AWS Updates: Jun 2026

AWS Security Hub now monitors Microsoft Azure resources, extending risk analytics, cloud security posture management, vulnerability management, and security response management across both AWS and Azure environments. This eliminates the need for separate security tools for each cloud, allowing security teams to prioritize risks and respond consistently from a single console. Security Hub automatically discovers Azure resources such as Virtual Machines (VMs), Azure Container Registry (ACR) container images, Azure Function Apps, and Azure identities. It evaluates them for misconfigurations, internet exposure, and software vulnerabilities. Users receive posture checks against security standards including the CIS Benchmarks™ for Microsoft Azure Foundations, a unified resource inventory, risk and exposure analysis, and automated response through existing EventBridge integrations. AWS and Azure findings appear in the same prioritized view with consistent finding formats and automation workflows. Security Hub offers a 30-day free trial for monitoring Azure resources after integrating with Microsoft Azure. After the trial, monitoring Azure resources costs the same as monitoring equivalent AWS resources. Integration with Azure can be created from all AWS Regions where Security Hub is available, except Middle East (UAE), Middle East (Bahrain), Asia Pacific (Taipei), and Asia Pacific (New Zealand). Integrations to Microsoft Azure for AWS Security Hub CSPM for posture management checks and Amazon Inspector for vulnerability management can also be created independently of AWS Security Hub.

AWS has announced maintenance transitions and end-of-support for several services. Services moving to maintenance (Amazon Bedrock Agents Classic, Amazon Cognito Sync, Amazon Kendra, Amazon Q Business, AWS Directory Service - Simple AD, AWS IoT Device Defender - Detect, AWS Mainframe Modernization - Self-Managed Experience, AWS Management Console - myApplications, AWS Resource Groups - Group Lifecycle Events, AWS Service Catalog - Application Registry, AWS Systems Manager - Application Manager, and Amazon SageMaker AI features such as A2I, Clarify, Debugger, GeoSpatial, Ground Truth, Mechanical Turk, Model Monitor, Role Manager, and Studio Lab) will no longer be accessible to new customers starting July 30, 2026, but existing customers can continue using them with ongoing AWS support. Services entering sunset (Amazon WorkSpaces - PCoIP, Amazon WorkSpaces - Pool, AWS Managed Services (AMS) Advanced, AWS re:Post Private, Amazon Sagemaker AI- Profiler) will end operations and support by June 30, 2026. Affected customers should review migration guides and can access support teams for assistance.

Amazon CloudWatch pipelines now supports processing and enriching OpenTelemetry (OTel) metrics during ingestion. CloudWatch pipelines is a fully managed service that ingests, transforms, and routes telemetry data to CloudWatch without requiring you to manage infrastructure. Until now, customers who needed to enrich or transform OTel metrics before storage had to build custom processing layers or modify application instrumentation at the source. With OTel metric processing in CloudWatch pipelines, you can apply metric transformations centrally as part of the ingestion path with no new infrastructure required. With CloudWatch pipelines, you can enrich metrics by adding business context such as team ownership, cost center, and environment tags to metrics from sources you cannot modify. You can strip high-cardinality labels from custom workloads to reduce storage costs, and rename metrics and attributes to enforce consistent naming conventions across your organization. Processing is applied transparently to matched metrics with no changes to application instrumentation required. OTel metric processing for CloudWatch pipelines is available in all AWS Regions where CloudWatch pipelines and CloudWatch native OpenTelemetry metrics are supported. Processing of OTel metrics via pipelines is offered at no additional cost. Standard CloudWatch pricing for OTel metrics ingestion applies. For pricing details, see CloudWatch Pricing. To get started, open the Amazon CloudWatch console, navigate to pipelines under Ingestion, and select CloudWatch Metrics (OTel) as the source. To learn more, see the CloudWatch pipelines documentation.

AWS announces general availability of AWS WAF protection for Amazon Bedrock AgentCore Gateway, enabling protection of agentic AI workloads from common web exploits and abuse. Users can associate an AWS WAF protection pack with their AgentCore Gateway to enforce IP-based access controls, rate-based rules, and AWS Managed Rule Groups. The protection pack is configured once at the Gateway level and applied consistently to all targets behind that Gateway. This feature is available in all AWS Regions where both AWS WAF and Amazon Bedrock AgentCore Gateway are offered.

AWS Clean Rooms now supports intermediate tables for SQL queries, offering increased flexibility for organizations running complex, multi-step analytical workflows with their partners. With this launch, customers can write the results of a SQL query to an intermediate table within a collaboration for reuse in subsequent analyses. Intermediate tables enable multi-step analytical workflows-from reusing complex joins to building shared ID mapping tables for downstream analyses-all within the privacy boundary of the collaboration. For example, a publisher and an advertiser can join their first-party data to build an ID mapping table in a collaboration, then reuse it across reach, frequency, and attribution analyses, reducing costs and optimizing performance for the subsequent analyses. AWS Clean Rooms helps companies and their partners easily analyze and collaborate on their collective datasets without revealing or copying one another’s underlying data.

Amazon GameLift Servers now offers DDoS Protection client SDKs for C# and Unity, helping game developers protect session-based multiplayer games against denial-of-service and distributed denial-of-service attacks. This feature co-locates a relay network directly alongside your game servers and uses access token-based authentication to ensure only authorized client traffic reaches your servers. DDoS Protection provides proactive UDP-based traffic protection with negligible latency and is available at no additional cost to Amazon GameLift Servers customers. The feature enforces per-player traffic limits to prevent disruptions even from seemingly legitimate sources, eliminating the need for manual byte matching. The new client SDKs for C# and Unity join existing support for C++ and Unreal Engine, giving developers flexibility to implement protection regardless of their game engine or language. Amazon GameLift Servers DDoS Protection is available in US East (N. Virginia), US West (Oregon), Europe (Frankfurt), Europe (Ireland), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Asia Pacific (Seoul).

Two new models are now available in the Kiro IDE and CLI for the AWS GovCloud (US-West) Region. OpenAI GPT-5.4 is available in Kiro for complex reasoning, coding, document analysis, and multi-step agentic workflows. It helps developers build AI applications and production workflows that can interpret context, interact with tools, operate software environments, and verify outputs across multiple steps. GPT-5.4 runs on Amazon Bedrock's next-generation inference engine with isolated queues and durable execution for resilient workloads. It is available with a 272K context window and a 1.2x credit multiplier. NVIDIA Nemotron 3 Super 120B is now available in Kiro as an open weight model option. It is a hybrid mixture-of-experts model activating only 12B of its 120B parameters for high compute efficiency and fast inference on agentic tasks. It features a 256K context window with a 32K max output and is available with a 0.25x credit multiplier. Ensure your IDE or CLI is updated to the latest version, then restart it to access the new models from the model selector. For more details about Kiro in AWS GovCloud (US), visit the GovCloud documentation or contact your AWS account team for more information. To learn more about Kiro, visit the Kiro product page.

AWS GovCloud (US) now offers Claude Opus 4.8, Anthropic's most capable generally available model to date. Claude Opus 4.8 delivers meaningful advances across agentic coding, professional knowledge work, and long-running autonomous tasks. For coding, it reads codebases like an engineer, plans before editing, and holds context across long sessions. For agentic tasks, it finds paths around obstacles, recovers from its own errors, and decides when to ask for help. For knowledge work, it synthesizes across long documents, self-checks output, and delivers structured deliverables. Amazon Bedrock keeps data within AWS infrastructure and provides access to Claude Opus 4.8 through a unified service with AWS-managed features like Guardrails and Knowledge Bases.

Amazon Managed Workflows for Apache Airflow (Amazon MWAA) Serverless now supports shared VPC subnets. Previously, customers using subnets shared via AWS Resource Access Manager (AWS RAM) encountered a validation error when creating MWAA Serverless workflows. With this update, MWAA Serverless correctly validates subnet ownership in shared VPC configurations, consistent with MWAA Provisioned environments. Sharing VPC subnets across accounts using AWS RAM is a common pattern in multi-account landing zone architectures. Organizations that centrally manage networking can now launch MWAA Serverless workflows in member accounts using shared subnets-no workarounds required. Customers using Amazon SageMaker Unified Studio Workflows also benefit from this update when their projects are configured with shared VPC networking. This update is available in all AWS Regions where Amazon MWAA Serverless is supported.

Amazon S3 now supports delivering server access logs to Amazon CloudWatch Logs, providing instant querying, alarms, cross-account and cross-Region aggregation, and AWS Key Management Service (KMS) encryption for access log data. Logs can also be mirrored to Amazon S3 Tables in Apache Iceberg format at no additional storage cost. With delivery to CloudWatch Logs, users can set alarms on error rates, monitor traffic patterns, investigate access incidents across accounts and Regions, and correlate S3 access activity with other operational data. Logs mirrored to S3 Tables are immediately queryable with standard SQL in Amazon Athena, Amazon Redshift, and other Iceberg-compatible query engines, enabling auditing of access patterns, analysis of usage trends, and identification of cost drivers across buckets over time. S3 server access logs delivery to CloudWatch Logs is available today in all AWS Regions except AWS China Regions and AWS GovCloud (US) Regions.

Amazon EC2 R8g instances are now available in AWS Asia Pacific (Thailand, New Zealand), AWS Africa (Cape Town), AWS Europe (Milan), and AWS Canada West (Calgary) regions. Powered by AWS Graviton4 processors, these instances deliver up to 30% better performance compared to AWS Graviton3-based instances. Ideal for memory-intensive workloads such as databases, in-memory caches, and real-time big data analytics, R8g instances are built on the AWS Nitro System, which offloads CPU virtualization, storage, and networking functions to dedicated hardware and software to enhance performance and security. R8g instances offer larger sizes with up to 3x more vCPU (up to 48xlarge) and memory (up to 1.5TB) than Graviton3-based R7g instances. They are up to 30% faster for web applications, 40% faster for databases, and 45% faster for large Java applications compared to R7g instances. Available in 12 different sizes, including two bare metal options, R8g instances provide up to 50 Gbps enhanced networking bandwidth and up to 40 Gbps of bandwidth to Amazon Elastic Block Store (Amazon EBS).

Amazon EC2 C8in instances are now available in the US East (Ohio) and Europe (Ireland) regions. Powered by custom sixth-generation Intel Xeon Scalable processors exclusive to AWS, these instances feature the latest sixth-generation AWS Nitro cards, delivering up to 43% higher performance compared to previous generation C6in instances. C8in instances scale up to 384 vCPUs and deliver 600 Gbps network bandwidth-the highest among enhanced networking EC2 instances-making them ideal for network-intensive workloads such as distributed computing and large-scale data analytics. C8in instances are available in US East (N. Virginia, Ohio), US West (Oregon), Asia Pacific (Tokyo, Sydney, Singapore, Malaysia), and Europe (Spain, Frankfurt, Ireland) regions. They can be provisioned through Savings Plans, On-Demand, and Spot instances. For more information, visit the Amazon EC2 C8i instance page.

Starting today, the general-purpose Amazon EC2 M8a instances are available in the AWS Asia Pacific (Mumbai) region. M8a instances are powered by 5th Gen AMD EPYC processors (formerly code named Turin) with a maximum frequency of 4.5 GHz, delivering up to 30% higher performance and up to 19% better price-performance compared to M7a instances. M8a instances deliver 45% more memory bandwidth compared to M7a instances, making these instances ideal for even latency sensitive workloads. M8a instances deliver even higher performance gains for specific workloads. M8a instances are up to 60% faster for GroovyJVM benchmark, and up to 39% faster for Cassandra benchmark compared to Amazon EC2 M7a instances. M8a instances are SAP-certified and offer 12 sizes including 2 bare metal sizes. This range of instance sizes allows customers to precisely match their workload requirements. M8a instances are built using the latest sixth generation AWS Nitro Cards and ideal for applications that benefit from high performance and high throughput such as financial applications, gaming, rendering, application servers, simulation modeling, mid-size data stores, application development environments, and caching fleets. To get started, sign in to the AWS Management Console. Customers can purchase these instances via Savings Plans, On-Demand instances, and Spot instances. For more information visit the Amazon EC2 M8a instance page.

Amazon EC2 C7a instances are now available in the Asia Pacific (Singapore) Region. Powered by 4th Gen AMD EPYC processors (code-named Genoa) with a maximum frequency of 3.7 GHz, C7a instances deliver up to 50% higher performance compared to C6a instances. They offer new processor capabilities such as AVX-512, VNNI, and bfloat16, and feature Double Data Rate 5 (DDR5) memory for high-speed data access, providing 2.25x more memory bandwidth than C6a instances, making them suitable for latency-sensitive workloads. C7a instances come in 12 sizes from medium to 48xlarge, including a bare-metal size. With the launch of C7a instances, customers can attach up to 128 EBS volumes to an EC2 instance, compared to C6a instances which allow up to 28 EBS volume attachments. Built on the AWS Nitro System, these instances are ideal for high-performance, compute-intensive workloads such as batch processing, distributed analytics, high-performance computing (HPC), ad serving, highly scalable multiplayer gaming, and video encoding. C7a instances are available through On-Demand, Spot Instances, and Savings Plans.

Amazon Redshift has announced the availability of All Upfront and Partial Upfront payment options for 1-year and 3-year reserved instances for RG instances. These new payment options join the previously available No Upfront option, giving customers greater flexibility to optimize compute costs based on their financial preferences. All Upfront provides the maximum discount by paying for the full reservation term upfront, while Partial Upfront splits the cost between an initial payment and lower monthly installments.

Kiro has achieved FedRAMP High and Department of Defense Cloud Computing Security Requirements Guide (DoD CC SRG) Impact Level (IL) 4 and 5 authorization in the AWS GovCloud (US) Regions. Federal agencies, public sector organizations, and other enterprises with FedRAMP High and DoD CC SRG IL-4/5 compliance requirements can now confidently use Kiro as their agentic engineering partner for sensitive workloads. Kiro is an agentic AI with an integrated development environment (IDE) and command-line interface (CLI) that helps build applications from prototype to production using spec-driven development. It works alongside users to turn prompts into detailed specs, then into working code, documentation, and tests. With native Model Context Protocol (MCP) support, Kiro connects to documentation, databases, APIs, and other enterprise resources, enabling mission-critical development workflows.

AWS Network Firewall now supports two new managed rule groups from VisionHeight, available through AWS Marketplace: Zero-Day Threat Protection, and Noisy Scanners and Tor Protection. These rule groups expand the managed rules offerings for AWS Network Firewall, giving customers access to proprietary threat intelligence built on VisionHeight's Pulse telemetry. Zero-Day Threat Protection proactively blocks malicious IP infrastructure before it appears on public blocklists, helping organizations stay ahead of emerging threats by weeks and strengthening defense for workloads facing targeted attacks. Tor Protection reduces firewall log noise by blocking communication with active Tor exit nodes and filtering traffic from known high-volume scanning sources. With daily refresh cycles, this rule group suppresses noise at the first packet-before events are generated-lowering SOC alert volume, reducing SIEM ingestion costs, and removing Tor as a path into or out of your environment. Managed rules for AWS Network Firewall are available from AWS Marketplace sellers including Check Point, Fortinet, Infoblox, Lumen, Rapid7, ThreatSTOP, Trend Micro, and VisionHeight. For a full list of supported regions, visit the AWS Regional Services page. To get started, visit the AWS Network Firewall console or browse available managed rules in AWS Marketplace. For more information, see the AWS Network Firewall product page and the service documentation.

OpenAI GPT, OpenAI GPT OSS, and NVIDIA Nemotron models are now FedRAMP High and Department of Defense Cloud Computing Security Requirements Guide (DoD CC SRG) Impact Level (IL) 4 and 5 approved within Amazon Bedrock in the AWS GovCloud (US) Regions. Federal agencies, public sector organizations, and other enterprises with FedRAMP High and DoD CC SRG IL-4/5 compliance requirements can now use these models on Amazon Bedrock to build and scale generative AI applications with confidence that they meet the security and compliance standards required for government workloads. These models are powered by Mantle, a next-generation distributed inference engine on Amazon Bedrock, which provides high-performance serverless inference with zero operator access, automated capacity management, and out-of-the-box compatibility with OpenAI API specifications.

Amazon Relational Database Service (Amazon RDS) Custom for SQL Server now supports the latest Cumulative Updates (CU) and General Distribution Release (GDR) updates for Microsoft SQL Server. This release includes support for SQL Server 2019 CU32+GDR KB5090407 (RDS version 15.00.4470.1.v1) and SQL Server 2022 CU25 KB5081477 (RDS version 15.00.4255.1.v1). The GDR updates address vulnerabilities described in CVE-2026-40370. For additional information on the improvements and fixes included in these updates, see Microsoft documentation for KB5090407, KB5081477. You can upgrade your Amazon RDS Custom for SQL Server instances to apply these recommended updates using Amazon RDS Management Console, or by using the AWS SDK or CLI. To learn more about upgrading your database instances, see Amazon RDS Custom User Guide.

Amazon Route 53 Global Resolver now enables you to share DNS views with other AWS accounts using AWS Resource Access Manager (AWS RAM). Consumer accounts can associate their own Route 53 private hosted zones with a shared DNS view, making their records resolvable through the owner's global resolver in every AWS Region where it runs-without transferring ownership of the hosted zone or the DNS view. With DNS view sharing, teams can continue to own and manage their private hosted zones while making them resolvable through a centralized global resolver. You can control access using predefined AWS RAM managed permissions - default association-only, lifecycle management, or full access-or create custom permissions to grant specific actions to the consumer. Private hosted zone associations created by the consumer belong to the consumer's account, while remaining visible to and removable by the owner. This capability is available at no additional cost in all AWS Regions where Route 53 Global Resolver is supported.

Amazon OpenSearch Ingestion is now generally available in the Europe (Paris) Region (eu-west-3) for ingesting data into Amazon OpenSearch Service managed clusters or serverless collections. Amazon OpenSearch Ingestion is a fully managed data ingestion tier that allows you to ingest and process data before indexing it in Amazon OpenSearch managed clusters or serverless collections. It provides a no-code experience to filter, transform, redact, and route data into Amazon OpenSearch Service. Amazon OpenSearch Ingestion automatically provisions and scales the underlying resources to meet the fluctuating demands of your workloads. With this launch, Amazon OpenSearch Ingestion is now generally available in 17 AWS regions.

Amazon Relational Database Service (Amazon RDS) for SQL Server now supports the latest General Distribution Release (GDR) updates for Microsoft SQL Server. This release includes support for Microsoft SQL Server 2016 SP3+GDR KB5084821 (RDS version 13.00.6485.1.v1), SQL Server 2017 CU31+GDR KB5084818 (RDS version 14.00.3525.1.v1), SQL Server 2019 CU32+GDR KB5084816 (RDS version 15.00.4465.1.v1) and SQL Server 2022 CU24+GDR KB5083252 (RDS version 16.00.4250.1.v1). The GDR updates address vulnerabilities described in CVE-2026-32167 and CVE-2026-32176. For additional information on the improvements and fixes included in these updates, see Microsoft documentation for KB5084821, KB5084818, KB5084816, KB5083252. We recommend that you upgrade your Amazon RDS for SQL Server instances to apply these updates using Amazon RDS Management Console, or by using the AWS SDK or CLI. You can learn more about upgrading your database instance in the Amazon RDS SQL Server User Guide for upgrading your RDS Microsoft SQL Server DB engine.

