AWS Updates: Jul 2026

AWS announces the Context Ontology Accelerator, an open-source tool that helps organizations build an ontology of their business-a machine-readable model of products, customers, policies, and operational rules for AI agents to make accurate, consistent, explainable, and auditable decisions. The accelerator connects to structured and unstructured data sources, using AI to draft an ontology for domain experts to review, edit, and approve. The approved ontology is stored in a knowledge graph owned by the user, expressed in open W3C standards and consumable by any agent via the included Model Context Protocol server. This tool reduces months of manual ontology authoring to days, from data connection to governed answers for agents. Available today on GitHub under Apache 2.0, the initial release uses Amazon Neptune as the graph store, Amazon OpenSearch Serverless as the vector store, and foundation models hosted on Amazon Bedrock. Users can deploy it themselves or engage AWS Professional Services. The managed, user-defined ontology capability will become a fully managed feature native to AWS Context. For more information, read the documentation.

Amazon Location Service now supports proximity-based point of interest discovery with GrabMaps data in the Asia Pacific (Singapore) and Asia Pacific (Malaysia) AWS Regions. Builders creating local discovery, delivery, and mobility applications in Southeast Asia can surface relevant nearby places using hyperlocal data validated by millions of daily Grab journeys. SearchNearby returns places within a specified radius of a user's location, ranked by distance. Developers can filter results by category (such as fuel stations, hospitals, or restaurants) to narrow responses to what their application needs. This enables a delivery platform to find the closest pickup points, a ride-hailing app to show nearby dining options, or a travel app to locate services within range. GrabMaps delivers hyperlocal mapping data purpose-built for Southeast Asia. Millions of daily journeys across the Grab platform continuously validate road networks, addresses, and points of interest, capturing changes in real time. GrabMaps covers detailed back alleys, narrow side streets, and motorcycle-accessible routes across more than 500 cities in Singapore, Malaysia, Thailand, Vietnam, Indonesia, Philippines, Myanmar, and Cambodia. To get started, see the Search Nearby Developer Guide, API reference, and the GrabMaps Overview page.

Amazon SageMaker Unified Studio now gives project members full Git version control directly within the tools they already use-Query Editor, Visual ETL, Workflows, and Notebooks. The enhanced Repositories experience replaces the previous automatic sync approach with flexible, file-level version control, bringing a consistent source control experience across all project tools, including Notebooks, which previously had no Git support. Users choose exactly which files to track in Git by adding them to a repository on GitHub, GitLab, or Bitbucket-source control is not enforced at the project level, so they decide what gets versioned and when. When ready, they commit and push all changes in a single action. Repositories are decoupled from project creation, meaning they can add a repository to a project at any point after the project is created, as needs evolve. Projects can connect to any number of repositories and branches at the same time, and users can create branches, pull updates, and resolve conflicts without ever leaving their project. If they use JupyterLab or Code Editor, they also retain full Git CLI access through the built-in terminal. This feature is available in all AWS Regions where Amazon SageMaker Unified Studio is supported, for both IAM and IAM Identity Center domains. If a project uses the previous Git experience, they can opt into the richer model by updating their project. To get started, see Working with repositories in the User Guide and Configuring Git connections in the Admin Guide

Amazon Elastic Compute Cloud (Amazon EC2) C7i instances powered by custom 4th Gen Intel Xeon Scalable processors (code-named Sapphire Rapids) are now available in the Europe (Milan) and Canada West (Calgary) regions. These custom processors, exclusive to AWS, offer up to 15% better performance over comparable x86-based Intel processors used by other cloud providers. C7i instances deliver up to 15% better price-performance versus C6i instances and are an excellent choice for compute-intensive workloads such as batch processing, distributed analytics, ad-serving, and video encoding. C7i instances offer larger instance sizes, up to 48xlarge, and two bare metal sizes (metal-24xl, metal-48xl). These bare-metal sizes support built-in Intel accelerators: Data Streaming Accelerator, In-Memory Analytics Accelerator, and QuickAssist Technology, which facilitate efficient offload and acceleration of data operations and optimize performance for workloads. To learn more, visit the EC2 C7i instances Page.

Amazon Elastic Compute Cloud (Amazon EC2) C7i-flex instances powered by custom 4th Gen Intel Xeon Scalable processors (code-named Sapphire Rapids) are now available in the Europe (Milan) region. These custom processors, exclusive to AWS, offer up to 15% better performance over comparable x86-based Intel processors used by other cloud providers. C7i-flex instances provide up to 19% better price-performance compared to C6i and are suitable for compute-intensive workloads. They offer common sizes from large to 16xlarge, making them ideal for applications that don't fully utilize all compute resources, such as web and application servers, databases, caches, Apache Kafka, and Elasticsearch.

AWS CodeDeploy is now available in five additional AWS Regions: Asia Pacific (New Zealand), Asia Pacific (Thailand), Asia Pacific (Taipei), Asia Pacific (Malaysia), and Mexico (Central). AWS CodeDeploy is a fully managed deployment service that automates application deployments to Amazon EC2 instances, on-premises servers, AWS Lambda functions, and Amazon ECS services. Customers in these newly added regions can now access CodeDeploy locally, enabling lower latency and supporting data residency requirements. AWS CodeDeploy is now available across 34 AWS commercial regions, as well as AWS GovCloud (US) and the AWS China Regions.

Amazon CloudWatch now supports collecting Prometheus metrics from your AWS infrastructure using fully managed collectors, enabling you to monitor Amazon EKS, Amazon EC2, Amazon ECS, Amazon MSK, and Amazon OpenSearch Service workloads without deploying or managing any agents. Previously, getting Prometheus metrics into CloudWatch required deploying, scaling, and maintaining a self-managed OpenTelemetry Collector. Managed Prometheus collectors eliminate that overhead. You provide a scrape configuration and a connection to your resources, and CloudWatch handles provisioning, scaling, and collection automatically. Metrics are delivered in OpenTelemetry format and can be queried alongside your AWS vended metrics using PromQL - providing unified alarming, dashboarding, and cross-service correlation in a single view. Managed collectors support Kubernetes service discovery (EKS), DNS-based service discovery via AWS Cloud Map (ECS), direct instance scraping (EC2), and open monitoring endpoints (MSK, OpenSearch). Metrics for EKS, MSK and OpenSearch can be visualized in automatic dashboards, queried with PromQL and used in CloudWatch alarms. This feature is available in all AWS Regions where the CloudWatch OTLP endpoint is available, except Asia Pacific (New Zealand). Managed Prometheus collectors are charged by the hour and standard CloudWatch OpenTelemetry metric ingestion pricing applies.

AWS Lambda now supports Java 8, Java 11, and Java 17 runtimes on Amazon Linux 2023 (AL2023), available as both managed runtimes and container base images. These new runtimes allow customers running Lambda functions on Java 8, 11, or 17 to migrate from Amazon Linux 2 (AL2) to AL2023 without requiring a simultaneous Java version upgrade. The existing Lambda runtimes for Java 8, 11 and 17 run on AL2, which reached end of life on June 30, 2026. AWS recommends upgrading to Java 21 or Java 25 on AL2023 as the preferred migration path. Existing AL2-based Lambda runtimes for Java 8, 11, and 17 will remain supported until June 30, 2027.

AWS Transit Gateway now supports Policy-Based Routing (PBR), providing network administrators with granular control over traffic forwarding. With PBR, forwarding decisions can be based on packet attributes such as source and destination IP addresses, ports, and protocol, rather than destination IP address alone. Previously, customers needed multi-VPC architectures with additional routing hops for traffic steering or workload isolation, adding complexity and operational overhead. PBR eliminates this by extending Transit Gateway's native routing capabilities, allowing security architects and enterprise network teams to classify and direct traffic inline without extra infrastructure. Customers associate a policy table with a Transit Gateway attachment and define an ordered set of rules. Each rule classifies traffic and directs matching packets to a specified route table using first-match-wins logic. This supports use cases such as steering sensitive workloads through AWS Network Firewall or third-party inspection appliances, routing application traffic over AWS Direct Connect or AWS VPN paths based on source, port, or protocol, and isolating production and development environments into separate routing domains. Policy-Based Routing for AWS Transit Gateway is available in all commercial AWS Regions where Transit Gateway is available. It can be configured using the AWS Management Console, AWS CLI, and AWS SDK. PBR incurs no additional charge beyond standard Transit Gateway fees

Following OpenAI's price reductions for GPT-5.6 Luna and Terra, Amazon Bedrock has also lowered on-demand inference prices for these models. Effective July 30, 2026, prices for GPT-5.6 Luna on Amazon Bedrock will be reduced by 80%, while prices for GPT-5.6 Terra will be reduced by 20%. These reductions align with OpenAI's first-party pricing changes for these models. GPT-5.6 Luna is optimized for fast, high-volume workloads and can use tools to complete multi-step workflows, making it well suited for content processing, classification, customer-service automation, and routine implementation tasks. GPT-5.6 Terra balances intelligence, speed, and cost for everyday production workloads requiring more sophisticated reasoning. These price reductions enable customers to apply their capabilities across more applications, process larger workloads, and lower the cost per completed task. Pricing for GPT-5.6 Sol remains unchanged. The new prices apply automatically, with no changes required from customers. GPT-5.6 Luna and Terra are available in US East (N. Virginia), US East (Ohio), and US West (Oregon) through the OpenAI Responses API on the bedrock-mantle endpoint. For more information, see the Amazon Bedrock OpenAI model documentation. Visit the Amazon Bedrock pricing page for the latest pricing information for GPT-5.6 models on Amazon Bedrock.

The IAM Policy Simulator has been integrated into the IAM console, replacing the standalone simulator site. This allows you to test policies in the same place where you manage your identities and policies. You can now include service control policies (SCPs) in your simulation to test how your organization's SCP hierarchy interacts with identity and resource policies. Through the API, you can test how condition keys such as region restrictions and tag requirements affect the outcome. New flexibility allows you to exclude specific policies to model "what if I remove this policy?" scenarios. Cross-account simulations now report per-policy decisions for identity and resource-based policies, with the matched statements returned for a denied request reflecting only the policies that drove the decision. These changes help teams automate policy unit testing, detect over-permissive access, and validate guardrails with greater confidence. These features are available in all AWS Regions where the IAM Policy Simulator is available. Access the IAM Policy Simulator in the IAM console by selecting Policy simulator in the navigation pane.

Amazon Redshift now supports Graviton-based RG instances on the trailing track. Starting today, rg.large and rg.12xlarge instance types are available for customers running workloads on the trailing track on patch P202 and onwards. The trailing track is designed for customers who prioritize stability for production workloads, running on a version already validated through the leading track. With RG instances now available on both tracks, customers can take advantage of AWS Graviton-powered performance-delivering up to 2.4x faster query performance than RA3 instances at 30% lower price per vCPU. Customers on the trailing maintenance track (patch P202 and later) can now create Amazon Redshift RG clusters in all AWS regions where RG is generally available. To get started, customers can provision a new cluster or resize an existing cluster to an rg.large or rg.12xlarge instance type using the AWS Management Console, AWS CLI, or AWS SDKs.

AWS Direct Connect now provides Border Gateway Protocol (BGP) route visibility, allowing you to view routes exchanged between AWS and your on-premises routers across private, transit, and public virtual interfaces (VIFs). You can now see which routes AWS accepted from your router and which routes AWS is advertising to your router, along with their AS path and BGP community values. This visibility helps network administrators troubleshoot routing issues, verify route propagation, and monitor hybrid network connectivity. With this feature, you can view accepted routes (routes AWS received from your router) and advertised routes (routes AWS sends to your router) directly in the Direct Connect console or programmatically using the ListVirtualInterfaceRoutes API action. Each route displays its prefix, address family, AS path, community values, and installation timestamp, providing comprehensive insight into your routing topology. You can filter routes by prefix, AS path, community, or address family to quickly identify specific routing behaviors. This capability is particularly valuable for managing complex multi-region architectures, validating BGP policy configurations, or diagnosing unexpected traffic patterns. This feature is available in all AWS commercial Regions and the AWS China Regions (Beijing, operated by Sinnet, and Ningxia, operated by NWCD). To learn more about BGP route visibility, visit the AWS Direct Connect documentation or access the feature through the Direct Connect console.

Amazon MSK Express brokers now deliver Apache Kafka data to Amazon S3 general purpose buckets, providing a fully managed capability to deliver Apache Kafka data in Amazon S3 for downstream processing in the easiest and most reliable way. This capability automatically scales to deliver high-throughput Kafka data to S3 with end-to-end reliability for mission-critical workloads, while reducing ingestion and delivery costs by up to 60% compared to self-managed alternatives. Customers deliver Apache Kafka data to Amazon S3 for use cases such as log archival, compliance retention, Kafka replay, and training AI/ML models, and typically build these pipelines with self-managed connectors that grow costly and operationally complex as workloads scale. With this capability, MSK Express automatically handles scaling, retries, and backpressure so customers no longer manage connector fleets or coordinate across teams. MSK Express supports throughput of up to 10 GB/s for data delivery to Amazon S3, and manages routine operations such as capacity scaling and version upgrades without introducing delivery gaps. Additionally, customers add this delivery capability without provisioning additional broker egress throughput, which eliminates the incremental infrastructure costs that scaling connector-based pipelines typically incurs, so customers scale delivery to actual workload demand rather than provisioning for peak, achieving reliable, high-throughput delivery to Amazon S3 while removing operational overhead and lowering costs. Amazon MSK data delivery to Amazon S3 is available today in every AWS Region where Amazon MSK Express brokers are offered.

AWS Glue now supports VPC connections, filter pushdown, and partition support for the REST API connector. The REST API connector allows you to ingest data from any source exposing a REST-based API, including proprietary systems and emerging platforms without native AWS Glue connectors. With VPC support, you can access data sources hosted in private subnets or connected through VPNs or AWS PrivateLink without exposing traffic to the public internet. Filter pushdown translates query predicates into API-native parameters, ensuring only matching records leave the source, reducing data transfer costs and improving job performance. Partition support splits large datasets across multiple Spark workers using field-based or record-count strategies, providing parallel reads that reduce ingestion time for high-volume, paginated APIs. These capabilities are available in all AWS commercial regions where AWS Glue is offered.

Amazon OpenSearch Service now supports OpenSearch version 3.7. Key enhancements include 1-bit scalar quantization on Faiss and Lucene engines to compress vectors, reducing storage and memory for vector workloads while maintaining search accuracy. Vectors can now be retrieved faster using doc values instead of document source, with no reindexing required. The Search Relevance Workbench adds new evaluation metrics, CSV judgment uploads, and expanded hybrid search optimization to help measure and improve search quality. New Query Insights capabilities include automated query recommendations, a finished-queries cache for observing recently completed queries, and the option to export top query data to Amazon S3, enabling identification of expensive queries and analysis of trends over time. For upgrade instructions, see the documentation. OpenSearch 3.7 is now available in all AWS Regions where Amazon OpenSearch Service is offered.

AWS Directory Service now allows you to upgrade your AWS Managed Microsoft AD directory from Standard Edition to Enterprise Edition directly through the AWS Management Console, AWS CLI, and API without migrating to a new directory or re-joining your existing workloads. Standard Edition is designed for organizations with up to 5,000 users and objects, while Enterprise Edition supports up to 500,000 objects and provides greater scalability for larger deployments. Customers who have outgrown Standard Edition limits can now upgrade in place, preserving existing trust relationships, application integrations, and group policies. The upgrade requires no changes to your DNS configuration or connected AWS workloads. This new capability is available in all AWS Regions where AWS Directory Service is available.

The Gemma 4 family of open-weight models from Google DeepMind is now available on Amazon Bedrock in AWS GovCloud (US-West). The Gemma 4 family includes three variants-Gemma 4 31B, Gemma 4 26B-A4B, and Gemma 4 E2B-spanning dense and mixture-of-experts (MoE) architectures with built-in reasoning, native function calling, support for 35+ languages, and multimodal input across text, image, video, and audio. Gemma 4 31B is suited for reasoning- and coding-heavy workloads with a 256K-token context window, Gemma 4 26B-A4B targets cost- and latency-sensitive workloads, and Gemma 4 E2B is the smallest variant, designed for low-latency interactive use cases. Gemma 4 runs on a new innovation in Amazon Bedrock designed for price performance, with improved support for tool calling, structured output, reasoning, and response streaming, enabling customers to build reliable generative AI applications with open-source models.

xAI's Grok 4.3 model is now available on Amazon Bedrock in AWS GovCloud (US-West). This reasoning-first model provides configurable reasoning effort (none, low, medium, high) and strong tool use and instruction-following capabilities for building reliable agents. It also offers token efficiency to maintain cost-effectiveness for high-volume inference. Grok 4.3 is particularly suited for enterprise workloads such as customer support, web development, case law research, and financial document Q&A, delivering consistent, high-quality results across conversational AI, search, chat, and multi-turn workflows. The model runs on Mantle, a new inference engine in Amazon Bedrock designed for price performance, with support for tool calling, structured output, and response streaming.

Amazon MSK Express brokers now deliver data to streaming tables for Apache Iceberg, a new capability that continuously materializes Apache Kafka topics as Apache Iceberg tables on Amazon S3 Tables. This reduces the cost of ingesting and delivering Apache Kafka data into Amazon S3 Tables by up to 60% versus self-managed deployments and reduces downstream query costs by up to 30% versus self-managed Apache Kafka deployments. Intelligent inline compaction eliminates the performance impact of small files and keeps query performance predictable without sacrificing data freshness, while built-in coordination resolves concurrent writer conflicts across high-throughput consumers. Amazon MSK supports throughput of up to 10 GB/s for delivery to Apache Iceberg on Amazon S3 Tables, and because this native capability adds no broker egress throughput, customers avoid the incremental infrastructure costs of scaling connector pipelines and match capacity to actual demand rather than peak. Customers can deliver data to streaming tables and query or transform the data with any engine of their choice, including Apache Spark, Trino, or Apache Flink. To get started, customers open the Amazon MSK console, select the Express cluster, and enable the capability in a few clicks, or use the MSK APIs or MCP server. Amazon MSK data delivery to streaming tables is available today in every AWS Region where Amazon MSK Express brokers are offered.

AWS has announced the general availability of AWS Interconnect for multicloud connectivity with Oracle Cloud Infrastructure (OCI). This service allows customers to quickly provision resilient, scalable private connections to other cloud providers, addressing the complexities of building and managing global multi-layered networks at scale that were previously required for multicloud strategies. OCI launched support for AWS Interconnect in public preview in May and is the latest cloud service provider to adopt the open specification powering the service. With today's GA launch, AWS customers can now use the same consistent, simple experience to interconnect their workloads on OCI and Google Cloud. Microsoft Azure will launch later in 2026. Interconnect for multicloud is available with OCI in the us-east-1 (N. Virginia) AWS Region. It can be created using the AWS Management Console, Command Line Interface (CLI), or API.

AWS WAF now includes pre-parse text transformations for query arguments and ten new text transformations to help normalize request content so that AWS WAF inspects requests the same way your application interprets them. Pre-parse text transformations normalize a raw query string before AWS WAF parses it into key-value pairs, closing gaps in HTTP parameter pollution and parser differential evasion. You can chain up to ten transformations, including URL decode, Combine Duplicate Query Arguments by Comma, and Replace Semicolons with Ampersands, then layer standard post-parse transformations on top within a single rule statement. The new text transformations provide more ways to normalize content before inspection, including industry-standard options such as Uppercase, Trim, Remove Whitespace, and SHA256, plus operating-system-aware command line and JavaScript decoding functions developed by the Amazon Threat Research Team. Each new transformation consumes 10 WCUs, with no additional charge beyond standard AWS WAF pricing, and is available in all AWS Regions.

Amazon Redshift Data API introduces new capabilities that reduce the number of API calls needed to retrieve SQL statement metadata or results, provide visibility into sessions, and allow batch statements to execute on separate transactions. Long polling enables retrieval of SQL statement metadata or results without repeatedly polling until the statement reaches a terminal state, by delaying the return of a synchronous response until the SQL statement finishes. ListSessions allows applications that reuse sessions across multiple queries to enumerate active sessions and filter by status, compute target, or database, eliminating the need to track session identifiers externally. Flexible batch execution via BatchExecuteStatement now supports an ExecutionMode parameter with AUTO_COMMIT mode, allowing each SQL statement in a batch to execute independently so that a single failure no longer rolls back the entire batch. Additionally, BatchExecuteStatement now accepts an array of SqlParameter, enabling parameter reuse across all statements in a batch.

Amazon EC2 Auto Scaling now supports Instance Refresh as a new AWS CloudFormation update policy. When you configure the new AutoScalingInstanceRefresh update policy and update properties that require instance replacement, CloudFormation automatically triggers an Instance Refresh. With this integration, you can now access Instance Refresh capabilities including replacing the root volume for in-place updates, launch-before-terminate, alarm-based monitoring, and checkpoints with bake time for controlled rollouts. Auto Scaling features such as scaling policies and health checks remain active throughout the update, so your service health is not at risk during deployments. Rollback is handled through CloudFormation stack rollback. This feature is available in all AWS Regions at no additional cost.

Amazon Connect Customer now automatically surfaces relevant examples of an agent's evaluations when managers prepare coaching feedback. Managers receive examples of recent evaluations where the agent scored high or low on the chosen coaching topic, along with human or AI evaluator notes explaining the agent behaviors that drove the result. For example, while preparing feedback for an agent on 'de-escalation,' a manager receives example calls where the agent successfully calmed a frustrated customer, alongside calls that were escalated, with insights into the agent behaviors that led to each outcome. This enables managers to deliver tailored coaching that accelerates agent performance improvement while saving time previously spent manually searching for examples. This feature is available in all regions where Amazon Connect Customer is offered.

