How to Use Recent AWS Releases to Reduce Cost, Restore True Client IPs, and Enforce Per‑Run Access Controls

What Happened

Transfer Family: source IP preservation (2026‑09‑17)

AWS Transfer Family added support for preserving client source IPs when an SFTP server is placed behind a Network Load Balancer (NLB) using Proxy Protocol v2 (PPv2). Preserved IPs are recorded in Transfer Family logs/events and presented to a custom identity provider during authentication. You can enable this per Transfer Family server via console, CLI, or API; feature available in all AWS Regions where Transfer Family is offered [1].

HealthOmics: IAM session policies (2026‑09‑17)

AWS HealthOmics now accepts IAM session policies to restrict permissions for individual runs without creating dedicated IAM roles per tenant or run. Session policies further limit the role’s permissions (intersection model) — useful for per‑tenant S3 scoping and temporary per‑run access. Feature is available in all HealthOmics Regions (US, EU, IL, APAC) and HealthOmics is HIPAA‑eligible [2].

Batch: bulk job cancellation/termination (2026‑09‑17)

AWS Batch added CancelJobs, TerminateJobs, and TerminateServiceJobs APIs that accept up to 50 job IDs per call and return per‑job results. CancelJobs targets SUBMITTED/PENDING/RUNNABLE jobs; TerminateJobs/TerminateServiceJobs work in any state (including STARTING/RUNNING). ListJobs and ListServiceJobs now return isCancelled/isTerminated fields [3].

EC2: T8i instances general availability (2026‑09‑17)

Amazon EC2 T8i (nano, micro, small, medium) launched — burstable instances powered by custom 6th‑gen Intel Xeon 6 CPUs and 6th‑gen Nitro cards. AWS claims up to 30% better price performance vs. T3, higher compute, network and EBS bandwidth, and the same T3 credit model (Standard/Unlimited). T8i.micro and T8i.small are in the Free Tier. Available in multiple US, EU, APAC and Canada regions; purchasable On‑Demand and Spot (Savings Plans coming soon) [4].

Elastic Beanstalk: Cluster Mode (no date specified)

Elastic Beanstalk introduced Cluster Mode to run multiple applications on pooled infrastructure powered by Amazon EKS instead of a dedicated environment per app. It supports source code, Dockerfile, or ECR images and offers event‑driven autoscaling, OpenTelemetry observability, Secrets Manager integration, and HTTPS by default via ACM. Cluster Mode is available in all commercial Elastic Beanstalk Regions; you pay for underlying AWS resources including EKS Auto Mode charges [5].

S3 Express One Zone: regional expansion (date not specified)

Amazon S3 Express One Zone — a single‑Availability Zone, low‑latency storage class — expanded to seven additional Regions (Singapore, Sao Paulo, N. California, Canada Central, Paris, Sydney, Seoul), bringing total availability to 15 Regions. AWS positions it for latency‑sensitive workloads (ML training, analytics, AI search caches) with up to 10× faster access and up to 80% lower request cost vs. S3 Standard for single‑AZ use cases [6].

AWS Builder Center: mobile app (date not specified)

AWS Builder Center launched mobile apps for iOS and Android. The app exposes articles, 600+ Skill Builder courses, sandboxes and hands‑on workshops, push notifications, and community features via AWS Builder ID sign‑in [7].

Why It Matters to Businesses

Auditability and compliance: Transfer Family’s preserved source IPs enable accurate IP‑based auditing and access controls for SFTP workflows that were previously masked by NLB private IP substitution [1].
Safer multi‑tenant data processing: HealthOmics session policy support removes the need for many ephemeral IAM roles and lets you scope per‑run S3 access, lowering blast radius for sensitive genomics/bioinformatics runs [2].
Operational scale and control: AWS Batch bulk cancellation simplifies large‑scale job control (e.g., wide CI job kills, stopping runaway compute) and improves lifecycle observability via new flags [3].
Lower TCO for bursty workloads: T8i offers improved price/performance for small, burstable services (microservices, CI runners, small DBs) and Free Tier options for development/testing [4].
Cost consolidation for many apps: Elastic Beanstalk Cluster Mode reduces per‑app compute overhead by pooling apps onto EKS, useful when you manage many small services and want unified observability [5].
Faster, cheaper single‑AZ storage: S3 Express One Zone is attractive for latency‑sensitive caches or ephemeral training data where cross‑AZ durability is not required [6].
Developer enablement: Builder Center mobile app improves on‑the‑go access to learning and events for engineering teams [7].

Kimbodo Engineering Perspective

We view these updates as practical building blocks rather than game changers. The Transfer Family PPv2 support closes a long‑standing blind spot for SFTP behind NLBs — a straightforward, high‑value compliance fix. HealthOmics session policies materially reduce IAM role churn in tenantized bioinformatics platforms but shift complexity into precise session policy generation and runtime enforcement. Bulk cancellation in Batch is an operational convenience that should be integrated into job orchestration tooling with careful error handling. T8i is attractive for cost‑sensitive, bursty workloads but doesn’t replace Arm‑based Graviton instances where better price/performance may exist for compute or memory workloads. Elastic Beanstalk Cluster Mode removes per‑app compute waste but trades off some of the old PaaS simplicity for EKS‑style cluster operations and cost elements (EKS Auto Mode). S3 Express One Zone is useful for performance‑sensitive, non‑critical data; treat it like any single‑AZ tier.