AWS Backup now executes S3 backup copy operations up to 8x faster for buckets with millions of objects and low change rates between backup copies through enhanced change tracking. This improvement reduces the time required to copy S3 backups across accounts and AWS Regions by eliminating the need to scan all objects in the destination account or Region. With this improvement, AWS Backup records object events as they occur, resulting in faster copy operations and reduced processing time. The enhancement automatically applies to all new S3 backup cross-account and cross-Region copy jobs and is enabled at no additional cost in all AWS Regions where AWS Backup supports Amazon S3 backup cross-account and cross-Region copying.

AWS GovCloud (US) customers now receive 24/7 technical support from US-based, US-citizen cloud support engineers by default, with no opt-in or special request required. This ensures that support across both AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions is handled exclusively by full-time AWS employees on US soil, trained to maintain ITAR compliance and meet other AWS GovCloud (US) requirements. Support is available around the clock through the AWS GovCloud (US) Console, API access for automated workflows, click-to-call for urgent issues, and live chat for quick questions.

The AWS IoT Device SDK for Swift is now generally available, enabling Swift developers to build secure, scalable IoT applications natively on Apple platforms including macOS, iOS, and tvOS, as well as Linux. This SDK addresses the previous lack of native Swift support for AWS IoT services, providing stable, production-ready APIs specifically designed for teams managing IoT device fleets and building cross-platform IoT solutions across the Apple ecosystem. The SDK delivers comprehensive capabilities for real-time device management and secure communication. With integrated service clients for AWS IoT Device Shadow, Jobs, and Fleet Provisioning, developers can synchronize device states between applications and AWS IoT Core, manage remote operations on connected devices at scale, and automate certificate and policy creation for secure device onboarding. The SDK also provides built-in TLS 1.3 support on Apple iOS and tvOS platforms, ensuring IoT applications use the latest industry-standard security practices for protecting data in transit.

Amazon EMR Serverless now supports updates to key application configurations such as maximum capacity and custom image settings-without stopping and restarting the application. New workloads submitted after the update automatically use the new settings, while existing workloads continue uninterrupted with their original configuration. Previously, modifying these settings required stopping your EMR Serverless application, making the change, and restarting it-forcing you to coordinate maintenance windows and temporarily block job submissions. Now you can adjust scaling boundaries or deploy updated custom images at any time without disrupting running jobs. This reduces operational overhead and lets you respond to changing workload demands or deploy image updates immediately. This feature is available on all Amazon EMR releases and in all AWS Regions where Amazon EMR Serverless is available.

Amazon EC2 introduces AMI watermarks, enabling you to embed custom identifiers in your private AMIs. Once applied, a watermark automatically carries forward to every AMI derived from the original, whether you copy it across regions or create a new AMI from a running instance. Watermarks also remain visible when you share an AMI with other accounts. This helps you identify trusted AMIs, track provenance, and enforce governance policies across your organization. Each watermark includes metadata such as the AMI ID, owner ID, region, and creation timestamps, providing reliable provenance that persists regardless of how many times an AMI is copied or new AMIs are created from it. AMI Watermarks improve AMI tracking by enabling you to filter and find related AMIs across your accounts. For governance, you can combine watermarks with Allowed AMIs to restrict instance launches to only AMIs carrying approved watermarks and enforce the setting at scale across your organization through Declarative Policies. You can start adding AMI watermarks to your private AMIs using the AWS Management Console, AWS CLI, or SDKs. To learn more, please visit the documentation. You can also attach watermarks through EC2 Image Builder, a service used to create and manage AMIs, as part of your AMI build pipeline. AMI Watermarks are available to all customers at no additional cost in all AWS regions including AWS China (Beijing) Region, operated by Sinnet, and AWS China (Ningxia) Region, operated by NWCD, and AWS GovCloud (US) Regions.

Amazon ElastiCache now supports Valkey 9.1 for node-based clusters, delivering higher throughput, improved memory efficiency, and stronger access control for multi-tenant workloads. This release includes a redesigned I/O threading model that improves throughput by up to 17%, reduces memory usage for strings under 128 bytes by up to 20%, and introduces database-level access control lists that allow administrators to scope user permissions to specific numbered databases. New commands like HGETDEL for atomic hash field retrieval and deletion, MSETEX for setting multiple keys with a shared expiration, and CLUSTERSCAN for cluster-wide key iteration simplify workflows that previously required multi-step client logic. The release also adds new main-thread and I/O-thread usage metrics for better operational visibility.

AWS announces the preview of AI-powered investigations in Amazon GuardDuty. This new capability automatically analyzes GuardDuty findings and accounts to help quickly distinguish true threats from benign findings. The feature examines finding context, related activity from the last 90 days, affected resources, and threat indicators using knowledge graphs and threat intelligence within minutes. Each investigation provides a disposition assessment with confidence scoring, MITRE ATT&CK® technique classification, supporting evidence, and actionable recommendations for suppression, containment, or remediation. This automation enables security teams to focus on genuine threats across individual AWS accounts or entire AWS Organizations and accelerate mean time to resolution. The feature is available in preview in 10 AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Europe (Ireland), Europe (London), Europe (Frankfurt), Europe (Paris), Europe (Stockholm), Asia Pacific (Tokyo). To get started, access AI-powered investigations through the Amazon GuardDuty console, CLI, API, or AWS' MCP Server.

Amazon EC2 High Memory U7in-24TB instances (u7in-24tb.224xlarge) are now available in the AWS Asia Pacific (Seoul) region. U7i instances belong to the AWS 7th generation and are powered by custom fourth-generation Intel Xeon Scalable processors (Sapphire Rapids). U7in-24TB instances provide 24 TiB of DDR5 memory, enabling customers to scale transaction processing throughput in fast-growing data environments. U7i instances deliver up to 45% better price performance over existing U-1 instances. They offer 896 vCPUs, support up to 100 Gbps of Amazon EBS bandwidth for faster data loading and backups, 200 Gbps of network bandwidth, and ENA Express. U7i instances are ideal for customers running mission-critical in-memory databases like SAP HANA, Oracle, and SQL Server.

Amazon CloudWatch now supports tagging for CloudWatch dashboards, allowing you to organize, categorize, and control access to your dashboards using tags. Tags are key-value pairs that help you identify and manage AWS resources across your environment. With this launch, the PutDashboard API now accepts an optional Tags parameter, allowing you to assign up to 50 tags when creating a new dashboard. The TagResource, UntagResource, and ListTagsForResource APIs now support dashboard ARNs, enabling you to add, remove, and list tags on existing dashboards. You can also manage dashboard tags using AWS CloudFormation. This new capability allows you to group dashboards by team, project, or environment, implement attribute-based access control by scoping IAM permissions to dashboards with specific tag values, and filter dashboards by tag in AWS Resource Explorer. CloudWatch Dashboard tagging support is available at no additional cost in all AWS Regions where Amazon CloudWatch is available

Amazon Neptune now supports AWS CloudFormation for provisioning and managing Neptune global databases. Using the new AWS::Neptune::GlobalCluster resource type, you can define your multi-region graph database topology as code-automating deployment, storing configurations in source control, and integrating with CI/CD pipelines. Neptune global databases provide a primary cluster with read-write capability and up to five read-only secondary clusters in different AWS Regions, connected through low-latency replication via the Neptune storage subsystem. Common use cases include low-latency read access across regions, disaster recovery, data residency compliance, and high-availability graph deployments with centralized writes and distributed reads. This feature is available in all AWS Regions where Neptune global databases are supported.

Amazon CloudWatch now offers OTel Container Insights for Amazon EKS. This feature collects infrastructure metrics at 30-second intervals using open-source receivers such as cAdvisor, Kube State Metrics, and NVIDIA DCGM. Each metric carries OpenTelemetry semantic conventions and Kubernetes labels, making it straightforward to correlate across nodes, pods, and workloads in a single PromQL query. Pre-built dashboards provide immediate visibility into cluster health, node performance, and pod-level resource usage. The CloudWatch PromQL endpoint allows you to connect existing Prometheus and Grafana dashboards directly to CloudWatch. You can enable it from the EKS console or via the CloudWatch Observability add-on (v6.2.0+), Helm, or CloudFormation. Available in all commercial AWS Regions except Middle East (UAE), Middle East (Bahrain), and Israel (Tel Aviv). For pricing details, see the Amazon CloudWatch pricing page. To get started, see the OTel Container Insights documentation.

AWS announces new automated refinement workflows for Automated Reasoning checks in Amazon Bedrock Guardrails. Automated Reasoning checks use formal logic to mathematically validate the accuracy of generative AI responses against a user-defined policy, helping detect hallucinations and provide verifiable explanations. The quality of validation results depends on how well a policy is defined. The new workflows help customers improve their policies with less manual effort, leading to more reliable Guardrail validation results. The launch introduces two refinement workflows: the iterative policy improvement workflow allows customers to start an iterative refinement run to deduce necessary changes for the policy to pass natural language tests, and the ambiguity reduction workflow helps automatically refine variable descriptions and type definitions to reduce ambiguous translation results. Both workflows are available through the Amazon Bedrock APIs and in the AWS Management Console, where customers can start a workflow by choosing Refine policy on the policy page. These workflows are available in all AWS Regions where Automated Reasoning checks in Amazon Bedrock Guardrails are offered.

Amazon Cognito now supports customer managed keys in AWS Key Management Service (KMS) for encrypting user pool data at rest. While AWS owned keys are used by default to protect your data, customer managed keys give you full control over the encryption keys, helping you achieve your organization's data governance objectives. With customer managed keys, you can define organizational policies and revoke access to encrypted data by disabling or deleting your key. You create and manage the customer managed key lifecycle and usage permissions in AWS KMS. You can configure a customer managed key when creating a new user pool or update an existing user pool to use one. You can also use AWS CloudTrail to monitor and audit all usage of your customer managed keys, giving you visibility into when and how your identity data is accessed. Customer managed keys are available in user pools in Essentials and Plus tiers at no additional costs. Standard AWS KMS charges apply. To get started, configure your customer managed keys using the AWS Management Console, AWS CLI, or AWS SDKs.

AWS HealthOmics now supports ephemeral storage for private workflows, offering bioinformatics workloads dedicated scratch space that delivers more consistent run performance and lower costs. Each workflow task now receives a dedicated local volume mounted at /tmp, and workflows that generate significant scratch data, such as genomic sequence alignment, BAM sorting, and variant calling, can experience faster run times. By default, each task includes 16 GiB of ephemeral storage at no additional charge. You can increase the amount of ephemeral storage allocated to individual tasks, up to a maximum of 3,072 GiB per task, using the appropriate directive in your WDL, Nextflow, or CWL workflow definition. You can enable ephemeral storage at runtime with the StartRun API. All ephemeral storage volumes are encrypted and deleted when a task terminates. This feature is available in all AWS Regions where AWS HealthOmics is offered: US East (N. Virginia), US West (Oregon), Europe (Frankfurt, Ireland, London), Israel (Tel Aviv), and Asia Pacific (Singapore, Seoul).

Amazon Bedrock AgentCore Memory now enables cross-account access, allowing you to build multi-account architectures where memory resources and consuming agents span multiple AWS accounts. You can grant principals in one account permission to call memory data plane APIs against resources in another account using resource-based policies, and configure memory delivery destinations (Amazon S3, Amazon SNS, Amazon Kinesis Data Streams) that reside in a separate account. Cross-account access is configured by attaching a resource-based policy to your memory resource. Once configured, principals in the consuming account can create events, write memory records, retrieve records, and perform semantic search by referencing the full memory ARN. Cross-account delivery destinations allow your memory resource to deliver payloads and stream events to S3 buckets, SNS topics, and Kinesis Data Streams in other accounts. To get started, see Cross-account memory access in the Amazon Bedrock AgentCore Developer Guide. Amazon Bedrock AgentCore Memory cross-account access is available in all AWS Regions where Amazon Bedrock AgentCore Memory is supported.

Amazon SageMaker notebook instances now support EC2 G6e instances, which are powered by up to 8 NVIDIA L40s Tensor Core GPUs with 48 GB of memory per GPU and third generation AMD EPYC processors. G6e instances deliver up to 2.5x better performance compared to EC2 G5 instances. Customers can use G6e instances for interactive model training use cases such as generative AI fine-tuning, and to deploy large language models (LLMs) with up to 13B parameters and diffusion models for generating images, video, and audio. Amazon EC2 G6e instances are available on SageMaker notebook instances in the AWS US East (N. Virginia and Ohio), US West (Oregon), Asia Pacific (Tokyo), Middle East (Dubai) and Europe (Frankfurt, Sweden, Spain) regions.

Amazon CloudWatch Logs now supports managed syslog ingestion, enabling customers to send syslog messages from firewalls, routers, switches, and Linux servers directly into CloudWatch Logs. With this launch, customers can configure their network devices and servers to send syslog messages over TCP, TCP+TLS, or UDP to a VPC endpoint in their account-without installing or managing any agents. Amazon CloudWatch Logs supports RFC 5424, RFC 3164, and Cisco FTD/ASA syslog formats, making it compatible with a wide range of infrastructure. It automatically parses incoming syslog messages and extracts structured fields such as facility, severity, hostname, and application name, eliminating the need for custom parsing pipelines. For example, customers can ingest syslog from their network firewalls and immediately query by severity or hostname using Logs Analytics to investigate security events or troubleshoot connectivity issues. This feature helps teams centralize infrastructure log visibility, simplify operational workflows, and reduce the overhead of deploying and maintaining log collection agents across distributed environments. Available in all commercial AWS Regions except Middle East (UAE), Middle East (Bahrain), and Israel (Tel Aviv).

Amazon Connect Customer now offers Agentic CX designer (NLX) in preview, a no-code canvas for designing and deploying AI-powered self-service experiences. This allows businesses to build voice and digital experiences that combine agentic and deterministic AI, transforming customer service with enterprise-grade control and reliability. Teams can move from designing conversations and integrating systems to testing, simulation, and launching production-ready experiences in weeks rather than months. Live Sync enables real-time guidance within web or mobile apps during voice or chat conversations, turning spoken exchanges into hands-on experiences.

Anthropic is launching Claude Tag in beta for AWS customers accessing Claude Enterprise through AWS Marketplace. Claude Tag allows teams to work with Claude directly in channels like Slack, connecting it to tools, data, and codebases of their choice. It operates under its own identity per channel, with spend controls and ambient mode off by default. The experience for Claude Enterprise in AWS Marketplace customers mirrors the first-party offering, with consumption-based pricing, org-wide budget visibility, and per-channel limits. An admin provisions the agent identity in the Claude admin console and scopes it per channel

Amazon MSK Replicator now supports mutual TLS (mTLS) authentication for data replication from external Apache Kafka clusters-including on-premises, self-managed on AWS, or other cloud providers-to Amazon MSK Express brokers. With this capability, external Apache Kafka clusters configured with mTLS authentication can now use MSK Replicator to migrate workloads to MSK Express brokers, support disaster recovery by using MSK Express-based clusters as a failover or backup target, and enable data distribution across hybrid and multi-cloud environments. MSK Replicator is a feature of Amazon MSK that automates data replication between Kafka clusters, eliminating the need to manage custom replication infrastructure or configure open-source tools. Previously, MSK Replicator supported SASL/SCRAM authentication only for connecting to external Apache Kafka clusters. With this launch, you can now also use mTLS authentication with MSK Replicator to replicate data from external Kafka clusters to Express brokers on Amazon MSK. Unlike self-managed replication tools, MSK Replicator lets you retain your original Kafka topic names during replication while automatically avoiding infinite replication loops. It also synchronizes consumer group offsets bidirectionally, enabling you to move producers and consumers across clusters independently, in any order, without coordination constraints or the risk of data loss. This new capability is supported in all AWS Regions where MSK Express brokers are available.

Amazon MSK now offers AI Agent Skills that provide AI coding assistants with expert, up-to-date guidance for operating Amazon MSK. These skills offer expert guidance for common operational tasks such as troubleshooting, sizing, configuring, monitoring, and migrating from external Kafka clusters. Teams can use these skills to keep their clusters healthy and performant, and to migrate their external Kafka workloads to MSK Express, which offers up to three times more throughput per broker, 20 times faster scaling, and a 90% reduction in recovery time compared to standard brokers running Apache Kafka. The skills turn tasks that once required specialized knowledge into a guided experience developers can complete quickly on their own. You can use the MSK skills with your existing AI coding agent-Kiro, Claude Code, or Cursor. To get started, configure the Agent Toolkit for AWS using the AWS CLI, then ask your coding agent a question, such as 'What broker type and size should I use for my MSK cluster?' or 'Is my Kafka cluster compatible with MSK Express?'

AWS Transform for migrations now supports all AWS commercial regions as migration targets. A migration target region is the AWS region where migrated resources are deployed, including landing zones, network infrastructure, and server rehosting. Customers can now deploy workloads in any commercial region, making it easier to meet data residency requirements. The new migration target regions include US East (N. California), Africa (Cape Town), Asia Pacific (Bangkok), Asia Pacific (Hong Kong), and others.

AWS has introduced Lambda MicroVMs, a new serverless compute primitive that delivers VM-level isolation, near-instant launch and resume speeds, and state preservation for executing user or AI-generated code. Developers building multi-tenant applications that run end-user or AI-supplied code now have a way to allocate a separate, isolated execution environment per user or session without trade-offs between isolation, speed, and state retention. Lambda MicroVMs, built on Firecracker virtualization technology, allows developers to create a MicroVM image from a Dockerfile and launch MicroVMs with dedicated HTTPS URLs supporting protocols like HTTP/2, gRPC, and WebSockets. Currently available in US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Tokyo), and Europe (Ireland). Pricing is based on baseline compute resources while the MicroVM runs, with additional charges only for active duration beyond the baseline

AWS HealthOmics now supports Nextflow profiles, enabling customers to activate predefined execution settings at run time. Nextflow profiles allow customers to define reusable settings and select them at the point of execution, making it easy to switch between execution settings without modifying workflow source code. With Nextflow profiles, you can cleanly separate platform-specific settings such as resource limits or execution options from core workflow logic. You can switch between development and production settings without creating separate workflow definitions. This reduces errors from manual edits, accelerates workflow portability, and saves time when scaling from development to production. If you use nf-core workflows, you can now activate the built-in and institutional profiles those pipelines already ship with. This feature is available in all AWS HealthOmics Regions: US East (N. Virginia), US West (Oregon), Europe (Frankfurt, Ireland, London), Israel (Tel Aviv), and Asia Pacific (Singapore, Seoul).