IAM Identity Center helps configure single sign-on for your workforce to AWS accounts and applications. You can now replicate IAM Identity Center from the primary AWS Region where you first enabled it to additional Regions of your choice when using Identity Center directory as your identity source. This extends multi-Region support, previously available for Identity Center organization instances connected to external identity providers, to instances that use the Identity Center directory to manage and authenticate their workforce. This feature enhances resilience of user access to AWS accounts and helps you deploy AWS applications in AWS Regions that best align with your business needs such as application data residency and proximity to users. When enabled, IAM Identity Center automatically replicates identities, entitlements, and other information from the primary Region to additional Regions. If IAM Identity Center is affected by a disruption in the primary Region, users continue to access their AWS accounts using the already provisioned entitlements in the additional Regions. AWS application administrators can use the standard application deployment workflow to deploy applications in an additional Region while continuing to administer IAM Identity Center in the primary Region. IAM Identity Center multi-Region support is currently available in the 17 default-enabled commercial AWS Regions for IAM Identity Center organization instances. The IAM Identity Center organization instance must be configured with a multi-Region customer managed KMS key (CMK). Standard AWS KMS charges apply for storing and using CMKs. IAM Identity Center is provided at no additional cost.

Amazon EFS now supports cross-account replication in AWS GovCloud (US) regions, allowing customers to replicate file systems between AWS accounts. With this launch, EFS Replication enables customers to easily maintain an up-to-date replica of their file system in the AWS GovCloud (US) region of their choice. This helps customers meet business continuity, multi-account disaster recovery, and compliance requirements by automatically keeping replicas of their file data in separate accounts. Customers often use multiple AWS accounts to isolate and manage business applications and data for operational excellence, security, and reliability. Starting today, customers can use EFS Replication to replicate their file system to another account in any AWS GovCloud (US) region. This eliminates the need to set up custom processes to synchronize EFS data across accounts, enhancing resilience and reliability in distributed environments. To get started, configure EFS Replication in just a few clicks using the Amazon EFS Console, AWS CLI, AWS CloudFormation, and APIs.

Second-generation AWS Outposts racks are now supported in the Asia Pacific (Mumbai) Region. Outposts racks extend AWS infrastructure, AWS services, APIs, and tools to virtually any on-premises data center or colocation space for a truly consistent hybrid experience. Organizations from startups to enterprises and the public sector in and outside of India can now order their Outposts racks connected to this new supported region, optimizing for their latency and data residency needs. Outposts allows customers to run workloads that need low latency access to on-premises systems locally while connecting back to their home Region for application management. Customers can also use Outposts and AWS services to manage and process data that needs to remain on-premises to meet data residency requirements. This regional expansion provides additional flexibility in the AWS Regions that customers’ Outposts can connect to.

AWS Console Home now supports the Cost and Usage widget in the AWS European Sovereign Cloud (Germany) Region, allowing customers to surface insights from Cost Explorer and Cost Optimization Hub on their Console Home dashboard. With the Cost and Usage widget, customers can track month-to-date and forecasted costs, identify savings opportunities, and see how their spend breaks down by service over time. To get started, sign in to the AWS Management Console, select Add widgets, and drag the Cost and Usage widget onto your Console Home dashboard. For more information, see Working with widgets in AWS Console Home documentation.

Amazon EKS now delivers faster pod autoscaling across all Provisioned Control Plane clusters by increasing Horizontal Pod Autoscaler (HPA) sync concurrency to up to 40 times the default Kubernetes value. This reduces the time it takes for HPA-driven workloads to scale in response to increased load. The Kubernetes Horizontal Pod Autoscaler continuously monitors workload metrics and adjusts pod counts to match demand. In clusters running hundreds or thousands of HPA objects, the speed at which the Kubernetes control plane processes these objects determines how quickly workloads scale. The HPA sync concurrency setting controls how many HPA objects the control plane evaluates in parallel. By increasing this value, Provisioned Control Plane clusters now process more HPA objects simultaneously, reducing the time between detecting increased load and scaling out pods. This enhancement is available to all customers using EKS Provisioned Control Plane and requires no configuration changes.

Amazon Elastic Kubernetes Service (Amazon EKS) now supports AWS PrivateLink for the cluster OIDC discovery and JWKS endpoint. This allows tools running inside your VPC, such as eksctl, Terraform, or custom token validators, to reach the OIDC discovery document and JWKS privately by creating an interface VPC endpoint for the com.amazonaws..oidc-eks service. This enables IRSA setup and token validation in VPCs without internet egress and ensures correct DNS resolution when the EKS management VPC endpoint is enabled with private DNS. AWS PrivateLink for the cluster OIDC endpoint is available at no additional cost beyond standard AWS PrivateLink pricing in all AWS Regions where Amazon EKS is available. To get started, see Access the cluster OIDC endpoint using AWS PrivateLink in the Amazon EKS User Guide.

AWS Glue Data Quality now supports a new Distribution Analyzer that generates frequency distribution profiles for data. Using this analyzer in the Data Quality Definition Language (DQDL), users can generate histograms for numeric columns and value distributions for categorical, date, and boolean columns. With support for custom bin counts, users can explore the shape and patterns of their data at the granularity that matters most to their use case. Understanding data distribution is foundational for building reliable data pipelines. Distribution statistics help quickly identify skewness, outliers, and unexpected patterns across datasets without writing custom code. The capability integrates directly with existing DQDL rulesets, allowing distribution profiling alongside current data quality checks in a single evaluation run. Distribution statistics are stored in Amazon S3 for future querying through services like Amazon Athena and are also exposed through APIs, making it easy to integrate distribution insights into monitoring workflows and visualization tools, including SageMaker Unified Studio. AWS Glue Data Quality distribution statistics are available in all AWS commercial regions and AWS GovCloud (US) regions.

AWS Glue Data Quality now supports anomaly detection for catalog-based data quality evaluations and the ability to write evaluation results to AWS Glue Data Catalog (GDC) tables. These capabilities work across both ETL jobs and catalog evaluations, giving you a consistent data quality experience regardless of workflow type. With anomaly detection support for GDC, you can identify unexpected changes in data statistics such as sudden drops in distinct values or row count spikes in your GDC tables using ML-powered time-series forecasting, without writing rules with explicit thresholds. This is especially valuable for data engineers monitoring hundreds of tables in the GDC who need to surface issues automatically. With results storage in GDC, Data Quality rule outcomes, profiling metrics, and anomaly predictions (with confidence bounds) are written back to GDC tables, creating a queryable record of all quality evaluations. Whether the evaluation runs in an ETL job or directly on a catalog table, results can be queried at any time using standard SQL. AWS Glue Data Quality anomaly detection and catalog results storage are available in all AWS commercial regions and AWS GovCloud (US) regions.

Amazon Neptune Database now supports tag-based access control (TBAC) for IAM, enabling customers to use AWS resource tags and IAM principal tags as conditions in IAM policies and Service Control Policies (SCPs) to control access to Neptune data-plane operations. Neptune already provides robust security through VPC isolation, TLS encryption, and IAM authentication, but customers managing multiple clusters at scale needed a dynamic, attribute-based mechanism to enforce organizational access boundaries. TBAC addresses this by allowing administrators to govern cluster access without enumerating specific cluster ARNs in every policy. With TBAC, IAM principals can only perform neptune-db:* actions against Neptune clusters whose tags match their own-for example, a principal tagged Project=FraudDetection is automatically restricted to clusters sharing that same tag. This eliminates lateral access risk within shared VPC environments, enforces team and environment-level isolation across projects, and supports federated identity workflows using SAML or OIDC session tags from external identity providers. Granular permissions like neptune-db:QueryLanguage can be used alongside TBAC for more fine-grained access control. This feature is available in all AWS Regions where Amazon Neptune is available and requires Neptune engine version 1.2.0.0 or later with IAM authentication enabled.

Amazon S3 Tables now supports the Variant data type as defined in the Apache Iceberg Version 3 (V3) specification. This allows you to write semi-structured data such as JSON directly to S3 Tables without defining a fixed schema in advance, enabling faster data ingestion while maintaining efficient analytical query performance. With the Variant data type, Apache Iceberg V3-compatible engines shred your semi-structured data into hidden columns during write operations, generating Parquet column statistics that query engines use for optimizations like file pruning, reducing the amount of data scanned by analytical queries. S3 Tables also provides ongoing table maintenance, including compaction, for Variant columns, allowing you to consolidate data from small files into larger files that Iceberg engines can read more efficiently. This feature is available in the following AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Mumbai), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Stockholm), and South America (São Paulo).

AWS DataSync Enhanced mode now supports agent-based data transfers with Hadoop Distributed File Systems (HDFS), Microsoft Azure Blob Storage, and self-managed object storage. Additionally, Enhanced mode agents can now be deployed on Microsoft Hyper-V. Using a DataSync agent, customers can transfer data to and from these locations with the parallelism, unlimited file counts, and detailed metrics that Enhanced mode provides. Enhanced mode HDFS support includes multiple NameNode configurations for high availability and Transparent Data Encryption (TDE) with Kerberos authentication, enabling organizations in regulated industries to securely migrate petabyte-scale encrypted Hadoop data without sacrificing availability. This capability is available in all AWS Regions where AWS DataSync is offered. To get started, visit the AWS DataSync console. For more information, see the AWS DataSync documentation.

AWS DataSync Enhanced mode now supports Amazon EFS and Amazon FSx for Lustre as source or destination locations. Enhanced mode processes data in parallel, removes file count limitations, and provides detailed transfer metrics. Previously, customers moving data to or from EFS or FSx for Lustre were limited to Basic mode. This enhancement simplifies workflows for large-scale migrations, AI and machine learning training, high-performance computing, genomics processing, and media rendering. This capability is available in all AWS Regions where AWS DataSync is offered.

AWS Elemental MediaTailor now provides direct control over ad decision server (ADS) timeouts. Previously, changing these settings required contacting AWS Support. You can now configure individual HTTP ad request timeouts, total ad personalization time budgets for live, VOD, and live ad prefetch, and enable parallel ADS requests. These settings allow you to optimize ad delivery performance for your specific workflows. For example, you can increase the personalization time budget for live events to improve ad fill rates or enable parallel ADS requests in VOD workflows to reduce overall response time for faster video startup. New prefetch-specific timeout settings give you additional granularity for livestream ad retrieval. You can configure these settings through the AWS Elemental MediaTailor console, AWS CLI, or AWS SDKs using the new AdsPersonalizationTimeouts and AdsPersonalizationConcurrency parameters on your playback configurations. This feature is available in all AWS Regions where AWS Elemental MediaTailor is available.

AWS announces the preview of the AWS Security Hub MCP App, a local Model Context Protocol (MCP) server that brings your Security Hub exposure findings directly into Claude Desktop. This capability can help accelerate your security investigations by reducing context switching and manual triage, letting you explore and act on your exposures without leaving your AI-assisted workflow. With the Security Hub MCP App, you can investigate your security posture in natural language: view your top exposure findings, drill into a finding’s attack path and expanded network path, examine correlated findings and affected resource configurations, and get remediation recommendations. Each tool call returns both a text summary for your AI agent to reason over and an interactive visualization for you to verify in the same conversation. The MCP server runs locally on your machine using your existing AWS credentials, and every tool is read-only-no changes are made to your environment. The Security Hub MCP App is available at no additional cost to Security Hub customers. This feature is available in preview in all AWS commercial Regions that support Security Hub. To learn more, see the AWS Security Hub User Guide and the AWS Security Hub product page. For the full list of Regions, see the AWS Regional Services List.

Amazon GameLift Streams now supports Custom Aspect Ratio and Dynamic Resolution, providing greater control over the streaming experience across diverse player devices and network conditions. With Custom Aspect Ratio, you can configure a specific resolution per stream session to match your player's device, including portrait, landscape, ultra-wide, and square aspect ratios. This eliminates letterboxing or pillarboxing, delivering native full-screen experiences on mobile phones, tablets, and non-standard displays. Dynamic Resolution automatically adapts stream quality when a player's network bandwidth fluctuates, reducing resolution to maintain smooth playback without frame drops or disconnections, and recovering to full quality when conditions improve. Both features are available in all AWS Regions where Amazon GameLift Streams is offered.

Amazon Relational Database Service (Amazon RDS) for SQL Server now supports restoring Transparent Data Encryption (TDE)-enabled SQL Server databases on Multi-AZ instances and instances configured with a read replica in the same region, using native backup and restore. Previously, restoring TDE-enabled databases was only available for Single-AZ instances, requiring users to disable TDE or migrate to a Single-AZ configuration before restoring encrypted databases. Users can now restore TDE-enabled database backups directly to Amazon RDS for SQL Server Multi-AZ instances and instances with read replicas in the same region. The process involves backing up the existing TDE certificate, storing it in Amazon S3, and restoring it to the Amazon RDS instance with the TDE option enabled. Then, the TDE-enabled database backup can be restored from Amazon S3 using Amazon RDS native backup and restore functionality. This simplifies migration and recovery workflows when both encryption at rest with TDE and the high availability of Multi-AZ deployments are required. This feature is available in all AWS Regions where Amazon RDS for SQL Server is supported.

AWS HealthLake now supports resource matching, which automatically identifies and links duplicate records in a datastore. Healthcare organizations can build accurate longitudinal patient records and trustworthy population health datasets without specialized master data management tooling. Resource matching works across seven Fast Healthcare Interoperability Resources (FHIR) resource types: Patient, Practitioner, Organization, Location, Device, RelatedPerson, and PractitionerRole. It matches high-confidence healthcare identifiers such as Social Security, medical record, and national provider numbers, applying each identifier's real-world scope and filtering out placeholder values to avoid false matches. Once enabled, every record that is created or updated is automatically evaluated and matches are connected through FHIR Linkage resources. Resource matching requires no configuration, matching rules, or third-party tools. Original records are never modified or deleted, preserving full provenance. Linkages are automatically re-evaluated as source records change and removed when records no longer match. AWS HealthLake resource matching is available in gated preview in the US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Mumbai), Europe (London), Europe (Ireland), Asia Pacific SouthEast (Sydney), and Canada (Central) Regions. To turn it on for your datastore during the preview period, request to be added to the allowlist.

Amazon Redshift Serverless now offers an all-upfront payment option for 3-year Serverless Reservations, providing up to 50% savings compared to on-demand rates. With this option, customers pay the full reservation term upfront and receive the maximum discount on their Amazon Redshift Serverless compute costs. This new payment option joins existing options including 1-year No Upfront, 1-year All Upfront, and 3-year No Upfront, offering greater flexibility to optimize costs based on financial preferences. Serverless Reservations are managed at the AWS payer account level and can be shared across multiple AWS accounts, reducing compute costs across all Amazon Redshift Serverless workloads in an organization. Usage exceeding the reserved RPU level is charged at standard on-demand rates. This pricing option is available in all AWS commercial and AWS GovCloud (US) Regions where Amazon Redshift Serverless is offered. Customers can purchase Serverless Reservations via the Amazon Redshift console or by invoking the Serverless Reservations API.

Amazon Managed Workflows for Apache Airflow (MWAA) now supports Apache Airflow version 2.11.2. This release includes security patches and stability improvements to core dependencies, the Airflow webserver, and task execution layers. It also includes fixes for task lifecycle management for queued tasks, enhanced secrets masking in logs, UI corrections in the Task Instances list view, and provider package updates for S3 and CloudWatch log delivery. You can create a new Apache Airflow 2.11.2 environment on Amazon MWAA or upgrade your existing environments with a few clicks in the AWS Management Console in all currently available Amazon MWAA regions.

Agents using Microsoft Azure Virtual Desktop (AVD) or Windows 365 Cloud PC can now take calls directly from their virtual desktop session with audio optimization enabled. IT administrators need to complete a one-time setup for their virtual desktop environment. Once configured, media is redirected from the virtual desktop to the agent's local device, improving audio quality. Agents simply log into their Azure Virtual Desktop or Windows 365 Cloud PC session and start accepting calls using the Amazon Connect Customer agent workspace or a custom agent interface built with the Amazon Connect Customer open-source JavaScript libraries. This support is in addition to existing audio optimization for Amazon WorkSpaces, Citrix cloud desktops, and Omnissa cloud desktops. This feature is available in all AWS Regions where Amazon Connect Customer is offered, except AWS GovCloud (US-West). To learn more, see the Amazon Connect Customer Administrator Guide.

AWS now offers Claude Opus 5, the most advanced Opus model to date, compatible with zero data retention (ZDR). It improves coding capabilities, enabling long-running agents and higher accuracy in complex analysis. Customers can access Claude Opus 5 through Amazon Bedrock, which enables ZDR by default, and Claude Platform on AWS, where ZDR is available on request. Both integrate with AWS management features and billing.

Amazon Simple Email Service (SES) now offers a simplified console experience for sending emails over SMTP using Mail Manager. Mail Manager is a capability within SES for managing email flow, but configuring its resources individually to set up SMTP sending requires multiple steps. The new guided setup creates and configures these resources automatically, so developers can get started in just a few clicks. The guided setup provides a working SMTP endpoint and downloadable credentials that can be integrated into any application or framework supporting SMTP. This is ideal for teams building applications that send email notifications, password resets, or transactional messages and need a fast path to a production-ready SMTP configuration. This experience is available in all AWS Regions where Amazon SES is available.

AWS Lambda now publishes logs for Lambda Managed Instances (LMI) capacity providers to Amazon CloudWatch Logs, providing visibility into scaling activity and instance lifecycle operations. LMI allows you to run Lambda functions on Amazon EC2 instances while maintaining serverless operational simplicity. Capacity providers let you define compute resources that Lambda provisions on your behalf. With capacity provider logs, you can monitor, troubleshoot, and optimize these managed EC2 instances, helping you quickly diagnose provisioning issues and understand scaling behavior. Customers use LMI for high-volume, predictable workloads with specialized compute configurations and achieve cost efficiency through EC2 pricing options like Savings Plans and Reserved Instances. The capacity provider logs are available in all AWS Commercial Regions where LMI is available and are enabled by default for all capacity providers. You can view logs in the Lambda console's capacity provider page and change log configuration using the Lambda API, console, AWS CLI, AWS SAM, or AWS CloudFormation. Standard Amazon CloudWatch Logs charges apply.

Amazon Kinesis Data Streams is a serverless streaming data service that makes it easy to capture, process, and store data streams at any scale. On-demand streams automatically increase ingest capacity in response to rising data ingest usage. With On-demand Advantage mode, you can proactively manage stream capacity using warm throughput to prepare streams for sudden changes in data traffic. We are extending warm throughput with the ability to also scale down ingest capacity, giving you full control to scale your stream's write throughput up or down. To scale down, simply set a lower warm throughput value on your on-demand stream. The stream adjusts to the requested capacity or the amount needed to support peak data ingest usage in the last hour, whichever is higher. This ensures your stream always retains sufficient capacity for current traffic while releasing excess capacity you no longer need. As a result, you get optimal stream-processing performance and cost efficiency. Warm throughput scale-down is available at no additional cost for all on-demand streams with On-demand Advantage mode enabled. For more information about On-demand Advantage, see Choose the right mode to stream in in the Amazon Kinesis Data Streams Developer Guide. To get started with the feature, see Update a stream. For pricing details, see Amazon Kinesis Data Streams pricing. The feature is available in all AWS Regions where Amazon Kinesis Data Streams On-demand Advantage is supported.

Starting today, customers can create Host Resource Groups (HRGs) for EC2 Dedicated Hosts without the previously required step of creating Self-Managed Licenses (SMLs) and associating AMIs through AWS License Manager. This flexibility is particularly valuable for EC2 Mac Instance customers and for customers who need Dedicated Hosts for hardware-level isolation rather than Bring Your Own License (BYOL). Customers with BYOL workloads can continue to create HRGs with SMLs to ensure that only instances from associated AMIs can be launched on the host and track host-level license consumption. To create an HRG without SML, uncheck the "Restrict to AMIs associated with self-managed license" option when creating a Host Resource Group in the EC2 Console, or set instance-launch-option to license-configuration-required via the AWS CLI. This feature is available in all AWS Regions where Host Resource Groups are supported.

AWS GovCloud (US) now offers Claude Sonnet 5 on Amazon Bedrock. Claude Sonnet 5 delivers strong performance across coding, professional work, and agentic tasks while maintaining the balance of capability, cost, and speed. For coding, it navigates large codebases, lands multi-file changes, and carries debugging and refactoring tasks through to completion with fewer rounds of correction. For agents, it calls tools precisely, holds state across many steps, and recovers from errors so more runs finish correctly the first time. For knowledge work, it builds spreadsheets, drafts documents, and turns unstructured material into structured analysis. With this launch, Claude Opus 4.8 and Claude Sonnet 5 are available on bedrock-runtime endpoints in AWS GovCloud (US-West and US-East) and bedrock-mantle endpoints in AWS GovCloud (US-West) for performing inference. Bedrock Mantle, Amazon's next-generation inference engine, supports the Anthropic Messages API. Amazon Bedrock keeps your data within AWS infrastructure and provides access to Claude Sonnet 5 through a unified service with AWS-managed features like Guardrails, Knowledge Bases, and regional data residency.

AWS Clean Rooms now supports larger worker types with 32 vCPUs and 244 GB of memory for SQL analyses, enabling more compute and memory-intensive workloads. Previously, the largest worker type available was 16 vCPUs with 120 GB of memory. These larger workers help improve performance for complex queries on large datasets, optimizing costs for customers. For example, an advertiser collaborating with a publisher can use larger workers to run complex feature engineering across billions of records to train their multi-touch attribution model, accelerating time-to-value and optimizing costs. AWS Clean Rooms helps companies and their partners easily analyze and collaborate on their collective datasets without revealing or copying one another’s underlying data.

