Release & Changelog Watcher — August 26, 2026

What Happened

Major AI and cloud vendors released targeted updates across identity, contact center, storage, ETL, backup, and education AI tooling. Highlights:

Amazon Cognito added an admin API to remove a user’s TOTP device association (AdminDeleteSoftwareToken), enabling administrative TOTP recovery without recreating accounts [1].
Amazon Connect Customer added two workforce and quality-of-service features: unplanned shrinkage inputs for agent schedules and points-based scoring for performance evaluations [2][4].
Mountpoint for Amazon S3 added configurable memory usage controls (user-defined or auto-detected) and throttling under memory pressure, enabling safe use in memory-constrained containers such as EKS [3].
AWS Glue 5.1 is available in the AWS European Sovereign Cloud Region and across commercial/GovCloud regions; core upgrades include Apache Spark 3.5.6, Python 3.11, Scala 2.12.18 and updated table format engines (Hudi 1.0.2, Iceberg 1.10.0, Delta Lake 3.3.2); Lake Formation now supports write controls for Spark and full-table access for Hudi/Delta tables [5].
AWS Backup added cross-Region copy and logically air-gapped (immutable) vault support for Amazon DocumentDB backups in nine additional Regions, with RAM sharing and multi-party approval options [6].
ChatGPT for Teachers is expanding into 55 additional U.S. school districts, adding >100,000 educators and staff to the program pool for secure AI tools and training (announcement details limited) [7].

Why It Matters to Businesses

These changes remove practical roadblocks and enable safer, more efficient operations across common enterprise workflows:

Faster MFA recovery with auditability: AdminDeleteSoftwareToken lets admins recover locked users without account recreation, preserving security posture and reducing support time and churn [1].
More accurate staffing and quality metrics: Unplanned shrinkage modeling improves projected service-level accuracy for contact centers; points-based scoring simplifies evaluative models that mix AI and human reviewers and aligns scores to business priorities [2][4].
Reliable S3 mounts in constrained environments: Mountpoint memory controls let operations run file-system-level S3 access in containerized ML and analytics workloads without memory interference [3].
Modernized ETL and data governance: Glue 5.1 upgrades give performance and security improvements (new Spark/Python), and better open-table support plus write-level Lake Formation controls reduce gaps in enforcement for ETL pipelines [5].
Stronger, compliant disaster recovery: Cross-Region DocumentDB copy and immutable vaults enable regulatory-friendly DR and ransomware-resistant backups with fine-grained sharing controls [6].
Education deployments require governance: Expansion of ChatGPT for Teachers means K-12 IT leaders must plan identity, privacy, and content controls before adoption [7].

Kimbodo Engineering Perspective

Identity & MFA (Cognito)

AdminDeleteSoftwareToken is a useful operational control but must be treated as a high-privilege operation. It closes a common support pain point (device loss) while preserving MFA enforcement, but it also concentrates recovery power in admin roles — design for least privilege, strong audit trails, and approval flows.

Contact Center Operations (Amazon Connect)

Unplanned shrinkage and points-based scoring improve realism and alignment. They change downstream metrics consumers (SLAs, staffing forecasts, pay/bonus calculations). Treat these as schema and business-rule changes that must be versioned so historical comparisons remain valid.

Storage and Containers (Mountpoint)

Memory budgeting in Mountpoint makes file-system S3 mounts viable in production EKS workloads. The trade-off is potential I/O throttling under pressure; design for predictable tails by combining resource requests/limits with Mountpoint budget tuning.

Data Platforms (Glue 5.1)

Upgrading to Glue 5.1 improves performance and governance but can introduce compatibility issues (Spark/Python/Scala changes and open-table format behaviors). Prioritize test-driven upgrades, migration plans for Iceberg/Hudi/Delta features, and explicit Lake Formation policy audits to avoid accidental write exposures.

Backup & Recovery (AWS Backup)

Cross-Region DocumentDB backup copies and immutable vaults strengthen resiliency and compliance posture. They add complexity around KMS keys, cross-account sharing, and recovery workflows that need deterministic testing and documentation.

EdTech AI (ChatGPT for Teachers)

Scaling to additional school districts increases the need for FERPA/PDPA alignment, identity federation, moderation and teacher training. A template governance playbook reduces deployment risk.