Amazon G7e instances feature up to 8 NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs, with 96 GB of memory per GPU, and 5th Generation Intel Xeon processors. They support up to 192 virtual CPUs (vCPUs) and up to 1600 Gbps of Elastic Fabric Adapter networking bandwidth. G7e instances support NVIDIA GPUDirect Peer to Peer (P2P) that boosts performance for multi-GPU workloads. Multi-GPU G7e instances also support NVIDIA GPUDirect Remote Direct Memory Access (RDMA) with EFAv4 in EC2 UltraClusters, reducing latency for small-scale multi-node workloads. Customers can use G7e instances to deploy large language models (LLMs), agentic AI models, multimodal generative AI models, and physical AI models. G7e instances offer the highest performance for spatial computing workloads as well as workloads that require both graphics and AI processing capabilities. Amazon EC2 G7e instances are available for SageMaker Studio notebooks in the AWS US East (N. Virginia and Ohio) and US West (Oregon) regions.

Migration Assistant for Amazon OpenSearch Service now includes an AI-assisted experience that simplifies moving self-managed Apache Solr, Elasticsearch, or OpenSearch deployments to OpenSearch Serverless or Managed Clusters. With the new assistant, users can leverage preferred AI tools such as Kiro, Claude Code, and others to plan migrations, deploy necessary infrastructure, and execute both historical and live traffic migrations. Migrations are often complex and require weeks of planning before any data movement can begin, and even then, the process can be error-prone. The new AI-assisted experience provides an agent-guided workflow that helps structure, execute, and validate data migrations faster and more reliably. Additionally, Migration Assistant now supports live traffic capture and replay for Solr. Migration Assistant supports migrations to OpenSearch Serverless and Managed Clusters from various Solr, Elasticsearch, and OpenSearch versions. It is available in all commercial AWS Regions and AWS GovCloud (US) Regions where Amazon OpenSearch Service is offered.

AWS IAM Identity Center now supports separate quotas for the number of AWS accounts and applications that can be configured in an IAM Identity Center instance. By default, you can configure up to 7,000 AWS accounts and up to 7,000 applications independently, ensuring that using more of one does not consume capacity from the other. Quotas can be further increased by submitting a quota increase request through the AWS Service Quotas console. Customers with existing higher limits are automatically granted the same limit for both accounts and applications, requiring no action. Organizations managing thousands of AWS accounts can now onboard applications without consuming account quota capacity. This update is available in all AWS Regions where IAM Identity Center is offered.

AWS Batch now offers the Best Fit Progressive Ordered (BFPO) and Spot Capacity Optimized Prioritized (SCOP) allocation strategies, giving users more control over instance type prioritization in compute environments. BFPO and SCOP enable users to manually define instance type ordering based on workload-specific performance characteristics. To use these features, specify the BEST_FIT_PROGRESSIVE_ORDERED allocation strategy for on-demand compute environments or SPOT_CAPACITY_OPTIMIZED_PRIORITIZED for Amazon EC2 Spot compute environments and provide an ordered list of instance types or families. These features are available via the AWS Batch API (CreateComputeEnvironment or UpdateComputeEnvironment) or the AWS Batch Management Console. BFPO and SCOP allocation strategies are supported in all AWS Regions where AWS Batch is available.

AWS Network Firewall now uses "Application drop established (server-directed only)" as the default stateful action for all newly created firewall policies, replacing the previous default of "Application drop established (bidirectional)". This change prevents legitimate server-to-client TCP packets, such as window updates, keep-alives, and resets, from being silently dropped, which previously caused intermittent connection failures that were difficult to diagnose. If your existing environment requires "Application drop established (bidirectional)") to support post-quantum cryptography (PQC) fragmented TLS handshakes, refer to the documentation for guidance on switching to "Application drop established (server-directed only)") or adding the "to_server" flag to your TCP drop rules. This update is available in all AWS Regions where AWS Network Firewall is offered.

AWS Outposts now provides self-service capabilities for configuration, quoting, ordering, subscription management, renewal, and decommissioning directly from the AWS Management Console, CLI, and API. Previously, customers relied on AWS teams for managing their Outposts lifecycle, from evaluation through end of term. A new configuration and quoting tool generates real-time cost estimates across payment options and term lengths, and proactively surfaces account and regional constraints before order submission. Quotes are generated in seconds and can be converted to orders directly in the console, for both new deployments and capacity additions. Subscription details, including term dates and billing, are now available in the console and programmatically, eliminating the need to contact AWS for contract information. When your term approaches its end date, self-service workflows let you renew with a new term and payment option, or decommission your Outpost through a guided workflow that handles resource cleanup. These features are available in all commercial AWS Regions that support AWS Outposts.

Starting today, nested virtualization is now available on C7i, R7i, M7i, C8id, R8id, M8id, C7i-flex, M7i-flex, I7i, C8i-flex, R8i-flex, M8i-flex, and X8i instances, in addition to already available support on C8i, M8i and R8i instances. This capability is also now available in AWS GovCloud (US-East) and AWS GovCloud (US-West), in addition to existing support in all commercial regions. With nested virtualization capabilities, customers can create nested environments by running KVM or Hyper-V on virtual EC2 instances. This can be leveraged for use cases such as running emulators for mobile applications, simulating in-vehicle hardware for automobiles, and running Windows Subsystem for Linux on Windows workstations.

AWS Parallel Computing Service (PCS) now supports Amazon EC2 P6e-GB200 and P6e-GB300 UltraServer instances, enabling customers to run large-scale GPU workloads using the NVIDIA Blackwell architecture within Slurm-managed clusters. With P6e-GB200 UltraServers, users can access up to 72 NVIDIA Blackwell GPUs within one NVLink domain, providing 360 petaflops of FP8 compute (without sparsity) and 13.4 TB of total high bandwidth memory (HBM3e). P6e-GB300 UltraServers offer 1.5x GPU memory and 1.5x FP4 compute (without sparsity) compared to P6e-GB200. AWS PCS is a managed service that simplifies running and scaling HPC workloads on AWS using Slurm, integrating compute, storage, networking, and visualization tools while handling cluster operations with managed updates and built-in observability features.

AWS Compute Optimizer now provides improved visibility into IOPS and throughput spikes when delivering Amazon EBS volume rightsizing recommendations. It analyzes two additional Amazon CloudWatch metrics, VolumeIOPSExceededCheck and VolumeThroughputExceededCheck, which indicate whether a workload consistently attempts to exceed the provisioned performance of a volume in any given minute. By incorporating these signals, Compute Optimizer helps users make informed decisions to balance cost and performance for workloads that experience bursts of high IOPS or throughput. This enhancement is available in all AWS Regions where AWS Compute Optimizer is offered, except AWS GovCloud (US) and China Regions. The underlying CloudWatch metrics are available at no additional charge for all EBS volumes attached to Nitro-based EC2 instances, excluding standard and Multi-Attach enabled volumes. Users can get started via the AWS Management Console, and more information is available in the AWS Compute Optimizer User Guide.

Amazon MSK Provisioned clusters with Express brokers now support Intelligent Rebalancing across all existing clusters at no additional cost. Previously limited to newly created clusters, Intelligent Rebalancing is now available for all MSK Provisioned clusters running Express brokers, enabling customers to effortlessly benefit from automatic partition balancing when scaling their Express-based clusters up or down. Intelligent Rebalancing maximizes capacity utilization of MSK Express-based clusters by optimally rebalancing Kafka resources for improved performance, eliminating the need for customers to manage partitions themselves or through third-party tools. It performs these operations up to 180 times faster compared to Standard brokers. Clusters are continuously monitored for resource imbalance or overload based on intelligent Amazon MSK defaults to maximize cluster performance. When required, brokers are efficiently scaled without affecting cluster availability for clients producing and consuming data. Intelligent Rebalancing is now available on all MSK Provisioned clusters with Express brokers in all AWS Regions where Express brokers are offered.

Amazon CloudWatch Synthetics announces support for multilocation canaries, allowing developers and site reliability engineers to run the same canary across multiple AWS Regions simultaneously from a single point of management. Previously, monitoring application availability from multiple geographic locations required creating and managing separate canaries in each Region, adding operational overhead and increasing the risk of configuration drift. With multilocation canaries, you create and manage a canary in one primary Region, and CloudWatch Synthetics automatically replicates it to the additional Regions you choose, consolidating all run data, metrics, and artifacts in the primary Region. Multilocation canaries help you ensure consistent user experience worldwide, identify region-specific performance bottlenecks, and validate that third-party dependencies like CDNs and payment processors work across all locations. Replica canaries run independently, giving you resilient monitoring coverage across geographic locations. You can also configure alarms that activate only when issues are detected from multiple locations, increasing alert confidence and helping your team focus on real customer-impacting problems. Amazon CloudWatch Synthetics multilocation canaries are available in all AWS commercial Regions that support CloudWatch Synthetics. You can upgrade existing single-region canaries to multilocation by adding replica Regions without recreating them. For more information about regional availability, see the AWS Region table. To learn more about CloudWatch Synthetics, see Using synthetic monitoring in the Amazon CloudWatch User Guide. To get started, visit the Amazon CloudWatch product page.

AWS announces the general availability of a new Local Zone in Hanoi, Vietnam, bringing AWS infrastructure closer to end users. This Local Zone supports Amazon EC2 with C7i, M7i, and R7i instances, Amazon S3 with the One Zone-Infrequent Access storage class, Amazon EBS with Local Snapshots and volume types gp3, gp2, io1, sc1, and st1, Amazon ECS, Amazon EKS, Amazon VPC, AWS Direct Connect, and Application Load Balancer. AWS Local Zones extend core services closer to metropolitan areas, helping achieve single-digit millisecond latency, meet data residency requirements, and support AI/ML inference workloads.

Customers using Amazon Simple Notification Service (Amazon SNS) in the Asia Pacific (Seoul) Region can now send text messages (SMS) to subscribers in more than 200 countries and territories. Amazon SNS is a fully managed pub/sub messaging service that enables message delivery to multiple endpoints including AWS Lambda, Amazon SQS, Amazon Data Firehose, mobile devices, and email. With this launch, customers using SNS in the Asia Pacific (Seoul) Region can subscribe phone numbers to SNS topics and broadcast SMS messages via AWS End User Messaging.

Amazon SageMaker AI introduces new observability capabilities that allow customers to confidently run production generative AI inference workloads by providing comprehensive visibility into token performance, GPU health, inference component placement, and autoscaling behavior. This eliminates the manual effort of searching CloudWatch for per-endpoint metrics, correlating latency spikes with GPU saturation or KV cache exhaustion, and diagnosing slow scaling operations. The capability tracks inference performance metrics in real-time, including Time to First Token, inter-token latency, queue depth, and tokens per second, and surfaces them alongside infrastructure health. SageMaker AI's pre-built Insights dashboard in Amazon CloudWatch provides token latency, GPU utilization, inference component copy counts, scaling events, and cold start breakdowns in a single view with OpenTelemetry native metrics published automatically. This allows teams to quickly diagnose TTFT degradation, verify availability zone compliance, and tune autoscaling policies. Customers standardized on observability tools like Grafana can connect directly using the regional PromQL endpoint and import a pre-configured dashboard template.

Amazon Elastic Kubernetes Service (Amazon EKS) introduces customer-routed control plane egress, a capability that lets you route outbound Kubernetes API server traffic through your own Amazon VPC. This includes admission webhook callbacks, OpenID Connect (OIDC) provider lookups, and aggregate API server requests. With customer-routed control plane egress, this traffic flows through your VPC, where you control the routing, security groups, and egress path. Organizations with data perimeter requirements, compliance mandates, or private network infrastructure can use customer-routed control plane egress to reach private OIDC providers and webhook servers that are accessible only within their VPC, and control how that traffic routes through their network. To get started, set controlPlaneEgressMode to CUSTOMER_ROUTED when creating a new cluster or updating an existing cluster. To enforce this configuration organization-wide, use the eks:controlPlaneEgressMode IAM condition key with AWS Organizations Service Control Policies. Customer-routed control plane egress is available at no additional cost in all AWS Regions where Amazon EKS is available.

AWS has announced the availability of the Ministral-3-14B-Instruct-2512 model in Amazon SageMaker JumpStart, expanding the portfolio of foundation models for AWS customers. This model from Mistral AI provides state-of-the-art multimodal capabilities within a compact 14B-parameter architecture optimized for edge deployment, enabling customers to build advanced AI assistants, agentic systems, and vision-enabled applications on AWS infrastructure. The model excels in analyzing images and providing insights based on visual content, alongside text processing, agentic capabilities with native function calling and JSON output, and multilingual understanding across dozens of languages including English, French, Spanish, German, Chinese, Japanese, Korean, and Arabic. With SageMaker JumpStart, customers can deploy this model with just a few clicks to address specific AI use cases. To get started, navigate to the Models section of SageMaker Studio or use the SageMaker Python SDK to deploy the model to your AWS account. For more information about deploying and using foundation models in SageMaker JumpStart, see the Amazon SageMaker JumpStart documentation.

AWS has announced the availability of the all-MiniLM-L12-v2 model in Amazon SageMaker JumpStart, expanding the portfolio of models available to AWS customers. This model from Sentence Transformers maps sentences and paragraphs to a 384-dimensional dense vector space, enabling customers to build high-quality semantic search, text clustering, and sentence similarity applications on AWS infrastructure. all-MiniLM-L12-v2 excels at encoding sentences and short paragraphs into dense vector representations that capture semantic meaning, making it ideal for information retrieval, semantic search systems, document clustering, duplicate detection, and paraphrase identification. Its compact architecture delivers fast inference while maintaining strong embedding quality, well suited for production workloads that require efficient text representations at scale. With SageMaker JumpStart, customers can deploy this model with just a few clicks to address their specific AI use cases. To get started with this model, navigate to the Models section of SageMaker Studio or use the SageMaker Python SDK to deploy the model to your AWS account.

Amazon Connect Customer now supports the ability to interrupt an agent with a contact, overriding their usual routing configuration in case of urgent or time-sensitive work. For example, an agent may be waiting for a time-sensitive callback on their personal extension while taking customer service calls in the meantime. When that urgent call comes in, it can now ring the agent even if the agent is currently already on another call, so the agent can decide whether to put the first caller on hold to pick up the callback as well. You can also use this feature to directly assign certain contacts to a specific agent even though that agent has set themselves to a custom status where they normally could not be offered queued contacts. For example, you may want to ensure that a specific agent cannot take customer service calls while in “Back Office Work” but still allow calls to their personal extension to ring through, improving efficiency for urgent contacts. This feature is available in all AWS regions where Amazon Connect Customer is offered.

Amazon MQ for RabbitMQ now supports private networking, allowing brokers to connect to private resources within a VPC without exposing them publicly. This helps meet security and compliance requirements when brokers need to access private identity providers, other brokers, or self-hosted RabbitMQ brokers. Previously, such connectivity required workarounds with Network Load Balancer and NAT Gateway. Amazon MQ establishes this connectivity using Amazon VPC Lattice, AWS Resource Access Manager (AWS RAM), and AWS PrivateLink, managing the underlying infrastructure on behalf of users. Available for Amazon MQ for RabbitMQ brokers in all AWS Regions where Amazon VPC Lattice is available.

Amazon EC2 G7 instances are now generally available. Powered by NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs, G7 instances deliver up to 4.6x AI inference performance and up to 2.1x graphics performance compared to G6. You can use G7 instances for AI inference workloads such as language translation, video and image analysis, speech recognition, and recommender systems. Additionally, G7 instances accelerate graphics workloads such as creating and rendering real-time, cinematic-quality graphics, game streaming, and data analytics workloads such as large-scale data processing pipelines. G7 instances feature up to 8 NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs with 32 GB of memory per GPU, custom Intel Xeon 6 processors, and up to 700 Gbps of Elastic Fabric Adapter (EFA) networking bandwidth. You can start using Amazon EC2 G7 instances today in two AWS Regions: US East (Ohio) and US West (Oregon). You can purchase G7 instances as On-Demand Instances, as part of Savings Plans, or Spot Instances.

Amazon ECS service auto scaling now detects and responds to load changes faster with support for high resolution (20-second) metrics and metric publishing optimizations. In AWS benchmarking tests, time to trigger scale-out improved from 363 seconds to 86 seconds (76% faster, 4.2x), and total time to scale and provision new tasks improved from 386 seconds to 109 seconds (72% faster, 3.5x). Faster service auto scaling also enables you to reduce baseline capacity and lower compute costs while maintaining service reliability and performance as workload demand fluctuates. Amazon ECS service auto scaling automatically adjusts task counts to meet workload demand with comprehensive scaling policies, including predictive scaling for recurring traffic patterns, scheduled scaling for planned events, and target tracking to scale dynamically on real-time metrics. With today's launch, target tracking policies for CPU and memory utilization now support 20-second metric resolution, in addition to the default 60-second resolution, for faster scaling signal detection. To get started, use the AWS Console, CLI, CloudFormation, or AWS SDKs to configure 20-second resolution for CPU or memory utilization metrics when creating or updating your ECS service, then configure a target tracking policy selecting the corresponding high-resolution predefined metric. This feature is available in all AWS commercial and AWS GovCloud (US) Regions, across all ECS compute options: AWS Fargate, Amazon ECS Managed Instances, and Amazon EC2. High-resolution metrics are subject to standard CloudWatch charges; for a pricing example, see Amazon CloudWatch pricing. To learn more, see our documentation and the launch blog post.

AWS announces the availability of Ubuntu 24.04 LTS bundles for Amazon WorkSpaces Personal in the AWS China (Ningxia) Region, operated by NWCD. With this bundle, customers in China can launch Ubuntu WorkSpaces and benefit from updated Linux packages, toolchains, and security improvements exclusive to Ubuntu 24.04. The new Ubuntu 24.04 option provides access to the latest software ecosystem, improved security posture, and an extended support lifecycle. It also offers a migration path for customers running older Amazon Linux 2 WorkSpaces who wish to stay current with upstream packages and receive the longest available maintenance window from Canonical. Customers can start using the managed Ubuntu 24.04 WorkSpaces bundle by selecting it when creating a new Linux WorkSpace. This new bundle is available in the AWS China (Ningxia) Region. For pricing information, visit the Amazon WorkSpaces pricing page.

Amazon GameLift Servers now supports two significant container fleet improvements that enhance flexibility and inter-container communication for game server deployments. These new capabilities address common challenges faced by game developers using containerized architectures, providing greater control over container permissions and enabling seamless discovery of co-located containers on the same instance. You can now customize Linux capabilities for containers in your container group definitions, giving you finer control beyond Docker's default capability set. This is particularly valuable for game servers requiring specialized capabilities such as NET_RAW for custom networking protocols or SYS_PTRACE for attaching debuggers and profiling tools. Additionally, game servers can now call the new ListContainersNetworkInfo() server SDK action to retrieve comprehensive network information, including container name, ID, local IP address, and container group type for all containers running on the same instance. This enables automatic service discovery and simplified communication between game servers and auxiliary services like metrics collectors, logging agents, or caching systems. These improvements are available through the Amazon GameLift Servers console, AWS CLI, AWS SDK, and AWS CloudFormation. The ListContainersNetworkInfo() action is supported in server SDK 5.x for Go, C++, and C#, as well as in plugins for Unreal Engine and Unity. Both features are available in all AWS regions where Amazon GameLift Servers is supported, except China.

