The week of 1 to 7 June 2026 removed two long-standing reasons to keep a workload where it is: the SQL Server license that pinned databases to EC2, and the Cognito user pool that pinned an application to one Region. Neither launch is glamorous. Both change a migration conversation that used to end with "we can't, because".

Underneath them, Kubernetes 1.36 reached Amazon EKS with user namespaces generally available, Fargate grew to 32 vCPU tasks, and the Cost and Usage Report finally lands in Athena and Redshift without a hand-built pipeline. Read together, it was a plumbing week, and plumbing weeks are where platform teams save real money.

RDS for SQL Server: bring the license you already paid for

Amazon RDS for SQL Server now supports Bring Your Own Media, published on 2 June. Customers moving from on-premises, from another cloud, or from self-managed SQL Server on EC2 can run on RDS while reusing existing SQL Server licenses, including Software Assurance, through Microsoft's License Mobility program. License usage is tracked through AWS License Manager.

Until now the RDS option was License Included, which meant paying Microsoft twice if you were mid-term on an enterprise agreement. That was the single most common reason I have heard for a SQL Server estate landing on EC2 instead of RDS: not a technical constraint, a procurement one. BYOM takes the argument away, and it arrives one week before AWS Transform adds a cost assessment that models BYOM against License Included (that one is dated 8 June, so it belongs to next week's post).

The trade-off is the one License Mobility always carries: it depends on active Software Assurance, and the compliance position is now yours to prove on a managed service. License Manager helps with the counting; it does not help with the audit. Decide who owns that before the first instance.

Cognito gets a second Region, with conditions

Amazon Cognito multi-Region replication keeps a synchronized copy of user profiles, credentials, and pool configuration in a secondary Region. The launch post spells out the shape: replication is one-way, the secondary is read-only and serves authentication, tokens issued by either Region are recognized by both, and federation (social, SAML, OIDC) works from the replica. It is an add-on for Essentials and Plus tier pools in 16 Regions, priced at $0.0045 per monthly active user per replica Region on Essentials, $0.006 on Plus, and a 30% surcharge on machine-to-machine tokens.

Cognito was the component that made "multi-Region" a lie in a lot of architectures: the database replicated, the compute was stateless, and the identity provider lived in exactly one place. This fixes that, but read the setup steps before you celebrate. You need a multi-Region KMS key, and you must switch the OIDC issuer type to the new multi-Region endpoints, which means redeploying every server-side client and shipping mobile app updates. Lambda triggers, SMS and email configuration, log streaming, and WAF rules are not replicated; you rebuild them in the target Region by hand. During failover, sign-in continues but new registrations and profile updates pause.

Failover itself is yours: DNS updates driven by health checks you design. For managed login with a custom domain there is built-in routing against a Route 53 health check. The post's advice to route a small share of off-peak traffic to the secondary before you need it is the whole game. An untested standby is a hypothesis.

Kubernetes 1.36 on EKS: fewer webhooks, less root

Amazon EKS and EKS Distro support Kubernetes 1.36 in all Regions where EKS runs, including GovCloud. Four features matter to platform operators: User Namespaces are generally available, mapping container root to an unprivileged host user so a container breakout buys no node privileges; Mutating Admission Policies let you express CEL-based mutations in the API server without running webhook infrastructure; in-place Pod-level vertical scaling resizes a Pod's shared CPU and memory budget without a restart; and Resource Health Status surfaces device health in Pod status.

The one to act on is Mutating Admission Policies. Every mutating webhook you run is a component on the critical path of every kubectl apply, with its own TLS, its own availability, and its own timeout. Moving sidecar injection, default labels, and image rewrites into CEL policies removes a class of outage. User Namespaces is the security win, but it needs runtime and node support, so treat it as a node group migration rather than a flag.

CUR 2.0 in Athena and Redshift, without the glue

Cost and Usage Report 2.0 now integrates with Athena and Redshift. Pick the engine, and the export arrives in the right format (Parquet or GZIP) with templates, table definitions, and load instructions; tables update as data refreshes. Everyone who has maintained a Glue crawler plus a CloudFormation stack just to make billing data queryable knows what this replaces. It is available in all commercial Regions, not GovCloud or China. Pair it with Compute Optimizer's new 32-day lookback for EBS and ECS rightsizing, which finally covers a full monthly cycle.

Also this week

The throughline

None of this week's launches adds a capability you could not build before. You could run SQL Server on EC2 with your own license. You could write a Cognito export job and pray. You could run webhooks. What changed is that the managed path now covers the case that used to force the unmanaged one, and the gap between "what we would like to run" and "what the license or the architecture allows" closed a little. Those are the weeks that move migrations, not the keynote weeks.

Read this next

The AI and agent reading of the week lives at ercan.ai. For consulting on AWS, cloud, CI/CD pipelines, Linux, GitHub/GitLab, and more, the hub is ercanermis.com.

References