Release & Changelog Watcher — August 4, 2026

What Happened

Amazon Bedrock — Web Search (GA): Bedrock added a Web Search capability that grounds OpenAI GPT models (GPT‑5.4, GPT‑5.5, GPT‑5.6 Sol/Terra/Luna) using an Amazon‑operated web index and built‑in knowledge graph; enables semantic snippets and citations in a single Bedrock API call with a single parameter, keeping processing inside AWS and avoiding third‑party search vendors [1].
EMR on EC2 — Spark Connect (interactive sessions): EMR on EC2 now supports persistent interactive Apache Spark sessions via Spark Connect (requires emr‑spark‑8.0+). Sessions run on dedicated EMR clusters and expose Spark UI, History Server and session management in console/API/CLI [2].
AWS Security Hub Extended — Supply Chain Security: Security Hub Extended adds a 10th category for Supply Chain Security with curated partners Chainguard and Socket; Extended now includes 23 partner solutions and aggregates findings via OCSF [3].
EC2 C8g (Graviton4) — Region expansion: C8g instances powered by Graviton4 are now available in Paris, Cape Town, Tel Aviv and Calgary; advertised up to ~30% better overall performance vs Graviton3, larger sizes and up to 50 Gbps networking and 40 Gbps EBS bandwidth [4].
ALB/NLB — RFC 9151 TLS policies: Application and Network Load Balancers support RFC 9151–compliant TLS security policies implementing NSA CNSA 1.0 crypto for TLS 1.2/1.3, with interoperability policies to ease client transitions [5].
EC2 I8g (Storage‑optimized Graviton4) — Region expansion: I8g storage‑optimized instances (Graviton4 + 3rd‑gen Nitro SSDs) are GA in Paris and Jakarta; target low‑latency I/O workloads with up to 65% better storage performance per TB vs I4g and up to 45 TB local NVMe [6].
RDS for SQL Server — Developer Edition expanded: Developer Edition (full Enterprise feature set for dev/test) is available in 13 additional regions, enabling closer‑to‑users development and lower latency test environments [7].
RDS for SQL Server — BYOM expanded: Bring‑Your‑Own‑Media (BYOM) is supported in 10 additional commercial regions for SQL Server 2019, 2022 and 2025 and integrates with AWS License Manager for tracking [8].

Why It Matters to Businesses

Faster, compliant production LLMs: Bedrock Web Search lets teams ground OpenAI models with fresh web evidence while keeping data inside AWS, reducing data‑residency and egress concerns for regulated workloads [1].
Improved data engineering velocity: EMR Spark Connect provides persistent interactive sessions for notebooks and IDEs, shortening debug cycles and enabling reproducible remote execution on managed clusters [2].
Better cost/perf and global footprint: Broader Graviton4 (C8g/I8g) availability gives production systems higher throughput and lower cost per core for compute and I/O‑heavy workloads in more regions [4][6].
Operational security and compliance: RFC‑9151 TLS policies and Security Hub’s supply‑chain category let security teams meet higher crypto and software‑supply‑chain assurance requirements while centralizing vendor integrations and billing [3][5].
Simpler SQL Server dev and migrations: Expanded Developer Edition and BYOM reduce licensing friction for dev/test and help reuse existing SQL Server licenses when moving to RDS in more regions [7][8].

Kimbodo Engineering Perspective

Bedrock Web Search — tradeoffs and judgment

Enabling Web Search inside Bedrock is a strong operational win for evidence‑backed LLM outputs and compliance, but it does not eliminate the need for provenance validation. Semantic snippets are optimized for model context windows and latency, which helps throughput, yet they can omit broader page context. We recommend treating Bedrock search results as a retrieval layer in a RAG pattern with explicit citation verification, freshness checks and fallback to raw pages when legal or auditable text is required [1].

Spark Connect on EMR — practical tradeoffs

Persistent interactive sessions reduce developer friction but increase baseline cluster cost and state management complexity. Use them for iterative development, debugging and model preprocessing; avoid leaving large fleets of idle persistent clusters. Autoscaling, short session timeouts and session inspection APIs should be part of the operational playbook to control cost and enforce lifecycle policies [2].

Graviton4 instances (C8g, I8g) — migration considerations

Graviton4 yields notable performance and price benefits, but x86→ARM migration risks remain: native binaries, JIT/VM tuning (Java, .NET), and vendor library support. Storage‑optimized I8g delivers much lower I/O latency variability but requires revalidation of durability and backup strategies (NVMe local vs EBS). Benchmarks on representative workloads are essential before fleet migration [4][6].