Amazon Relational Database Service (Amazon RDS) for SQL Server now supports higher volume-level limits for General Purpose (gp3) storage. With this update, each gp3 volume can scale up to 64 TiB in size (4X the previous 16 TiB limit), up to 80,000 IOPS (5X the previous 16,000 IOPS limit), and up to 2,000 MiB/s throughput (2X the previous 1,000 MiB/s limit). These improvements allow customers to run larger Microsoft SQL Server databases on Amazon RDS. Workloads with demanding I/O requirements such as high-throughput OLTP systems and large-scale analytical workloads can benefit from higher IOPS and throughput on a single volume with simplified storage management, achieving better performance for mission-critical SQL Server workloads. Additionally, you can configure up to three additional gp3 or io2 volumes per DB instance, increasing total capacity up to 256 TiB per instance. Pricing remains unchanged-customers pay for storage and any additional IOPS and throughput provisioned beyond the baseline default. For more information, refer to the Amazon RDS for SQL Server User Guide. See Amazon RDS for SQL Server Pricing for pricing details and regional availability.

Amazon Aurora MySQL-Compatible Edition and Amazon Relational Database Service (RDS) for MySQL now offer Amazon RDS Extended Support for MySQL 5.7 through June 30, 2029, from the previous end date of February 28, 2027. This applies to Aurora MySQL version 2 (with MySQL 5.7 compatibility) and RDS for MySQL version 5.7, giving customers additional time to plan and complete their upgrades to a supported major version while continuing to receive critical security patches and bug fixes. RDS Extended Support delivers security patches for critical and high CVEs, bug fixes for critical operational issues, and access to AWS Support within the standard Aurora and RDS SLAs. There is no price increase with this extension, and customers using RDS Extended Support for MySQL 5.7 will continue to pay Year 3 pricing through June 30, 2029. For pricing details, see Aurora pricing and RDS for MySQL pricing. We recommend upgrading to MySQL 8.0 or MySQL 8.4 compatible versions to benefit from the latest database features, performance improvements, and security enhancements. You can upgrade using Amazon RDS Blue/Green Deployments, in-place upgrade, or snapshot restore. To learn more, see the Aurora MySQL and RDS for MySQL user guides. This extension is available in all AWS Regions where Aurora MySQL and RDS for MySQL are available. Amazon Aurora is designed for high performance and availability at global scale with full MySQL and PostgreSQL compatibility. Amazon RDS for MySQL, PostgreSQL, and MariaDB make it simple to set up, operate, and scale open source deployments in the cloud. Visit the getting started pages for Aurora and RDS to begin.

AWS Graviton5-based M9g database instances are now generally available for Amazon RDS for PostgreSQL, MySQL, and MariaDB. These instances deliver up to 30% performance improvement and up to 23% price/performance improvement for on-demand pricing over Graviton4-based instances of equivalent sizes, depending on database engine, version, and workload. M9g DB instances are available in new 24xlarge and 48xlarge sizes, offering up to 192 vCPU, up to 100Gbps enhanced networking bandwidth, and up to 72Gbps of bandwidth to Amazon Elastic Block Store (Amazon EBS). These instances are now available in the US East (N. Virginia, Ohio), US West (Oregon), and Europe (Frankfurt) Regions.

AWS DevOps Agent now offers a release management capability in preview, reviewing code changes for release readiness and running autonomous release testing to help you ship code to production safely and with confidence. With this addition, AWS DevOps Agent works across both delivery and operations. It accelerates and validates the deployment of code changes, then keeps your applications running optimally across AWS, multicloud, and on-prem environments. With release readiness review, AWS DevOps Agent evaluates code changes for production safety during code generation by checking for drift from internal standards, dependency impacts, and access controls. It maps cross-repository dependencies to surface breaking changes before commit and uses deterministic proofs to review that infrastructure changes do not drift from AWS Well-Architected best practices. With release testing, AWS DevOps Agent generates and runs test plans for web and API-based applications in customer-provisioned environments, catching regressions, UX issues, and integration failures a human reviewer may miss. To get started with the preview, connect your code repositories and pipelines in your AWS DevOps Agent space. AWS DevOps Agent release management is available in the US East (N. Virginia) Region and at no additional cost during the preview period.

AWS HealthOmics now streams workflow engine logs from Nextflow, WDL, and CWL workflow runs to Amazon CloudWatch in real time. This provides immediate access to execution details during a run, including workflow orchestration events, task scheduling, import/export activity, and full stack traces on errors. Customers can set up CloudWatch alarms on log patterns to detect anomalies early, build dashboards for ongoing monitoring, and integrate with existing observability tooling. Available in all AWS HealthOmics regions: US East (N. Virginia), US West (Oregon), Europe (Frankfurt, Ireland, London), Israel (Tel Aviv), and Asia Pacific (Singapore, Seoul).

AWS Glue Interactive Sessions now supports Apache Spark Connect, allowing you to develop and run Apache Spark applications from your preferred environment, including managed notebooks in Amazon SageMaker Unified Studio or your preferred notebook environments and IDEs like Jupyter and Visual Studio Code, while running them on AWS Glue's serverless infrastructure without managing clusters. With Spark Connect, you submit Spark jobs to AWS Glue Interactive Sessions using a thin client architecture that decouples your client application from the Spark execution environment. This enables workflows such as ad hoc data exploration, iterative step-by-step debugging, and incremental PySpark job development before deploying to production, all from the tools you already use. Spark Connect also simplifies upgrades and improves stability by isolating client dependencies from the server-side Spark runtime. For observability, you get real-time session monitoring via the Spark UI, history tracking through the Spark History Server, and session management using the AWS Glue API, CLI, or SDK. AWS Glue Interactive Sessions with Spark Connect is available in Asia Pacific (Mumbai, Seoul, Singapore, Sydney, Tokyo), Canada (Central), Europe (Frankfurt, Ireland, London, Paris, Stockholm), South America (São Paulo), US East (Ohio, N. Virginia), and US West (Oregon). To get started, connect to Glue Interactive Sessions using Spark Connect from notebooks in Amazon SageMaker Unified Studio, your favorite IDE with a Python interpreter, or the AWS API, SDK, and CLI. To learn more, visit the AWS Glue Interactive Sessions documentation.

AWS announces the general availability of the managed agent harness in Amazon Bedrock AgentCore, enabling teams to go from idea to working agents in minutes. The harness handles orchestration loop execution, tool execution, context window management, state persistence, failure recovery, and session isolation. Instead of coding the loop, customers define an agent in configuration: the model it uses, the tools it calls, the skills it accesses, and the instructions it follows. AgentCore assembles and runs that loop from a single definition, producing a production-grade agent in minutes with a filesystem, shell, memory, AWS-curated skills, and web browsing. The harness is decoupled from the model, allowing customers to choose any model and switch providers mid-session without losing context. It is part of a single platform, reaching tools through the same gateway that enforces security policies and connecting the agent to organizational knowledge and web search. Identity, memory, and observability come from that same platform, ensuring every agent action is governed and traced from the first call. When custom orchestration is needed, a single CLI command exports the harness to Strands-based code on the same compute and primitives, with Claude Agent SDK coming soon as an export target.

Amazon Quick now connects to 16 additional tools, allowing teams to act on insights from their data, analytics, design, and communication apps without switching context. New connectors include Adobe, Cisco Video Messaging, Cisco Webex Meetings, Dun & Bradstreet, Figma, Google Chat, HG Insights, Microsoft OneNote, Moody’s, Shopify, Smartsheet, Snowflake, Visier, WhatsApp, Zapier, and ZoomInfo. With this expansion, Quick now integrates across productivity, design, analytics, data infrastructure, financial intelligence, commerce, and communication covering the tools teams already rely on and making it easier to build workflows that combine multiple tools in a single conversation. For example, a revenue team can enrich account data from Dun & Bradstreet, cross-reference it against a Snowflake dataset, and track outreach tasks in Smartsheet without leaving Quick. Teams can add new tools to their workspace in minutes and immediately start incorporating them into Quick Flows, Chat, and Spaces alongside their existing integrations. These integrations are available in all AWS Regions where Amazon Quick is available

AWS has announced the public preview of AWS Blocks, an open-source TypeScript framework for application developers who want backend capabilities on AWS without needing to learn infrastructure tools. AWS Blocks runs a fully functional local environment with Postgres, authentication, and real-time messaging, no AWS account required. When ready to deploy, the same application code runs on production AWS services with zero changes, and developers can drop into AWS CDK at any point for direct resource configuration. A developer building a SaaS application can add database tables, user authentication, AI agents, file uploads, and background jobs in a single session, test the full stack locally, and deploy to AWS when ready. Built-in guidance for AI coding tools enables correct architecture without custom configuration, and end-to-end type safety flows from the data schema to the frontend without a code generation step. At preview, supported frontend frameworks include SPAs (e.g., Vite + React) and SSR frameworks such as Next.js, Nuxt, and Astro. AWS Blocks is available at no additional charge; you only pay for the AWS services your application uses. AWS Blocks deploys to all commercial AWS regions.

Amazon Redshift is expanding the general availability of RG instances-powered by AWS Graviton processors-to three additional AWS Regions: Africa (Cape Town), Asia Pacific (Bangkok), and Mexico (Central). Amazon Redshift's new Graviton-based RG instances deliver up to 4.2X better price-performance for data warehouse workloads compared to other data warehouses, run workloads up to 2.4x faster than previous-generation RA3 instances, and cost 30% less per vCPU. Customers in Cape Town (af-south-1), Bangkok (ap-southeast-7), and Mexico Central (mx-central-1) can provision rg.xlarge and rg.4xlarge node types-ideal for a wide range of workloads from smaller development environments to production data warehouse deployments. Customers can upgrade their existing RA3 provisioned instances to RG instances and immediately benefit from improved query performance and reduced compute costs. RG instances come with additional cost savings built in by default. With Amazon Redshift incremental manual snapshots, customers now pay less for backup storage as snapshot costs are metered based on unique data blocks rather than total snapshot size. Additionally, RG instances eliminate Redshift Spectrum scanning charges, meaning customers no longer pay for data scanned in Amazon S3 via Spectrum-further reducing the total cost of running data lake queries.

AWS Sign-in now supports resource-based policies and resource control policies (RCPs) for the AWS Management Console. These policies allow you to restrict console sign-in to expected networks. Policies are evaluated during sign-in and whenever the console session requests new credentials. Resource-based policies apply to individual AWS accounts, while resource control policies apply organization-wide through AWS Organizations. You can combine these policies with AWS Management Console Private Access to control both which networks users can sign in from and which accounts they can access. AWS Sign-in resource-based policies and RCPs are available at no additional cost in all AWS commercial Regions.

Web Search is now generally available on Amazon Bedrock AgentCore. This feature eliminates the need for developers to integrate external search providers, manage authentication, and handle security and compliance across multiple services when adding web search to agents. Built on Amazon’s proven search infrastructure, it combines a web index with structured knowledge graph data to deliver high-precision responses. Using the Model Context Protocol, it returns ranked results with relevant snippets, source URLs, titles, and publication dates. Currently available in the US East (N. Virginia) region.

AWS Transform for mainframe now delivers a connected, traceable reimagine experience from assessment through code generation. Previously, modernizing mainframe applications required months of analysis across multiple tools for discovery, reverse engineering, and code generation with manual handoffs between phases. With this launch, enterprises running z/OS COBOL and PL/I workloads can assess their portfolio to identify discrete business functions, extract business rules, generate development-ready requirements, and produce traceable cloud-native code in a single connected workflow. The experience starts with a portfolio assessment, where AWS Transform systematically identifies and catalogs discrete business functions. Selected business functions flow directly into the reimagine workflow, creating a connected path from portfolio analysis through code generation. For each business function, AWS Transform generates development-ready requirements with full traceability, flowing directly into Kiro and other IDEs through MCP-based integrations. Teams can generate interactive documentation for any requirement or code directly in the IDE. Every requirement traces back to the source code, so teams can audit any transformation decision back to its origin. This end-to-end approach compresses what previously took years of manual effort into months of automated, evidence-based modernization. These capabilities are available in all AWS Regions where AWS Transform for mainframe is available.

Automated Reasoning checks in Amazon Bedrock Guardrails use formal verification techniques to validate AI model outputs with mathematical rigor, offering a fundamentally different approach from traditional sampling-based testing methods. This capability addresses critical challenges in deploying generative AI applications, including AI hallucinations, policy compliance violations, and ambiguous responses that can undermine trust in AI systems. Organizations in regulated industries such as finance, healthcare, and legal services, as well as any enterprise requiring unambiguous validation of AI outputs, can now leverage this advanced verification capability. The feature delivers up to 99% accuracy in detecting correct responses from large language models, offering provable assurance through mathematical guarantees rather than probabilistic testing. Automated Reasoning checks help enterprises meet regulatory requirements for AI deployment while significantly reducing risks associated with incorrect or fabricated model outputs.

Amazon S3 Vectors can now return up to 10,000 similarity search results per query, a 100x increase from the previous limit. The higher result limit helps you retrieve a larger, more comprehensive set of candidates during similarity queries. This is especially valuable for applications with multi-stage retrieval pipelines that need to apply additional processing such as reranking, aggregations, or deduplication to produce a more relevant final result set. To get started with the higher limit, use the latest AWS SDK and update your application code to specify up to 10,000 relevant results (topK nearest neighbors) when making a QueryVectors API request. Query results are now returned across multiple pages, and you can start processing the first page immediately while retrieving additional pages as needed. For queries that return larger result sets, you pay a small data-returned fee based on the total size of results returned. The first 512 KB of data returned per query is free. For full pricing details, visit the S3 pricing page. S3 Vectors supports retrieving up to 10,000 results per query in all AWS Regions where it is available. To learn more about S3 Vectors, visit the product page and S3 User Guide.

AWS Transform now provides a model-to-model migration custom transformation for generative AI workloads. This transformation assesses workloads and produces a comprehensive migration plan for moving from third-party providers to Amazon Bedrock. An AI-powered agent scans the codebase, identifies all AI SDKs and models in use, gathers migration requirements through interactive questions, and maps models to Bedrock equivalents with transparent cost comparisons and production-ready code changes. This managed custom transformation helps organizations consolidate AI workloads on AWS, gaining IAM-based security, VPC endpoint isolation, prompt caching, Amazon Bedrock Guardrails, and unified operational tooling via Amazon CloudWatch. The transformation supports migrations from OpenAI, Google Gemini, direct Anthropic SDK usage, and open-source models via LiteLLM or Ollama. It handles direct SDK integrations, framework-wrapped patterns such as LangChain and LlamaIndex, agentic architectures including CrewAI and LangGraph, and multi-provider routing layers-preserving application architecture while swapping only the model layer. The agent includes intelligent cost optimization with tiered model routing recommendations, prompt caching analysis, and model lifecycle awareness that excludes models within 90 days of end-of-life from all recommendations. For some workloads, it recommends Amazon Bedrock's OpenAI-compatible endpoints as a zero-code-change migration path. AWS Transform model-to-model migration is available in all AWS Regions where AWS Transform is offered, at no additional charge beyond standard AWS Transform pricing. To get started, install the ATX CLI and run the mke-genai-model-migration custom transformation against your codebase.

Amazon Bedrock Guardrails now offers the InvokeGuardrailChecks API, a new resourceless API that allows you to apply individual safeguards at any point in your agentic AI applications without creating guardrail resources. The API provides granular, per-request control over which safeguards to run at each step of your agent loop, returning numeric severity and confidence scores so you can implement custom thresholds and actions, whether to block, pass, retry, or log based on your specific requirements. Agentic AI applications operate through iterative loops, and each step carries a different risk profile. The InvokeGuardrailChecks API operates in detect-only mode with no guardrail IDs to track and no versions to manage. You specify which safeguards to run directly in each request. The API supports content filters, prompt attack detection, and sensitive information filters. Prompt attack detection is exposed as a separate safeguard. The InvokeGuardrailChecks API is available in US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (London), Europe (Stockholm), Asia Pacific (Tokyo), and Asia Pacific (Sydney).

AWS Security Agent (now part of AWS Continuum) now includes threat modeling, an AI-powered capability that automatically generates threat models for applications. Currently available in public preview, AWS Security Agent analyzes design documents or application source code, understands the full context of the application architecture, and identifies threats with recommended mitigations using the STRIDE framework. Threat modeling is critical but often requires specialized expertise and significant manual effort. This capability brings agentic AI reasoning to the process by deeply analyzing code and documentation to understand architecture, data flows, and trust boundaries, then producing a contextually relevant threat model with actionable mitigations across all six STRIDE categories. Developers can integrate the agent into IDEs such as Kiro and Claude Code to create threat models from specifications and address threats early in the design phase. Security teams can use it for pre-deployment assessments against design documents and source code. The threat modeling capability is available in all regions supported by AWS Security Agent at no additional cost during the public preview.

Amazon Bedrock Managed Knowledge Base, a fully managed retrieval-augmented generation (RAG) service, is now generally available. With Managed Knowledge Base, developers can build production-ready AI agents grounded in enterprise data without managing vector databases, data pipelines, or retrieval infrastructure. The service handles data ingestion, storage optimization, and advanced retrieval so teams can go from prototype to production faster. Amazon Bedrock Managed Knowledge Base includes six native data source connectors-Amazon S3, SharePoint, Confluence, Google Drive, OneDrive, and Web Crawler-with automatic data syncing and managed vector storage optimized for price-performance. Advanced retrieval capabilities include hybrid search, document ranking, and agentic retrieval that automatically orchestrates query planning, interim response evaluation, and re-ranking for complex multi-hop queries. You can use Managed Knowledge Base to power employee assistants, automate customer support, or build multimodal knowledge bases spanning text, video, audio, and images. The service integrates natively with Amazon Bedrock AgentCore, enabling you to connect your knowledge base to agents with auto-generated permissions and built-in observability. Amazon Bedrock Managed Knowledge Base is available today in the US East (N. Virginia), US West (Oregon), Asia Pacific (Sydney, Tokyo), Europe (Dublin, Frankfurt, London), and AWS GovCloud (US-West) Regions.

AWS Secrets Manager now offers a secret safety skill as part of the aws-core plugin in the Agent Toolkit for AWS, an open-source repository that equips AI coding agents with tools, knowledge, and guardrails for building on AWS. This skill enables developers to use secrets within agentic workflows without ever exposing secret values to the underlying model or session logs. Previously, developers using AI coding agents could retrieve secrets as plain text without guardrails, bringing sensitive values into agent context. The skill uses a two-layer approach: first, it steers the agent so the model never requests or receives raw secret values-instead prompting the developer to clarify intent and constructing a command that uses the secret rather than retrieving it. Second, a child process resolves secret references to actual values only at execution time, outside the agent process. Together, these layers ensure plaintext secrets never appear in model context, session logs, or agent memory-without disrupting the developer's workflow. The secret safety skill is available today for all agent harnesses supported by the Agent Toolkit for AWS-including Claude Code, Codex, and Cursor-and in all AWS Regions where Secrets Manager is available.

