AWS just removed one of the persistent performance excuses for keeping high‑throughput code off Lambda: outbound network bandwidth for non‑VPC functions now scales dramatically with memory, roughly from ~625 Mbps at 2 GB up to about ~3 Gbps at 10 GB (10,240 MB). That single change materially reshapes serverless architecture choices for data‑plane workloads.
If you build Lambda functions that move lots of bytes — streaming transformations, parallel API callers, inline compression/encryption, or acting as a control plane for shuttle jobs — the need to place functions inside a VPC (and suffer ENI cold starts, NAT gateway costs and ENI scale limits) has been one of the core tradeoffs. With roughly 3 Gbps available outside the VPC, many throughput‑sensitive patterns can stay out of the VPC altogether and avoid the complexity that comes with ENI lifecycle and scaling.
Practical implications
- You can push more of your egress‑heavy work into smaller, simpler Lambdas that don't require VPC networking hop‑offs. That reduces operational surface area: no ENI warmers, fewer NAT gateways, and simpler IAM bindings.
- Expect different cost tradeoffs. Running a 10 GB Lambda for bandwidth is more expensive per second than a 2 GB function, but you avoid persistent NAT or proxy infrastructure and the opaque per‑ENI scaling costs that often surprise teams at scale.
- Security and architecture still matter: non‑VPC functions can’t directly reach resources in private VPC subnets. If your architecture relies on RDS in private subnets, you either redesign (VPC‑accessible endpoints, the RDS Data API, or private network proxies) or accept hybrid approaches where egress‑heavy functions are non‑VPC and stateful operations remain behind the VPC.
This is the right call from AWS: give teams a clear, documented bandwidth curve tied to memory, and let them choose architecture tradeoffs instead of forcing everyone into VPC workarounds. But it also hands platform engineers a new risk vector — high‑bandwidth Lambdas outside the VPC become higher‑value targets for exfiltration if runtime controls or tenant isolation aren’t airtight.
Amazon Bedrock: web retrieval inside the account
AWS also added retrieval/web‑search capabilities to Bedrock that let models fetch live internet data via a managed retrieval flow. The feature is intended to keep retrieved content and related telemetry within the customer's AWS account boundary (minimizing external egress) and to simplify building retrieval‑augmented generation patterns without plumbing external adapters.
Why this matters: if you run agentic workflows or consumer‑facing assistants that need fresh facts, having retrieval integrated and resident in your account reduces compliance and data‑movement friction. Combined with AWS guidance and tooling for attribution and observability of model calls, teams can map model activity and retrieved content to applications or tenants for cost chargeback and auditing.
What didn’t change: EKS Distro stayed quiet
The Amazon EKS Distro repository shows no new releases this week. That’s not a crisis — it signals stability in the control‑plane distribution while AWS and partners focus on observability tooling (CloudWatch managed Prometheus collectors, better attribution for Bedrock usage) rather than Kubernetes version churn.
One tight prediction
Lambda’s bandwidth lift plus Bedrock’s in‑account retrieval nudges architectures toward smaller, faster serverless front ends that fetch live data and call models inside the cloud boundary — shifting more of the data plane into AWS. That’s sensible for latency and cost, but it raises the stakes for in‑account governance: if you haven’t invested in fine‑grained inference profiling, network egress monitoring, and tenant isolation, this week’s conveniences will become next quarter’s audit failures.
If you want the short, actionable link: we covered Lambda’s non‑VPC bandwidth change earlier here, and there’s more on Bedrock’s retrieval and agent policy work in this piece: Amazon Bedrock: Web Search, third-party models, and agent policy refinement.
Two immediate moves for platform teams: (1) map which functions could be moved out of the VPC for simpler scaling now that bandwidth is ample, and (2) treat Bedrock retrieval as an account‑level capability that needs cost attribution and strict output controls. Ignore either and the architecture wins become governance liabilities.
Sources
- AWS Weekly Roundup – AWS Heroes Summit, Web Search on Amazon Bedrock, Lambda bandwidth and more (August 10, 2026)
- AWS Weekly Roundup – Price reduction of GPT models in Bedrock, CloudWatch managed Prometheus collectors for Prometheus metrics and more (August 3, 2026)
- Amazon EKS Distro (EKS-D) – Releases and Kubernetes version matrix
- Recent Announcements – What's New at AWS (global feed)
- Technical How-to – AWS Architecture Blog (Bedrock inference profiles post)