Python SDK to spin up a test endpoint or batch transform for a representative dataset; run functional and performance tests (latency, throughput, token cost) [2][3].
• Infrastructure choices:
  • For latency-sensitive inference: provision multi-GPU instances (A100/H100-class) with model parallelism or use SageMaker multi-model endpoints where applicable.
  • For high-throughput agents and long context (Nemotron): evaluate DFlash speculative decoding and streaming strategies; architect a checkpointed context store (Redis or S3-backed chunking) and token-budget guardrails to control costs [3].
• Productionization: containerize inference with Triton or optimized server images, add autoscaling, request tracing, per-principal request logging, and cost telemetry tied to Bedrock/SageMaker usage.

3) Glue → SageMaker Unified Studio workflow

• Action steps: Enable SageMaker Unified Studio access in Glue console, confirm IAM role permissions using the inline policy editor, and create a standard role template in your org IaC (Terraform/CloudFormation) to replicate across accounts [4].
• Operationalizing: Create recipes or notebooks that read Glue Data Catalog tables directly, run sample queries, and add CI tests validating IAM assumption and data lineage.

4) Configure Secrets Manager managed rotations for Jenkins and SonarQube

• Action steps: In Secrets Manager, add new managed external secrets for Jenkins API Token and SonarQube tokens → choose rotation mode (self-rotation vs admin-assisted) per token type → test rotation in a staging environment before enabling in production [5].
• Best practice: Maintain a recovery admin token with strict audit and limited use, and wire rotated secret values into CI/CD vault integrations or Kubernetes secrets managers with automated refresh.

5) Clean Rooms log export and RDS MariaDB 12.3 upgrades

• Clean Rooms: Grant export permission when creating collaborations, configure an S3 bucket sink with fine-grained bucket policies and lifecycle rules, and attach a Glue/Athena catalog for analysis of anonymized Spark execution logs [7].
• RDS MariaDB 12.3: Validate application compatibility in staging using snapshots or Blue/Green deployment, test queries that rely on TO_DATE() and JSON predicates, and plan rollback with snapshot restores or DMS-based fallback [8].

Risks, Costs and Security

• Cost risk from large models: High-throughput and long-context models (Nemotron, Qwen3.5) can produce large token costs and require expensive GPU instances; benchmark end-to-end cost-per-inference and implement token and concurrency quotas [2][3].
• Tagging and attribution pitfalls: Incorrect or inconsistent IAM tagging undermines Bedrock cost allocation. Enforce tag policies via SCPs/organization policies and validate CUR exports regularly [1].
• Secrets rotation availability risk: Automated rotation reduces exposure but can break CI/CD or tooling if a rotated token isn’t propagated. Use staggered rotations, monitoring, and a recovery admin token with manual controls [5].
• Data leakage and privacy: Clean Rooms log exports contain execution metadata; ensure S3 bucket encryption, access control, and retention policies align with collaboration agreements and regulatory requirements [7].
• Model behavior and compliance: New multimodal and agentic models require safety testing (hallucination, instruction-following, data handling). Apply model validation, red-teaming, and PII filters before production deployment.
• Operational complexity: Managed features reduce custom code but add platform dependencies (SageMaker JumpStart, Secrets Manager). Maintain runbooks and IaC for repeatable provisioning and emergency rollback.

Sources

1. [1] Amazon Bedrock expands IAM principal cost allocation to the bedrock-mantle endpoint
2. [2] LocateAnything-3B, Qwen-AgentWorld-35B-A3B, and Qwen3.5-122B-A10B models now available on Amazon SageMaker JumpStart
3. [3] NVIDIA Nemotron 3.5 Lightning model is now available on Amazon SageMaker JumpStart
4. [4] AWS Glue adds one-click access to SageMaker Unified Studio from the AWS console
5. [5] AWS Secrets Manager adds managed external secrets support for Jenkins and SonarQube
6. [6] Amazon Connect Customer launches performance dashboard for Cases
7. [7] AWS Clean Rooms supports exporting privacy-enhanced analysis logs for SQL
8. [8] Amazon RDS for MariaDB now supports MariaDB 12.3