Oracle Database@AWS now supports Oracle Autonomous AI Database Serverless (ADB-S), a fully managed Oracle database service on Exadata infrastructure that automatically handles patching, tuning, and scaling. ADB-S is available through both public and private offers on AWS Marketplace, with support for Bring Your Own License and License Included options. With ADB-S, you can provision an Oracle Autonomous AI Database directly from the AWS Management Console, AWS CLI, or AWS APIs without provisioning dedicated Exadata infrastructure or VM clusters. ADB-S supports four workload types - AI Transaction Processing, AI Lakehouse, AI JSON Database, and Oracle APEX - with compute and storage that scale independently based on workload demand. ADB-S includes Autonomous Data Guard for high availability and disaster recovery, automated backups to Amazon S3, and cross-Region disaster recovery. ADB-S integrates with AWS Key Management Service (KMS) for encryption, Amazon CloudWatch for monitoring, and Amazon EventBridge for event management. Oracle Autonomous AI Database Serverless on Oracle Database@AWS is available in the US East (N. Virginia) and US West (Oregon) AWS Regions. To learn more, visit Oracle Database@AWS and the Oracle Database@AWS User Guide. To get started, subscribe through AWS Marketplace.

Today, AWS announces AWS Continuum, which discovers, prioritizes, validates, and remediates security risks at machine speed within guardrails you define. Frontier models have made finding software vulnerabilities faster and cheaper, but the harder work comes after: deciding which vulnerabilities matter to your business, proving which are exploitable, and fixing them without days of cross-team coordination. AWS Continuum closes that gap, so your security team shifts from manual triage to setting direction and approving outcomes. AWS Continuum for code vulnerabilities, available in gated preview, works the full lifecycle of a vulnerability at machine speed. It ingests findings from your existing tools and its own scans, prioritizes each one using a context graph of your environment and business, and validates which are exploitable by building reproducible proof in an isolated sandbox. Confirmed exposures then receive fast, reversible mitigations within your guardrails, followed by durable fixes that route through your own review and deployment process, with blast radius visibility and rollback. AWS Security Agent penetration testing and code scanning are now available as Continuum penetration testing and Continuum code scanning (preview). AWS is also launching Continuum threat modeling in preview, which automatically generates more comprehensive threat models from design documents or source code and outputs results in STRIDE format. AWS Continuum works alongside your existing AWS security services, including Amazon GuardDuty and AWS Security Hub

AWS announces the preview of business context and semantic search for AWS Glue Data Catalog, helping users discover and understand data by semantic meaning. Users can now enrich Glue Data Catalog tables, including those backed by S3 Tables, with glossary terms and custom metadata fields. Skills can also be added to the catalog to direct agents to additional context about the data. With business context indexed alongside technical metadata, the new Glue Search API can find data by semantic meaning, grounding AI agents in trusted definitions rather than inferred context. The new search capability allows users to find tables in the catalog by their structure, such as schema and table format, and by the business meaning attached through glossary terms and descriptive metadata fields. This means an analyst exploring data or an agent reasoning about it can retrieve a table's definition, what its data represents, and how to use it correctly, in a single step. Any MCP-compatible agent, including Claude Code, Kiro, Cursor, and Codex, can get started with virtually no setup using the aws-data-analytics plugin from the Agent Toolkit for AWS.

Today, AWS announces that Amazon Bedrock AgentCore now supports Bedrock Guardrails in policy, giving enterprises deeper safety and security controls as they scale AI agents in production. AgentCore policy is an authorization capability within Amazon Bedrock AgentCore that controls which actions AI agents are authorized to take. Guardrails provide defenses against top security and safety risks with AI agent workloads, including prompt injection attacks and sensitive data exposure. Guardrails can evaluate the outputs of every authorized agent action and inputs of every call to a gateway target (tools, agents, and models) in real-time, helping detect and block prompt injection attacks, harmful content, and sensitive information exposure before they reach downstream systems. Guardrail results are evaluated in policy at the AgentCore gateway perimeter, outside the agent's code, ensuring consistent enforcement regardless of agent autonomy. All policy evaluations are logged via AgentCore observability for optimization and auditing purposes. AgentCore policy works with existing AgentCore gateway deployments and requires no new infrastructure. Customers author policies through natural language or policy-as-code, with consumption-based pricing for policy evaluations. Bedrock Guardrails are available in policy in US East (N. Virginia), Europe (London), Europe (Stockholm), Asia Pacific (Sydney), and Asia Pacific (Tokyo).

Today, AWS announces new optimization capabilities in AgentCore that turn production traces into continuous improvement for agents. The most dangerous agent failures are not the ones that throw errors; they are the silent ones that look fine on dashboards. These failures produce no error signal and often surface through customer complaints weeks later. AgentCore closes that gap with a loop to understand what agents are doing, generate fixes grounded in data, and prove they work. To understand agent behavior, AgentCore surfaces failure, intent, and trajectory insights across hundreds of sessions, revealing patterns no dashboard or one-at-a-time trace review would catch. Failure insights discover recurring failure patterns, including silent behavioral failures, explain the root cause of each, and rank them by how widespread they are, so teams can fix the problems hurting the most users first. Intent insights cluster requests by what users were trying to do, and trajectory insights group the paths agents take through a task, surfacing common patterns and outliers. Customers can enable continuous monitoring or run a targeted investigation in minutes. To fix issues with confidence, recommendations analyze traces and evaluation outputs to suggest specific improvements to system prompts and tool descriptions, grounded in how the agent actually behaves. Each recommendation includes a clear rationale tied to observed failures and comes ready to validate, not a generic suggestion but a targeted change derived from production data. Before a change reaches users, batch evaluation tests recommendations against a defined test dataset and reports aggregate scores across multiple evaluators, catching regressions early. Customers define what "good" looks like, and batch evaluation measures each candidate change against that bar at scale. A/B testing then confirms improvements hold under real conditions, running a controlled comparison between agent versions by splitting live production traffic and measuring outcomes side by side. This provides statistical evidence that a change actually works in production, not just on test data, before customers commit to rolling it out fleet-wide. These capabilities work regardless of where agents run: on AgentCore’s runtime, AWS Lambda, Amazon EKS, or non-AWS environments. Failure, intent, and trajectory insights are available in preview today in 13 AWS Regions. Batch evaluations, recommendations, and A/B tests are generally available today in 14 AWS Regions. To learn more, visit Amazon Bedrock AgentCore or explore the documentation.

Amazon Quick now offers autonomous agents and multi-dataset analytics capabilities. Autonomous agents allow users to specify tasks in natural language with granular autonomy levels, from step-by-step approval to broad goal-based execution, automating workflows continuously and eliminating manual repetitive work and notification overload. The new multi-dataset analytics feature enables users to query across data sources including Snowflake and relational databases using natural language, without requiring technical data preparation or pre-joining datasets. Quick leverages semantic intelligence from existing data catalogs such as AWS Glue, Databricks Unity Catalog, and Collibra, enforcing security through identity propagation that respects existing permissions. The redesigned activity feed provides a personalized, conversational interface where users can prioritize updates using thumbs up/down feedback, reply to emails and Slack messages, and approve requests directly-all without switching between applications. Users can also share Quick applications as public websites, extending collaboration capabilities beyond their organization.

AWS announces the availability of bmn-cx3a instances on second-generation AWS Outposts racks. Bmn-cx3a instances feature 5th Gen AMD EPYC processors with a maximum frequency of 4.1 GHz and NVIDIA ConnectX-7 (CX7) network interface cards, delivering up to 800 Gbps of bare-metal accelerated network bandwidth operating at near line rate. Bmn-cx3a instances offer up to 256 cores and 1.5 TB of memory across two sizes, bmn-cx3a.metal-32xl and bmn-cx3a.metal-64xl, with 2x 8 TB NVMe SSD storage. With native Layer 2 (L2) multicast and hardware Precision Time Protocol (PTP) support, bmn-cx3a instances are designed for high-throughput workloads such as real-time market data ingestion and distribution, market and risk analytics, telecom 5G core network applications, and media distribution. Bmn-cx3a instances on AWS Outposts racks are available in all countries and regions where second-generation Outposts racks are supported.

AWS Management Console Private Access has been updated to allow traffic through VPC endpoints for supported service consoles. This enables enterprises to manage their AWS infrastructure through the console while maintaining strict network security controls. AWS PrivateLink establishes secure network paths between customer VPCs and the console. Customers can apply VPC endpoint policies to restrict access to specific AWS accounts and organizations, and use IAM, Service Control, and Resource Control policies to require that employees access resources only from authorized networks. This capability is available in all AWS commercial regions, and you only pay for the underlying AWS PrivateLink VPC endpoint usage and data processing.

AWS DevOps Agent now supports custom SRE agents, enabling teams to create and schedule agents within Agent Spaces to run on a cadence. For example, teams can create a daily database health report that checks for slow queries and parameters needing tuning, or build an agent that reviews logs from the past 24 hours and flags anomalies. In headless mode, developers can invoke DevOps Agent from the tools and agents they already use via A2A or MCP protocols. For example, the Kiro power for AWS DevOps Agent allows developers to check production health and investigate issues without leaving their IDE. Teams can also connect their own sub-agents built with Amazon Bedrock or third-party frameworks via A2A to extend DevOps Agent capabilities. The agent also introduces chat enhancements, incident-skip support based on customer-defined rules, enhanced knowledge with memories and Git-managed skills, human labeling and customer-created dashboards for tracking task quality, and is now available in five new Regions.

AWS Partner Central now provides lead enrichment and prospecting, allowing AWS Partners to enrich AWS-sourced or partner-sourced leads with AWS-generated propensity insights and recommendations for program, funding, and sales motion eligibility. Partners can upload leads via the AWS Partner Central console or programmatically using the AWS Partner Central API. For each lead, partners receive propensity-to-buy signals, including the likelihood of purchasing through AWS Marketplace and alignment with solution categories, along with account eligibility for the Partner Greenfield Program (PGP), Pioneer Credits, and Partner-Led Sales Motion. Lead enrichment and prospecting is available to all APN Customer Engagements (ACE) eligible AWS Partners through both AWS Partner Central and the AWS Partner Central API, available in the US East (N. Virginia) Region.

AWS Lambda Managed Instances (LMI) now supports tag propagation, allowing you to automatically apply tags to managed resources such as Amazon EC2 instances, Amazon EBS volumes, and Amazon ENIs. This helps enforce cost allocation, service control policies (SCPs), and compliance requirements across all resources provisioned by your capacity providers. LMI runs Lambda functions on managed EC2 instances with built-in routing, load balancing, and auto scaling, providing access to specialized compute configurations. Previously, organizations had no way to propagate tags to the underlying managed resources LMI provisions, making it difficult to track costs accurately, enforce SCPs, or meet compliance standards. Now, by specifying a set of tags in your capacity provider configuration, LMI automatically applies those tags to all managed resources it creates. This ensures consistent tagging across EC2 instances, EBS volumes, and ENIs without manual intervention or custom automation. The feature is available in all AWS commercial Regions where LMI is generally available. To get started, configure the PropagateTags setting on your capacity provider using the CreateCapacityProvider or UpdateCapacityProvider APIs, set the mode to Explicit, and provide your desired tags as key-value pairs. Tag propagation applies to all new managed resources provisioned after the configuration is applied. You can configure these settings using the AWS Management Console, AWS CLI, AWS CloudFormation, AWS CDK, or AWS SAM.

AWS announces Cost Explorer historical data retention for accounts in billing groups. Previously, billing group configuration restricted access to historical billing data (priced at AWS billable rates) for accounts mapped to billing groups. With this launch, accounts included in billing groups retain access to their historical billing data in Cost Explorer at their original billable rates. Accounts previously onboarded to Billing Conductor and Billing Transfer will gain access to their historical data with no additional action required, enabling reporting continuity for customers opting into AWS Billing Conductor and Billing Transfer. Billing Transfer is available today in all AWS Regions, excluding GovCloud, China (Beijing) and China (Ningxia) Regions.

The Amazon FSx for Lustre Intelligent-Tiering storage class is now available in 13 additional AWS Regions across Africa, Europe, Asia Pacific, and South America. This storage class provides the lowest-cost and only fully elastic Lustre file storage in the cloud, optimized for workloads with a mix of hot and cold data that do not require consistent SSD-level performance. It automatically tiers data across three storage tiers (Frequent Access, Infrequent Access, and Archive) based on access patterns, with an optional SSD read cache keeping active data fast. It delivers high performance for active data in HPC and AI/ML workloads and low-cost storage for data accessed less often, charging only for what is stored with no upfront capacity to provision. With FSx for Lustre Intelligent-Tiering, customers achieve up to 34% better price-performance compared to on-premises HDD file storage and reduce storage costs for rarely accessed data by up to 96% compared to other fully managed file offerings in the cloud. With this expansion, the FSx Intelligent-Tiering storage class is now available for FSx for Lustre file systems in the following additional AWS Regions: Africa (Cape Town); Europe (Milan, Paris, Spain, Zurich); Asia Pacific (Hyderabad, Jakarta, Malaysia, Melbourne, Osaka, Taipei, Thailand); and South America (São Paulo).

Amazon Elastic Container Service (Amazon ECS) Express Mode is now available in the AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. Express Mode allows developers to quickly launch containerized applications, including web applications and APIs, simplifying the orchestration and management of cloud architecture while maintaining full control over infrastructure resources. Each Express Mode service automatically receives an AWS-provided domain name, making the application immediately accessible without additional configuration. Applications using Express Mode incorporate AWS operational best practices, serve public or private HTTPS requests, and scale in response to traffic patterns. Express Mode automatically consolidates up to 25 services behind a single Application Load Balancer, using intelligent rule-based routing to maintain isolation between services. All resources provisioned by Express Mode remain fully accessible in the user's account, ensuring control and flexibility is never sacrificed. As application requirements evolve, users can directly access and modify any infrastructure resource, leveraging the full feature set of Amazon ECS and related services without disrupting running applications. To get started, provide the container image and Express Mode deploys the application and auto-generates a URL. Express Mode is available at no additional charge; users pay only for the AWS resources created to run their application. Deployment can be done via the Amazon ECS Console, SDK, CLI, CloudFormation, CDK, and Terraform.

Amazon Web Services announces the preview of Palo Alto Networks (PANW) Advanced DNS Security on Amazon Route 53 Resolver DNS Firewall. Security administrators can now enforce DNS threat protections from Palo Alto Networks directly on Route 53 DNS Firewall rules, without deploying separate firewalls or modifying VPC configurations-by subscribing to PANW from the DNS Firewall console through the embedded AWS Marketplace widget. With this launch, you can enforce DNS threat protections from Palo Alto Networks by deploying one or more security categories including Command and Control, Malware, Phishing, Newly Registered Domains, and more, directly within the DNS Firewall rule creation workflow. You can apply these protections for your DNS query traffic from Amazon VPCs and hybrid-cloud, forwarded via Route 53 Resolver Endpoints, providing unified DNS threat protection across AWS and on-premises environments. This integration complements AWS-managed domain lists with Palo Alto Networks' threat intelligence, including fast-flux protection, DNS tunneling detection, DNS rebinding protections, and DGA detection. It simplifies security operations by eliminating the need to deploy separate PANW firewalls per VPC or account, and supports multi-account management through AWS Resource Access Manager (RAM), Route 53 Profiles, and AWS Firewall Manager. Customers gain centralized visibility through AWS Security Hub findings and query logs stored in Amazon S3, Amazon Data Firehose, or Amazon CloudWatch Logs. Palo Alto Networks Advanced DNS Security on Route 53 DNS Firewall is available in preview in the following AWS Regions: US East (Ohio), US West (N. California), Europe (London), Europe (Frankfurt), Asia Pacific (Tokyo), Asia Pacific (Mumbai), Asia Pacific (Singapore), and Africa (Cape Town). DNS Firewall Advanced customers can add PANW rules to existing rule groups at no additional DNS Firewall charge, and the Palo Alto Networks Advanced DNS Security Marketplace subscription is free during preview. To get started, see the Route 53 DNS Firewall documentation. To view Route 53 pricing, visit the Route 53 pricing page. To learn more about the AWS Marketplace listing and pricing for PANW Advanced DNS Security, see here.

Amazon CloudWatch now offers Log Analytics, a unified console experience that combines CloudWatch Logs Insights for querying and analyzing log data, Live Tail for real-time log streaming, and Contributor Insights for identifying top contributors-all in one place. With this launch, customers can execute multiple queries across different tabs and utilize all existing Logs Insights features such as patterns, saved queries with parameters, facets for interactive log exploration, natural language query generation, and visualizations. Live Tail and Contributor Insights are also accessible from within Log Analytics, which serves as the default experience. Customers who opt out will see Logs Insights, Live Tail, and Contributor Insights alongside Log Analytics. Log Analytics is available in all commercial AWS Regions and uses the same pricing as its underlying capabilities-Logs Insights queries, Live Tail, and Contributor Insights.

Amazon FSx for OpenZFS now supports on-demand data replication across AWS opt-in Regions, allowing you to easily and efficiently transfer incremental point-in-time snapshots of your volumes beyond AWS Regions that are enabled by default. This feature provides a simple and resilient way to implement disaster recovery, replicate production data to a different Region or account, and enable lower latency data access for your global customer base or workforce. On-demand data replication across opt-in Regions is available in all AWS Regions where Amazon FSx for OpenZFS is offered, including supported opt-in Regions. There is no additional charge for on-demand data replication, and standard AWS data transfer charges apply when replicating across AWS Regions or accounts.

Amazon Bedrock AgentCore Memory extracts useful information from short-term memory and stores it as long-term memory records. Metadata on these records helps organize, filter, and route them for retrieval. Previously, metadata values could only be inferred by the LLM during extraction. Now, you can also attach metadata values directly from your application, ensuring they pass through extraction and consolidation exactly as supplied with no LLM inference. When you set a metadata key's extraction type to STRICTLY_CONSISTENT, the value you provide on the short-term memory event is the value that lands on the resulting long-term memory record unchanged. Strictly consistent metadata also isolates how events are grouped. Events sharing the same values are extracted together and consolidated together. Records with different values are never merged, even if semantically similar. This enables department-scoped retrieval, compliance boundaries between regulated and standard records, and multi-tenant memory where each tenant's data is processed independently. You can configure up to three strictly consistent keys per strategy. The feature is supported on semantic, user preference, and episodic strategies, including custom overrides. Keys must be of type STRING and declared in the memory's indexed keys. Both LLM-inferred and strictly consistent keys can coexist on the same memory resource. To get started, see Long-term memory metadata. Amazon Bedrock AgentCore Memory strictly consistent metadata is available in all AWS Regions where AgentCore Memory is supported.

AWS announces the availability of xAI's Grok 4.3 model on Amazon Bedrock. Grok 4.3 is a reasoning-first model offering configurable reasoning effort (none, low, medium, high) and strong tool use and instruction-following capabilities for building reliable agents. It is particularly suited for enterprise workloads such as customer support, web development, case law research, and financial document Q&A. The model runs on Mantle, a new inference engine in Amazon Bedrock designed for price performance, with support for tool calling, structured output, and response streaming.