How We Would Implement It

Implementing Cognito AdminDeleteSoftwareToken

Enable API usage: authorize service principal and grant a narrow IAM role permission for cognito-idp:AdminDeleteSoftwareToken for designated support/admin accounts [1].
Approval workflow: implement an internal ticketing trigger (e.g., Lambda invoked by ServiceNow) that requires manager approval and logs requestor, user, and justification to CloudTrail before calling the API.
Auditing & monitoring: add CloudWatch Alarms and an Athena query dashboard on CloudTrail logs for AdminDeleteSoftwareToken activity and follow-up sign-ins.

Adopting Amazon Connect Scheduler & Scoring Features

Schedule modeling: export/import shrinkage assumptions from WFM sources into Connect via provided UI/APIs; validate projections against historical adherence to tune shrinkage percentages [2].
Scoring migration: version evaluation templates (old percentage weights vs new points schema), store scoring definitions in a config service (DynamoDB), and update analytics ETL to record raw point tallies for auditability and downstream KPI calculation [4].
Integrate AI evaluations: normalize AI-generated scores into points using a deterministic mapping and keep human/AIdecisions auditable for compliance.

Deploying Mountpoint in Containers

Set explicit Kubernetes resource requests/limits for pods using Mountpoint and enable Mountpoint memory limit either via container env or operator auto-detection [3].
Configure liveness/readiness probes to detect throttled I/O conditions, and instrument mount metrics to track throttle events and tail latencies.
For ML training/analytics, prefer batch jobs with node allocation that reserves headroom for Mountpoint; isolate high-I/O workloads to nodes with higher memory budgets.

Upgrading to AWS Glue 5.1

Create a parallel Glue environment: run critical ETL jobs in a staged Glue 5.1 workspace to validate Spark/Python behavior and open-table features (Iceberg/Hudi/Delta) before switching production traffic [5].
Update CI tests: add integration tests that exercise Lake Formation write policies and Spark SQL DML/DDL to confirm permissions and behavior match expectations.
Migration steps: adapt ETL scripts for Python 3.11 syntax/dep changes, rebuild dependencies, and use Glue Studio for orchestration and monitoring.

Configuring AWS Backup for DocumentDB

Define backup plans with cross-Region copy rules for the nine added Regions and specify target vaults with immutability enabled; configure KMS keys per Region and document key rotation policies [6].
Use RAM to share immutable vaults to the recovery account and enable multi-party approval where required; script restore rehearsals and record RTO/RPO metrics.
Cost control: schedule lifecycle transitions for cross-Region copies and set retention aligned to compliance needs.

Deploying ChatGPT for Teachers in Districts

Identity: integrate SSO (SAML/OIDC) with district IdP, map roles, and limit admin privileges. Preconfigure domain allowlists and data export controls [7].
Privacy & safety: enable content moderation and disable telemetry collection where required; provide teacher training and an opt-in consent flow.
Governance: produce a deployment checklist covering FERPA, acceptable-use policy changes, and parent/guardian notices.

Risks, Costs and Security

Each change delivers value but introduces operational and security considerations:

Privilege concentration (Cognito): AdminDeleteSoftwareToken is high-sensitivity. Mitigate with least-privilege IAM, approval workflows, and immutable audit logs [1].
Metric drift and comparability (Connect): Changing shrinkage and scoring models will alter historical baselines—version scoring schemas and annotate reports to avoid misinterpretation [2][4].
Resource contention (Mountpoint): Throttling under memory limits can surface as higher tail latency; budget conservatively and monitor SLOs [3].
Compatibility and regression (Glue 5.1): Spark/Python/runtime changes can break jobs; plan staged rollouts, dependency rebuilds, and test suites to avoid silent data corruption [5].
Cross-Region costs and KMS complexity (AWS Backup): Cross-Region copies incur egress and storage costs; multi-region KMS keys and RAM sharing require careful key policy management and documented recovery procedures [6].
Privacy and legal risk (EdTech): Deploying ChatGPT to schools demands FERPA/ state privacy compliance, clear data retention, and supervised access controls [7].

Operational recommendations:

Enforce least-privilege roles and approval gates for all new administrative APIs.
Run staged rollouts and parallel environments for platform upgrades (Glue, Mountpoint) with comprehensive integration tests.
Document and version business rules (scoring, shrinkage) and include schema metadata in analytics pipelines.
Estimate cross-Region backup costs, automate restore rehearsals, and control KMS key usage via central key policies.
For education deployments, require legal review, parental notification workflows, and explicit data governance controls before procurement.

Where Kimbodo Comes In

Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.