How We Would Implement It

Transfer Family — preserve source IPs with NLB

Identify SFTP servers behind NLBs using VPC endpoints. Plan a maintenance window to enable PPv2 per server.
Enable Proxy Protocol v2 on the NLB and toggle source‑IP preservation on the Transfer Family server via CLI/API/console [1].
Update your custom identity provider to read the preserved source IP from the authentication context (test with representative clients and IPv4/IPv6 flows).
Validate logs (CloudWatch/Transfer events) and integrate with SIEM for IP‑based alerting; add automated tests to detect source IP regression in deployment pipeline.

HealthOmics — per‑run IAM session policy pattern

Maintain a single long‑lived IAM role with broad baseline permissions required by HealthOmics.
On run submission, programmatically generate a minimal session policy that constrains S3 prefixes and other resources to the tenant/run and pass it as the session policy when assuming the role (using STS AssumeRole or the HealthOmics run API where supported) [2].
Enforce policy generation rules in a template library and log the generated session policy to CloudTrail and a secure audit store for compliance reviews.
Set conservative session durations and test access boundary behavior (deny precedence, wildcard path edge cases).

AWS Batch — integrate bulk cancel/terminate

Enhance orchestration tooling to call CancelJobs or TerminateJobs with up to 50 job IDs for mass failure remediation. Use per‑job result payloads to reconcile partial success and implement retries/backoff for transient failures [3].
Rely on the new isCancelled/isTerminated flags from ListJobs/ListServiceJobs for polling and lifecycle dashboards to avoid race conditions.
Audit bulk actions with CloudTrail and require approval gates in CI/CD for mass termination operations.

T8i adoption guidance

Benchmark representative workloads (CPU‑bursty vs sustained) on T8i vs existing flavors (T3, Graviton) including EBS and network IO to validate claimed improvements before large‑scale migration [4].
Prefer T8i for services that fit the burstable credit model (login gateways, small DBs, CI runners). Keep Standard vs Unlimited credit policy in mind for cost predictability.
Update AMI/ASG templates and run staged rollouts; track CPU credit consumption and EBS throughput metrics after migration.

Elastic Beanstalk Cluster Mode migration

Containerize apps (Docker/ECR) and adopt the Elastic Beanstalk GitHub Action for CI/CD deploys to Cluster Mode [5].
Design namespaces, resource quotas, and autoscaling rules for pooled EKS clusters. Centralize OpenTelemetry exports to CloudWatch and integrate with existing APM tools.
Estimate EKS Auto Mode and EKS control plane costs; test multi‑tenant security controls (NetworkPolicies, IAM for Service Accounts) before consolidating many apps.

S3 Express One Zone usage patterns

Use for ephemeral ML training sets, low‑risk caches, or single‑AZ analytics datasets where lower latency and request cost outweigh cross‑AZ durability concerns [6].
Implement lifecycle rules to expire or replicate critical data to Standard or cross‑region buckets when durability is required.

Builder Center mobile app

Encourage engineers to install for on‑the‑go training and workshop access; integrate with internal learning plans and track completion as part of onboarding [7].

Risks, Costs and Security

Proxy Protocol and IP handling: Enabling PPv2 surfaces true client IPs — improve logging and access control, but verify that downstream systems correctly parse PPv2. Misconfiguration can break authentication and expose internal addresses if NLB/Proxy headers are mishandled [1].
Session policy complexity: Generating session policies per run improves least privilege but increases risk of overly broad or mistakenly narrow policies. Implement strict templates, validation, and logging for session policy generation [2].
Partial failures and automation safety: Bulk cancellation is powerful — guard with approval steps and idempotent reconciliation to avoid accidental termination of critical jobs [3].
Instance choice tradeoffs: T8i is Intel‑based; if you rely on Arm‑optimized binaries or expect better Graviton price/performance, benchmark both. Monitor CPU credit exhaustion and EBS throughput costs [4].
Cluster mode isolation and cost: Elastic Beanstalk Cluster Mode centralizes workloads on EKS. This reduces per‑app compute but increases shared‑infrastructure blast radius and creates EKS charges; apply strong namespace/network isolation and cost tagging [5].
S3 durability and availability: Express One Zone reduces cross‑AZ durability — do not store irrecoverable or compliance‑required data only in One Zone. Factor in replication and lifecycle transfer costs when designing storage plans [6].
Operational overhead and observability: New features require CI/CD updates, additional monitoring, and test coverage. Budget engineering time for runbooks and incident drills.

Where Kimbodo Comes In

Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.