Amazon Web Services (AWS) announces the general availability of Amazon EC2 I8ge instances in the AWS Europe (London) and Canada (Central) regions. I8ge instances are powered by AWS Graviton4 processors and deliver up to 60% better compute performance compared to previous generation Graviton2-based storage-optimized Amazon EC2 instances. They utilize third-generation AWS Nitro SSDs and local NVMe storage, providing up to 55% better real-time storage performance per TB compared to previous generation Amazon EC2 Im4gn instances. I8ge instances offer up to 60% lower storage I/O latency and up to 75% lower storage I/O latency variability compared to Im4gn instances. These storage-optimized instances provide up to 120TB of local NVMe storage and are ideal for workloads requiring rapid local storage with high random read/write performance and consistently low latency for accessing large datasets. Available in eleven different sizes including two metal sizes, they deliver up to 180 Gbps of network bandwidth and 60 Gbps of dedicated bandwidth for Amazon Elastic Block Store (EBS), ensuring fast and efficient data transfer for the most demanding applications.

Amazon CloudWatch Logs now supports Application Load Balancer (ALB) logs as vended logs, improving observability and simplifying debugging for network traffic patterns. You can now analyze ALB access, connection, and health check logs directly in CloudWatch to gain insights into client connections, traffic distribution, connection status, and target health, helping you identify and troubleshoot network issues faster. Additionally, you can set up CloudWatch telemetry enablement rules to automatically configure logging of both existing and newly created ALB resources, for your organization, specific accounts, or specific resources, ensuring consistent monitoring coverage without manual setup. With this CloudWatch Logs integration, you can track detailed access patterns using CloudWatch Logs Insights queries, create metric filters for monitoring and alarming, and review traffic patterns in real time using Live Tail. ALB logs can be configured through the integrations tab of your application load balancer in the AWS Management Console, AWS CLI, or SDKs. You can also configure delivery of ALB logs to Amazon Data Firehose or Amazon S3 with support for Apache Parquet format. ALB logs delivery to CloudWatch is available in all AWS Commercial and GovCloud regions where Application Load Balancer and CloudWatch are available. ALB logs are charged as vended logs when delivered to CloudWatch Logs and Data Firehose, while delivery to Amazon S3 is free (Parquet conversion is charged at $0.035/GB - N. Virginia). To learn more about configuring ALB logs in CloudWatch Logs, please visit our documentation. For pricing information, see the CloudWatch pricing page.

AWS announces the general availability of the AWS Lambda Durable Execution SDK for .NET, allowing C# developers to build resilient, long-running workflows using Lambda durable functions. With this SDK, developers can create multi-step applications such as payment processing pipelines, AI agent orchestration, and human-in-the-loop approvals directly in their applications without implementing custom progress tracking or integrating external orchestration services. Lambda durable functions extend Lambda's event-driven programming model with operations that automatically checkpoint progress and pause execution for up to a year while waiting for external events. The AWS Lambda Durable Execution SDK for .NET provides an idiomatic C# experience for building with Lambda durable functions, including steps for progress tracking, callback integration for human and agent-in-the-loop workflows, durable invocation for reliable function chaining, and waits for efficient suspension. The SDK installs from NuGet into the .NET toolchain used today, and the local testing emulator in the SDK enables developers to build and debug locally before deploying to production.

Amazon Elastic Container Service (Amazon ECS) introduces zone-aware routing for ECS Service Connect, enabling customers to reduce cross Availability Zone (AZ) data transfer costs and latency by automatically prioritizing service-to-service traffic within the same AZ. With this launch, ECS Service Connect preferentially routes requests to endpoints in the same AZ as the originating task while dynamically adjusting traffic weights as endpoints scale to maintain balanced load across target services. Previously, as customers distributed their applications across AZs for resiliency, service-to-service traffic led to significant cross-zone data transfer, requiring trade-offs between cost and resilience. Zone-aware routing eliminates this trade-off, and when local endpoints become unhealthy or fall below capacity thresholds, traffic automatically redistributes across healthy AZs to maintain availability without overloading any single zones. Zone-aware routing is enabled by default for all new and existing services and requires no additional infrastructure or application code changes. Existing services require a one-time redeployment to enable the new routing behavior. You can use Amazon VPC Flow Logs with AZ metadata to monitor cross-AZ traffic patterns and validate routing effectiveness. This feature is available in all AWS commercial and AWS GovCloud (US) Regions, where ECS Service Connect is supported at no additional cost.

AWS today announced a research preview of aws-bench, an open-source benchmark that measures how accurately and efficiently AI agents complete real-world AWS tasks. Model providers and AI researchers building agents that operate on AWS infrastructure need an objective, reproducible way to measure performance and diagnose failures. aws-bench provides a public suite of test cases derived from analysis of real AWS usage, including investigation, troubleshooting, and infrastructure creation tasks. Each test case pairs a natural-language query with a defined cloud resource state and a ground-truth answer, allowing any agent or model to be scored on a consistent, verifiable basis. Researchers and model providers can use aws-bench to improve foundation model performance on AWS tasks, enhance agent harnesses, and track progress. The release includes an easy-to-use CLI tool to instantiate testing environments, execute and score evaluation runs, and reset resource state. aws-bench is now available on GitHub. To get started, follow the setup instructions on the README.

Two new models are now available in the Kiro IDE and CLI for the AWS GovCloud (US) Regions. Claude Opus 4.8 is the most intelligent Opus model, delivering stronger self-verification, more efficient tool calling, and better follow-through on long-horizon projects. It plans before it edits, catches its own mistakes, and finds creative paths around obstacles instead of stalling, making it well suited for complex multi-step tasks that previously required close supervision. Available with a 1M context window and 2.2x credit multiplier. Claude Sonnet 5 is the most agentic Sonnet model, bringing stronger reasoning, tool use, and coding at Sonnet-class pricing. It approaches Opus 4.8 on reasoning and agentic coding benchmarks while running at meaningfully lower cost, giving developers a cost-performance dial between maximum accuracy and higher throughput. Available with experimental support, a 1M context window, and 1.3x credit multiplier. Kiro enterprise administrators now have full visibility into organizational usage through built-in monitoring and tracking. A usage dashboard provides aggregate metrics at a glance, per-user activity reports deliver daily CSV telemetry (credits, model usage, and more) to your S3 bucket for license optimization and audit, and optional prompt logging captures user prompts and Kiro responses for compliance and debugging. All data is stored in your own account with no additional charge beyond S3 storage. Ensure your IDE or CLI is updated to the latest version, then restart it to access the new models from the model selector. For more details, visit the GovCloud documentation, the monitoring and tracking guide, or contact your AWS account team. To learn more about Kiro, visit the Kiro product page.

Amazon SageMaker AI inference now offers EC2 G7e instances in Asia Pacific (Seoul), Europe (London), and Asia Pacific (Tokyo) regions. G7e instances feature up to eight NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs with 96GB of memory per GPU, 5th Generation Intel Xeon processors, and up to 1,600 Gbps of Elastic Fabric Adapter networking bandwidth. This delivers up to 2.3x inference performance compared to previous-generation G6e instances. With up to 768GB of total GPU memory on a single instance, G7e instances enable serving medium-to-large language models of up to 70 billion parameters with FP8 precision without multi-node configurations. These instances are well suited for LLM inference, image and video generation, spatial computing, and scientific computing workloads requiring high GPU memory capacity and bandwidth.

Amazon Elastic VMware Service (Amazon EVS) is now available in the Asia Pacific (Seoul), Europe (Zurich), and Europe (Stockholm) Regions. This expansion allows VMware workloads to benefit from lower latency closer to end users, compliance with data residency requirements, and additional high availability options. Amazon EVS enables running VMware Cloud Foundation directly within a VPC on EC2 bare-metal instances powered by AWS Nitro, allowing a complete VCF environment to be set up in just a few hours. It supports VCF 9.0 and 9.1, providing access to the latest VMware features such as memory tiering.

Amazon Bedrock AgentCore now delivers agent traces and prompts to the same log group as your agent's logs, providing unified observability for AI agents in a single Amazon CloudWatch log group. Previously, AgentCore split agent telemetry across multiple destinations-trace spans went to the shared aws/spans log group while event logs containing prompts, inputs, and outputs went to a separate resource-specific log group. This meant debugging an agent invocation required searching across multiple log groups, and customers could not apply fine-grained access control or customer-managed key (CMK) encryption at the individual agent level. With today's launch, all of an agent's telemetry traces, prompts, structured logs, and standard output are delivered to a single per-agent log group (/aws/bedrock-agentcore/runtimes/<agent_id>-<endpoint_name>). You can now correlate traces and logs in one place, scope IAM policies and CMK encryption to individual agents, and export all telemetry by subscribing to a single log group. For multi-agent systems, each agent's complete execution history stays together, making end-to-end debugging straightforward. All newly created agents starting July 20, 2026, in supported AWS Regions use unified observability by default with no configuration needed. For existing agents, set the UNIFIED_TRACES_DESTINATION_ENABLED=true environment variable on your agent runtime and upgrade ADOT to version 0.17.1 or later. This feature is available in all AWS commercial regions where AgentCore runtime is supported. Learn more in the AgentCore Developer Guide.

Amazon RDS for MySQL now supports community MySQL version 9.7 in the Amazon RDS Database Preview Environment, allowing you to evaluate the latest release on Amazon RDS for MySQL. This preview environment provides a sandbox where you can test applications and explore new MySQL 9.7 capabilities before they become generally available. MySQL 9.7 is the latest Long-Term Support release for community MySQL, including bug fixes, security patches, and new features. Amazon RDS Database Preview Environment database instances are retained for a maximum of 60 days and are automatically deleted after the retention period. Snapshots created in the preview environment can only be used to create or restore database instances within the preview environment. Pricing for preview environment instances is the same as production RDS instances in the US East (Ohio) Region.

AWS now enables customers who pay through electronic funds transfer to configure preferences for how credit memos are automatically applied to outstanding invoices. Customers can choose from different application preferences directly on the Billing and Cost Management console to match their internal payment processes. These options include combinations of applying credit memos to the original invoice, next eligible invoice, and oldest unpaid invoice. By default, credit memos are applied to the original invoice first, then to future invoices, unless a different preference is selected. Automatic credit memo application preferences are available in all commercial AWS Regions.

AWS announces the general availability of node lifecycle actions in AWS Parallel Computing Service (PCS). With node lifecycle actions, you can run custom scripts automatically at defined points in a compute node's lifecycle. Use them to prepare your nodes for work, such as mounting shared storage, joining a directory service, installing software, or setting up monitoring. Define node lifecycle actions in your PCS compute node group configuration when you create or update the group, and reuse the same script across multiple compute node groups and clusters. For each script, set its location as an Amazon S3 or HTTPS URI, the arguments to pass, which lifecycle stage it runs in, whether it re-runs on reboot, and its error-handling behavior. AWS PCS writes the output to a dedicated log file, providing visibility into what ran. AWS PCS is a managed service that simplifies running and scaling high-performance computing (HPC) workloads on AWS using Slurm. Build complete, elastic environments that integrate compute, storage, networking, and visualization tools. The service manages cluster updates and provides built-in observability. Node lifecycle actions are available in all AWS Regions that support AWS PCS. For more information, see the AWS PCS User Guide.

Amazon SageMaker AI inference now supports G7 instances powered by NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs. These instances offer up to 4.6x AI inference performance compared to previous-generation G6 instances. G7 instances provide 32 GB of GPU memory per GPU with 5th Generation Tensor Cores, up to 700 Gbps of EFA-enabled networking (7x compared to G6), and up to 7.6 TB of local NVMe SSD storage for keeping large models close to compute. These capabilities make G7 instances well suited for serving models in the 7B-30B parameter range, image and video generation workloads, and multi-model inference endpoints that benefit from higher memory bandwidth and throughput. You can deploy models on G7 instances using the SageMaker AI Inference console, API, or SDK by specifying G7 instance types (such as ml.g7.xlarge through ml.g7.48xlarge) in your endpoint configuration.

Amazon EC2 M8id instances are now available in the Europe (Ireland) region. These instances are powered by custom Intel Xeon 6 processors and deliver up to 43% higher performance and 3.3x more memory bandwidth compared to previous generation M6id instances. M8id instances offer up to 384 vCPUs, 1.5 TiB of memory, and 22.8 TB of NVMe SSD storage, 3x more than previous generation instances. These instances deliver up to 46% higher performance for I/O intensive database workloads, and up to 30% faster query results for I/O intensive real-time data analytics than previous sixth-generation instances. Additionally, these instances support Instance Bandwidth Configuration, allowing 25% flexible allocation between network and EBS bandwidth, allocating resources optimally for each workload. M8id instances are well-suited for balanced workloads including application servers, microservices, enterprise applications, and small to medium databases. Customers can purchase these instances via Savings Plans, On-Demand instances, and Spot instances. For more information visit the Amazon EC2 instance type page.

Amazon EC2 C7a instances are now available in the AWS US West (N. California) Region. Powered by 4th Gen AMD EPYC processors (code-named Genoa) with a maximum frequency of 3.7 GHz, C7a instances deliver up to 50% higher performance compared to C6a instances. They offer new processor capabilities such as AVX-512, VNNI, and bfloat16, and feature Double Data Rate 5 (DDR5) memory for high-speed data access with 2.25x more memory bandwidth than C6a instances, making them ideal for latency-sensitive workloads. C7a instances come in 12 sizes from medium to 48xlarge, including a bare-metal size. With the launch of C7a instances, customers can attach up to 128 EBS volumes to an EC2 instance, compared to C6a instances which allow up to 28 EBS volume attachments. Built on the AWS Nitro System, these instances are ideal for high-performance, compute-intensive workloads such as batch processing, distributed analytics, high-performance computing (HPC), ad serving, highly scalable multiplayer gaming, and video encoding. C7a instances are available through On-Demand, Spot Instances, and Savings Plans.

Amazon EC2 High Memory U7i instances, u7in-16tb (224xlarge) in South America (Sao Paulo) region and u7in-24tb (224xlarge) in Europe (Ireland) region, are now available. U7i instances feature fourth-generation Intel Xeon Scalable processors and provide 16 TiB or 24 TiB of DDR5 memory, enabling customers to scale transaction processing throughput in fast-growing data environments. Both instances deliver 896 vCPUs, support up to 100 Gbps Amazon EBS bandwidth for faster data loading and backups, 200 Gbps network bandwidth, and ENA Express. They are ideal for mission-critical in-memory databases such as SAP HANA, Oracle, and SQL Server.

AWS Wickr now offers a managed Data Retention Service feature for Premium users, enabling organizations to retain conversations across their network for data archiving purposes. The Data Retention Service can retain conversations in your network, including direct messages and conversations in Groups or Rooms between internal members and external federated teams. The serverless architecture offers simplified deployment, managed infrastructure, automatic scaling, and comprehensive monitoring while maintaining Wickr's end-to-end encryption standards. This feature is particularly valuable for organizations that require comprehensive data archiving capabilities and maintaining audit trails. AWS Wickr Premium customers can opt in to enable data retention for their networks.

Amazon EC2 G6 instances are now available for Amazon SageMaker AI inference in the AWS GovCloud (US-East) region. G6 instances feature up to 8 NVIDIA L4 Tensor Core GPUs, each with 24 GB of memory, and third-generation AMD EPYC processors, delivering up to 2x the deep learning inference performance compared to G4dn instances. This region expansion allows government agencies and organizations operating in GovCloud to deploy inference endpoints on G6 instances for generative AI workloads-including small-to-medium language models, image generation, and computer vision tasks-while meeting strict compliance and data residency requirements. G6 instances offer strong price-performance for production inference workloads that fit within 24 GB of GPU memory.

AWS Organizations now supports up to 2,000 resource control policies (RCPs) per organization, doubling the previous limit of 1,000. RCPs enable centralized management of maximum permissions available to resources across member accounts. This quota increase helps customers managing large, complex multi-account environments define more granular resource access controls without encountering policy limits. With RCPs, you can restrict which external principals can access resources across your organization's member accounts, enforcing organization-wide access control guidelines at scale without updating individual resource-based policies. The increased quota of 2,000 RCPs per organization is available at no additional cost in all AWS Regions where AWS Organizations is supported. No action is required-existing organizations automatically have access to the higher limit.

On July 22, 2026, Amazon announced quarterly security and critical updates for Amazon Corretto Long-Term Support (LTS) and Feature Release (FR) versions of OpenJDK. Corretto 26.0.2, 25.0.4, 21.0.12, 17.0.20, 11.0.32, and 8u502 are now available for download. Starting with this release, the default Amazon Corretto Docker images are based on Amazon Linux 2023, with Amazon Linux 2 images continuing to be provided as non-default options for customers who cannot yet migrate. JavaFX binaries are no longer included with Corretto 8 from this release onward. Migration recommendations can be found on the Corretto 8 GitHub page. Updates can be downloaded from the Corretto home page or obtained on Linux systems by configuring a Corretto Apt, Yum, or Apk repository

AWS Lambda durable functions now supports encryption of durable execution data using AWS Key Management Service (AWS KMS) customer managed keys. Previously, Lambda encrypted execution state at rest by default with an AWS owned key. With this update, users can select and manage their own encryption keys. This is particularly useful for regulated industries such as financial services or healthcare, where data governance policies may require customer-owned encryption keys. The durable execution key operates independently of the function-level key that protects environment variables and SnapStart snapshots, allowing separate management of execution data access. The feature is available in all AWS Regions where Lambda durable functions are offered. Standard AWS KMS charges apply for customer managed keys, with no additional Lambda charges for this feature.

AWS Entity Resolution now supports real-time matching with advanced matching workflows, allowing customers to match records in milliseconds using complex rulesets through the GenerateMatchId API. Previously, real-time matching was limited to simple rule-based workflows, while advanced rulesets-which support operators like Exact and ExactManyToMany combined with AND/OR logic-could only be used for batch processing that took minutes to hours. This created a critical gap for customers needing real-time entity resolution with sophisticated matching logic. With this launch, customers performing fraud detection, real-time account lookup, or website personalization can define advanced matching rules and get results in real-time without maintaining separate matching infrastructure or re-architecting applications. To enable advanced real-time matching, customers set the enableRealTimeMatching parameter to true on their matching workflow, then call the existing GenerateMatchId API-no new endpoints or migration required. Advanced real-time matching is available in all AWS Regions where AWS Entity Resolution is available.

Network Load Balancer (NLB) now supports listener rules, allowing you to route connections to different target groups based on the source IP address type. With listener rules, a single dual-stack NLB sends IPv6 client traffic to IPv6 targets and IPv4 client traffic to IPv4 targets, preserving the original client IP address end to end for both address families. Previously, serving both IPv4 and IPv6 clients from one NLB meant accepting a tradeoff: either run two separate load balancers (one per IP version) and split clients with DNS, or send all traffic to one target group and lose the original client IP through protocol translation. Listener rules remove that tradeoff by enabling conditional routing at Layer 3, directing each connection to a same-family target group with no translation and no additional infrastructure. You can add listener rules to existing dual-stack NLBs without recreating them. Rules are supported on TCP, UDP, TCP_UDP, and TLS listeners and work alongside existing NLB features including connection draining, target group stickiness, cross-zone load balancing, weighted target groups, and client IP preservation. Listener rules for Network Load Balancer are available in all AWS commercial Regions and the AWS GovCloud (US) Regions at no additional charge. Standard NLB pricing for load balancer hours and LCUs applies.

Amazon EC2 M8a instances are now available in the Asia Pacific (Hyderabad) region. M8a instances are powered by 5th Gen AMD EPYC processors (formerly code named Turin) with a maximum frequency of 4.5 GHz, delivering up to 30% higher performance and up to 19% better price-performance compared to M7a instances. M8a instances deliver 45% more memory bandwidth compared to M7a instances, making these instances ideal for even latency sensitive workloads. M8a instances deliver even higher performance gains for specific workloads. M8a instances are up to 60% faster for GroovyJVM benchmark, and up to 39% faster for Cassandra benchmark compared to Amazon EC2 M7a instances. M8a instances are SAP-certified and offer 12 sizes including 2 bare metal sizes. This range of instance sizes allows customers to precisely match their workload requirements. M8a instances are built using the latest sixth generation AWS Nitro Cards and ideal for applications that benefit from high performance and high throughput such as financial applications, gaming, rendering, application servers, simulation modeling, mid-size data stores, application development environments, and caching fleets. To get started, sign in to the AWS Management Console. Customers can purchase these instances via Savings Plans, On-Demand instances, and Spot instances. For more information visit the Amazon EC2 M8a instance page.

Amazon Elastic Container Service (Amazon ECS) now supports built-in blue/green, linear, and canary deployment strategies in the AWS European Sovereign Cloud, making software updates for containerized applications safer and allowing you to release new application versions faster with greater confidence. Built directly into Amazon ECS, these capabilities eliminate the need for custom deployment tooling while providing production-ready controls including deployment lifecycle hooks, bake time, and quick rollback. With these strategies, Amazon ECS provisions a new application version alongside the existing version and allows you to validate it before shifting production traffic. Blue/green deployments shift traffic in a single step, linear deployments shift traffic in equal increments over a specified period, and canary deployments shift a small percentage initially before shifting the remainder. You can use deployment lifecycle hooks, including Lambda hooks and pause hooks, to run custom validation logic and approval workflows at specific deployment stages. You can also configure bake time to evaluate the new version after traffic has shifted, and roll back without downtime if regressions are identified. To automatically detect failures, configure Amazon CloudWatch alarms or Amazon ECS deployment circuit breaker, or initiate a rollback directly using the StopServiceDeployment API. These capabilities are available for Amazon ECS services using Application Load Balancers (ALB), Network Load Balancers (NLB), and Amazon ECS Service Connect. You can configure deployments using the AWS Management Console, AWS CLI, AWS SDKs, or infrastructure-as-code tools on new or existing Amazon ECS services.

