The week of 15 to 21 June 2026 was AWS Summit New York, and for an infrastructure reader the headline is not an agent: AWS Transform stopped being a migration tool and became a standing service that scans your repositories for tech debt and fixes it on a schedule. In the same week CloudWatch changed its metrics model to native OpenTelemetry with PromQL and per-GB ingestion pricing, the Management Console learned to live entirely inside a VPC, ECS auto scaling got 20-second metrics, and MySQL 5.7 Extended Support was pushed out to June 2029.

The Summit's agent announcements (AgentCore harness GA, AWS Continuum, Managed Knowledge Base) are covered in depth at ercan.ai. Here they get one bullet, because the infra side had enough of its own.

Four AWS Transform launches, one direction

On 15 June AWS launched continuous modernization in AWS Transform, in preview in US East (N. Virginia) and Europe (Frankfurt). Connect code from GitHub, GitLab, Bitbucket, or elsewhere, and it continuously detects, prioritizes, and remediates tech debt across "thousands of repositories": end-of-life dependencies, outdated frameworks, plus agentic-readiness and modernization-readiness analyses and a hook into AWS Security Agent for source-level vulnerabilities. Remediation can be scheduled automatically "with human oversight", and the launch post describes it generating pull requests against configurable baselines.

Then on 16 June, three more: model-to-model migration assessment scans a codebase for OpenAI, Gemini, direct Anthropic SDK, LiteLLM, and Ollama usage (including through LangChain, LlamaIndex, CrewAI, and LangGraph) and produces Bedrock mappings, cost comparisons, and code changes, at no charge beyond standard Transform pricing. AWS Transform for mainframe gained a traceable reimagine workflow for z/OS COBOL and PL/I: business functions become development-ready requirements and cloud-native code, every requirement traces back to source, and it all lands in Kiro and other IDEs over MCP. And AWS Transform now targets Amazon FSx for NetApp ONTAP in public preview, replicating block storage from NetApp, Dell, Pure Storage, or VMware sources in the same wave as compute and network, where EBS was previously the only target.

Continuous modernization is the one that changes the relationship. A migration tool is a project: it has a start, an end, and a scope you can review. A service that reads every repository all the time and opens PRs is a standing permission. The questions to settle before the preview touches anything are mundane and decisive: which baselines, who reviews PRs the agent opens, what "automatic remediation" means for a repo nobody has deployed in two years, and whether the read token covers repositories that hold secrets in history. The preview being limited to two Regions is the least interesting constraint.

CloudWatch becomes a Prometheus-compatible metrics store

CloudWatch introduced native OpenTelemetry metrics with PromQL querying and per-GB pricing on 16 June. CloudWatch accepts metrics over OTLP, exposes a Prometheus-compatible query API, and lets you query custom metrics alongside vended metrics from more than 70 AWS services in one PromQL statement. Ingestion is priced per GB with 15 months of storage included. Available in all commercial Regions except Middle East (UAE), Middle East (Bahrain), and Israel (Tel Aviv).

It did not ship alone. Cross-account metrics centralization (15 June, 17 Regions) replicates metrics from many accounts and Regions into a destination account using rules defined in AWS Organizations, so a central team owns the copy for alarming and governance. Log Analytics (15 June) folds Logs Insights, Live Tail, and Contributor Insights into one default console experience with tabbed queries, billed at the underlying rates. Query Studio went GA.

Model the pricing change before you move anything. CloudWatch custom metrics have been priced per metric per month, which punishes cardinality. Per-GB ingestion prices bytes, not series, which is how Prometheus-shaped workloads have always been costed. The announcement gives no rates, so run your own: take a week of your busiest OTel exporter, estimate the bytes, and compare against the same series as custom metrics. If you run Amazon Managed Service for Prometheus purely as a PromQL endpoint for Grafana, this launch asks whether you still need it.

The console moves inside the perimeter

Two launches close a gap that data-perimeter architectures have worked around for years. AWS Management Console Private Access (15 June) now routes all console traffic for supported service consoles over PrivateLink VPC endpoints, so the console works from a VPC with no internet path; you pay only the endpoint and data processing charges. Previously Private Access could restrict which accounts and networks reached the console, but still required internet connectivity. AWS Sign-in now supports resource-based policies and resource control policies (16 June), evaluated at sign-in and again whenever the session requests new credentials, so an organization-wide RCP can restrict console sign-in to expected networks.

If your position is that nobody touches the console in production, this still matters: the break-glass path exists, and it is better reachable only from your network than as a public endpoint behind a source-IP condition someone will loosen during an incident.

Containers: faster scaling, routed egress

ECS service auto scaling gained 20-second metrics on 18 June: ECSServiceAverageCPUUtilizationHighResolution and ECSServiceAverageMemoryUtilizationHighResolution, enabled per service and selectable as target-tracking metrics. In AWS benchmarks, time to trigger a scale-out dropped from 363 to 86 seconds and total time to running tasks from 386 to 109 seconds. The feature is free; the high-resolution CloudWatch metrics it depends on are not, where standard 60-second metrics were.

EKS customer-routed control plane egress (18 June) sends the control plane's outbound traffic, meaning admission webhook callbacks, OIDC provider lookups, and aggregated API requests, through your VPC, under your route tables and security groups. Set controlPlaneEgressMode to CUSTOMER_ROUTED on create or update, and enforce it fleet-wide with the eks:controlPlaneEgressMode SCP condition key. The win is reaching a private OIDC provider or webhook server inside the VPC; the risk is that your routing is now in the path of every webhook call, so a bad route table becomes an API server that cannot admit Pods.

Also this week

The throughline

Read the infra launches as one move: AWS is pulling things that lived outside its boundary back inside it. Tech debt remediation becomes a service. The Prometheus metrics store becomes CloudWatch. The console becomes a VPC endpoint. The EKS control plane's outbound calls become your routes. Together they mean more of your operational surface is a managed service with a policy knob, and fewer parts are something you can read the code of. Decide where you want that line, because this week moved it.

Read this next

The agent side of the Summit, from the harness to Continuum, is at ercan.ai. For consulting on AWS, cloud, CI/CD pipelines, Linux, GitHub/GitLab, and more, the hub is ercanermis.com.

References