Release & Changelog Watcher — September 4, 2026

What Happened

• Amazon EC2: AMI owners can now declare compatible/unsupported instance types on AMIs; launch attempts on disallowed types are blocked. Default behavior unchanged; available in all Regions at no extra cost [1].
• Amazon ECS: Introduced Early Success Criteria for rolling service deployments to mark a deployment successful when a configured healthy percent of desired tasks are running; supports BLOCKING and DEFERRED source-revision cleanup modes and works with rolling deployment strategy across AWS Commercial and GovCloud regions [2].
• AWS MCP Server: Added a serverless capability for coding agents to diagnose running AWS Lambda functions and connected resources (API Gateway, EventBridge, S3, DynamoDB, SNS, SQS, Step Functions) with correlated 7‑day baselines and single-call diagnostics; accessible via Agent Toolkit or standalone, runs in US‑East (N. Virginia) and Europe (Frankfurt) [3].
• EC2 C8g: C8g Graviton4-based instances expanded to Asia Pacific (Taipei, New Zealand) and AWS GovCloud (US‑East); 12 sizes (two bare-metal), up to 30% perf vs Graviton3 and up to 50 Gbps networking / 40 Gbps EBS bandwidth [4].
• AWS Transfer Family SFTP Connectors: Now continue file transfers during credential rotation by authenticating against an ordered list of AWS Secrets Manager version stages (e.g., current, previous); requires Secrets Manager-stored credentials and is available in supported Regions [5].
• SageMaker AI Batch Transform: Now supports ml.g6e (G6e) instances with up to eight NVIDIA L40S GPUs and 3rd‑gen AMD EPYC CPUs for large offline inference; available in select regions (e.g., US East, US West, Mumbai, Hyderabad) [6].
• EC2 C9g / C9gd: Graviton5-based instances (C9g/C9gd) are available in Asia Pacific (Tokyo). They claim up to 25% compute improvement vs Graviton4 and include the Nitro Isolation Engine; C9gd adds local NVMe SSDs [7].

Why It Matters to Businesses

• Fewer failed launches and safer image management: AMI-level instance-type controls reduce unexpected incompatible launches and downstream incident work during deployments while preserving existing workflows unless owners opt in [1].
• Faster CI/CD and reduced rollout friction for constrained capacity workloads: ECS Early Success Criteria lets teams unblock downstream pipelines and subsequent deployments earlier for workloads with slow task stabilization (GPU/accelerator starts, long init tasks) while still completing scale-out asynchronously [2].
• Faster root-cause and less token usage for cloud-native debugging: The AWS MCP Server serverless mode gives coding agents lower-latency, consolidated diagnostics across Lambda-connected services with 7‑day baseline correlation—useful for on-call/observability workflows [3].
• Performance and cost leverage: New Graviton4/Graviton5 instance availability and G6e GPU Batch Transform support let organizations choose higher-performance, lower-cost options for CPU-heavy and GPU-batch inference workloads; region expansion increases capacity planning choices [4][6][7].
• Operational resilience during credential rotation: Transfer Family connectors that try multiple Secrets Manager stages remove a common transient failure window in SFTP pipelines and reduce manual secret-swapping work [5].

Kimbodo Engineering Perspective

These updates are practical, low-friction improvements that should be adopted selectively and with attention to operational controls.

Trade-offs and rules of thumb

• Use AMI instance-type restrictions when image compatibility must be enforced (kernel, NVMe, or bare-metal requirements). Do not apply globally to images used by many teams without a migration plan because enforcement immediately blocks launches on disallowed types [1].
• Adopt ECS Early Success Criteria when task startup latency is the gating factor for pipelines (e.g., GPU inference where full stabilization is slow). Choose DEFERRED cleanup for services where you want fast pipeline progression and asynchronous draining, and BLOCKING when you must complete source cleanup before marking success [2].
• Integrate AWS MCP Server for agent-driven diagnostics but treat it as an augmented observability input, not a single source of truth; validate its findings against metrics/traces and control access via tight IAM roles and audit logging [3].
• Benchmark Graviton4/5 and G6e instance types for your specific workloads—claims are workload-dependent (databases, Java, ML inference) and migration requires library/ABI validation and AMI/container rebuilds [4][6][7].
• Use Secrets Manager staged versions and connector configuration to eliminate rotate-induced failures; ensure secret rotation processes always maintain at least one valid stage during rotation windows [5].