Amazon SageMaker Unified Studio now supports Amazon OpenSearch as a data source, enabling you to query and analyze your search and log analytics data directly alongside your other data assets. With this new connection, you can combine operational search data in OpenSearch with data from sources like Amazon Redshift, Amazon S3, and relational databases-all within a single, governed environment. This integration is particularly valuable when you need to correlate data across analytical and operational workloads. For example, you can join application logs and metrics stored in OpenSearch with transactional data to gain insights into system performance and user behavior. Data engineers and analysts can build data pipelines that bring together real-time search and analytics data with structured datasets, streamlining cross-source workflows without switching between tools. To get started, add an Amazon OpenSearch connection under your project’s data section. Your OpenSearch data now appears in the data explorer alongside your other project data. From there, you can query it directly using the query editor, explore it in notebooks, or incorporate it into a visual ETL job, all without leaving the studio. Support for Amazon OpenSearch connections is available in all AWS Regions where Amazon SageMaker Unified Studio is available.

AWS Elastic Disaster Recovery (AWS DRS) is now available in six additional AWS Regions: Asia Pacific (Bangkok), Asia Pacific (Malaysia), Asia Pacific (New Zealand), Asia Pacific (Taipei), Canada West (Calgary), and Mexico (Central). Elastic Disaster Recovery is the recommended service for disaster recovery to AWS. It helps minimize downtime and data loss with fast, reliable recovery of on-premises and cloud-based applications using affordable storage, minimal compute, and point-in-time recovery. With Elastic Disaster Recovery, you can recover your applications on AWS from physical infrastructure, VMware vSphere, Microsoft Hyper-V, and cloud infrastructure. You can also use Elastic Disaster Recovery to recover Amazon EC2 instances in a different AWS Region. AWS DRS replicates and recovers a wide range of applications, including critical databases such as Oracle, MySQL, and SQL Server, and enterprise applications such as SAP. AWS DRS uses a unified process for drills, recovery, and failback, so you do not need application-specific skillsets to operate the service. With this launch, Elastic Disaster Recovery is now available in 36 AWS Regions. See the AWS Regional Services List for the most up-to-date availability information.

Today, AWS announced the expansion of 100 Gbps dedicated connections at the existing AWS Direct Connect location within the Cirion data center in Lima, Peru. You can now establish private, direct network access to all public AWS Regions (except those in China), AWS GovCloud Regions, and AWS Local Zones from this location. This is the first AWS Direct Connect location in Peru to provide 100 Gbps connections with MACsec encryption capabilities. The Direct Connect service enables you to establish a private, physical network connection between AWS and your data center, office, or colocation environment. These private connections can provide a more consistent network experience than those made over the public internet.

AWS Secrets Manager now automatically publishes events to Amazon EventBridge whenever your secret values change, enabling you to build event-driven workflows that respond in real time to secret updates. Previously, you had to rely on AWS CloudTrail events parsed into EventBridge to detect secret value changes, requiring you to match multiple API events such as rotation success, PutSecretValue, and UpdateSecretValue. With this launch, Secrets Manager publishes events directly into EventBridge whenever your secret value changes. You can use EventBridge rules to detect when the active secret value changes-such as during rotation-and route notifications to targets like AWS Lambda, Amazon SNS, Amazon SQS, or Amazon Step Functions. This enables you to proactively refresh cached credentials in your applications, restart dependent services, or update compliance reports for secret rotation. Secret update notifications are published to your default event bus automatically with no additional configuration or opt-in required. This feature is available in all AWS Regions where AWS Secrets Manager is available at no additional cost.

Amazon Elastic Kubernetes Service (EKS) now supports Amazon EC2 placement groups and Elastic Fabric Adapter (EFA) network device configuration for node pools on EKS Auto Mode and the open-source Karpenter project, enabling you to optimize EKS workloads for performance and availability. With EKS Auto Mode and Karpenter’s EFA configuration, you can configure network interfaces as EFA-only or standard ENI on EFA-capable instances with both dynamic and static capacity node pools. EFA-only interfaces do not consume IP addresses, giving you fine-grained control over IP utilization in your VPC while achieving full interconnect bandwidth. With placement group support, you can launch EC2 instances using cluster, spread, or partition strategies directly from your EKS Auto Mode or Karpenter node pool configuration, giving you control over how instances are physically distributed without additional operational workarounds. These capabilities allow you to optimize for the performance, availability, and fault isolation characteristics your workloads require, whether that's maximizing throughput for distributed training jobs or minimizing blast radius for critical production services. These features are available in all AWS Regions where Amazon EKS is available.

Amazon Elastic Container Service (Amazon ECS) now introduces Action Logs, a new observability feature that delivers detailed, timestamped records of the actions Amazon ECS performs on behalf of customers during service deployments and ECS Managed Daemon updates. This visibility into previously invisible service-side operations allows you to monitor and troubleshoot your workloads directly, without contacting AWS Support or manually correlating data from multiple sources. Action Logs provide visibility into key deployment state transitions of service deployments and Managed Daemon updates. Each log entry includes the event name, log level (INFO, WARN, or ERROR), relevant resource ARNs, and a status reason, helping reduce mean time to resolution when issues arise. You can opt in at the cluster level through the Amazon ECS console or by using Amazon CloudWatch vended logs APIs, and choose to deliver logs to Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose depending on your operational needs. At launch, Amazon Q in the Amazon ECS console integrates with Action Logs to automatically detect deployment issues such as circuit breaker rollbacks and unstable service revisions, providing customers with root cause analysis, resource-level comparisons, and step-by-step remediation guidance without leaving the console. Standard CloudWatch Logs, Amazon S3, or Amazon Data Firehose pricing applies for log ingestion and storage. For pricing details, see Amazon CloudWatch Pricing. Amazon ECS Action Logs are available in all AWS Regions, including the AWS GovCloud (US) Regions.

Amazon Simple Email Service (SES) has introduced pricing plans, simplifying the purchase and access to SES capabilities without evaluating them individually. The plans include Essentials, Pro, and Enterprise, each building on the previous one with progressively more capabilities at a discount compared to à-la-carte pricing. Essentials provides deliverability insights, Pro adds managed dedicated IPs, email validation, and global inbox placement visibility to proactively prevent issues, and Enterprise adds multi-region resilience, workload-level reputation isolation, and an annual deliverability assessment. These pricing plans are available in all AWS Regions where Amazon SES is offered, except the Middle East (UAE) and Middle East (Bahrain) Regions.

Amazon Elastic Compute Cloud (Amazon EC2) M6in and M6idn instances are now available in the AWS Asia Pacific (Hyderabad) and South America (Sao Paulo) regions. These sixth-generation network-optimized instances, powered by 3rd Generation Intel Xeon Scalable processors and built on the AWS Nitro System, deliver up to 200Gbps of network bandwidth, which is 2x more than comparable fifth-generation instances. Customers can use M6in and M6idn instances to scale the performance and throughput of network-intensive workloads such as high-performance file systems, distributed web-scale in-memory caches, caching fleets, real-time big data analytics, and Telco applications such as 5G User Plane Function. M6in and M6idn instances are available in 10 different instance sizes including metal, offering up to 128 vCPUs and 512 GiB of memory. They deliver up to 100Gbps of Amazon Elastic Block Store (EBS) bandwidth and up to 400K IOPS. M6in and M6idn instances support Elastic Fabric Adapter (EFA) networking on 32xlarge and metal sizes. M6idn instances offer up to 7.6 TB of high-speed, low-latency instance storage. With this regional expansion, M6in and M6idn instances are available in the following AWS Regions: US East (Ohio, N. Virginia), US West (N. California, Oregon), Europe (Ireland, Frankfurt, Spain, Stockholm, Zurich, London), Asia Pacific (Hyderabad, Mumbai, Singapore, Tokyo, Sydney, Seoul), South America (Sao Paulo), Canada (Central), and AWS GovCloud (US-West). Customers can purchase the new instances through Savings Plans, On-Demand, and Spot instances. To learn more, see the M6in and M6idn instances page.

Amazon Elastic Compute Cloud (Amazon EC2) C6in instances are now available in the AWS Asia Pacific (Taipei) Region. These sixth-generation network-optimized instances, powered by 3rd Generation Intel Xeon Scalable processors and built on the AWS Nitro System, deliver up to 200Gbps of network bandwidth, which is 2x more than comparable fifth-generation instances. Customers can use C6in instances to scale performance for applications such as network virtual appliances (firewalls, virtual routers, load balancers), Telco 5G User Plane Function (UPF), data analytics, high-performance computing (HPC), and CPU-based AI/ML workloads. C6in instances are available in 10 different sizes with up to 128 vCPUs, including bare metal sizes. They provide up to 100Gbps of Amazon Elastic Block Store (Amazon EBS) bandwidth and up to 400K IOPS. The 32xlarge and metal sizes support Elastic Fabric Adapter (EFA) networking. C6in instances are available in multiple AWS Regions including US, Europe, Middle East, Asia Pacific, Africa, South America, Canada, AWS GovCloud, and Mexico

Amazon Elastic Compute Cloud (Amazon EC2) R6in and R6idn instances are now available in the AWS Europe (Paris) and Canada (Central) regions. These sixth-generation network-optimized instances, powered by 3rd Generation Intel Xeon Scalable processors and built on the AWS Nitro System, deliver up to 200Gbps of network bandwidth, 2x more network bandwidth, and up to 2x higher packet-processing performance over comparable fifth-generation instances. Customers can use R6in and R6idn instances to scale the performance and throughput of network-intensive workloads such as memory-intensive SQL and NoSQL databases, distributed web scale in-memory caches (Memcached, Redis), in-memory databases (SAP HANA), and real-time big data analytics (Apache Hadoop, Apache Spark). R6in and R6idn instances are available in 10 different instance sizes including metal, with up to 128 vCPUs and 1024 GiB of memory. They deliver up to 100 Gbps of Amazon Elastic Block Store (EBS) bandwidth and up to 400K IOPS. R6in and R6idn instances offer Elastic Fabric Adapter (EFA) networking support on 32xlarge and metal sizes. R6idn instances offer up to 7.6 TB of high-speed, low-latency instance storage. With this regional expansion, R6in and R6idn instances are available in the following AWS Regions: US East (N. Virginia, Ohio), US West (Oregon), Europe (Ireland, Frankfurt, Paris, Stockholm), Asia Pacific (Singapore, Sydney, Tokyo), Canada (Central), and AWS GovCloud (US-West). Customers can purchase the new instances through Savings Plans, Reserved, On-Demand, and Spot instances. To learn more, see the R6in and R6idn instances page.

AWS HealthOmics private workflows are now available in the Asia Pacific (Tokyo) and US East (Ohio) Regions, expanding access to fully-managed bioinformatics workflows for research, drug discovery, and agriculture science initiatives with regional compliance requirements. AWS HealthOmics is a HIPAA-eligible service that helps healthcare and life sciences customers accelerate scientific breakthroughs with fully managed bioinformatics workflows. With HealthOmics private workflows, customers can build and scale genomics data analysis pipelines using familiar domain-specific languages including Nextflow, WDL, and CWL, enabling healthcare and life sciences customers to focus on scientific discovery rather than infrastructure management. HealthOmics provides built-in features, such as Git integrations for version-controlled workflow development and third-party container registry support through Amazon ECR, to make it easy to migrate existing pipelines and accelerate development of new genomics workflows while maintaining full data provenance and compliance requirements. Private workflows are now available in the following AWS Regions: US East (N. Virginia, Ohio), US West (Oregon), Europe (Frankfurt, Ireland, London), Israel (Tel Aviv), and Asia Pacific (Seoul, Singapore, Tokyo).

AWS Marketplace now enables India-based sellers to upload and manage their seller signatures directly through AWS Partner Central, eliminating the previous manual, email-based submission process. Sellers located in India are required to provide a valid seller signature for tax invoicing and regulatory compliance. This launch consolidates Goods and Services Tax Identification Number (GSTIN) registration and seller signature management into a single, centralized location purpose-built for India-based sellers transacting on AWS Marketplace. Once uploaded, AWS Marketplace securely stores your signature and uses it for applicable buyer tax invoices generated on your behalf for transactions in India. This launch introduces automated real-time validation and a new tax summary container providing at-a-glance visibility into GSTIN registration and seller signature verification status. Sellers are notified by email when their signature is verified or rejected, and can resolve rejections independently by resubmitting directly in the console using the displayed rejection reason, ensuring real-time compliance visibility. To learn more about managing your tax compliance and seller signature in AWS Partner Central, visit the AWS Marketplace Seller Guide.

Amazon WorkSpaces Applications now supports Microsoft OneDrive for Business and Google Drive as persistent storage options on multi-session fleets. Users streaming on multi-session fleets can now connect their OneDrive or Google Drive accounts and access, save, and sync their cloud-based files directly within their streaming sessions, in addition to the existing home folder backed by Amazon S3. Multi-session fleets allow multiple users to share a single fleet instance, enabling organizations to achieve cost efficiencies by increasing session density across their infrastructure. With the addition of OneDrive and Google Drive support, customers can now take full advantage of the cost savings offered by multi-session fleets while providing their users with familiar, enterprise-grade cloud storage experiences. Users can browse, upload, and download files from their connected storage accounts without disruption, enabling seamless collaboration and continuity across streaming sessions. Microsoft OneDrive for Business and Google Drive support on multi-session fleets is available in all AWS Regions where Amazon WorkSpaces Applications is offered. Standard usage pricing applies for WorkSpaces Applications streaming sessions; there is no additional charge for enabling OneDrive or Google Drive storage connectors. To enable this feature for your users, you must use a WorkSpaces Applications image that uses a WorkSpaces Applications agent released on or after June 29, 2026 or your image uses Managed WorkSpaces Applications image updates released on or after June 29, 2026.

Amazon Connect Customer dashboards now display real-time and historical metrics for agent queues. Agent queues are used to directly route contacts to a specific agent. This allows supervisors to track how these agents perform in their own queues. For example, a supervisor can notice a spike in contacts queued to a specific agent queue following a series of scheduled callbacks and reassign them to avoid long wait times. Agent queue metrics are available in all AWS commercial and AWS GovCloud (US-West) regions where Amazon Connect Customer is offered.

AWS Partner Central agents now support all AWS Partner funding programs. Partners can get guidance on eligibility requirements, application processes, and program details for any funding program and receive documentation-backed answers in seconds. The agents already automate the full funding lifecycle for four funding programs, supported since the March 2026 launch. This expansion adds Strategic Collaboration Agreement (SCA) and AWS Growth Initiative (AGI) funding programs, eliminating manual data entry and reducing eligibility errors. The agents validate eligibility against opportunity and partner data, review uploaded documentation against program requirements, and draft fund requests with auto-populated fields. AWS Partner Central agents are available in all commercial AWS Regions. To get started, open an opportunity in AWS Partner Central to receive funding recommendations, or review the agents guide for more details.

Amazon RDS for SQL Server now supports Microsoft SQL Server 2025 for Enterprise, Standard, and Developer editions. SQL Server 2025 integrates AI directly into the database engine, allowing customers to invoke external REST endpoints from T-SQL without additional middleware. This enables secure integration of existing database workloads with AWS services such as Amazon Bedrock, Amazon SageMaker, Amazon S3, and AWS Lambda, without re-architecting applications. SQL Server 2025 introduces a new free edition for development and testing (Standard Developer Edition), significant capacity increases for Standard Edition up to 32 cores and 256 GB buffer pool memory, and Resource Governor previously exclusive to Enterprise Edition. It also introduces a native vector data type for storing and querying vector embeddings directly within the database. Customers running earlier SQL Server versions on RDS can upgrade to SQL Server 2025 by modifying the DB engine version, and customers running SQL Server on-premises can migrate to take advantage of these capabilities with fully managed infrastructure

Amazon Relational Database Service (Amazon RDS) for SQL Server now supports the latest Cumulative Updates (CU) and General Distribution Release (GDR) updates for Microsoft SQL Server. This release includes support for Microsoft SQL Server 2016 SP3+GDR KB5089271 (RDS version 13.00.6490.1.v1), SQL Server 2017 CU31+GDR KB5090354 (RDS version 14.00.3530.2.v1), SQL Server 2019 CU32+GDR KB5090407 (RDS version 15.00.4470.1.v1) and SQL Server 2022 CU25 KB5081477 (RDS version 16.00.4255.1.v1). The GDR updates address vulnerabilities described in CVE-2026-40370. For additional information on the improvements and fixes included in these updates, see Microsoft documentation for KB5089271, KB5090354, KB5090407 and KB5081477. We recommend that you upgrade your Amazon RDS for SQL Server instances to apply these updates using Amazon RDS Management Console, or by using the AWS SDK or CLI. You can learn more about upgrading your database instance in the Amazon RDS SQL Server User Guide for upgrading your RDS Microsoft SQL Server DB engine.

Amazon Managed Service for Prometheus now supports up to 1.5 billion active metric time series and up to 200,000 total recording and alerting rules per workspace. Customers can also create many workspaces per account, enabling the storage and analysis of billions of Prometheus metrics across their organization. This fully managed, Prometheus-compatible monitoring service makes it easy to monitor and alert on operational metrics at scale. It automatically scales ingestion and storage for high-cardinality workloads across containerized, serverless, and hybrid environments, and integrates with AWS security services for fast, secure access to data. To get started, create an Amazon Managed Service for Prometheus workspace and increase your workspace active series or rules limits by filing a service limit increase request in AWS Support Center or AWS Service Quotas.

Amazon Managed Service for Apache Flink now supports Apache Flink version 2.3. This release includes adaptive partition selection for improved backpressure handling, enabling applications to run more smoothly under uneven load. It also introduces better handling of out-of-order updates in change data capture (CDC) pipelines, improving data correctness, and new SQL functions that make it easier to convert between changelog and standard streams. Apache Flink 2.3 is available across all AWS Regions where Amazon Managed Service for Apache Flink is offered.

Amazon EC2 I8ge instances are now available in the AWS GovCloud (US-East, US-West) Regions. Powered by AWS Graviton4 processors, I8ge instances deliver up to 60% better compute performance compared to previous generation Graviton2-based storage-optimized Amazon EC2 instances. They utilize third-generation AWS Nitro SSDs and local NVMe storage, providing up to 55% better real-time storage performance per TB compared to previous generation Amazon EC2 Im4gn instances. I8ge instances offer up to 60% lower storage I/O latency and up to 75% lower storage I/O latency variability compared to Im4gn instances. These storage-optimized instances provide up to 120TB of local NVMe storage, making them ideal for workloads that require fast local storage with high random read/write performance and consistently low latency for accessing large datasets. Available in eleven different sizes including two metal sizes, they deliver up to 180 Gbps of network performance bandwidth and 60 Gbps of dedicated bandwidth for Amazon Elastic Block Store (EBS), ensuring fast and efficient data transfer for the most demanding applications.

Amazon Connect now supports over 50 languages including Spanish, French, Italian, Japanese, Korean, Portuguese, and Thai, along with more than 100 new voice options. Conversational improvements make AI interactions sound more fluid and responsive, enabling smoother conversations with seamless response pacing that fills natural pauses, more accurate turn-taking to prevent overlap, and speech controls to adjust speed, volume, and emotion to match brand tone. These enhancements allow AI agents to understand, reason, and act across voice and digital channels, adapting responses to match customer tone and sentiment while maintaining a natural conversational pace. For more information, see the Amazon Connect Customer Administrator Guide. For the full list of supported languages and voices, see Supported Languages. For region availability, see the availability of Amazon Connect Customer features by Region.

AWS has launched enhanced event filtering for network activity events for VPC endpoints, a CloudTrail event type that captures actions transmitted through a Virtual Private Cloud Endpoint. Customers can now control which network activity events are logged based on the IAM user identity making the API call. For example, you can configure selectors to log only access denied events when the calling user identity is not on a known safe list. This allows you to capture unauthorized access attempts while excluding routine traffic from trusted identities, reducing both logging costs and noise. With UserIdentity filtering, customers building a data perimeter strategy can focus on network activity event logging for scenarios that matter most in security. You can configure selectors to log only VpceAccessDenied events from identities outside a trusted set of IAM roles. This enables detection of potential data exfiltration attempts through VPC endpoints without the cost of logging every successful API call from approved principals. You can combine UserIdentity conditions with existing fields like eventName or vpcEndpointId for fine-grained control over what gets recorded. You can use this feature via the AWS Management Console, AWS Command Line Interface, and AWS SDKs. This feature is available in all AWS Regions where CloudTrail network activity events are supported.

Starting today, Amazon Elastic Compute Cloud (Amazon EC2) R8i and R8i-flex instances are available in the Europe (Stockholm, Zurich) regions. These instances are powered by custom Intel Xeon 6 processors, available only on AWS, delivering the highest performance and fastest memory bandwidth among comparable Intel processors in the cloud. The R8i and R8i-flex instances offer up to 15% better price-performance, and 2.5x more memory bandwidth compared to previous generation Intel-based instances. They deliver 20% higher performance than R7i instances, with even higher gains for specific workloads. They are up to 30% faster for PostgreSQL databases, up to 60% faster for NGINX web applications, and up to 40% faster for AI deep learning recommendation models compared to R7i. R8i-flex, our first memory-optimized Flex instances, are the easiest way to get price performance benefits for a majority of memory-intensive workloads. They offer the most common sizes, from large to 16xlarge, and are a great first choice for applications that don't fully utilize all compute resources. R8i instances are a great choice for all memory-intensive workloads, especially for workloads that need the largest instance sizes or continuous high CPU usage. R8i instances offer 13 sizes including 2 bare metal sizes and the new 96xlarge size for the largest applications. R8i instances are SAP-certified and deliver 142,100 aSAPS, delivering exceptional performance for mission-critical SAP workloads.