AWS Transform now includes a new continuous modernization capability (preview) that autonomously detects, prioritizes, and remediates technical debt across enterprise software portfolios. The feature also assesses and remediates codebases for AI agents, and integrates with AWS Security Agent to detect and remediate security vulnerabilities at the source code level. Customers can use the AWS Transform web console, CLI, or coding agents to analyze code from GitHub, GitLab, Bitbucket, and other sources. The capability is available in the US East (N. Virginia) and Europe (Frankfurt) regions.

Amazon Elastic Compute Cloud (Amazon EC2) P6-B200 instances accelerated by NVIDIA Blackwell GPUs are now available in the Asia Pacific (Mumbai) Region. These instances offer up to 2x performance compared to P5en instances for AI training and inference. P6-B200 instances feature 8 Blackwell GPUs with 1440 GB of high-bandwidth GPU memory and a 60% increase in GPU memory bandwidth compared to P5en, 5th Generation Intel Xeon processors (Emerald Rapids), and up to 3.2 terabits per second of Elastic Fabric Adapter (EFAv4) networking. P6-B200 instances are powered by the AWS Nitro System, enabling reliable and secure scaling of AI workloads within Amazon EC2 UltraClusters to tens of thousands of GPUs. P6-B200 instances are currently available in p6-b200.48xlarge size in the following AWS Regions: US West (Oregon), US East (N. Virginia, Ohio), AWS GovCloud (US-West, US-East), and Asia Pacific (Mumbai) Region. To learn more about P6-B200 instances, visit Amazon EC2 P6 instances.

AWS Transform has introduced a new storage migration capability in public preview, enabling customers to migrate block storage workloads from any on-premises or cloud source to Amazon FSx for NetApp ONTAP (FSx for ONTAP), in addition to Amazon EBS. AWS Transform for migrations is an agentic AI service that automates the discovery, planning, and migration of workloads, accelerating infrastructure modernization with increased speed and confidence. FSx for ONTAP is a fully managed shared storage service built on NetApp's ONTAP file system, allowing customers to migrate on-premises applications that rely on NetApp ONTAP or other storage appliances to AWS without changing how they manage their data. AWS Transform has previously supported migrating block storage from any source vendor, including NetApp, Dell, Pure Storage, and VMware environments, to Amazon EBS as part of compute rehosting. Now, customers can also choose Amazon FSx for NetApp ONTAP as the migration target for workloads that require ONTAP capabilities post-migration. Traditionally, customers migrating to AWS have managed storage migration separately using additional tools and workflows. With this new capability, AWS Transform replicates block storage data directly to FSx for ONTAP volumes as part of the same migration wave that handles compute and network, eliminating the need for intermediate storage platforms, separate migration tools, and the additional cost and risk they introduce. Whether migrating from NetApp ONTAP or any other storage platform, including block storage or NFS datastores in VMware environments, customers access a fully managed service that combines ONTAP's enterprise capabilities with the scalability and resiliency of AWS services.

Amazon S3 introduces annotations, enabling users to attach up to 1GB of custom metadata in JSON, XML, or YAML format to S3 objects. This helps AI agents and analytics tools discover and use the right data. Annotations move with objects during copy and replication operations and are removed when the object is deleted. They complement existing metadata capabilities and can be queried at scale using S3 Metadata, which stores metadata in read-only Apache Iceberg tables queryable with Amazon Athena. Annotations are available in all AWS Regions.

AWS announces the general availability of onboarding capabilities for AWS Partner Central agents. The agent acts as an always-available advisor that guides new partners through every step required to be ready to sell with AWS, from profile setup to guidance to complete compliance requirements like verifications, tax, and payment setup, all the way to being ready to create listings on Marketplace. The agent builds complete partner profiles automatically, pulling facts from your company website to populate industries served, solutions offered, and key capabilities. The agent identifies what each partner needs to do next to be ready to sell with AWS and why, and provides step-by-step guidance through tax, banking, and compliance requirements. These agentic onboarding capabilities are available today in all commercial AWS Regions. To get started, log in to AWS Partner Central in the AWS Management Console and access agents by clicking on any of the default prompts available on the dashboard, or review the agents guide. To integrate into your own CRM or partner management tools, visit the Partner Central agents MCP server guide.

AWS Marketplace Storefront is now generally available, allowing AWS Partners to create and deploy their own branded catalog of solutions and services on their website or application within hours. Channel Partners and Independent Software Vendors can simplify how they manage their cloud marketplace business and make it easier for customers to discover and purchase their solutions from AWS Marketplace. With AWS Marketplace Storefront, Partners can configure a fully branded storefront with no code required, importing listings from AWS Marketplace and going live the same day. Transactions flow through AWS Marketplace billing infrastructure and appear automatically on customers' AWS invoices, eliminating the need to build or maintain separate payment systems. Partners can automate deal workflows with private offer templates, approval automation, and native CRM connectivity to tools like Salesforce and HubSpot. The storefront supports a curated catalog on the Partner's own domain, helping them maintain and strengthen customer relationships. For Channel Partners who resell multiple vendors' solutions, this means presenting each customer a tailored catalog of approved products and expanding it as their channel business grows, with listing automation and catalog management tools. This new capability is available in all AWS Regions where AWS Marketplace operates.

AWS has announced the Amazon Connect Customer Services Competency, a new AWS Specialization that helps customers identify Services Partners with proven expertise in transforming enterprise-wide customer experience on Amazon Connect Customer. The Amazon Connect Customer Competency recognizes Services Partners across two categories: Contact Center Transformation and AI-Powered Customer Experience. Partners validated in this Competency have demonstrated technical depth and proven success in migrating legacy contact centers and operationalizing AI at scale on Amazon Connect. This is the first AWS Competency directly aligned to an AWS service, replacing the Amazon Connect Service Delivery Program designation, which will be deprecated on June 1, 2027. AWS Partners on the Services Path who are validated or differentiated members and have demonstrated customer success with Amazon Connect are encouraged to apply.

AWS Partners co-selling with AWS can now use express private offers to automate pricing within co-sell workflows. Partners configure their pricing rules, discount boundaries, and eligible products once, and when AWS sales representatives identify their solution as a fit for a customer's needs, the deal can move from opportunity to private offer in minutes rather than weeks of manual negotiation. As AWS sellers identify relevant Partner solutions through co-sell tools, they can see which Partners have express private offers enabled and directly invite customers to receive personalized pricing. Customers specify their purchase requirements, contract duration, and configuration needs, and receive a tailored private offer based on the Partner's pre-configured pricing rules. Partners receive the customer's contact details and can follow up at any time to assist with offer acceptance or provide additional context. This gives Partners increased visibility in AWS-led sales motions, faster deal conversion, and the ability to engage with customers who have expressed purchase intent, while giving AWS sellers confidence that matched Partners can deliver customized pricing without delays. To get started, Partners can onboard their products to express private offers by following the AWS Marketplace Seller Guide. For best practices on co-selling with AWS, review this guide on improving your visibility to AWS Sales.

AWS Marketplace now offers a 0.5% listing fee for professional services private offers, reduced from 2.5%. This makes it more cost-effective for consulting partners, systems integrators, managed services providers and independent software vendors to transact their services through AWS Marketplace, while retaining the procurement and billing benefits that come with it. Professional services is an established and growing category on AWS Marketplace, with hundreds of partners actively transacting. The reduced fee complements capabilities purpose-built for the discovery and purchase of services through AWS Marketplace. Customers can find the right Partner through AI-powered discovery in Agent Mode, procure complete solutions through multi-product solutions that combine software and services in a single transaction, and pay through variable billing models like time-and-materials - all through AWS Marketplace. For Partners, these improvements make it simpler and more economical to transact professional services through AWS Marketplace. Partners with existing professional services listings benefit automatically, with the reduced fee applying to all new private offers going forward while existing offers and subscriptions continue at their original terms. The fee applies in all AWS Regions where AWS Marketplace operates, across all pricing models and currencies. To get started, Partners can review the seller documentation and list professional services through AWS Partner Central. Customers can explore professional services directly in AWS Marketplace.

Amazon S3 Vectors has reduced data processed charges for queries on vector indexes with over 10 million vectors by up to 80%. This reduction lowers costs for customers running similarity search across large-scale AI, RAG, and semantic search workloads. The new pricing applies automatically with no application changes required. While this change reduces costs for large indexes, we continue to recommend distributing vectors across multiple indexes for improved query performance. S3 Vectors query pricing reductions are effective today in all AWS Regions where S3 Vectors is available. For updated pricing information, visit the S3 pricing page. To learn more about S3 Vectors, visit the product page and S3 User Guide.

Amazon Relational Database Service (Amazon RDS) for SQL Server has launched memory-optimized X2m database instances. Based on the Amazon EC2 X2iedn instance, X2m database instances provide the Amazon RDS Optimize CPU feature, which allows customers to reduce SQL Server software licensing costs by 50% or more compared to Amazon RDS x2iedn database instances for memory-intensive database workloads. X2m instances offer up to 64 vCPUs, up to 4 TB memory, up to 256K IOPS, and up to 32:1 memory to vCPU ratio. To use the X2m instances, you can modify your existing RDS database instance or create a new RDS database instance from the RDS Management Console, or using the AWS SDK or CLI. X2m instances can be purchased using On-Demand pricing, and qualify for AWS Database Savings Plan. See Amazon RDS for SQL Server Pricing for up-to-date pricing of instances, storage, data transfer and regional availability.

AWS Partner Central now supports the Business Value Realization (BVR) motion, a new experience and funding motion for partners who drive customer adoption and business outcomes after deploying strategic AWS services. BVR helps partners drive business outcomes for their customers by structuring the AWS service adoption journey across defined stages, with funding tied to proven demonstrated value realization. Partners can now enroll in BVR through a self-service registration flow in AWS Partner Central, nominate customer opportunities, and track customer progress towards value realization. The new experience enables partners to track customer progression across structured adoption stages, with guided activities to help customers achieve desired outcomes. As partners drive customer adoption, AI agents in AWS Partner Central generate weekly adoption reports that surface highlights, risks, and recommendations, helping partners identify where customer users drop off and how tooling adoption is accelerating. When partners complete stages, funding is automatically disbursed through the AWS Partner Funding Portal without requiring separate requests. BVR is available in AWS Partner Central for consulting, system integrator, and managed services partners with advance or premier tier status and a qualifying domain competency.

AWS Partner Central now accepts SOC 2 Type II audit reports or AWS Well-Architected Framework Reviews (WAFR) reports to complete the Foundational Technical Review (FTR) in minutes. This streamlined process with AI-powered validation provides AWS partners with immediate feedback on their solution's validation against AWS Partner Network (APN) requirements. Partners receive approval or actionable feedback within minutes, accelerating solution validation and unlocking qualified software badges, APN program eligibility, and co-selling and funding benefits. The streamlined FTR aligns AWS partner validation with industry compliance standards recognized by enterprise customers. Partners with SOC 2 certifications can satisfy FTR requirements by submitting third-party reports in AWS Partner Central, while those without SOC 2 can submit WAFR reports generated in the AWS Well-Architected Tool. When issues are identified, partners receive specific AI-generated feedback with remediation steps for each failing control, enabling immediate iteration and re-submission. FTR is available to all partners for software solutions deployed on AWS and enabled for AWS Partner Revenue Measurement.

AWS Marketplace today announced AI-assisted product listing in Partner Assistant chat, helping Independent Software Vendors (ISVs) and Consulting Partners create high-quality product listings on AWS Marketplace using their existing digital assets. This new capability helps partners create listings optimized for discovery by buyers, while eliminating the time-consuming manual data entry and guesswork around meeting AWS Marketplace requirements. Partner Assistant automatically generates and validates product listing content by importing information from existing digital assets, including website URLs, PDFs, case studies, and product documentation. The AI-powered assistant creates content across all required product information fields, validates it against AWS Marketplace size and format requirements, and optimizes it for search. Users receive field-level recommendations based on AWS Marketplace best practices, with a quality score indicating where their listing stands relative to the standards that drive buyer engagement. Whether creating the first listing or managing multiple products, Partner Assistant streamlines the process while helping ensure listings are best positioned to be discoverable and considered by customers in AWS Marketplace. The AI-assisted product listing capability is available through the Partner Assistant chat in AWS Partner Central and the AWS Marketplace Management Portal (AMMP). For programmatic access, the Partner Agent MCP server can be used. This feature is not available in AWS GovCloud (US) Regions or China Regions.

Amazon CloudWatch now natively supports OpenTelemetry metrics. You can send metrics via the OpenTelemetry Protocol (OTLP) and query them using Prometheus Query Language (PromQL), with per-GB ingestion pricing and 15 months of storage included. This allows you to consolidate custom application metrics and AWS-vended metrics from more than 70 services into a single solution, queryable together in PromQL. CloudWatch exposes a Prometheus-compatible query API, so teams already using OpenTelemetry, Prometheus, or Grafana can use CloudWatch as a destination that fits seamlessly with their existing tools. Available in all commercial AWS Regions except Middle East (UAE), Middle East (Bahrain), and Israel (Tel Aviv). For pricing details, see the Amazon CloudWatch pricing page. To get started, see the Amazon CloudWatch metrics documentation.

Starting today, AWS Partner Central agents qualify every co-sell opportunity in real time and make recommendations that drive AWS engagement and accelerate deal progression. Building on the AWS Partner Central agents released on March 16, 2026, the agent can act on the partner's behalf through conversation to enrich the opportunity details. This eliminates waiting for manual review, so partners build a stronger pipeline and progress deals faster. Now, each opportunity is matched to a co-sell motion that determines AWS engagement: AWS field-engaged, where an AWS sales team collaborates directly; Agent-engaged, where the agent strengthens the submission to increase AWS engagement; and Partner-led, where the partner drives the deal with agent support. Across all motions, the agent provides customer insights, recommendations, and sales plays, and each opportunity receives an Opportunity Quality Score that measures co-sell readiness and directly influences how AWS engages. The agent recommends how to improve this score, and as the opportunity improves, the score and motion recalculate in real time, moving it closer to AWS engagement. The new enhanced experience is available today to AWS Partners in all commercial AWS Regions. To get started, log in to AWS Partner Central and access opportunity management. Partners can also use the agentic experience in native AI tools like Amazon Quick and Kiro, or through MCP in their own CRM. See the Partner Central agents MCP server guide to get started.

Amazon Relational Database Service (Amazon RDS) for MariaDB now supports community MariaDB minor versions 10.6.27, 10.11.18, 11.4.12, and 11.8.8. These minor versions include fixes for known security vulnerabilities in prior versions of MariaDB, as well as bug fixes, performance improvements, and new functionality added by the MariaDB community. You can leverage automatic minor version upgrades to automatically upgrade your databases to more recent minor versions during scheduled maintenance windows. You can also use Amazon RDS Managed Blue/Green Deployments for safer, simpler, and faster updates to your MariaDB instances. For more information about upgrading your database instances, including automatic minor version upgrades and Blue/Green Deployments, see the Amazon RDS User Guide.

Amazon Relational Database Service (Amazon RDS) for MySQL now supports new Amazon RDS Extended Support minor version 5.7.44-RDS.20260521. We recommend that you upgrade to this version to fix known security vulnerabilities and bugs in prior versions of MySQL. Amazon RDS Extended Support provides up to three years to upgrade to a new major version, helping meet business requirements. During Extended Support, Amazon RDS provides critical security and bug fixes for MySQL databases on Aurora and RDS after the community ends support for a major version. You can run MySQL databases on Amazon RDS with Extended Support for up to three years beyond a major version’s end of standard support date. Learn more about upgrading database instances and Extended Support in the Amazon RDS User Guide and Pricing FAQs.

Amazon RDS for MariaDB now supports MariaDB 12.3 in the Amazon RDS Database Preview Environment, allowing you to evaluate the latest Long-Term Support Release on Amazon RDS for MariaDB. This preview environment provides a sandbox where you can test applications and explore new MariaDB 12.3 capabilities before they become generally available. MariaDB 12.3 includes Oracle TO_DATE() function compatibility, a SQL Standard IS JSON predicate for native JSON validation, and a basic XML data type. It adds support for cursors on prepared statements and allows UPDATE/DELETE operations to read from Common Table Expressions. The query optimizer now handles reorderable LEFT JOIN statements and ordered scans over RANGE partitions more efficiently. Please refer to the MariaDB 12.3 release notes for more details. Amazon RDS Database Preview Environment database instances are retained for a maximum period of 60 days and are automatically deleted after the retention period. Amazon RDS database snapshots created in the preview environment can only be used to create or restore database instances within the preview environment. For pricing information, see Amazon RDS for MariaDB pricing. For further information, see Working with the Database Preview Environment.

Starting today, Amazon GameLift Servers provides network bandwidth in and out of AWS at no additional charge for all instance types from generation 6 and later, including On-Demand and Spot, with no commitment required. This change eliminates one of the most unpredictable cost components for game studio customers, offering the simplicity of bare-metal hosting with the global reach of AWS. Free network bandwidth requires no enrollment, pricing agreement, or configuration change, and existing customers on eligible fleets receive the benefit immediately. It is now available in all Amazon GameLift Servers supported regions except China.

Amazon Web Services announces the general availability of Amazon CloudWatch Query Studio, a unified querying and visualization experience that enables you to explore metrics from a single interface within the CloudWatch console. With Query Studio, a team operating services across multiple AWS accounts and regions can use PromQL or Metrics Insights to query OpenTelemetry and AWS vended metrics from a single workspace. Per-query cross-account and cross-region selectors make it easy to correlate latency and error rates across their entire fleet. They can build queries visually with guided builders for PromQL and Metrics Insights (SQL), then choose from visualization types including line, bar, scatter plot, heatmap, histogram, pie, gauge, and number widgets with dual y-axis configuration and series overrides. Query Studio also integrates with CloudWatch dashboards, supports Grafana imports, and provides keyboard shortcuts for running queries. Query Studio is available in all commercial AWS regions, except Middle East (UAE), Middle East (Bahrain) and Israel (Tel Aviv).

Amazon CloudWatch Metrics Centralization is now generally available. This feature allows you to define centralization rules through AWS Organizations to automatically replicate metrics from source accounts and regions into a centralized destination account. Central teams gain full ownership of the data for querying, alarming, compliance, and governance. The centralized metrics work with both CloudWatch and OpenTelemetry metrics, and are fully compatible with Metrics Insights, dashboards, alarms, Metric Math, anomaly detection, Metric Streams, and PromQL.