Security Hub Extended & TLS policies — operational realities

Adding supply‑chain telemetry and CNSA‑compliant TLS policies supports high‑assurance environments, but brings integration work: map partner findings into OCSF, tune alerting to reduce noise, and validate client compatibility with stricter cipher suites. Expect a short transition window for older clients and third‑party integrations [3][5].

RDS SQL Server — licensing and environment strategy

Developer Edition expansion is useful for low‑cost dev/test but is not licensed for production. BYOM simplifies license reuse, but you must verify Software Assurance eligibility and track entitlements via AWS License Manager to avoid compliance exposure [7][8].

How We Would Implement It

Deploying Bedrock Web Search safely (recommended pattern)

Architectural pattern: RAG (retrieval → rank → generate) where Bedrock Web Search is the retrieval provider returning snippets + citations to the LLM. Implement a verification layer that logs snippet metadata and stores evidence for audits [1].
Steps: enable the Web Search parameter in Bedrock API calls; add a retrieval cache (TTL by content type); attach lineage metadata (query, snippet id, retrieval timestamp) to model outputs; configure CloudWatch metrics for latency, hit rate and citation counts.
Operational controls: enforce redaction rules, denylist sensitive domains, and route queries through VPC endpoints to control network egress within AWS.

Using Spark Connect in production notebooks

Steps: provision EMR clusters with emr‑spark‑8.0+, enable Spark Connect, and integrate with SageMaker Unified Studio or Jupyter/VS Code clients. Configure IAM roles and VPC security groups for notebook access [2].
Operational: implement session lifecycle policies (max idle time, auto‑terminate), enable Spark UI/History Server and centralize logs to CloudWatch/S3 for reproducibility.

Migrating to Graviton4 (C8g/I8g)

Plan: run smoke and perf benchmarks on representative workloads; recompile native dependencies when required; test Java/CLR tuning and garbage collection settings.
For I8g storage: design data tiering between local NVMe and EBS, validate snapshot/backup procedures, and tune filesystem/IO scheduler settings for low latency.

Rolling out RFC 9151 TLS policies and Security Hub supply‑chain

TLS rollout: apply RFC‑9151 policy to non‑production ALBs/NLBs first, run client compatibility tests, then use the interoperability policy during phased cutover to production listeners [5].
Supply‑chain integration: onboard Chainguard/Socket into Security Hub Extended, map findings into your SIEM/SOAR via OCSF, and automate blocking for high‑confidence malicious dependency alerts [3].

RDS SQL Server developer and BYOM setup

Developer Edition: deploy dev/test instances in the newly supported regions for latency‑sensitive teams; treat these as non‑production and automate backup/refresh workflows [7].
BYOM: register licenses in AWS License Manager, validate Software Assurance status, and use RDS BYOM workflows to import media where supported; perform an entitlement audit before production migration [8].

Risks, Costs and Security

Costs: Persistent Spark Connect clusters increase baseline spend; Graviton migrations reduce per‑core cost but require upfront engineering and testing. Bedrock Web Search increases API usage; estimate retrieval+generation cost per request [1][2][4].
Data and compliance risk: Even with in‑AWS processing, web‑sourced content can carry copyright or PII risks — enforce redaction, provenance logging and legal review of routed content [1].
Licensing risk: BYOM requires active Software Assurance and strict tracking; misconfiguration can trigger audit exposure [8].
Security tradeoffs: Supply‑chain alerts can generate false positives; integrate with change control to avoid blocking legitimate builds. Tightening TLS to CNSA‑level can break legacy clients; use interoperability policies and staged testing [3][5].
Operational failure modes: NVMe local storage (I8g) increases recovery complexity after host failure; ensure robust backup/snapshot strategies and multi‑AZ failover designs [6].
Mitigations: run staged pilots, implement fine‑grained IAM and VPC controls, centralize logging/lineage, automate license/entitlement checks, and define rollback plans for TLS and supply‑chain policy changes.

Where Kimbodo Comes In

Kimbodo builds and operates this in production for businesses — see our AI Application Development practice. Wondering what it would cost for your organization? Get a preliminary range, timeline and architecture in about a minute.

Estimate My AI Application