AWS announces standardized product metadata for Amazon Bedrock in AWS Data Exports (Cost and Usage Report), providing FinOps teams and cloud administrators with consistent, structured attributes to understand Bedrock costs. AWS Data Exports allows you to create customized exports of your AWS cost and usage data and deliver them to Amazon S3 for querying with Amazon Athena or loading into your data warehouse. With these attributes, you can attribute Bedrock spend without building custom logic to parse various product metadata in CUR 2.0. The standardized attributes include model provider, model name, pricing unit, inference type (such as input tokens or output tokens), and feature (the inference serving mode, such as On-Demand or Batch), along with a unified "Amazon Bedrock" product family name that consolidates all Bedrock costs. In CUR 2.0, the model provider, model name, inference type, and feature attributes are available in the product map column, and pricing unit is available as a column. The standardized fields are available by default, at no additional cost, to Amazon Bedrock customers using AWS Data Exports.

AWS announces the availability of KNFSD File Cache, an open-source, Apache-2.0 licensed solution for deploying a scalable, high-speed Network File System (NFS) cache on AWS. KNFSD File Cache mounts exports from one or more source NFS servers, whether on-premises, in another AWS Availability Zone or Region, or in another cloud over AWS Interconnect - multicloud, and re-exports them to NFS clients in AWS. You can front multiple on-premises filers, in-cloud file systems such as Amazon FSx for OpenZFS and Amazon FSx for NetApp ONTAP, and any other NFS v3, v4.1, or v4.2 compliant filer. Frequently read data is cached in memory and on local NVMe storage, so files cross the high-latency link to the source once and are then served to large compute fleets at local VPC speed. The solution is designed for read-heavy burst compute workloads such as visual effects rendering, simulation, financial services, health and life sciences, microprocessor design, weather forecasting, and energy. KNFSD File Cache builds on standard Linux kernel technology: nfs-kernel-server provides NFS re-export, and FS-Cache provides the persistent disk cache. Because it uses the native NFS stack, it fully supports the NFS client-server protocol, including byte-range reads and writes, synchronous and asynchronous writes, and both write-through and write-around modes. You build the cache Amazon Machine Image (AMI) with Packer, then deploy the cluster with the included Terraform module. Cache nodes run in an Amazon Elastic Compute Cloud (Amazon EC2) Auto Scaling group on AMD, Intel, or AWS Graviton instances, with client traffic distributed by DNS round-robin or a Network Load Balancer, and optional automatic scaling based on the number of active NFS client connections. An Amazon CloudWatch dashboard provides more than 70 metrics through an OpenTelemetry-based agent, which can also publish to third-party tools such as Prometheus and Grafana. KNFSD File Cache (preview) is available in all AWS Regions. There are no licensing costs; you pay only for the AWS resources you consume. To get started, visit the KNFSD File Cache GitHub repository, launch blog, and AWS Solutions Guidance. For detailed deployment and configuration guidance, see the GitHub documentation.

Amazon CloudWatch announces the launch of coding agent insights, giving engineering leaders visibility into how AI coding tools are driving value across their organization. Coding Agent Insights integrates with the Claude apps gateway for AWS to collect telemetry from Claude Code without additional instrumentation. Other supported coding agents include Codex and GitHub Copilot. As organizations scale AI coding agent adoption, they need to understand return on investment. Coding agent insights is built on OpenTelemetry metrics emitted by your coding agents and presents them alongside your existing CloudWatch operational data. This helps you answer questions like which teams would benefit from expanded access, where are agents accelerating delivery, and how can you right-size token budgets across departments. You can track spend trends, set proactive token billing alerts, correlate agent adoption with improvements in commit throughput and pull request velocity, or identify the models delivering the best cost-to-output ratio for your workloads. CloudWatch coding agent insights is available in all AWS commercial regions except Middle East (UAE), Middle East (Bahrain), and Israel (Tel Aviv). Configure your Claude apps gateway to emit telemetry to CloudWatch using the setup guide and view the Coding Agent Insights dashboard in the CloudWatch console. Standard CloudWatch OpenTelemetry metric ingestion pricing applies - see metrics pricing for details.

AWS announces the general availability of a new Local Zone in Athens, Greece. The Athens Local Zone is the second Local Zone in EMEA, supporting Amazon S3 and Amazon EBS Local Snapshots, enabling customers to store and process data within Greece to meet local data residency requirements. The Athens Local Zone supports Amazon EC2 with C7i, M7i, and R7i instances, Amazon S3 with the One Zone-Infrequent Access storage class, Amazon EBS with Local Snapshots and volume types gp3, gp2, io1, sc1, and st1, Amazon ECS, Amazon EKS, Amazon VPC, AWS Direct Connect, and Application Load Balancer. Use cases include public sector services requiring strict data residency, financial applications needing in-country data processing, and real-time gaming and interactive experiences benefiting from single-digit millisecond latency. Customers can use the same APIs, tools, and security features available in AWS Regions, with no minimum commitment and pay-as-you-go pricing including On-Demand, Savings Plans, and Spot Instances. The Athens Local Zone is part of AWS Global Infrastructure, with Local Zones now available in more than 30 metropolitan areas worldwide.

With Amazon SageMaker Unified Studio, data engineers can now create, share, and reuse custom visual transforms within visual ETL flows. This capability allows teams to build reusable, business-specific transformation logic without requiring coding expertise. Users can develop their own transforms and publish them to a shared library, making them accessible to other team members directly from the visual ETL interface. For example, transforms can standardize customer phone numbers, mask personally identifiable information, or apply organizational data-quality checks. Team members can reuse the same logic across multiple ETL jobs, reducing duplication and ensuring consistent results. This feature is available in all AWS Regions where Amazon SageMaker Unified Studio is offered.

Amazon SageMaker HyperPod now supports network topology configuration at the partition level for Slurm orchestrated clusters. A single cluster can now run tree topology in one partition and block topology in another, with each partition using the topology best suited to its instance types. This improves distributed training performance by keeping job placement aligned with the interconnect characteristics of each instance type, so GPU-to-GPU communication is faster, NCCL collective operations are more efficient, and training throughput improves. HyperPod determines the topology for each partition based on the instance types of its compute instance groups. Partitions with Amazon EC2 UltraServer instance types such as ml.p6e-gb200.36xlarge use block topology, and those with hierarchical-interconnect instance types such as ml.p5.48xlarge, ml.p5e.48xlarge, and ml.p5en.48xlarge use tree topology, while partitions with instance types that don't provide network topology information remain fully schedulable. HyperPod maintains this configuration automatically as the cluster changes through scale-up, scale-down, and node replacement events, so each partition's topology always reflects the current state of the cluster. To get started, create or update a SageMaker HyperPod Slurm cluster running Slurm 25.11 or later with supported GPU instance types. Topology-aware scheduling is enabled by default and requires no configuration. This feature is available in all AWS Regions where Amazon SageMaker HyperPod is supported

Amazon GameLift Streams now supports assigning an IAM role to a stream session, enabling your application to securely access resources in your AWS account, such as Amazon S3 buckets and DynamoDB tables. With this launch, you can pass a RoleArn parameter when starting a stream session, and your application automatically receives short-lived, auto-refreshing AWS credentials through the standard AWS SDK credential resolution chain - no application code changes required. Previously, customers who needed their streamed applications to access AWS services had to embed long-lived access keys in application bundles or pass them as environment variables, creating security and operational challenges. Now, Amazon GameLift Streams handles credential vending and automatic refresh using the same container credential provider mechanism trusted by Amazon ECS task roles and Amazon EKS Pod Identity. Role misconfigurations are validated at session start, surfacing clear errors immediately rather than during runtime. You can also configure IAM roles directly in the Amazon GameLift Streams console, which provides a pre-filled trust policy template to simplify role setup. IAM role support for stream sessions is available in all AWS Regions where Amazon GameLift Streams is available.

Amazon OpenSearch Service now supports one-click migration from legacy OpenSearch Dashboards to OpenSearch UI for both OpenSearch domains and serverless collections. OpenSearch UI is the new, zero-downtime, serverless interface for search and unified observability across multiple data sources. With this launch, multiple tenants and thousands of saved objects created in legacy OpenSearch Dashboards become reusable in OpenSearch UI applications, reducing operational complexity when moving between interfaces. The one-click migration allows users to move existing tenants and saved objects into OpenSearch UI workspaces without manual recreation. The mechanism works for OpenSearch Dashboards created under Amazon OpenSearch Service domains and serverless collections. Users can migrate everything into a new workspace or an existing one. If multiple tenants were created in OpenSearch Dashboard, users have the option to convert them into a single workspace or keep them separate for different teams. This feature is available in all AWS Regions where OpenSearch UI is available.

Amazon CloudWatch Synthetics now supports customer-managed AWS Key Management Service (KMS) keys for encrypting canary environment variables. This gives users full control over the encryption of sensitive configuration data such as API keys, credentials, and tokens. Previously, environment variables were encrypted at rest using only an AWS-owned key. Now, in addition to the default AWS-owned key, users can specify their own symmetric KMS key for encryption at rest. Users can also encrypt individual values client-side before storage, and their canary script decrypts them at runtime using the AWS KMS Decrypt API. This feature benefits teams in regulated industries that require organizational key management policies, auditability, or key rotation controls across all services. Amazon CloudWatch Synthetics customer-managed key encryption is available in all commercial AWS Regions, and multi-location canaries can use a different KMS key per replica Region.

Amazon RDS for PostgreSQL 19 Beta 2 is now available in the Amazon RDS Database Preview Environment, allowing you to evaluate the pre-release of PostgreSQL 19 on Amazon RDS for PostgreSQL. PostgreSQL 19 introduces parallel autovacuum with configurable worker limits, eliminating routine maintenance bottlenecks for large databases. The new REPACK CONCURRENTLY command rebuilds tables and reclaims storage online, keeping production databases accessible without third-party extensions. Native SQL Property Graph Queries (SQL/PGQ) allow you to express relationship traversals directly in standard SQL, eliminating separate application logic. Logical replication now automatically synchronizes sequence values and can be enabled dynamically without a server restart, reducing planned downtime. Beta 2 adds bug fixes and stability improvements from the Beta 1 testing period, including refinements to parallel autovacuum worker coordination and REPACK CONCURRENTLY lock handling. Amazon RDS Database Preview Environment database instances are retained for a maximum period of 60 days and are automatically deleted after the retention period. Amazon RDS database snapshots created in the preview environment can only be used to create or restore database instances within the preview environment. You can use the PostgreSQL dump and load functionality to import or export your databases from the preview environment. Amazon RDS Database Preview Environment database instances are priced as per the pricing in the US East (Ohio) Region.

AWS Billing and Cost Management (BCM) now supports a Cost Efficiency widget in BCM Dashboards. This allows users to view cost efficiency trends alongside Cost Explorer, Budgets, and reports for Savings Plans and Reserved Instance coverage and utilization. The widget displays efficiency scores over time, enabling analysis by AWS account, region, or overall scope. Users can add multiple widgets to monitor optimization performance directly from existing workflows, with direct links to the Cost Optimization Hub console for actionable recommendations. The widget integrates with dashboard exports, supporting scheduled email reports and CSV/PDF downloads, and is included in cross-account dashboard sharing. Available at no additional charge in all commercial AWS Regions.

Amazon S3 has reduced the minimum retention period for transitioning objects to S3 Standard-Infrequent Access (S3 Standard-IA) and S3 One Zone-Infrequent Access (S3 One Zone-IA) from 30 days to zero days after object creation. This change enables immediate migration of objects to these storage classes, which offer up to 40% lower storage costs than S3 Standard while providing millisecond access when needed. These classes are ideal for backups, log analytics, and compliance workloads where data becomes cold within hours or days. Users can configure new S3 Lifecycle rules to transition objects to S3 Standard-IA and S3 One Zone-IA immediately using the S3 console, AWS CLI, or SDKs. The update is available in all AWS Regions where S3 Standard-IA and S3 One Zone-IA are offered.

Amazon Redshift announces the general availability of two new RG instance sizes - rg.large and rg.12xlarge. These new sizes deliver the same Graviton-powered performance benefits as existing RG instances, including up to 2.4x faster query performance than previous-generation RA3 instances at 30% lower price per vCPU, giving you more flexibility to right-size your provisioned clusters for any workload. rg.large and rg.12xlarge instance sizes are available on the current track (P202) only. Customers on the trailing track (P201) can continue to use rg.xlarge and rg.4xlarge. Existing RA3 clusters can migrate to RG instances using Snapshot and Restore, Elastic Resize, or Classic Resize. RG instances are available with flexible pricing options, including On-Demand, and 1-year and 3-year Reserved Instances with No Upfront payment. The new rg.large and rg.12xlarge instance sizes are now available in the following AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), US West (N. California), Canada (Central), Mexico (Central), South America (São Paulo), Europe (Ireland), Europe (Frankfurt), Europe (London), Europe (Paris), Europe (Stockholm), Europe (Spain), Africa (Cape Town), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Mumbai), Asia Pacific (Jakarta), Asia Pacific (Hong Kong), Asia Pacific (Osaka), Asia Pacific (Malaysia), Asia Pacific (Hyderabad), Asia Pacific (Taiwan), Asia Pacific (Thailand), and Asia Pacific (Melbourne).

Amazon EC2 High Memory U7in-24TB instances (u7in-24tb.224xlarge) are now available in the AWS Europe (Paris) region. U7i instances are part of the AWS 7th generation and are powered by custom fourth-generation Intel Xeon Scalable processors (Sapphire Rapids). U7in-24TB instances offer 24 TiB of DDR5 memory, enabling customers to scale transaction processing throughput in a fast-growing data environment. U7i instances deliver up to 45% better price performance over existing U-1 instances. They provide 896 vCPUs, support up to 100 Gbps of Amazon EBS bandwidth for faster data loading and backups, 200 Gbps of network bandwidth, and ENA Express. U7i instances are ideal for customers running mission-critical in-memory databases like SAP HANA, Oracle, and SQL Server.

The AWS Sustainability service now includes annual water withdrawal data for customers to view alongside existing carbon emissions data. This enhancement provides comprehensive visibility into environmental impact across both carbon and water usage. Water withdrawal data is available by AWS Region, service, and account on an annual basis through the AWS Sustainability console and API. The data represents the total volume of water withdrawn for data center operations, with efficiency improvements reflected as lower withdrawal volumes. This feature is available at no additional charge in all AWS Regions where the service is offered.

Amazon S3 Event Notifications now include system-generated tags in events delivered to all destinations, including Amazon EventBridge, Amazon SQS, Amazon SNS, and AWS Lambda. System-generated tags are metadata labels attached to your bucket by AWS services. These tags allow you to filter events from thousands of buckets with a single EventBridge rule, rather than listing each bucket name individually. To get started, enable S3 Event Notifications on your general purpose buckets through the AWS Management Console, AWS SDK, or AWS CLI. If AWS services like AWS CloudFormation have already applied system-generated tags to your buckets, S3 automatically includes them in new event notifications. System-generated tags in S3 Event Notifications are available at no additional cost in all AWS Regions and require no changes to existing configurations.

Amazon EC2 now surfaces AWS Systems Manager (SSM) Parameter Store parameters associated with public AMIs directly in the AMI metadata. When you describe a public AMI, the response includes the associated public SSM parameter, making it easy to discover and reference in your configurations. Previously, finding the SSM parameter associated with a public AMI required manually searching through SSM parameter namespaces. This change allows you to easily discover the SSM parameter for a public AMI and use it as an alias that always resolves to the latest version, simplifying AMI updates across your infrastructure. This capability is available to all customers at no additional cost in all AWS regions.

Amazon Managed Grafana is now a FedRAMP High authorized service in the AWS GovCloud (US-East) and AWS GovCloud (US-West) regions. Federal agencies, public sector organizations, and other enterprises with FedRAMP High compliance requirements can now use Amazon Managed Grafana to visualize, query, and alert on operational metrics across their AWS and hybrid environments while meeting their strict security and compliance requirements. Amazon Managed Grafana is a fully managed service based on open-source Grafana that makes it easier for you to visualize and analyze your operational data at scale. The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program that delivers a standard approach to the security assessment, authorization, and continuous monitoring for cloud products and services. For more details about Amazon Managed Grafana in AWS GovCloud (US), visit the Amazon Managed Grafana GovCloud documentation or contact your AWS account team for more information.

Amazon Aurora DSQL is now in scope for FedRAMP Moderate in the US East (Ohio), US East (N. Virginia), and US West (Oregon) Regions. The Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services across the US government. Aurora DSQL is the fastest serverless, distributed SQL database with active-active high availability and multi-Region strong consistency, allowing you to build always-available applications with virtually unlimited scale, the highest availability, and zero infrastructure management.

AWS Backup restore testing is now available in seven additional AWS Regions: Asia Pacific (Taipei), Asia Pacific (Malaysia), Asia Pacific (New Zealand), Asia Pacific (Thailand), Israel (Tel Aviv), Mexico (Central), and Canada West (Calgary). Restore testing helps automate and periodically run restore tests of supported AWS resources across storage, compute, and database services. Users can create restore testing plans that automatically select recovery points, run restores on a schedule, and measure restore job completion time against recovery time objectives (RTO). This helps evaluate recovery readiness and meet regulatory and compliance requirements for disaster recovery and business continuity. To get started, visit the AWS Backup console, AWS Command Line Interface (CLI), or AWS SDKs. For a complete list of supported Regions and features, visit the AWS Backup documentation. To learn more about restore testing, visit the feature documentation and pricing page.

AWS Backup logically air-gapped vaults are now available in six additional AWS Regions: Asia Pacific (Taipei), Asia Pacific (Malaysia), Asia Pacific (New Zealand), Asia Pacific (Thailand), Mexico (Central), and Canada West (Calgary). With logically air-gapped vaults available in these Regions, you can store immutable, isolated backups that are locked by default and encrypted using AWS owned keys or customer-managed keys. You can back up directly to logically air-gapped vaults, copy backups across accounts and Regions, share vaults for recovery using AWS Resource Access Manager (RAM), and safeguard vault access during account compromise using Multi-party approval. To get started, visit the AWS Backup console, AWS Command Line Interface (CLI), or AWS SDKs. For a complete list of supported Regions and features, visit the AWS Backup documentation. To learn more about logically air-gapped vaults, visit the feature documentation and pricing page.

AWS Glue SAP OData connector and zero-ETL integrations are now available in AWS GovCloud (US-West) and AWS GovCloud (US-East) Regions, supporting Amazon DynamoDB, Salesforce, and SAP OData as sources. Customers in regulated environments can now replicate data from these sources into Amazon Redshift, Amazon S3, or other supported destinations without building or maintaining custom data pipelines. The SAP OData connector allows you to extract data from SAP systems exposing OData services, eliminating the need for custom extraction logic or third-party middleware. The zero-ETL integrations are fully managed by AWS and minimize the need to build ETL data pipelines. With this new zero-ETL integration, you can efficiently extract and load valuable data from your Amazon DynamoDB databases or Salesforce and SAP applications into your data lake and data warehouse for analysis. Zero-ETL integration reduces your operational burden and saves the weeks of engineering effort needed to design, build, and test data pipelines. By selecting a few settings in the no-code interface, you can quickly set up your zero-ETL integration to automatically ingest and continually maintain an up-to-date replica of your data in the data lake and data warehouse. Zero-ETL integrations help you focus on deriving insights from your application data, breaking down data silos in your organization and improving operational efficiency. To get started, navigate to the AWS Glue console and create a new zero-ETL integration. For more information, visit the AWS Glue zero-ETL integrations documentation.

Amazon Cognito now supports importing users with password hashes in CSV user imports. Previously, users imported from a CSV file had to reset their passwords on first sign-in. Now, you can include password hashes in your CSV file so that imported users can sign in immediately with their existing credentials. When creating a CSV import, you specify the password hashing algorithm used by your source system. Amazon Cognito imports these users and verifies their password against the imported hash on first sign-in. Supported algorithms include bcrypt, scrypt, Argon2id, and PBKDF2 with SHA-256. All imported hashes receive an additional layer of cryptographic protection before storage. Password hash import is available in all AWS Regions where Amazon Cognito is available. To get started, create a user import using the AWS Management Console, AWS Command Line Interface (CLI), or AWS Software Development Kits (SDKs).

Amazon EC2 G7e instances are now available in the AWS Europe (Frankfurt, Stockholm) and Asia Pacific (Mumbai) Regions. G7e instances feature up to eight NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs, each with 96 GB of memory, and 5th Generation Intel Xeon processors. They support up to 192 virtual CPUs (vCPUs) and up to 1600 Gbps of networking bandwidth. G7e instances support NVIDIA GPUDirect Peer to Peer (P2P) to boost performance for multi-GPU workloads, and multi-GPU G7e instances also support NVIDIA GPUDirect Remote Direct Memory Access (RDMA) with EFA in EC2 UltraClusters, reducing latency for small-scale multi-node workloads. G7e instances are ideal for deploying large language models (LLMs), agentic AI models, multimodal generative AI models, and physical AI models. They offer the highest performance for spatial computing workloads and workloads requiring both graphics and AI processing capabilities. G7e instances can be purchased as On-Demand Instances, Spot Instances, or as part of Savings Plans.