AWS WAF today announced AI traffic monetization, a new Bot Control capability that allows you to price, meter, and collect payment from AI bots and agents accessing your content and APIs. As AI agents increasingly support autonomous payments for the content and APIs they consume, AWS WAF now enables content owners and publishers to set a price for that access, accept payment through third-party providers, and grant scoped access directly at the edge. When an AI bot or agent requests a protected resource like an article, a data feed, or a licensed archive, AWS WAF returns a machine-readable HTTP 402 Payment Required response using the x402 open protocol for machine-to-machine payments. The response contains your prices to access the content, accepted payment methods, and license terms. The agent presents proof of payment, AWS WAF verifies it at the edge, issues a scoped access token, and serves the response within a single request cycle. With AWS WAF AI traffic monetization, you can configure pricing through the AWS WAF console, define AI bot or agent policies based on verification status (including Web Bot Auth signatures), and receive payouts in stablecoins to your preferred wallet. AWS WAF's integration with payment settlement and verification flows are provided by Coinbase's x402 Facilitator. Integration with Stripe for direct account payments and Machine Payments Protocol (MPP) support is coming soon. Publishers can apply differentiated pricing based on agent identity and intent, allow verified AI search crawlers at one price while charging a different price to unverified agents or training crawlers, and validate end-to-end configuration in test mode before going live. Revenue analytics are available directly in the AWS WAF console alongside the AI traffic analysis dashboard, giving publishers a unified view of agent traffic and the revenue it generates. Publishers receive payments directly from agents and manage disbursement through their chosen payment provider. AI traffic monetization is available to AWS WAF customers at no additional charge. Standard AWS WAF charges apply. Refer to AWS WAF pricing for details. This capability is available in all edge locations where AWS WAF Web ACLs are associated with Amazon CloudFront distributions. To get started, visit the AWS WAF console or explore the AWS WAF Developer Guide.

Amazon EC2 C7i instances powered by custom 4th Gen Intel Xeon Scalable processors (code-named Sapphire Rapids) are now available in the Israel (Tel Aviv) Region. C7i instances deliver up to 15% better price-performance versus C6i instances and are ideal for compute-intensive workloads such as batch processing, distributed analytics, ad-serving, and video encoding. They offer larger instance sizes, up to 48xlarge, and two bare metal sizes (metal-24xl, metal-48xl). These bare-metal sizes support built-in Intel accelerators: Data Streaming Accelerator, In-Memory Analytics Accelerator, and QuickAssist Technology, which facilitate efficient offload and acceleration of data operations and optimize performance for workloads. C7i instances also support new Intel Advanced Matrix Extensions (AMX) that accelerate matrix multiplication operations for applications such as CPU-based ML. Customers can attach up to 128 EBS volumes to a C7i instance, compared to up to 28 EBS volumes for a C6i instance, enabling processing of larger datasets, scaling workloads, and improved performance over C6i instances.

Amazon Elastic Compute Cloud (Amazon EC2) C8i instances are now available in the Europe (Stockholm) region. These instances are powered by custom Intel Xeon 6 processors, exclusive to AWS, delivering the highest performance and fastest memory bandwidth among comparable Intel processors in the cloud. C8i instances offer up to 15% better price-performance and 2.5x more memory bandwidth compared to previous generation Intel-based instances. They deliver up to 20% higher performance than C7i instances, with even higher gains for specific workloads. The C8i instances are up to 60% faster for NGINX web applications, up to 40% faster for AI deep learning recommendation models, and 35% faster for Memcached stores compared to C7i and C7i-flex. C8i instances are ideal for memory-intensive workloads, especially those requiring the largest instance sizes or continuous high CPU usage. They come in 13 sizes, including two bare metal sizes and a new 96xlarge size for the largest applications. To get started, sign in to the AWS Management Console. Customers can purchase these instances via Savings Plans, On-Demand instances, and Spot instances. For more information about the new C8i instances, visit the AWS News blog.

AWS is announcing the availability of high-performance, storage-optimized Amazon EC2 I7i instances in the AWS Europe (Paris) region. Powered by 5th Gen Intel Xeon Processors with an all-core turbo frequency of 3.2 GHz, these new instances deliver up to 23% better compute performance and more than 10% better price performance over previous generation I4i instances. Equipped with 3rd generation AWS Nitro SSDs, I7i instances offer up to 45TB of NVMe storage with up to 50% better real-time storage performance, up to 50% lower storage I/O latency, and up to 60% lower storage I/O latency variability compared to I4i instances. I7i instances are designed for x86-based storage-optimized workloads that demand very high random IOPS performance and real-time latency for accessing small to medium-sized datasets. The torn write prevention feature supports block sizes up to 16KB, helping customers eliminate database performance bottlenecks. I7i instances are available in eleven sizes-nine virtual sizes up to 48xlarge and two bare metal sizes-delivering up to 100Gbps of network bandwidth and 60Gbps of Amazon Elastic Block Store (EBS) bandwidth.

Amazon SageMaker AI now supports serverless model customization for the NVIDIA Nemotron 3 Nano model using supervised fine-tuning (SFT) and reinforcement fine-tuning (RFT). This popular open-weight model from NVIDIA has 30 billion total parameters. In addition to deploying this model on SageMaker AI, users can now adapt it to their specific domains and workflows. Model customization enables users to tailor foundation models with proprietary data, whether improving accuracy on domain-specific tasks, aligning outputs with organizational tone, or enhancing performance on new tasks using labeled data. With serverless customization, SageMaker AI handles all infrastructure provisioning and training orchestration, allowing users to focus on data and evaluation rather than cluster management, and only pay for what they use. Serverless model customization for NVIDIA Nemotron 3 Nano on SageMaker AI is available in US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), and Europe (Ireland).

Starting today, Amazon Lightsail is available in three additional AWS Regions: Asia Pacific (Hong Kong), South America (São Paulo), and Europe (Spain). This expansion brings the power and simplicity of Lightsail to customers across new geographies in Asia, South America, and Europe. With this launch, customers in these geographical regions can now enjoy lower latency and better performance for their applications while meeting local data residency requirements. The new Regions provide access to Lightsail's full range of features including instances that meet your compute needs, from general purpose to compute-optimized and memory-optimized bundles, as well as managed databases, container services, load balancers, and more, all with the same simple, predictable pricing that Lightsail customers love. Startups, small businesses, and developers in these regions can now run their applications closer to their end users with low latency. Lightsail is available in these AWS Regions: US East (Ohio, N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt, Ireland, London, Paris, Spain, Stockholm), Asia Pacific (Hong Kong, Jakarta, Malaysia, Mumbai, Seoul, Singapore, Sydney, Tokyo), South America (São Paulo). To learn more about Regions and Availability Zones for Lightsail, please refer to the documentation. You can create Lightsail resources in these AWS Regions through the Lightsail Console, AWS Command Line Interface (CLI), and AWS SDKs.

AWS Lake Formation now enables you to read and write the underlying data files in Amazon S3 for tables registered in the AWS Glue Data Catalog. This provides a single set of permissions for both SQL queries and direct file access using your existing Lake Formation table grants. With this launch, Lake Formation provides temporary, scoped credentials for registered S3 locations based on your table permissions. SELECT permissions grant read access, and SUPER permissions grant read and write access to the data at that location. This capability comes built-in with Amazon EMR 7.13 or later, allowing you to access data files directly from your Spark jobs for tasks that require file level access such as model training, feature engineering, or debugging data quality issues. You can also integrate your Apache Spark or Trino applications using APIs or through an open source plugin provided by AWS. Additionally, all access is logged in AWS CloudTrail to provide a unified audit trail across SQL and file-based operations on your tables. This feature is available at no additional charge in all AWS Regions where AWS Lake Formation is available.

Amazon Managed Workflows for Apache Airflow (MWAA) Serverless now supports emitting workflow and task state change events to Amazon EventBridge. This enables data engineering and platform teams to build event-driven automation for their Apache Airflow workflows. Previously, monitoring workflow execution required custom polling logic or manual observation. With this launch, MWAA Serverless can emit events when workflows transition between states, including started, running, succeeded, or failed, and when individual tasks change state, such as scheduled, succeeded, failed, or up for retry. This feature allows you to further automate your existing workflows-for example, using EventBridge notifications to trigger alerts when a production workflow fails, automatically restart dependent pipelines when an upstream workflow succeeds, or log state transitions to Amazon S3 for compliance and auditing. This feature is available in all AWS Regions where Amazon MWAA Serverless is available.

AWS Elastic Beanstalk now provides a CloudWatch Logs integration directly in the environment Logs tab of the Elastic Beanstalk console. Previously, customers had to navigate to the CloudWatch console to find the relevant log groups and log streams for their environments. With this launch, customers can view CloudWatch log events without leaving the Elastic Beanstalk console. The Logs tab displays log groups that an environment streams logs to, as well as log groups matching the aws/elasticbeanstalk/<env-name>/* prefix. Customers can select a log group to view its log streams, with the most recently active stream selected by default. A log stream dropdown allows switching between streams and filtering results. For deeper analysis, a View in CloudWatch dropdown provides direct links to the log group, log stream, or CloudWatch Logs Insights in the CloudWatch console. This feature is available across all Elastic Beanstalk platform branches in all AWS Commercial Regions and AWS GovCloud (US) Regions where Elastic Beanstalk is available.

Amazon Aurora PostgreSQL-Compatible Edition now supports PostgreSQL major version 18, starting with version 18.3. This release includes community improvements to query performance and database management, and introduces support for pg_roaringbitmap, a new extension that performs fast, memory-efficient set operations on large collections of integers. This enables use cases such as audience segmentation, tag-based filtering, and permission checks directly in the database without application-layer processing. PostgreSQL 18 introduces B-tree skip scans, which improve query performance and reduce index storage and maintenance overhead. Major version upgrades now retain optimizer statistics, ensuring consistent query performance immediately after upgrading without waiting for statistics to be regenerated. Logical replication can now stream large transactions in parallel, reducing replication lag and keeping downstream systems more current. You can upgrade your database using several options including RDS Blue/Green deployments, in-place upgrade, or restoring a snapshot. Aurora PostgreSQL 18.3 is available in all commercial AWS Regions and AWS GovCloud (US) Regions. Amazon Aurora is designed for unparalleled high performance and availability at global scale with full PostgreSQL and MySQL compatibility. It provides built-in security, continuous backups, serverless compute, up to 15 read replicas, automated multi-Region replication, and integrations with other AWS services.

Amazon CloudWatch Application Signals introduces service health ranking on the application map and new infrastructure, logs, and traces tabs on the service overview page. These capabilities allow operators to triage unhealthy services and inspect the underlying compute environment, log snippets, and trace details in one place, making it easier to find root causes without switching tools. Customers use Application Signals to monitor the health of distributed applications, but identifying why a service was unhealthy often required leaving CloudWatch to correlate infrastructure data across separate tools. The application map now ranks services by health and shows runtime indicators on service nodes for Amazon EKS, Amazon ECS, AWS Lambda, and Amazon EC2, along with a new infrastructure tab that surfaces the compute and runtime environment, its components, and curated default metrics with deep links to the relevant monitoring tools. In addition, the service overview page provides the infrastructure, logs, and traces tab, helping operators spot issues in context of their application. With health-ranked services on the application map and new infrastructure, logs, and traces tabs, operators can instantly identify their most degraded services and drill into the compute environment, error-producing log snippets, and slow or failing transactions - all without leaving Application Signals. These capabilities span workloads running on Amazon EKS, Amazon ECS, AWS Lambda, and Amazon EC2, giving teams a single pane to move from symptom to root cause in minutes instead of hours. These capabilities are available in all AWS Regions where Amazon CloudWatch Application Signals is supported.

Today, AWS is expanding support for Amazon Elastic Kubernetes Service (EKS) local clusters on AWS Outposts to first-generation and second-generation AWS Outposts racks running Amazon EC2 instances that boot from Amazon EC2 instance store. AWS Outposts provides static stability for Amazon EC2 instances backed by EC2 instance store, and AWS is now extending that benefit to Amazon EKS local clusters customers. With local clusters, the entire Kubernetes control plane runs on AWS Outposts, supporting advanced data residency requirements and mitigating the risk of impact from temporary network disconnects to the cloud. Amazon EKS local clusters on AWS Outposts backed by Amazon EC2 instance store use an updated architecture that brings greater operational and feature-level parity with Amazon EKS clusters in the cloud. The Kubernetes control plane on your Outpost is managed by Amazon EKS in a service-owned account, so you don’t need to manage etcd backups or logging agents on control plane instances. New Kubernetes versions and Amazon EKS platform versions are made available for local clusters as they’re released for Amazon EKS in the cloud. Local clusters deployed with the updated architecture support Amazon EKS add-ons, IAM Roles for Service Accounts, EKS Pod Identity, OIDC authentication, access entries, and Bottlerocket worker nodes (in addition to Amazon Linux 2023). The updated architecture and new capabilities are generally available on AWS Outposts racks backed by Amazon EC2 instance store in all commercial AWS Regions that support AWS Outposts racks. AWS Outposts that boot Amazon EC2 instances from Amazon EBS will continue to use the original local clusters architecture. For more information, see local clusters in the Amazon EKS user guide.

Amazon Quick now integrates with Snowflake Cortex AI through the Model Context Protocol (MCP). This allows teams to query their Snowflake data and documents using natural language and automate multi-step workflows directly within their Quick workspace. After setting up the connection using Snowflake's managed MCP server with OAuth authentication, users can ask questions across structured data through Cortex Analyst and retrieve insights from unstructured documents through Cortex Search. With this integration, users can build Flows in Quick that orchestrate Snowflake Cortex Agents to execute repeatable, governed workflows with consistent structured output. This is ideal for any multi-step process spanning structured data and unstructured documents. The same MCP connection is also accessible from Quick Chat and other Quick features. For example, users can ask ad-hoc follow-up questions or explore their Snowflake data conversationally alongside their automated flows. Quick intelligently routes relevant prompts to Snowflake Cortex AI and returns contextualized answers alongside enterprise knowledge stored in Quick Spaces, giving teams both the rigor of a structured process and the flexibility of a conversational interface. The Snowflake Cortex AI integration with Amazon Quick is available in all AWS Regions where Amazon Quick is available.

Amazon EC2 High Memory U7i-8TB instances (u7i-8tb.112xlarge) are now available in the AWS Europe (Paris) region. U7i instances are part of the AWS 7th generation and are powered by custom fourth-generation Intel Xeon Scalable processors (Sapphire Rapids). U7i-8TB instances offer 8 TiB of DDR5 memory, enabling customers to scale transaction processing throughput in a fast-growing data environment. U7i instances offer up to 45% better price performance over existing U-1 instances. U7i-8TB instances deliver 448 vCPUs and support up to 100 Gbps of Amazon EBS bandwidth for faster data loading and backups, 100 Gbps of network bandwidth, and ENA Express. U7i instances are ideal for customers running mission-critical in-memory databases like SAP HANA, Oracle, and SQL Server.

Amazon EC2 Capacity Blocks for ML is now available in AWS GovCloud (US-West) and AWS GovCloud (US-East), enabling government and regulated-industry customers to reserve GPU capacity for machine learning workloads. EC2 Capacity Blocks for ML allows you to reserve GPU instances in advance for a defined duration, giving you assured access to accelerated compute for short-duration pre-training, fine-tuning, rapid prototyping, and inference demand surges. Capacity Blocks deliver low-latency, high-throughput connectivity through colocation in Amazon EC2 UltraClusters. You can reserve capacity up to eight weeks in advance for durations up to 6 months, in cluster sizes of one to 64 instances. Capacity Blocks can also be shared across multiple accounts using AWS Resource Access Manager (RAM), helping organizations coordinate ML infrastructure investments and keep reserved capacity in continuous use across workloads. In AWS GovCloud (US), EC2 Capacity Blocks for ML is available on P6-B200 instances in AWS GovCloud (US-West), and P6-B200 and P6-B300 instances in AWS GovCloud (US-East). To get started, visit the EC2 Capacity Blocks documentation.

Amazon Elastic Compute Cloud (Amazon EC2) M9g and M9gd instances, powered by AWS Graviton5 processors, are now generally available. AWS Graviton5 processors are the fifth generation of custom-designed AWS processors, delivering the best price performance for general purpose workloads running on Amazon EC2. M9g instances serve a broad range of general-purpose workloads including application servers, microservices, gaming, caching, and containers, while also delivering the performance needed for agentic AI use cases like real-time reasoning, code generation, and multi-step orchestration. M9gd instances offer local NVMe-based SSD block-level storage for customers that require high-speed, low-latency local storage, such as media processing, batch and log processing, and applications that need access to temporary storage including caches and scratch files. M9g and M9gd instances deliver up to 25% better compute performance compared to AWS Graviton4-based M8g and M8gd instances. They are up to 30% faster for databases, up to 35% faster for web applications, and up to 35% faster for machine learning. These instances are built on the sixth-generation AWS Nitro System and are the first to feature the Nitro Isolation Engine, harnessing formal verification to provide mathematical assurance that customer workloads are isolated from each other and AWS operators, pioneering a new standard for mathematically proven cloud security. M9g and M9gd instances are available in US East (N. Virginia, Ohio), US West (Oregon), and EU (Frankfurt) regions. M9g and M9gd instances are available for purchase via Savings Plans, On-Demand, Spot instances, Dedicated instances, or Dedicated hosts.

Amazon VPC Flow Logs now supports EC2 resource tags and next-hop interface metadata. With EC2 resource tag support, you can embed tag values from your network interfaces, EC2 instances, and auto scaling groups. This eliminates the need to join flow log data with separate tag metadata to correlate records with specific workloads. With next-hop metadata support, you can capture details about the next-hop network interface for each flow, including its interface ID, subnet, Availability Zone, VPC, and interface type. These fields help you understand how traffic traverses through network resources such as NAT Gateways, Network Load Balancers, and Transit Gateways without requiring manual correlation of multiple data sources.

AWS announces the availability of the Gemma 4 family of open-weight models from Google DeepMind on Amazon Bedrock. The Gemma 4 family includes three variants-Gemma 4 31B, Gemma 4 26B-A4B, and Gemma 4 E2B-spanning dense and mixture-of-experts (MoE) architectures with built-in reasoning, native function calling, support for 35+ languages, and multimodal input across text, image, video, and audio. Gemma 4 31B is suited for reasoning- and coding-heavy workloads with a 256K-token context window, Gemma 4 26B-A4B targets cost- and latency-sensitive workloads, and Gemma 4 E2B is the smallest variant, designed for low-latency interactive use cases. Gemma 4 runs on a new innovation in Bedrock designed for price performance, with improved support for tool calling, structured output, reasoning, and response streaming, so customers can build reliable generative AI applications with open-source models. Gemma 4 models are available in the following AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), and Europe (Frankfurt).

Amazon ECS Managed Daemons now support inter-task visibility and communication, allowing customers to deploy tracing, profiling, and security agents that require access to application processes and shared IPC resources on ECS Managed Instances. With this launch, you can configure two new settings in ECS daemon definitions: pidMode controls whether the daemon can see all processes on the instance, and ipcMode controls whether the daemon shares an IPC namespace with other containers on the instance. Setting either to "shared" grants the daemon access to the respective namespace; the default of "none" keeps daemons isolated from application containers and other tasks. These settings let you run process-aware and IPC-dependent agents as ECS daemons instead of embedding them as sidecars in application task definitions. ECS places exactly one daemon task per managed instance and starts daemons before application tasks, so platform teams can deploy and update agents independently with consistent coverage across all workloads. This feature is now available in all AWS Regions at no additional cost.