How We Would Implement It

Concrete steps and architecture choices Kimbodo recommends for production adoption.

Enforcing AMI compatibility ([1])

• Add a step in the image pipeline (Packer/EC2 Image Builder) to set AMI-compatible instance-type metadata when an image is built and validated.
• Maintain a compatibility matrix in source control; automate tag-based enforcement and CI tests that attempt launches on allowed and disallowed instance types.
• Roll out restrictions in phases: start with non-production accounts, invite owners to opt in, then expand to prod after a migration window.

Using ECS Early Success Criteria ([2])

• Update ECS service definitions (CloudFormation/Terraform) to include Early Success Criteria thresholds appropriate to the workload (e.g., 90% healthy for large GPU pools).
• Decide between DEFERRED vs BLOCKING: use DEFERRED for short-lived connections and high-throughput services; use BLOCKING for stateful services requiring a full source cleanup before success.
• Modify CI/CD pipelines to wait on the Early Success signal or to continue depending on business requirements; instrument CloudWatch Events to trigger rollbacks if success criteria are not met within a configured window.

AWS MCP Server integration ([3])

• Enable via “aws configure agent-toolkit” or deploy the standalone MCP Server in allowed regions; restrict access to the MCP Server through IAM and VPC endpoints where possible.
• Integrate agent calls into developer tooling (IDE plugins, chatops) with scoped read-only roles; log all agent queries and results to a centralized audit store for compliance.
• Validate MCP outputs against application logs and traces and tune the 7‑day baseline assumptions as needed for seasonal patterns.

Adopting new instance types and Batch Transform ([4][6][7])

• Run a migration assessment: compile target workloads, run Graviton and G6e benchmark jobs, and validate container runtimes, CUDA/CUDNN and driver compatibility for ml.g6e.
• Use AWS Graviton Fast Start and Porting Advisor for CPU migrations; for G6e, prepare GPU drivers in build pipelines and test Batch Transform jobs in available regions before switching production jobs.
• Update cost models and Savings Plans/Reserved Instance strategies once performance-per-dollar is verified.

Making Transfer Family connector rotation robust ([5])

• Store connector credentials in Secrets Manager and use version stages (current, previous) during rotation.
• Automate secret rotation so at least one usable stage exists at all times; test connector behavior in staging to verify continued transfers during rotation windows.

Risks, Costs and Security

• Operational risk: AMI compatibility enforcement can cause blocked launches if applied broadly without a migration plan—introduce slowly and monitor rollout failures [1].
• Deployment correctness vs speed: ECS Early Success Criteria reduces time-to-success but may mask incomplete rollout state if thresholds are set too permissively; choose thresholds conservatively and monitor post-deploy metrics [2].
• Data residency and access surface: AWS MCP Server runs in US‑East and Frankfurt; agent diagnostics access Lambda/config metadata—restrict via IAM, session policies, and audit logs; treat MCP outputs as sensitive [3].
• Cost: G6e GPU instances and Graviton5 instances have higher SKU-specific costs; savings depend on utilization and instance sizing—bench and model TCO before scale adoption [4][6][7].
• Credential and rotation risk: Connectors that try multiple secret stages rely on correct stage management—misconfigured rotation can still cause auth failures if no valid stage exists [5].
• Security posture: Nitro Isolation Engine provides stronger formal isolation guarantees on Graviton5 instances but does not replace OS/container hardening, kernel patches, or runtime security controls [7].

Sources

1. [1] Amazon EC2 now supports specifying compatible instance types on AMIs
2. [2] Amazon ECS introduces Early Success Criteria for service deployments
3. [3] AWS MCP Server adds a serverless capability for AWS Lambda functions
4. [4] Amazon EC2 C8g instances now available in additional regions
5. [5] AWS Transfer Family SFTP Connectors now support continuing file transfers during credential rotation
6. [6] Amazon SageMaker AI Batch Transform now supports G6e instances
7. [7] Amazon EC2 C9g and C9gd instances are now available in Asia Pacific (Tokyo) region