Amazon CloudWatch Logs now supports intelligent storage tiering, which automatically classifies log data into three storage tiers-Standard (existing), Infrequent Access, and Archive Instant Access-based on access patterns. This allows customers to retain high-volume verbose logs needed for extended periods at a lower cost in Amazon CloudWatch without filtering or exporting them. CloudWatch monitors access patterns and automatically reclassifies data not accessed for 30 days to the Infrequent Access tier, and data not accessed for 90 days to the Archive Instant Access tier. When older data is accessed, it is automatically promoted back to the Standard tier for 30 days. By consolidating all logs in CloudWatch, customers gain full visibility in one tool, eliminating the operational overhead of managing multiple storage solutions and reducing Mean Time to Resolution (MTTR) by analyzing and alerting on all logs in a single place. This feature is available in all AWS commercial regions except Middle East (Bahrain) and Middle East (UAE). Customers can enable intelligent tiering at the account level in the AWS Management Console, AWS SDKs, or through AWS CLI.

Amazon CloudWatch Logs Insights query language now supports 25 new commands and functions, expanding the ability to query, transform, correlate, and analyze logs. These additions include type conversion and encoding functions, date and time functions, string functions, JSON inspection functions, a conditional validation function, statistical commands, row-sequencing and null-handling commands, sessionization and time-comparison commands, a data analysis command, query-composition and join commands, and a lookup enrichment command. These commands and functions are available today in all commercial AWS Regions.

AWS Control Tower Account Factory for Terraform (AFT) now supports automatically re-applying an account's customizations when that account moves to a different Organizational Unit (OU). Previously, moving an enrolled account between OUs required manually triggering customization re-application, creating operational overhead and risk of configuration drift. With this capability, you can opt in to automatic re-application in your AFT deployment, ensuring accounts remain consistent with their OU-specific configuration immediately after movement. To enable this, set aft_customization_triggers = ["account_move"] in your AFT configuration. The re-application workflow skips the bootstrap and provisioning phases, running only global and account-level customizations for faster execution. Individual accounts can be excluded by setting account_skip_customization_triggers = "true", giving teams precise control over which accounts participate. This release also includes support for custom Terraform Cloud and Enterprise workspace naming variables, tighter access controls on the AFT logging bucket, and improved scaling for large-scale AWS Enterprise Support enrollment. Organizations enforcing compliance or security baselines tied to OU membership will benefit most from these combined enhancements. This capability is available today across all AWS regions where AWS Control Tower Account Factory for Terraform is offered.

Amazon RDS now allows up to four storage modifications per database instance within a rolling 24-hour window. These modifications let you increase the size, change the type, and adjust the performance of your RDS storage volumes. You can start a new modification right after storage optimization for the previous modification is complete without having to wait for the six-hour cool-off period to complete. This enhancement improves operational agility for scaling storage capacity or adjusting performance during sudden data growth or unexpected workload spikes. With RDS storage modifications, you can modify your volumes without downtime, keeping applications running with minimal performance impact. The feature is automatically enabled on all Amazon RDS for PostgreSQL, Amazon RDS for MariaDB, Amazon RDS for MySQL, Amazon RDS for Db2, Amazon RDS for Oracle, and Amazon RDS for Microsoft SQL Server instances in all commercial AWS Regions and the AWS GovCloud (US) Regions.

Amazon Managed Streaming for Apache Kafka (MSK) Express Brokers now supports Apache Kafka version 4.2. This release includes Eligible Leader Replicas (ELR) enhancements that improve availability with better leader election correctness. It also introduces a new consumer rebalance protocol that ensures smoother and faster group rebalances, and a new Streams Rebalance Protocol that extends broker coordination capabilities to Kafka Streams for optimized task assignments. MSK Express Brokers are designed to deliver up to three times more throughput per broker, scale up to 20 times faster, and reduce recovery time by 90 percent. To get started, select version 4.2.x when creating a new cluster with Express Brokers via the AWS Management Console, AWS CLI, or AWS SDKs. Existing MSK Express Brokers can also be upgraded with an in-place rolling update. Amazon MSK orchestrates broker restarts to maintain availability and protect your data during the upgrade. Kafka version 4.2 support is available today across all AWS regions where Amazon MSK Express Brokers is offered. For more information, see the Amazon MSK Developer Guide

Amazon Relational Database Service (RDS) now supports R8gd database instances in 12 additional regions and M8gd database instances in 6 additional regions with Optimized Reads for Amazon Aurora PostgreSQL, RDS for PostgreSQL, RDS for MySQL, and RDS for MariaDB. R8gd and M8gd instances deliver up to 165% better throughput and up to 120% better price-performance over R6g instances for Aurora PostgreSQL. Optimized Reads uses local NVMe-based SSD block storage to store ephemeral data such as temporary tables, reducing network storage access and improving query latency. The result is improved query performance for complex queries and faster index rebuild operations. Aurora PostgreSQL Optimized Reads instances using the I/O-Optimized configuration also use the local storage to extend their caching capacity. Database pages that are evicted from the in-memory buffer cache are cached in local storage to speed subsequent retrieval of that data. Customers can get started with Optimized Reads through the AWS Management Console, CLI, and SDK by modifying their existing Aurora and RDS databases or creating a new database using R8gd or M8gd instances.

AWS Graviton4-based R8g database instances are now generally available for Amazon Aurora (MySQL and PostgreSQL compatibility) and Amazon RDS for PostgreSQL, MySQL, and MariaDB in Asia Pacific (Hyderabad, Melbourne, Malaysia), Europe (London, Paris, Zurich), AWS GovCloud (US-East), South America (Sao Paulo), and Mexico (Central) regions. Additionally, M8g instances are now supported for Amazon RDS for PostgreSQL, MySQL, and MariaDB in US West (N. California), Asia Pacific (Mumbai, Sydney, Hong Kong, Seoul, Malaysia, Singapore), Canada West (Calgary), Europe (Zurich, Milan, Paris), South America (Sao Paulo) and Africa (Cape Town) regions. AWS Graviton4-based instances provide up to 40% performance improvement and up to 29% price/performance improvement for on-demand pricing over Graviton3-based instances of equivalent sizes on Amazon Aurora and Amazon RDS databases, depending on database engine, version, and workload. Built on the AWS Nitro System, the new R8g database instances introduce 24xlarge and 48xlarge sizes, delivering up to 192 vCPUs, an 8:1 ratio of memory to vCPU with the latest DDR5 memory, up to 50Gbps enhanced networking bandwidth, and up to 40Gbps of bandwidth to Amazon Elastic Block Store (Amazon EBS). You can easily launch R8g or M8g database instances through the Amazon RDS Management Console or by using the AWS Command Line Interface (CLI). For detailed information about specific engine versions that support these database instance types, please refer to the Aurora and RDS documentation. For complete information on pricing and regional availability, please refer to the Amazon RDS pricing page.

Amazon MQ now allows you to configure the EBS disk storage size for RabbitMQ brokers independently of the instance type. When creating or updating a broker, you can define a custom storage size, enabling you to right-size storage independently of your instance size to match your specific messaging workload requirements. Configurable storage is available for RabbitMQ M7g brokers on version 4.2 or later using cluster deployments only. You can choose a storage size from the default value on M7g to the maximum allowed value depending on your instance size in increments of 5 GB. You can specify the Storage Size using the AWS Console, AWS CloudFormation, AWS Command Line Interface (CLI), or the AWS Cloud Development Kit (CDK). Storage changes are applied during the next broker reboot. Standard Amazon MQ storage pricing applies based on the disk size as per Amazon MQ pricing. Configurable storage is available in all commercial AWS Regions where Amazon MQ for RabbitMQ is offered.

Amazon Connect Customer Outbound Campaigns are now available in the Africa (Cape Town) Region. Businesses in the region can use Connect Customer's proactive outreach capabilities to create targeted, personalized engagement campaigns for service updates, promotional offers, appointment reminders, and product usage tips. These campaigns can be configured and managed through the Connect Customer admin website and Outbound Campaigns APIs. For example, a retail business can segment customers by purchase behavior and run a coordinated campaign that sends promotional offers via SMS, appointment reminders via WhatsApp, and product usage tips via email, with each message personalized to the recipient. Built-in analytics show which messages drove engagement, and event-based triggers automatically start campaigns from customer actions such as a completed purchase or a missed appointment.

The AWS Lambda console now provides a one-click setup prompt for coding agents, configuring them with AWS serverless skills and the Serverless Model Context Protocol (MCP) server, embedding serverless best practices from the start. This setup is available wherever developers begin their Lambda journey-whether they are getting started with Lambda, exploring its capabilities, or have created their first function. Developers use coding agents to build, test, and deploy Lambda functions, but setting up an agent for serverless development previously required navigating across multiple documentation pages to find the right configuration. The one-click setup prompt eliminates this friction by instructing the agent to install AWS serverless skills (hosted in Agent Toolkit for AWS) and the Serverless MCP server directly in the developer's preferred coding agent. The prompt references the Lambda agent setup guide, which includes installation commands for Claude Code, Kiro, Cursor, GitHub Copilot, Codex, Devin Desktop, and OpenCode, for AWS serverless skills, three specialized Lambda skills (MicroVM, Managed Instances, durable functions), and Serverless MCP server configuration. If a developer does not have local AWS authentication configured, the prompt guides them to connect using the signing-in-to-aws skill. This capability is available in all commercial AWS Regions (except Middle East (Bahrain) and Middle East (UAE)) and AWS GovCloud (US) Regions where Lambda is available.

Amazon EC2 is now making M8in, M8idn, M8ib, and M8idb instances available in the US East (Ohio), Europe (Ireland), and Asia Pacific (Tokyo) regions. These instances are powered by custom 6th generation Intel Xeon Scalable processors exclusive to AWS, delivering up to 43% higher performance compared to previous generation instances. They also feature the latest 6th generation AWS Nitro cards. M8in and M8idn instances offer 600 Gbps network bandwidth, the highest among enhanced networking EC2 instances, ideal for workloads such as real-time big data analytics, distributed web-scale in-memory caches, caching fleets for AI/ML clusters, and Telco applications like 5G User Plane Function (UPF). M8ib and M8idb instances deliver up to 300 Gbps EBS bandwidth, the highest among non-accelerated compute EC2 instances, best suited for workloads benefiting from high block storage performance, such as high-performance file systems and NoSQL databases. M8idn instances are ideal for network-intensive workloads that benefit from low-latency local storage, such as distributed computing, data analytics, and high-performance file systems. M8idb instances are ideal for storage-intensive workloads such as large commercial databases, data lakes, and NoSQL databases that benefit from both high EBS throughput and low-latency local NVMe storage. M8in, M8idn, M8ib, and M8idb instances are available in US East (N. Virginia, Ohio), US West (Oregon), Europe (Ireland), Asia Pacific (Tokyo), and Europe (Spain) regions, via Savings Plans, On-Demand, and Spot instances.

Amazon CloudWatch now supports a lookup processor, enabling you to enrich log events with additional context by matching fields in your logs against a lookup table directly within your CloudWatch Pipeline. With the lookup processor, you can upload CSV files containing reference data and configure your pipeline to match incoming log fields against this data to add enriched metadata. For example, you can upload a CSV mapping IP addresses to application teams and automatically tag VPC Flow Logs with team ownership information as logs are ingested. The lookup processor matches fields in your log events against fields in a lookup table and adds specified fields from matching rows to your log events. This enables data enrichment scenarios such as mapping user IDs to user details, product codes to product information, or error codes to human-readable error descriptions, thereby eliminating the need to build and maintain custom enrichment logic outside of CloudWatch. By enriching logs at ingestion time, your queries, dashboards, and alarms immediately benefit from the added context without any post-processing. The lookup table processor is available in all AWS commercial regions that support Amazon CloudWatch pipelines. You can add a lookup processor to your pipeline using the AWS Management Console, AWS CLI, or AWS SDKs.

AWS Lambda now supports self-managed Amazon S3 buckets for code storage, allowing you to reference source code directly from your own S3 buckets without Lambda creating intermediate copies. This eliminates code storage limits and reduces function activation time after function creates and updates by removing the copy step. Previously, Lambda always copied your deployment package to Lambda-managed storage during function and layer creation, counting against this limit. With self-managed code storage, Lambda references your code directly in your Amazon S3 bucket without creating a copy, so you can store as much function and layer code as your bucket allows. You maintain a single source of truth for your deployment packages in your own account. No additional Lambda charges apply for self-managed storage; you only pay for standard Amazon S3 storage and, where applicable, cross-Region data transfer rates. In addition, Lambda has increased the default limit for Lambda-managed code storage from 75GB to 300GB per Region per account. Self-managed Amazon S3 code storage is available in all commercial AWS Regions. To get started, set the S3ObjectStorageMode parameter to REFERENCE when creating or updating functions and layers through the AWS CLI, AWS CloudFormation, AWS SAM, or AWS SDKs. You must grant the Lambda service principal s3:GetObject and s3:GetObjectVersion permissions on your S3 bucket. You can also update a function to use self-managed code storage via the Lambda Console. To learn more, visit the AWS Lambda Developer Guide.

Amazon RDS for Db2 is now available in the Asia Pacific (Thailand), Asia Pacific (Malaysia), Asia Pacific (Taipei), Mexico (Central), and Canada West (Calgary) Regions. Amazon RDS for Db2 makes it easy to set up, operate, and scale Db2 databases in the cloud. Customers can deploy a Db2 database in minutes with automatically configured parameters for optimal performance. For databases setup with Multi-AZ configuration, Amazon RDS performs synchronous replication to a standby instance in a different Availability Zone to provide high availability. To use Amazon RDS for Db2, customers can purchase a Db2 license from the AWS Marketplace for hourly, pay-as-you-go pricing, or use Bring Your Own License (BYOL). Both hourly and BYOL licensing are available in Standard and Advanced Editions. You can also choose to use the latest Db2 Community Edition that provides all the features available in Standard and Advanced Editions, with no commercial software licensing charges for development and test applications. This allows you to easily start developing and testing Db2 applications with a managed database service without worrying about software licensing.

Amazon OpenSearch Service now integrates with the Agent Toolkit for AWS, enabling you to build, manage, and query OpenSearch Service domains and OpenSearch Serverless collections directly from AI coding agents such as Claude Code, Kiro, and Cursor. This integration is powered by the AWS MCP (Model Context Protocol) server, which executes AWS API calls on your behalf, paired with the curated amazon-opensearch-service skill that automatically routes natural-language requests to the right capability. With this skill, you can describe a goal in plain language and the agent handles the rest across five areas: Migration moves you from self-managed OpenSearch into OpenSearch Service or OpenSearch Serverless; Operations provisions and manages domains and collections; Search builds vector, semantic, hybrid, and RAG search; Log analytics analyzes logs with PPL and OpenSearch Ingestion; Trace analytics investigates distributed traces with OpenTelemetry. The integration works with both managed domains and collections across all versions, requires no changes to your existing infrastructure, and is available at no additional charge. Support is available in all AWS Regions where Amazon OpenSearch Service and OpenSearch Serverless are offered. To get started, install the aws-data-analytics plugin in your agent - it bundles the AWS MCP Server configuration and the OpenSearch skill in a single step. For setup instructions, see MCP Server and Agent Skills.

AWS Security Hub now provides an AI inventory, giving central security teams a continuously updated, organization-wide view of AI assets and their security posture. As organizations rapidly deploy AI agents, models, and pipelines, security teams may lack visibility into what AI assets exist across their organization. Without centralized visibility connecting AI assets to active threats and misconfigurations, organizations cannot secure what they don't know exists. Security Hub AI inventory automatically discovers and catalogs AI workloads across your AWS environment through three discovery methods. For managed AI services, Security Hub inventories AWS Config resources from Amazon Bedrock, Bedrock AgentCore and Amazon SageMaker, with no additional configuration. For self-hosted AI workloads, Security Hub leverages the software bill of materials (SBOM) analysis from Amazon Inspector, which has been enhanced to identify inference endpoints, models and AI agents installed on Amazon EC2 instances and Amazon ECR container images, including frameworks such as Ollama, vLLM, Hugging Face TGI, and others. Security Hub also leverages Amazon GuardDuty DNS telemetry to discover external AI API endpoints (such as calls to third-party model providers) being accessed from your EC2 instances, revealing third-party AI dependencies that may not have been previously identified. Each discovered AI asset is mapped to its underlying infrastructure and correlated with security findings from across the AWS security stack, including threat findings from Amazon GuardDuty. Teams can filter, group, and query their AI inventory by account, resource type, discovery method, and specific model identity, enabling them to prioritize remediation based on which AI workloads are actively under threat and carry the highest organizational risk. AI Inventory is included with Security Hub Essentials at no additional cost and requires no new enablement. It is available in all AWS commercial Regions where Security Hub is offered.

Starting today, Amazon Aurora DSQL is available for single-Region clusters in the Europe (Spain) Region. Aurora DSQL is the fastest serverless, distributed SQL database, with active-active high availability and multi-Region strong consistency. It enables you to build always-available applications with virtually unlimited scalability, the highest availability, and zero infrastructure management, making scaling and resilience effortless for your applications. With this launch, Aurora DSQL is available in the following AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Canada West (Calgary), South America (São Paulo), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Spain), Europe (Stockholm), Asia Pacific (Hong Kong), Asia Pacific (Melbourne), Asia Pacific (Mumbai), Asia Pacific (Osaka), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), and Asia Pacific (Tokyo). Get started with Aurora DSQL for free with the AWS Free Tier. To learn more, visit the Aurora DSQL webpage and documentation.

Amazon WorkSpaces Personal now provides automated rollback and support for migrating stopped WorkSpaces from the PCoIP protocol to DCV. This builds on the recently launched console-based migration workflow and checkpoint snapshot support. These new capabilities enable administrators to migrate WorkSpaces at scale with minimal manual intervention. Amazon DCV is a high-performance streaming protocol developed by AWS that powers Amazon WorkSpaces services. By migrating to DCV, customers gain access to broader operating system support including Windows 11 and Windows Server 2025, enhanced security features such as certificate-based authentication and WebAuthN redirection, and improved streaming performance. If a protocol modification fails, the WorkSpace automatically rolls back to the pre-migration snapshot, ensuring it returns to a known healthy state without manual intervention. Additionally, administrators can now initiate migration for WorkSpaces in a stopped state, eliminating the need to manually start each stopped WorkSpace before modifying its protocol. This significantly speeds up large-scale migrations. These enhancements are available in all AWS commercial and AWS GovCloud (US) Regions where Amazon WorkSpaces Personal is supported.

Amazon Managed Service for Apache Flink now offers AI Agent Skills that provide expert, up-to-date guidance for building and operating Flink applications. These skills offer guidance for common tasks such as creating applications, troubleshooting, scaling, monitoring, networking configuration, and cost optimization. Customers can use these skills to maintain healthy and performant Flink applications, accelerate the development of new streaming applications, and easily upgrade to the latest versions of Apache Flink, such as Flink 2.2. The skills turn tasks that previously required specialized Apache Flink knowledge into a guided experience developers can complete on their own. You can use the Managed Service for Apache Flink skills with your existing AI coding agent, including Kiro, Claude Code, or Cursor. To get started, configure the Agent Toolkit for AWS using the AWS CLI, then ask your coding agent a question, such as "How do I create a new Flink application on MSF?" or "My Flink application is unhealthy - what's wrong?"

Amazon GuardDuty now offers AI Protection, extending threat detection to AWS AI services including Amazon Bedrock and Amazon SageMaker. As organizations rapidly adopt AI, security teams often lack visibility into threats specifically targeting AI workloads, such as anomalous model invocations, cost harvesting attacks, and prompt injection attempts. GuardDuty AI Protection continuously monitors these workloads, allowing security teams to detect and respond to AI-specific threats without manual configuration or custom tooling. GuardDuty AI Protection analyzes CloudTrail management and data events from AWS AI services to identify suspicious activity, including unusual invocation patterns, cost harvesting attacks where threat actors force AI resources to consume excessive GPU time and tokens, and prompt injection attempts through integration with Amazon Bedrock Guardrails. Threat findings flow directly into AWS Security Hub, providing teams with a single view of AI assets and threats for prioritized response. GuardDuty AI Protection can be enabled in a few steps via the GuardDuty or Security Hub console and can be centrally enabled for all accounts in an organization using AWS Organizations. GuardDuty AI Protection is available to GuardDuty customers with a 30-day free trial. For pricing details, visit the Amazon GuardDuty pricing page. To learn more, see the Amazon GuardDuty User Guide and the Amazon GuardDuty product page. For the full list of supported Regions, see the AWS Regional Services List.

AWS IAM Identity Center is now in scope for FedRAMP Class C in the US East (Ohio), US East (N. Virginia), US West (N. California), and US West (Oregon) Regions. This allows you to use IAM Identity Center to enable workforce access to AWS accounts and applications that are subject to FedRAMP Class C compliance. The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program that delivers a standard approach to the security assessment, certification, and continuous monitoring for cloud products and services. AWS IAM Identity Center is the recommended service for managing workforce access to AWS accounts and applications.

AWS Elastic Disaster Recovery (AWS DRS) now reduces recovery time for AWS-based workloads running on Amazon EC2 by up to 65% for Windows and up to 40% for Linux, by skipping preparation steps no longer needed. During a disaster or drill, every minute counts. Since workloads already running on AWS include AWS-compatible drivers and configurations, DRS can launch them with fewer steps-helping you bring applications back online sooner and with greater confidence. Networking, drivers, and licensing are still applied automatically, so recovery remains simple and hands-off. You retain control: enable faster recovery across your entire account or for individual servers, and change settings whenever your needs change. This capability is available in all AWS Regions where AWS DRS is offered, at no additional cost.