Amazon EC2 future-dated Capacity Reservations enable customers to secure capacity up to 120 days in advance by specifying required capacity, start date, and commitment duration. With this update, customers can now cancel their future-dated reservations. If a cancellation charge applies, EC2 presents a quote with exact terms for review and acceptance before the cancellation takes effect. Any cancellation charges can be tracked in the AWS Cost and Usage Report (CUR) 2.0 under a new value in the Capacity Reservation Status column. This feature is available to all future-dated Capacity Reservation customers. Refer to the AWS Capabilities by Region website for regional availability. For more details, see the Capacity Reservation user guide.

Amazon OpenSearch Service now supports MCP Apps, bringing observability workflows directly into compatible agentic IDEs such as Claude Desktop and VS Code. With this capability, the AI agent in the local environment can investigate incidents using logs, traces, metrics, and alerts stored in OpenSearch domains, collections, and Amazon Managed Service for Prometheus. Users can easily review and verify the results in interactive MCP App visualizations without leaving the local environment. Each MCP App tool call returns a dual response: a concise text summary for the agent to reason over and an interactive visualization rendered in the same conversation thread for review. Users can work alongside the observability agent from firing an alert, performing root cause analysis, exploring distributed traces, service maps, PromQL metric charts, and cross-signal correlations all within a single conversation. Available MCP App tools cover log, metrics, and trace investigation, service performance, topology, dynamic visualizations, agent health, cluster health, and instrumentation scoring. The OpenSearch MCP app experience is available in all AWS Regions where the Amazon OpenSearch UI is offered.

AWS announces the expanded availability of OpenAI's GPT-5.4 and GPT-5.5 models, now available in the US East (N. Virginia) Region on Amazon Bedrock. With these models, you can build generative AI applications across reasoning, coding, computer use, document workflows, and long-running agentic tasks. GPT-5.5 is OpenAI's most capable model, designed for advanced coding, research, analysis, software operation, document workflows, and long-running agentic tasks. It can understand open-ended goals, use tools, reason across longer workflows, navigate ambiguity, and carry complex tasks through to completion with less orchestration. GPT-5.4 brings frontier reasoning, coding, computer use, long-context workflows, and tool use to production applications that interpret context, interact with tools, operate software environments, and verify outputs across multiple steps. Both models support a 272K-token context window, accept text and image input, and are available through the Responses API with support for server-side and client-side tool calling, projects, and response streaming.

AWS Workload Credentials Provider is a lightweight client-side provider that automates the deployment of exported certificates from AWS Certificate Manager (ACM) and local caching of secrets from AWS Secrets Manager across AWS and non-AWS workloads. Previously, customers exporting public or private certificates from ACM had to build custom automation using Amazon EventBridge to detect renewals and deploy updated certificates. With public certificate lifetimes decreasing per the Certification Authority Browser Forum (CA/B) mandate, this custom automation can become difficult to maintain at scale. AWS Workload Credentials Provider eliminates this complexity by providing a single provider that helps distribute and automate both secrets and certificates to your workloads. You configure it with your certificate ARN and specify options such as file paths and server reload behavior - the provider then handles certificate export and deployment automatically to prevent expiry related failures. It runs on Windows and Linux and supports Apache and NGINX web servers. For secrets caching, the provider maintains full backwards compatibility with the AWS Secrets Manager Agent, enabling you to securely cache application secrets locally across AWS and non-AWS workloads through the same unified provider. AWS Workload Credentials Provider is open source and available on GitHub. You can use it with exportable ACM certificates and Secrets Manager in all AWS Regions.

Amazon Managed Service for Prometheus now supports out-of-order sample ingestion and a workspace-level rule query offset. All workspaces have a default out-of-order time window of 1 minute, allowing the workspace to accept metric samples arriving outside strict chronological order. This window can be adjusted to match ingestion patterns or set to 0 to disable the feature and discard out-of-order samples. A global rule query offset can also be configured to introduce a delay before rule evaluation queries run, giving late-arriving samples time to be ingested before rules execute. Together, these features reduce data loss and improve alerting accuracy for workloads with distributed collectors, batched exports, or variable network latency. Out-of-order sample support ensures late-arriving data points are ingested rather than discarded, preserving metric completeness. The rule query offset compensates for expected ingestion delay; without it, rules evaluate instantly and may miss samples that haven't landed yet, producing results that differ from the same expression evaluated after all metrics arrive. Two new CloudWatch vended metrics, OutOfOrderIngestionRate and OutOfOrderSampleAge, provide visibility into ingestion patterns, helping tune both settings for your workload. Out-of-order sample ingestion and rule query offset are available in all AWS regions where Amazon Managed Service for Prometheus is generally available. To get started, configure the out-of-order time window and rule query offset in your workspace settings via AWS console, API, or CLI. For more information, see Amazon Managed Service for Prometheus user documentation.

Amazon Managed Service for Prometheus now supports ingestion, storage, and querying of Prometheus native histograms, allowing customers to capture high-resolution metric distributions with greater precision and lower cardinality than classic histograms. DevOps engineers, site reliability engineers, and platform teams monitoring latency, request durations, and other distributions can now obtain more accurate percentile calculations without pre-defining bucket boundaries or managing high-cardinality time series. Native histograms use exponential bucketing to automatically adapt resolution to data, storing an entire distribution in a single time series rather than requiring one series per bucket boundary. This reduces the active series count, as a classic histogram with 20 buckets that previously required 22 time series now requires only one, while delivering more precise tail-latency insights from functions like histogram_quantile(). Native histograms can be adopted incrementally alongside existing classic histograms, allowing workloads to be migrated at their own pace without disrupting current monitoring. Amazon Managed Service for Prometheus meters and charges native histograms based only on populated buckets that contain actual observations, so users do not pay for empty buckets in sparse distributions. This capability is available in all AWS Regions where Amazon Managed Service for Prometheus is offered.

AWS is announcing the general availability of metal-48xl and metal-96xl sizes for Amazon Elastic Compute Cloud (Amazon EC2) M8in, M8ib, M8idn, M8idb, R8in, R8ib, R8idn, and R8idb instances. These instances are powered by custom sixth generation Intel Xeon Scalable processors, available only on AWS, and feature the latest sixth generation AWS Nitro cards. They deliver up to 43% better compute performance per vCPU compared to previous generation M6in, M6idn, R6in, and R6idn instances. M8in, M8idn, R8in, R8idn instances deliver 600 Gbps network bandwidth, the highest among enhanced networking EC2 instances. They are ideal for workloads such as real-time big data analytics, distributed web scale in-memory caches, caching fleets for AI/ML clusters, and Telco applications like 5G User Plane Function (UPF). M8idn and R8idn instances are ideal for network-intensive general purpose workloads requiring local storage, such as distributed compute, data analytics, and high-performance file systems. M8ib, M8idb, R8ib, R8idb instances deliver up to 300 Gbps EBS bandwidth, the highest among non-accelerated compute EC2 instances. M8ib and R8ib instances are best suited for workloads that benefit from high block storage performance, such as high-performance file systems and NoSQL databases. M8idb and R8idb instances are ideal for storage-intensive general purpose workloads such as large commercial databases, data lakes, and NoSQL databases that benefit from both high EBS throughput and low-latency local NVMe storage. These instances support Elastic Fabric Adapter (EFA) networking on 48xlarge, 96xlarge, metal-48xl, and metal-96xl sizes, enabling lower latency and improved cluster performance for workloads deployed on tightly coupled clusters. The new metal-48xl and metal-96xl sizes are available in the AWS US East (N. Virginia) region. To get started, see the AWS Management Console, AWS Command Line Interface (AWS CLI), and AWS SDKs.

AWS announces the preview of AWS FinOps Agent, a frontier agent for FinOps practitioners and engineering teams. The agent answers cost questions, generates cloud cost reports for finance and engineering teams, surfaces rightsizing, idle resource, and Savings Plans recommendations from AWS Cost Optimization Hub and AWS Compute Optimizer, and can open Jira tickets on your behalf. When a cost anomaly is detected, FinOps Agent can automatically investigate the root cause and post the findings to a Slack channel, notifying engineering teams without manual triage. AWS FinOps Agent (preview) is available in the US East (N. Virginia) Region and includes cost and usage data covering all AWS Regions, except AWS GovCloud (US) Regions and AWS China (Beijing and Ningxia) Regions. AWS FinOps Agent is offered at no additional charge during the preview.

Amazon S3 Access Grants can now be created in the AWS European Sovereign Cloud (Germany) Region. S3 Access Grants maps identities in directories such as Microsoft Entra ID or AWS Identity and Access Management (IAM) principals to datasets in S3. This helps manage data permissions at scale by automatically granting S3 access to end users based on their corporate identity. Visit the AWS Region Table for complete regional availability information and the product page to learn more about Amazon S3 Access Grants.

Amazon SageMaker Unified Studio Notebooks now support Amazon EMR Serverless with Apache Spark Connect, providing data engineers and analysts with more flexibility in choosing their Spark runtime for interactive analytics and data engineering workloads. In addition to Amazon Athena Spark, users can now leverage Amazon EMR Serverless as their Spark runtime, selecting the optimal engine based on their requirements. With this launch, users can run PySpark and Spark SQL on an EMR Serverless Spark Application in Notebook cells. Users can select their Spark runtime from the Notebook side panel, and the selected runtime applies to both Python and SQL cells. Additionally, users can leverage SageMaker Data Agent, the built-in AI assistant, to generate code and execution plans from natural language prompts, accelerating Spark development workflows with EMR Serverless. Organizations can leverage pre-initialized capacity to improve session start times, while benefiting from unified Spark UI monitoring across all supported engines for consistent visibility into job execution and performance. Additionally, EMR Serverless provides VPC connectivity support for workloads requiring network isolation. This feature is available in all AWS Regions where Amazon SageMaker Unified Studio is available, supporting both SageMaker Unified Studio notebooks and JupyterLab IDE environments.

Amazon FSx for OpenZFS now offers the Intelligent-Tiering storage class in 8 additional AWS Regions across the US, Europe, Asia Pacific, and South America. FSx Intelligent-Tiering is built for general-purpose file workloads such as file shares, archives, media libraries, and migrations from on-premises HDD storage. It automatically moves data across three storage tiers (Frequent Access, Infrequent Access, and Archive) based on access patterns, with an optional SSD read cache keeping active data fast. It delivers high performance for active workloads and low-cost storage for everything else, costing only for what is stored with no capacity to manage. With FSx Intelligent-Tiering, users can save up to 85% compared to the FSx SSD storage class and up to 20% compared to on-premises HDD-based NAS. The FSx Intelligent-Tiering storage class is now available for FSx for OpenZFS file systems in the following additional AWS Regions: US West (N. California), Europe (London, Stockholm, Spain, Zurich), Asia Pacific (Hyderabad, Seoul), and South America (São Paulo).

AWS today announces that AWS Cost and Usage Report 2.0 (CUR 2.0) now supports updates to data table configurations via the AWS Management Console and SDK/CLI. This capability allows customers to modify their existing exports to take advantage of new CUR 2.0 features without having to delete and recreate their exports. Previously, customers configured CUR 2.0 exports with specific table settings - including export content, time granularity, column selection, export format, and destination settings. When AWS introduced new features, such as additional columns and finer row-level granularity, existing export settings intentionally remained unchanged to protect ETL jobs that depended on a stable schema. However, customers who wanted to adopt these new capabilities and were ready for the new schema couldn't simply update their preference in existing export. They had to delete their existing export and create a new one with the new preference. With this launch, customers can update their table configuration directly through the AWS Management Console or SDK/CLI and begin receiving exports with their updated preferences starting from the next scheduled export delivery. To learn more about this feature, see AWS Data Exports and AWS Billing and Cost Management in the AWS Cost Management User Guide.

Amazon Elastic Compute Cloud (Amazon EC2) P6-B200 instances accelerated by NVIDIA Blackwell GPUs are now available in the AWS GovCloud (US-East) Region. These instances deliver up to 2x performance compared to P5en instances for AI training and inference. P6-B200 instances feature 8 Blackwell GPUs with 1440 GB of high-bandwidth GPU memory and a 60% increase in GPU memory bandwidth over P5en, 5th Generation Intel Xeon processors (Emerald Rapids), and up to 3.2 terabits per second of Elastic Fabric Adapter (EFAv4) networking. Powered by the AWS Nitro System, P6-B200 instances enable reliable and secure scaling of AI workloads within Amazon EC2 UltraClusters to tens of thousands of GPUs. P6-B200 instances are available in p6-b200.48xlarge size in the following AWS Regions: US West (Oregon), US East (N. Virginia, Ohio), AWS GovCloud (US-West) and AWS GovCloud (US-East) Region. To learn more about P6-B200 instances, visit Amazon EC2 P6 instances.

Amazon DocumentDB (with MongoDB compatibility) now supports engine minor versions, starting with 5.0.1. This release delivers enhanced aggregation capabilities with new operators ($rand, $pow, $dateToParts, $dateFromParts), the active connections metric to monitor instances, and granular command-level performance metrics in CloudWatch (find, insert, findAndModify, update, etc.). Minor versions provide new features and bug fixes within the same major version, giving you more control over when and how you upgrade your clusters. You can specify minor version 5.0.1 when creating a new cluster, or manually upgrade an existing 5.0.0 cluster to 5.0.1 using the AWS Management Console or AWS CLI (via the modify-db-cluster command with --engine-version 5.0.1). Once you upgrade to a newer minor version, you cannot downgrade back to a previous minor version. Upgrading from 5.0.0 (LTS) to 5.0.1 gives you access to the latest features and fixes, but you will no longer be on the LTS track. If minimizing upgrades is your priority, you should remain on LTS. Amazon DocumentDB engine minor version 5.0.1 is available in all AWS Regions where Amazon DocumentDB 5.0 is available.

Amazon MSK Express Brokers now supports automatic topic creation with Kafka Streams. Customers can now deploy their Kafka Streams applications on Express Brokers without needing to manually pre-create or manage topics for stateful operations. MSK Express Brokers are designed to deliver up to three times more throughput per broker, scale up to 20 times faster, and reduce recovery time by 90 percent. Kafka Streams uses topics to store state and repartition data for stateful operations. Previously, customers running Kafka Streams with Express Brokers had to manually name and pre-create these topics before deploying their application. With this launch, these topics are created automatically when the application starts, simplifying deployment and reducing operational setup for Kafka Streams applications on Express Brokers. This capability is available today in all AWS regions where MSK Express Brokers are available. No additional configuration or setup is required to get started.

AWS Compute Optimizer now identifies idle resources for Amazon DynamoDB provisioned tables, Amazon ElastiCache (Redis and Valkey), Amazon MemoryDB, Amazon DocumentDB (provisioned and serverless), Amazon WorkSpaces, and Amazon SageMaker endpoints. This expansion allows you to detect unused resources across more of your AWS environment and identify potential cost savings. Compute Optimizer analyzes utilization metrics to determine whether a resource is idle. Customers can set this lookback period based on the nature of their workloads. For each resource type, Compute Optimizer evaluates service-specific signals such as consumed capacity, cache hits, active connections, and CPU utilization. When Compute Optimizer identifies potential idle resources, it surfaces these recommendations, along with detailed utilization metrics and estimated savings in the console, enabling you to evaluate recommendations before acting. You can also view idle resource recommendations across all AWS accounts in your organization through the Cost Optimization Hub, with de-duplicated estimated savings with other recommendations on the same resources. For more information about the AWS Regions where Compute Optimizer is available, see the AWS Region table. For more information about AWS Compute Optimizer, visit our product page and documentation. You can start using AWS Compute Optimizer through the AWS Management Console, AWS CLI, and AWS SDK.

AWS Cost Explorer now supports 'Analyze with Amazon Q', a new capability that delivers comprehensive cost explanations for any report configured in Cost Explorer. With a single button click, users can receive detailed analysis from Amazon Q Developer covering cost trends, top cost drivers, and anomalies. The analysis uses the exact filters and time period configured and provides guidance to discover optimization opportunities through follow-up questions. Previously, cost analysis required manual investigation across multiple filters and data points. With 'Analyze with Amazon Q', users simply configure their Cost Explorer view and click a single button. Amazon Q analyzes the current context and delivers explanations directly in its chat panel, adapting to what is being viewed: historical explanations for past dates, forecast explanations for future dates, or both for mixed periods. Users can then ask follow-up questions to explore any insights related to their cost data in greater detail as Amazon Q maintains full conversation context throughout. 'Analyze with Amazon Q' is available in all commercial AWS Regions at no additional charge.

Amazon EMR Serverless now supports interactive sessions with Spark Connect. This enables you to develop and run Apache Spark applications from managed notebooks in Amazon SageMaker Unified Studio, as well as your favorite notebook environments and IDEs such as Jupyter and Visual Studio Code. An interactive session provides a persistent Spark context that spans across cells and scripts, allowing you to blend local Python code execution with remote Spark operations within a unified environment. This is enabled by Spark Connect's client-server architecture, which decouples your application client from the Spark driver, allowing you to maintain your preferred development environment and tooling while Spark infrastructure runs independently on EMR Serverless. This architecture enables workflows such as ad hoc data exploration, iterative step-by-step debugging, and incremental PySpark job development before deploying to production. For observability, you get real-time session monitoring via the Spark UI, history tracking through the Spark History Server, and session management from the EMR console or API/CLI/SDK. Spark Connect on Amazon EMR Serverless is available with EMR release 7.13 in all AWS Regions where Amazon EMR Serverless is available. The SageMaker Unified Studio experience is available in supported regions.

AWS Backup support for Amazon Elastic Kubernetes Service (EKS) is now available in the AWS European Sovereign Cloud (Germany) Region. This expansion brings fully-managed, policy-based data protection and recovery to Amazon EKS clusters in this newly supported Region, including automated scheduling, retention management, immutable vaults, and cross-Region and cross-account copies. AWS Backup for Amazon EKS allows you to protect entire EKS clusters, specific namespaces, or individual persistent volumes using a centralized, agent-free solution that replaces custom scripts or third-party tools. Use AWS Backup to protect your clusters for disaster recovery, compliance requirements, or before EKS cluster upgrades.

AWS has announced the general availability of Claude Fable 5, making Mythos-level capabilities available to all customers with strong safeguards for broader use. Fable 5 is state-of-the-art on nearly all tested benchmarks and offers significant advancements in autonomous knowledge work and coding for developers and enterprises building production AI applications. It is designed for professional tasks in finance, legal, marketing, sales, data, and engineering, proactively updating its skills based on learnings, developing evaluation harnesses, and verifying its work before delivery. Customers can access Claude Fable 5 through Amazon Bedrock, which keeps data within AWS infrastructure and provides access through a unified service with AWS-managed features like Guardrails, Knowledge Bases, and regional data residency. Alternatively, the Claude Platform on AWS, operated by Anthropic, offers direct access to Anthropic's native Claude platform experience with unified AWS billing and authentication. Claude Mythos 5, the same model without those safety classifiers, is available to a small group of customers.