AWS Elastic Disaster Recovery (AWS DRS) now supports the Amazon EBS volume initialization rate, helping recovered volumes reach full performance faster during drills and recoveries. When DRS restores EBS volumes from snapshots, data loads from Amazon S3 in the background, and I/O to blocks that haven’t loaded yet can be slower until initialization finishes. With this launch, you can set a volume initialization rate on your DRS-managed EC2 launch template, and DRS applies it automatically when creating volumes during recovery-bringing your applications to full storage performance on a predictable timeline. This is especially valuable for I/O-intensive workloads such as databases, where fast, consistent storage performance is critical to meeting recovery time objectives. You set the rate once on the launch template, and DRS preserves it across updates for rightsizing or disk changes. If the rate cannot be applied for a given recovery, DRS completes the recovery without it, ensuring your recovery is never blocked. AWS DRS support for the EBS volume initialization rate is available in all AWS Regions and environments where the EBS volume initialization rate is offered. You are charged per GB based on the full snapshot size and the rate you specify; see Amazon EBS pricing for details.

Amazon Redshift Serverless now automatically preserves zero-ETL and Amazon S3 event integrations when restoring a namespace from a snapshot or recovery point to the same serverless namespace. Previously, restoring a snapshot marked associated integrations as failed, requiring manual recreation after the restore completed. This meant additional time reconfiguring data pipelines and potential data ingestion gaps during the rebuild process. With this enhancement, integrations are automatically maintained and resume operating after the restore completes, simplifying data ingestion workflows and reducing administrative overhead. This streamlines disaster recovery and testing workflows by reducing manual configuration steps and potential errors. This applies only to restores within the same serverless namespace. Restoring to a different namespace or restoring provisioned clusters does not maintain integrations. This feature is available in all AWS regions where Amazon Redshift Serverless is available

Amazon DocumentDB (with MongoDB compatibility) now supports 46 additional MongoDB aggregation operators and cursor methods starting from minor version 8.0.1. This release significantly expands query API compatibility, making it easier to migrate MongoDB workloads to Amazon DocumentDB without application code changes. New capabilities span seven categories: Accumulators (13), Trigonometry (15), Bitwise aggregation (4), Arithmetic (3), Data size and type (4), Timestamp (2), and Stages and other (5). These operators are available starting from Amazon DocumentDB 8.0.1 in all regions where Amazon DocumentDB is available.

Amazon Managed Service for Prometheus is now available in the Asia Pacific (New Zealand) Region. This service is a fully managed, Prometheus-compatible monitoring service that simplifies monitoring and alerting on operational metrics at scale. Amazon Managed Service for Prometheus is available in multiple AWS Regions. Customers can send up to 1 billion active metric series to a single workspace and can create many workspaces per account, where a workspace is a logical space dedicated to the storage and querying of Prometheus metrics. For pricing details, visit the pricing page.

GPT-5.6 Sol, Terra, and Luna are now generally available on Amazon Bedrock, bringing OpenAI's smartest family of models to Bedrock's next-generation inference engine built for high performance, security, and reliability. GPT-5.6 sets a new standard for intelligence and efficiency, enabling you to solve harder problems in less time with more intelligence per token. The three models span capability tiers from flagship reasoning (Sol) to balanced performance (Terra) to fast, cost-efficient inference (Luna), all accessible through the Responses API on Amazon Bedrock. With GPT-5.6, you can build autonomous coding agents, run long-horizon genomics and biology analyses, and perform advanced cybersecurity research. Sol delivers state-of-the-art results on agentic coding benchmarks, Terra provides GPT-5.5-level performance at half the cost, and Luna offers fast, affordable inference at the lowest price point. GPT-5.6 also supports prompt caching with explicit cache breakpoints, so repeated context across agentic workflows is billed at a 90% discount and doesn't compound cost as you scale. Pricing matches OpenAI first-party rates and usage counts toward your AWS commitments. GPT-5.6 Sol is available in US East (N. Virginia) and US East (Ohio). GPT-5.6 Terra and Luna are available in US East (N. Virginia), US East (Ohio), and US West (Oregon). Get started with Sol, Terra, and Luna using the Amazon Bedrock Console or the Responses API on the bedrock-mantle endpoint.

AWS Storage Gateway now allows you to copy file shares across gateways directly from the Storage Gateway console. When you initiate a copy, the console reads the configuration of your source share and creates a new file share on the destination gateway with compatible settings preserved. Previously, you had to manually recreate each file share on the destination gateway and re-enter configuration details one by one. This new capability automates the transfer of configurations, significantly reducing the time and effort required for migrations such as upgrading to AL2023. A guided experience highlights any configurations that require attention before the new share is created, helping ensure a smooth transition without missing critical settings. This feature is available in commercial AWS Regions. For more information, visit the AWS Storage Gateway User Guide.

AWS has announced the availability of Qwen3-VL-Embedding-2B and Qwen3-Reranker-4B models in Amazon SageMaker JumpStart, expanding the portfolio of foundation models available to AWS customers. These models from Qwen are designed for information retrieval and cross-modal understanding, enabling customers to build comprehensive search pipelines on AWS infrastructure. The Qwen3-VL-Embedding-2B model accepts diverse inputs including text, images, screenshots, and videos, generating semantically rich vectors that capture both visual and textual information in a shared space. The Qwen3-Reranker-4B model takes a query and document pair as input and outputs a precise relevance score to refine retrieval results. With SageMaker JumpStart, customers can deploy these models with just a few clicks to address their specific AI use cases.

AWS has announced the availability of Voxtral-Mini-4B-Realtime-2602 in Amazon SageMaker JumpStart. This model from Mistral AI is a multilingual, real-time speech transcription model that enables customers to build low-latency speech applications on AWS infrastructure. It features a natively streaming architecture for real-time transcription, supports 13 languages, and allows users to configure transcription delays to balance latency and accuracy. The model can be deployed with a few clicks using SageMaker Studio or the SageMaker Python SDK.

AWS has announced the availability of privacy-filter in Amazon SageMaker JumpStart, expanding the portfolio of foundation models available to AWS customers. This model from OpenAI is a bidirectional token-classification model for personally identifiable information (PII) detection and masking in text, enabling customers to build data sanitization workflows on AWS infrastructure. Privacy-filter is fast, context-aware, and tunable, designed for high-throughput data sanitization workflows that teams can run on-premises. It labels an input sequence in a single forward pass and detects PII span categories including account numbers, addresses, emails, names, phone numbers, URLs, dates, and secrets. With SageMaker JumpStart, customers can deploy this model with just a few clicks to address their specific AI use cases. To get started with this model, navigate to the Models section of SageMaker Studio or use the SageMaker Python SDK to deploy the model to your AWS account. For more information about deploying and using foundation models in SageMaker JumpStart, see the Amazon SageMaker JumpStart documentation.

AWS has announced the availability of gemma-4-E2B-it in Amazon SageMaker JumpStart, expanding the portfolio of foundation models available to AWS customers. This model from Google DeepMind is a multimodal, instruction-tuned model optimized for efficient local execution, enabling customers to build capable AI applications on AWS infrastructure. Gemma-4-E2B-it processes text, image, and audio input and generates text output, with a built-in reasoning mode that lets the model think step-by-step before answering. It offers image understanding including object detection, document parsing, screen and UI understanding, chart comprehension, and OCR; video understanding; native function calling for agentic workflows; code generation, completion, and correction; and multilingual support across dozens of languages. With SageMaker JumpStart, customers can deploy this model with just a few clicks to address their specific AI use cases. To get started with this model, navigate to the Models section of SageMaker Studio or use the SageMaker Python SDK to deploy the model to your AWS account.

Amazon DocumentDB (with MongoDB compatibility) is now available as a specialized database skill in the Agent Toolkit for AWS. With this skill, AI coding agents can set up, manage, migrate, optimize, and troubleshoot Amazon DocumentDB clusters using step-by-step best-practice workflows, reducing errors and helping developers move faster without needing to manually look up DocumentDB operations guidance. The skill covers seven workflows: cluster provisioning, schema design, MongoDB compatibility assessment, DMS-based migration with change data capture, performance tuning, a 41-check well-architected review, and major version upgrades. When paired with the AWS MCP Server, agents can execute AWS CLI commands and run diagnostic queries with IAM-based guardrails, CloudTrail audit logging, and sandboxed execution. The skill also works standalone via the AWS CLI for teams that prefer local execution. The Amazon DocumentDB skill is available at no additional charge as part of the Agent Toolkit for AWS.

Amazon SageMaker HyperPod now supports custom AMIs for Slurm-orchestrated clusters, enabling customers to deploy clusters with pre-configured, security-hardened environments that meet their specific organizational requirements. Customers deploying AI/ML workloads on HyperPod Slurm clusters need customized environments that meet strict security, compliance, and operational requirements while maintaining fast cluster startup times, but often struggle with complex lifecycle configuration scripts that slow deployment and create inconsistencies across cluster nodes. This capability allows customers to build upon HyperPod's performance-optimized base AMIs while incorporating customized security agents, compliance tools, proprietary libraries, and specialized drivers directly into the image, delivering faster startup times, improved reliability, and enhanced security compliance. Security teams can embed organizational policies directly into base images, allowing AI/ML teams to use pre-approved environments that accelerate time-to-training while meeting enterprise security standards. You can specify custom AMIs when creating new HyperPod Slurm clusters using the CreateCluster API, adding instance groups with the UpdateCluster API, or patching existing clusters with the UpdateClusterSoftware API. Custom AMIs must be built using HyperPod's public base AMIs to maintain compatibility with distributed training libraries and cluster management capabilities. This feature is available in all AWS Regions where Amazon SageMaker HyperPod is supported.

Amazon Location Service has announced enhancements to its Places APIs, providing developers with greater control over address name formatting, multilingual addresses, travel-optimized POI search, and drive-through data. These capabilities cover the Geocode, ReverseGeocode, GetPlace, Suggest, Autocomplete, SearchNearby, and SearchText APIs. Developers can now control how address component names are returned using the new AddressNamesMode parameter. By default, addresses return normalized names, but developers can request matched names or administrative names. The new AddressTranslations parameter returns place name translations in over 50 languages, simplifying multilingual application development. A TravelMode parameter optimizes Suggest and SearchText results for users on the move, improving relevance for navigation and in-vehicle scenarios. Additionally, GetPlace, Suggest, SearchNearby, and SearchText now return a DriveThrough attribute indicating whether a place offers drive-through service, useful for logistics, food delivery, and navigation applications. The Geocode API also supports a new Parsing.AdditionalInfo response field with extra details about how the input address was interpreted.

Amazon Elastic Kubernetes Service (Amazon EKS) now supports Amazon Application Recovery Controller (ARC) zonal shift and autoshift for clusters using EKS Auto Mode. ARC helps manage and coordinate recovery across AWS Regions and Availability Zones (AZs). With this launch, EKS Auto Mode automatically protects compute during a zonal shift at no additional cost or configuration, maintaining Kubernetes application availability by shifting in-cluster network traffic away from an impaired AZ. Customers run highly available applications across multiple AZs in Amazon EKS to eliminate single points of failure. Because EKS Auto Mode manages compute on their behalf, they get zonal shift support without setting flags, granting permissions, or managing Karpenter versions; simply enable ARC zonal shift on their cluster. When a zonal shift is activated, EKS Auto Mode stops provisioning new capacity in the impaired AZ and halts voluntary disruptions such as consolidation and drift for nodes in that zone. It also prevents voluntary disruptions in healthy zones if they depend on scheduling pods to the impaired zone. When the shift expires or is canceled, normal operations resume. Users can start a shift manually or authorize AWS to manage it using zonal autoshift, with practice runs to verify cluster functions with one less AZ. ARC zonal shift support for EKS Auto Mode is available in all AWS Regions where EKS Auto Mode is offered.

Amazon SageMaker HyperPod now supports AMI-based configuration for Slurm clusters that use continuous provisioning. Continuous provisioning adds nodes to the cluster as capacity becomes available, and this launch extends AMI-based configuration to clusters using this mode. With this support, clusters using continuous provisioning can be created without downloading, configuring, or uploading lifecycle configuration scripts to Amazon S3. AMI-based configuration provisions nodes with the software and configurations needed for a production-ready environment to run AI/ML training workloads, including required software such as Docker, Enroot, and Pyxis, and configurations such as Slurm accounting, SSH key generation, and log rotation. When using continuous provisioning, each node is configured from the AMI as it is added to the cluster, without the need to manage lifecycle configuration scripts, so nodes become available to schedule jobs sooner. To enable AMI-based configuration, omit the LifeCycleConfig block from the instance group configuration when creating clusters via the API, or select "None" under Lifecycle scripts in Custom setup when using the SageMaker AI console. For additional customization on top of the AMI-based configuration baseline, an extension script can be provided by specifying the OnInitComplete parameter and SourceS3Uri in the LifeCycleConfig block via the API, or by providing the S3 URI in the "Extension script file in S3" field in Custom setup when using the console. Custom lifecycle configuration scripts remain fully supported for use cases that require full control over provisioning. AMI-based node lifecycle configuration for Slurm clusters using continuous provisioning is available in all AWS Regions where SageMaker HyperPod is available. To get started, see Getting started with SageMaker HyperPod using the AWS CLI or Getting started with SageMaker HyperPod using the SageMaker AI console in the SageMaker user guide.

AWS Database Migration Service (DMS) Schema Conversion now supports offline source conversion for Microsoft SQL Server, enabling you to convert SQL Server schemas and code without direct connectivity to your source databases. You extract metadata using standard database commands in your own environment, then upload it to DMS Schema Conversion for processing. This eliminates security reviews, firewall changes, and VPN setup that delay migration projects, while delivering the same conversion results as the connected approach. Offline Source is ideal for organizations with security policies that restrict external tool access to production SQL Server databases. Database administrators generate human-readable metadata files within their existing environment, and security teams can review the commands and output before uploading, making approval straightforward. By removing the connectivity requirement, Offline Source transforms weeks of security reviews into a simple command-and-upload workflow. Offline Source supports all DMS Schema Conversion targets at no additional conversion charge. For regional availability, see the Supported AWS Regions page. To get started, see Using Offline Source in the DMS Schema Conversion documentation.

Amazon Elastic Compute Cloud (Amazon EC2) G7 instances powered by NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs are now available in the US East (N. Virginia) Region. G7 instances deliver up to 4.6x AI inference performance and up to 2.1x graphics performance compared to G6 instances, and also provide faster performance for GPU-accelerated data analytics workloads. Customers can use G7 instances for deploying AI models for language translation, video and image analysis, and speech recognition. They also accelerate graphics workloads such as creating and rendering real-time, cinematic-quality graphics and game streaming. Additionally, G7 instances support video transcoding, spatial computing, and data analytics workloads such as recommender systems, Retrieval Augmented Generation (RAG) inference, and real-time data pipelines. G7 instances feature up to eight NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs with 32 GB of memory per GPU and custom Intel Xeon 6 processors. They support up to 192 virtual CPUs (vCPUs) and up to 700 Gbps of Elastic Fabric Adapter networking bandwidth. They also support up to 768 GiB of system memory, and up to 7.6 TB of local NVMe SSD storage. You can start using Amazon EC2 G7 instances today in three AWS Regions: US East (N. Virginia and Ohio), and US West (Oregon). You can purchase G7 instances as On-Demand Instances, Spot Instances, or as part of Savings Plans. To get started, visit the AWS Management Console, AWS Command Line Interface (CLI), and AWS SDKs. To learn more, visit the G7 instance page.

Amazon EMR on EKS now supports the Apache Spark troubleshooting agent. Data engineers can now diagnose EMR on EKS job failures through natural language, receiving automated root cause analysis and PySpark code recommendations without manually navigating distributed logs and Spark History Server data. The agent analyzes Spark History Server data, distributed executor logs, and cluster configurations to identify issues such as memory errors, data skew, resource contention, and connectivity failures. With this launch, the Spark troubleshooting agent now covers all EMR deployment options: EMR on EC2, EMR Serverless, and EMR on EKS. The agent is accessible directly from the EMR on EKS console through a "Troubleshoot with AI" option on failed jobs. Additionally, the agent is available through MCP (Model Context Protocol) using any compatible AI coding agent, including Kiro, Claude Code, and Cursor. All operations are read-only, authenticated with IAM roles, and logged in AWS CloudTrail.

Amazon Elastic Compute Cloud (Amazon EC2) now offers R8in, R8ib, R8idn, and R8idb instances in the AWS Asia Pacific (Tokyo) and Europe (Frankfurt, Ireland) regions. Powered by custom sixth-generation Intel Xeon Scalable processors and the latest sixth-generation AWS Nitro cards, these instances deliver up to 43% better compute performance per vCPU compared to previous generation R6in and R6idn instances. R8in and R8idn instances provide 600 Gbps network bandwidth, the highest among enhanced networking EC2 instances, making them ideal for real-time big data analytics, distributed web-scale in-memory caches, AI/ML cluster caching fleets, and Telco applications such as 5G User Plane Function (UPF). R8ib and R8idb instances deliver up to 300 Gbps EBS bandwidth, the highest among non-accelerated compute EC2 instances, suited for high-performance file systems and NoSQL databases. R8ib instances are optimal for workloads benefiting from high block storage performance, while R8idb instances are ideal for storage-intensive general-purpose workloads like large commercial databases, data lakes, and NoSQL databases that require both high EBS throughput and low-latency local NVMe storage. These instances support Elastic Fabric Adapter (EFA) networking on 48xlarge, 96xlarge, metal-48xl, and metal-96xl sizes, enabling lower latency and improved cluster performance for tightly coupled clusters. Amazon EC2 R8in and R8ib instances are available in US East (N. Virginia, Ohio), US West (Oregon), Asia Pacific (Tokyo), and Europe (Spain, Frankfurt, Ireland) regions through Savings Plans, On-Demand, and Spot instances.

AWS Partner Central now offers Partner Lead Prospecting, an AI-powered capability that helps APN Customer Engagements (ACE)-eligible AWS Partners act on and convert their leads faster. Building on the lead enrichment capabilities launched earlier this year-which provide propensity insights and eligibility for select AWS programs, funding benefits, and sales motions-Partner Lead Prospecting generates personalized sales plays, call scripts, and email outreach tailored to the customer's industry context and each partner's unique solutions and offerings. By incorporating a partner's own portfolio directly into prospecting content, the feature reduces the manual effort of researching leads and drafting outreach, helping partners engage prospective customers with more relevant, ready-to-use messaging. Partner Lead Prospecting is available to all ACE-eligible AWS Partners globally. Partners can access it through the Leads page in the AWS Partner Central console or via the AWS Partner Central MCP server.

Amazon Elastic Compute Cloud (Amazon EC2) M8gd and R8gd instances are now available in the AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. These instances feature up to 11.4 TB of local NVMe-based SSD block-level storage and are powered by AWS Graviton4 processors, delivering up to 30% better performance over Graviton3-based instances. Built on the AWS Nitro System, these instances are ideal for applications requiring high-speed, low-latency local storage. Each instance is available in 12 different sizes, providing up to 50 Gbps of network bandwidth and up to 40 Gbps of bandwidth to Amazon Elastic Block Store (Amazon EBS). Customers can also adjust the network and Amazon EBS bandwidth on these instances by 25% using EC2 instance bandwidth weighting configuration, offering greater flexibility in allocating bandwidth resources to optimize workloads. The instances support Elastic Fabric Adapter (EFA) networking on the 24xlarge, 48xlarge, metal-24xl, and metal-48xl sizes.

Amazon EC2 C8id, M8id, and R8id instances are now available in the Asia Pacific (Mumbai) and Europe (Stockholm, London) regions. These instances are powered by custom Intel Xeon 6 processors, delivering up to 43% higher performance and 3.3x more memory bandwidth compared to previous generation C6id, M6id, and R6id instances. C8id, M8id, and R8id instances offer up to 384 vCPUs, 3 TiB of memory, and 22.8 TiB of NVMe SSD storage, three times more than previous generation instances. They deliver up to 46% higher performance for I/O intensive database workloads and up to 30% faster query results for I/O intensive real-time data analytics compared to previous sixth-generation instances. Additionally, these instances support Instance Bandwidth Configuration, allowing 25% flexible allocation between network and EBS bandwidth to optimize resources for each workload. C8id instances are ideal for compute-intensive workloads such as high-performance web servers, batch processing, distributed analytics, ad serving, video encoding, and gaming servers. M8id instances are well-suited for balanced workloads including application servers, microservices, enterprise applications, and small to medium databases. R8id instances are ideal for memory-intensive workloads such as in-memory databases, real-time big data analytics, large in-memory caches, and scientific computing applications. Customers can purchase these instances via Savings Plans, On-Demand instances, and Spot instances. For more information visit the Amazon EC2 instance type page.

AWS Partner Central subsidiary connections now enable partners to share qualifications across their connected partner and seller accounts. Partners connecting newly acquired partner accounts or regional subsidiary accounts they own can now consolidate their AWS partnership standing across those accounts beyond revenue attribution. Partners with active subsidiary connections can now select Associate qualifications to share specializations, certifications, and select program enrollments across all connected accounts. The subsidiary's display name is automatically updated to reflect its affiliation with the primary account, and tier is recalculated based on combined scorecard metrics. Upon connection, Partner Revenue Measurement (PRM) continues to attribute combined revenue across all connected accounts. With qualification sharing, partners now also benefit from a unified public profile and consolidated scorecard. Subsidiary account connections and qualification sharing are available today in all commercial AWS Regions. Partners can self-service their subsidiary account connections and qualification sharing directly in AWS Partner Central.

Amazon SageMaker HyperPod now supports deep health checks for Slurm-orchestrated clusters created with continuous provisioning, enabling you to proactively verify GPU accelerator health on running instances at any time. Continuous provisioning lets you start training quickly and scale instance groups asynchronously without all-or-nothing failures, and you can now pair that flexibility with comprehensive hardware validation as instances come online. This capability addresses a critical challenge where even a single unhealthy node can waste hours of compute time and delay critical workloads. With deep health checks, you can target entire instance groups or specific instances to run comprehensive hardware stress tests and connectivity tests before committing compute resources to a job. Because continuous provisioning adds worker nodes to your Slurm cluster asynchronously as capacity becomes available, you can run deep health checks on each new node as it comes online, validating hardware before scheduling jobs on it and without interrupting workloads already running on healthy nodes. Progress and results are visible at both the instance group and instance level through the SageMaker console and APIs, providing complete visibility into GPU health, network connectivity, and multi-node communication performance. Instances undergoing checks are automatically isolated from workload scheduling and returned to service upon passing. When paired with HyperPod's automatic node recovery capability, instances that fail are automatically rebooted or replaced, ensuring cluster health. This capability is available in all regions where Amazon SageMaker HyperPod is available.

AWS announces Replace Root Volume using an existing EBS volume, a new option for replacing the root volume of a running Amazon EC2 instance. Customers can now use an EBS volume as the target for a root volume replacement, in addition to the existing options of replacing from a snapshot or an AMI. This option supports customers running stateful workloads who need to include specific metadata or software on the root volume before the application boots. Many customers use Replace Root Volume today to apply operating system patches and configuration changes without stopping the instance. However, customers who needed specific metadata or software on the root volume had to first capture a volume with data as a snapshot or register it as an AMI before they could replace the root volume. These intermediate steps added time and operational overhead. Customers can now configure the volume directly and use it as the new root volume, removing the snapshot and AMI creation steps. This reduces operational overhead and speeds up root volume patching for stateful workloads where downtime is costly. Using an EBS volume when replacing a root volume of an EC2 instance is available in all commercial AWS Regions and AWS GovCloud (US) regions.

AWS is announcing the general availability of Amazon EC2 Storage Optimized I8g instances in AWS GovCloud (US East, US West) regions. I8g instances offer the best performance in Amazon EC2 for storage-intensive workloads. Powered by AWS Graviton4 processors, they deliver up to 60% better compute performance compared to previous generation I4g instances. They use the latest third-generation AWS Nitro SSDs, providing up to 65% better real-time storage performance per TB, up to 50% lower storage I/O latency, and up to 60% lower storage I/O latency variability. Built on the AWS Nitro System, these instances offload CPU virtualization, storage, and networking functions to dedicated hardware and software, enhancing performance and security. Designed for I/O-intensive workloads requiring rapid data access and real-time latency from storage, I8g instances excel at handling transactional and real-time distributed databases such as MySQL, PostgreSQL, HBase, and NoSQL solutions like Aerospike, MongoDB, ClickHouse, and Apache Druid. They are also optimized for real-time analytics platforms such as Apache Spark, data lakehouse, and AI LLM pre-processing for training. Available in 11 sizes up to 48xlarge, with 1.5 TiB of memory and 45 TB of local instance storage, they deliver up to 100 Gbps of network bandwidth and 60 Gbps of dedicated bandwidth for Amazon Elastic Block Store (EBS).

You can now connect AI agents directly to the AWS MCP Server using AWS Sign-In. Agents connect using industry-standard OAuth without requiring additional authentication software. Existing AWS identities, sign-in methods, IAM permissions, and governance controls you have already set up continue to apply. Developers can authorize agents interactively through a browser or programmatically using non-interactive (headless) authorization. Administrators can govern OAuth access using familiar IAM policies together with new OAuth capabilities, including global condition keys, token introspection and revocation APIs, dynamic client registration, and CloudTrail audit events.

AWS Organizations now automatically applies security controls by default when you create a new organization via the AWS Organizations console, simplifying initial security configuration by automatically applying core security controls. This approach safeguards multi-account environments by protecting against unintended member account departures from your organization. CloudOps administrators and central security teams get immediate protection in their new organizations from day one. When you create a new organization using the AWS Organizations console, the service automatically applies service control policies (SCPs) that prevent member accounts from leaving the organization or closing themselves. These controls help enterprises migrating to AWS or starting a new organization establish strong governance patterns without requiring deep security expertise. The security defaults are intentionally lightweight to provide protection without impeding legitimate operations. You maintain full control to modify or disable these settings at any time. This feature is available in US East (N. Virginia), AWS GovCloud (US-East), AWS GovCloud (US-West), China (Beijing), and China (Ningxia).

AWS Database Migration Service (DMS) Schema Conversion now supports AI agent automation through the AWS MCP Server. You can connect AI coding agents, including Kiro, Claude Code, and Cursor, to DMS Schema Conversion and run complete migration workflows using natural language directly from your IDE. Agents create projects, browse source metadata, convert schemas, generate assessment reports, and export results autonomously. The DMS Schema Conversion skill, dms-schema-conversion, loads on demand and provides agents with predefined procedures, including API patterns, schema exclusions, and operational sequencing rules. Agents follow these procedures rather than improvising from general knowledge, reducing trial-and-error loops. They can also help convert remaining code objects such as stored procedures, functions, and triggers, building on the generative AI capabilities launched at re:Invent 2024. AI agent automation is available for all existing DMS Schema Conversion source and target engine pairs at no additional charge. For regional availability, see the Supported AWS Regions page. To get started, see Using AI agents with DMS Schema Conversion in the documentation.

Amazon DocumentDB (with MongoDB compatibility) now supports R8g.24xlarge and R8g.48xlarge database instances. Powered by AWS Graviton4 processors and featuring DDR5 memory, these instances allow customers to achieve higher throughput and support larger working sets in memory. With R8g.24xlarge (96 vCPUs, 768 GiB memory) and R8g.48xlarge (192 vCPUs, 1,536 GiB memory), customers can run more demanding workloads such as high-concurrency transactional applications, large-scale document processing, and memory-intensive operational workloads. Customers can get started with R8g.24xlarge and R8g.48xlarge instances through the AWS Management Console, CLI, and SDK by modifying their existing Amazon DocumentDB database cluster or creating a new one. R8g instances are available for Amazon DocumentDB 5.0+ on both Standard and IO-Optimized cluster storage configurations. For more information including region availability, visit our pricing page and documentation.

AWS announces that Amazon EC2 I7ie instances are now available in the AWS Asia Pacific (Hyderabad) region. Designed for large storage I/O intensive workloads, I7ie instances are powered by 5th Gen Intel Xeon Processors with an all-core turbo frequency of 3.2 GHz, offering up to 40% better compute performance and 20% better price performance over existing I3en instances. I7ie instances offer up to 120TB local NVMe storage density for storage optimized instances and provide up to twice as many vCPUs and memory compared to prior generation instances. Powered by 3rd generation AWS Nitro SSDs, I7ie instances deliver up to 65% better real-time storage performance, up to 50% lower storage I/O latency, and 65% lower storage I/O latency variability compared to I3en instances. I7ie instances are high density storage optimized instances, ideal for workloads requiring fast local storage with high random read/write performance at very low latency consistency to access large data sets. These instances are available in 9 different virtual sizes and deliver up to 100Gbps of network bandwidth and 60Gbps of bandwidth for Amazon Elastic Block Store (EBS). To learn more, visit the I7ie instances page.

Amazon MSK Replicator now supports data replication from external Apache Kafka clusters-including on-premises, self-managed on AWS, or other cloud providers-to Amazon MSK Standard brokers. This capability extends replication support to MSK Standard brokers, in addition to the existing support for MSK Express brokers. With this launch, you can migrate workloads to MSK Standard brokers, support disaster recovery by using MSK clusters as a failover or backup target, and enable data distribution across hybrid and multi-cloud environments. MSK Replicator is a feature of Amazon MSK that automates data replication between Kafka clusters, eliminating the need to manage custom replication infrastructure or configure open-source tools. Previously, MSK Replicator supported replication from external Apache Kafka clusters to MSK Express brokers only. With this launch, you can now also replicate data from external Kafka clusters to MSK Standard brokers, using either SASL/SCRAM or mutual TLS (mTLS) authentication to connect to your external clusters. You can also use MSK Replicator to replicate data from Amazon MSK Standard to external Kafka clusters for reliable failback or multi-cloud data distribution. Unlike self-managed replication tools, MSK Replicator lets you retain your original Kafka topic names during replication while automatically avoiding infinite replication loops. It also synchronizes consumer group offsets bidirectionally, enabling you to move producers and consumers across clusters independently, in any order, without coordination constraints or the risk of data loss. This new capability is supported in all AWS Regions where Amazon MSK Replicator is available.

Amazon SageMaker Feature Store is a fully managed capability that simplifies computing, storing, and retrieving features for training and deploying AI models. This update introduces new capabilities for high-throughput feature ingestion, record discovery, and offline store cataloging. Data scientists can now use BatchWriteRecord to write multiple records across multiple feature groups in a single request, and ListRecords to retrieve record identifiers in a feature group page by page. When configuring an offline store, they can also create Glue and Iceberg tables with custom names. These features allow data scientists to ingest features at scale and manage records stored in SageMaker Feature Store without building custom tooling.

Amazon SageMaker Unified Studio now supports custom asset types for IAM-based domains. Domain administrators can catalog any format of asset within SageMaker Unified Studio, such as medical imaging files in Amazon S3, revenue dashboards built in PowerBI, or PDF research reports generated by a third-party platform. Custom asset types bring all assets, regardless of their underlying format, into the SageMaker catalog so teams can search, discover, and subscribe to them without needing separate tools or processes. Administrators can create a custom asset type with a name, description, and optional metadata forms, then create individual assets enriched with glossary terms and README documentation, and publish them for discovery. Once published, anyone in the domain can find the asset by name, type, or glossary term and request a subscription through the same governed workflow used for all other catalog assets. Custom asset types for IAM-based domains are available in all AWS Regions where Amazon SageMaker Unified Studio is available.

AWS Client VPN is now available in four new regions: Canada West (Calgary), Mexico (Central), and two in Asia Pacific - New Zealand and Taipei. This fully managed service enables customers to securely connect their remote workforce to resources in AWS or on-premises networks. It eliminates the need for hardware VPN appliances and complex operational management through its pay-as-you-go model. Organizations can easily manage and monitor VPN connections through a single console.

Amazon Timestream for InfluxDB now publishes events to Amazon EventBridge when your database instances or clusters undergo state changes. Events are emitted for lifecycle operations including creation, deletion, compute and storage scaling, parameter group updates, maintenance windows, and reboot-covering both successful completions and failures. With this capability, customers can use Amazon EventBridge rules to programmatically react to database operations without polling the API for status. DevOps teams can build automation workflows that trigger when a scaling operation completes, operations teams can route failure events for immediate alerting, and compliance teams can persist all events to Amazon CloudWatch Logs or Amazon S3 for audit trails. Events are published to the default Amazon EventBridge event bus in your account with source aws.timestream-influxdb, supporting content-based filtering and routing to any EventBridge target including AWS Lambda functions, AWS Step Functions, Amazon SQS queues, Amazon SNS topics, and cross-account event buses. This capability is available in all AWS Regions where Amazon Timestream for InfluxDB is available. Standard Amazon EventBridge pricing applies for rule evaluation and target delivery.

Amazon Elastic Compute Cloud (Amazon EC2) M8gd and R8gd instances are now available in Europe (Paris) and Asia Pacific (Mumbai) regions. Additionally, EC2 R8gd instances are available in Europe (Stockholm, Milan) and Asia Pacific (Osaka, Melbourne, Singapore, Taipei) regions. These instances feature up to 11.4 TB of local NVMe-based SSD block-level storage and are powered by AWS Graviton4 processors, delivering up to 30% better performance over Graviton3-based instances. Built on the AWS Nitro System, these instances are ideal for applications requiring high-speed, low-latency local storage. Each instance is available in 12 different sizes, providing up to 50 Gbps of network bandwidth and up to 40 Gbps of bandwidth to Amazon Elastic Block Store (Amazon EBS). Customers can now adjust network and Amazon EBS bandwidth on these instances by 25% using EC2 instance bandwidth weighting configuration, offering greater flexibility in allocating bandwidth resources to better optimize workloads. These instances also offer Elastic Fabric Adapter (EFA) networking on 24xlarge, 48xlarge, metal-24xl, and metal-48xl sizes.

AWS Config now supports 191 additional managed rules across key services including Amazon Bedrock, Amazon SageMaker, Amazon ECS, Amazon EKS, Amazon RDS, Amazon Redshift, Amazon S3, and Amazon CloudTrail. This expansion increases built-in governance coverage across AI workloads and core cloud infrastructure. Examples of the new managed rules include evaluating resource configurations for encryption, logging, public access, network security, data protection, and other operational best practices across AWS services. With this launch, you can deploy these new managed rules individually or as part of a conformance pack in the AWS Regions where the corresponding AWS services are available.

AWS Neuron has been updated to version 2.31.0. This release introduces NKI 0.5.0 with new MX FP8 scale dtype support, tensor indirection for compute operations, and new NkiTensor view APIs for zero-cost tensor layout transformations. Additionally, the Neuron UltraServer Operator for Amazon EKS is now available in public beta, automating UltraServer discovery, workload allocation, and resource claim generation for Trainium UltraServer workloads on Amazon EKS. The Neuron Compiler includes a redesigned code generation backend now enabled by default on Trn2 and Trn3, delivering improved performance. The Neuron Runtime adds contiguous shared scratchpad support, simplifying device configuration by eliminating the need to manually set scratchpad page sizes. The NKI Library adds 14 new experimental kernels covering MoE training collectives, deformable attention, DeepSeek MLA projection, and ring attention, alongside PyTorch reference implementations. Neuron Explorer adds System Trace Viewer source code linking and updated default grouping for improved workload debugging.

Amazon SageMaker Unified Studio Workflows now supports 19 new operators for Amazon Bedrock, Amazon S3 Tables, Amazon S3 Vectors, AWS Glue Data Catalog, and Amazon MWAA Serverless. With these operators, customers can add new tasks using the visual workflow creator to orchestrate these services without writing custom integration code. This enables data workers and builders to create workflows that manage Bedrock guardrails, provision and delete S3 Tables and S3 Vectors resources, manage Glue Data Catalog tables and databases, and trigger MWAA Serverless workflow runs. This expands the breadth of AWS services that can be orchestrated from SageMaker Unified Studio Workflows, reducing the need to switch between consoles or write custom DAG code. This feature is available in all AWS Regions where Amazon SageMaker Unified Studio is available.

AWS Builder Center now allows builders to request free, time-limited sandbox environments directly from eligible workshops, eliminating the need for a personal AWS account, credit card, or concerns about unexpected charges. Previously, workshops could only be completed using a builder's own AWS account. With sandbox environments, builders of all skill levels can safely deploy resources, write code, and experiment in a pre-provisioned AWS account. Free sandbox environments are ideal for builders who want to gain practical AWS experience without setting up an account. Each sandbox provides 8 hours of access from activation, with automatic cleanup afterward. Builders can request one sandbox per week (resetting every Sunday), and most environments are ready within 15 minutes. Sandboxes are available for select workshops at launch, with more being enabled over time.

Amazon Connect Customer now supports forecasting, capacity planning, and scheduling for Tasks and Emails, enabling you to plan and optimize your workforce across all workloads (Voice, Chat, Tasks, Emails). Connect Customer accounts for the unique characteristics of each channel, including concurrent work handling, duration of work from minutes to months, and distinct service level requirements, so your forecasts and schedules reflect how your operation actually runs. For example, if your agents handle email inquiries or tasks such as case processing alongside voice calls, you can now generate a unified forecast that accounts for all of these workloads and create schedules that efficiently allocate agents across channels. Thus enabling end-to-end workforce optimization within a single solution and ensuring consistent service levels across all customer interaction channels.

Amazon Aurora DSQL change data capture (CDC) is now generally available, enabling you to stream real-time database changes to Amazon Kinesis Data Streams for event-driven architectures and data integration workflows. Aurora DSQL CDC automatically captures the results of insert, update, and delete operations as change events and delivers them to Kinesis Data Streams with no infrastructure to manage. You can use CDC to synchronize data across microservices, trigger AWS Lambda functions, or deliver changes to Amazon S3, Amazon Redshift, and Amazon OpenSearch Service via Amazon Data Firehose. CDC streaming is designed to have zero impact on your database workload performance. CDC streaming is available in all AWS Regions where Aurora DSQL is available. Get started with Aurora DSQL for free with the AWS Free Tier.

Amazon Redshift now supports Graviton-based RG instances on the trailing track. Starting July 7, 2026, rg.4xlarge and rg.xlarge instance types are available for customers running workloads on the trailing track (P201). The trailing track is designed for customers who prioritize stability for production workloads, running on a version already validated through the leading track. With RG instances now available on both tracks, customers can take advantage of AWS Graviton-powered performance - delivering up to 2.4x faster query performance than RA3 instances at 30% lower price per vCPU. To get started, customers can provision a new cluster or resize an existing cluster to an rg.4xlarge or rg.xlarge instance type on the trailing track (P201) in the AWS Management Console, AWS CLI, or AWS SDKs. For more information, see Amazon Redshift cluster versions.

AWS Security Hub now introduces Network Scanning, a capability that identifies resources in your environment that are reachable from the public internet. Network Scanning probes your resources from the internet to detect actual reachability, not just what could be reachable based on security group rules and route tables. It discovers public IP addresses, virtual machines, and load balancers across your AWS and Azure environments, identifies reachable ports, and determines what services are running behind them. This complements Security Hub’s existing network reachability findings, which identify configurations that could make a resource reachable from the internet. Network Scanning confirms actual reachability from the internet. Each reachable port generates a Security Hub finding with evidence of the port and service discovered. Security Hub Exposures then automatically correlates these findings with other findings and resource configurations to determine broader risk.

Amazon SageMaker Unified Studio now supports OpenLineage compatible data lineage in IAM-based domains, capturing lineage events from Apache Spark jobs run on Amazon EMR, AWS Glue, SageMaker Visual ETL, and notebooks. This capability is already available in IAM Identity Center-based domains. The interactive lineage graph provides an aggregate visual representation of how data moves from source to consumption, with configurable graph depth, event timestamp mode for detailed column-level lineage, and a dataset-only view for simplified visualization. For both IAM-based and IAM Identity Center-based domains, you can programmatically publish, query, and manage data lineage from OpenLineage compatible applications. You can now also remove published events using the DeleteLineageEvent API. This feature is available in all AWS Regions where Amazon SageMaker Unified Studio is available.

Amazon S3 Vectors is now available in AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. S3 Vectors is purpose-built vector storage for AI agents, inference, Retrieval Augmented Generation (RAG), and semantic search at billion-vector scale. It offers the same elasticity, durability, and availability as Amazon S3, with dedicated APIs for storing, accessing, and querying vectors without provisioning infrastructure.

Amazon GameLift Streams now supports Stream Session Admin Shell, providing a secure terminal connection to the live runtime environment of a stream session for real-time troubleshooting. Users can inspect logs, query running processes, check GPU utilization, and examine application state-all without managing SSH keys, open ports, or infrastructure credentials. To connect, call the new CreateStreamSessionAdminShell API with your stream group and stream session identifiers, then use the returned credentials with the SSM Session Manager plugin for the AWS CLI. The feature supports Linux (Ubuntu 22.04), Proton, and Windows Server 2022 runtimes. The terminal connection is scoped to your application environment and automatically closes when the stream session ends. This feature is available at no additional cost in all AWS Regions where Amazon GameLift Streams is offered

Amazon EC2 High Memory U7i instances are now available in the AWS Europe (Zurich) region. The U7i-12tb.224xlarge instance offers 12TiB of DDR5 memory, 896 vCPUs, up to 100Gbps Elastic Block Storage (EBS) and network bandwidth, and supports ENA Express. These instances are ideal for mission-critical in-memory databases such as SAP HANA, Oracle, and SQL Server.

Amazon RDS for Oracle now supports Oracle Database 26ai, Oracle's latest Long Term Support Release. Oracle Database 26ai includes features such as Select AI for generating and running SQL queries from natural language prompts, AI Vector Search for retrieval augmented generation directly from SQL, JSON Relational Duality Views, and SQL Property Graphs for in-database graph analytics. You can create new DB instances running Oracle Database 26ai or upgrade from Oracle Database 19c or 21c container databases. Oracle Database 26ai is available in Enterprise Edition only and can be used in all commercial AWS Regions and AWS GovCloud (US) Regions

Amazon Redshift RG instances, powered by AWS Graviton processors, are now available in the AWS GovCloud (US-West) and AWS GovCloud (US-East) Regions. RG instances deliver better performance, running data warehouse and data lake workloads up to 2.4x as fast as previous generation RA3 instances, at 30% lower price per vCPU. RG instances include Redshift's custom-built vectorized data lake query engine that processes Apache Iceberg and Parquet data on your cluster nodes, enabling you to run SQL analytics across your data warehouse and data lake using a single engine. RG instances are available in two instance sizes, rg.xlarge and rg.4xlarge. Customers with existing RA3 clusters can upgrade them to RG using Snapshot & Restore, Elastic Resize, or Classic Resize. RG instances are available with flexible pricing options, including On-Demand, and 1-year and 3-year Reserved Instances with All Upfront, Partial Upfront, and No Upfront payment options.

Amazon EC2 C8ine instances are now available in the AWS Europe (Frankfurt) region. Powered by custom sixth-generation Intel Xeon Scalable processors exclusive to AWS, these instances feature the latest sixth-generation AWS Nitro cards, delivering up to 43% higher performance compared to previous generation C6in instances. C8ine instances offer up to 2.5 times higher packet performance per vCPU versus prior generation network-optimized instances, providing up to 2x higher network throughput for traffic through Internet gateways compared to existing C6in network-optimized instances. They are designed for security and network virtual appliances, including virtual firewalls, load balancers, and Telco 5G UPF workloads. Amazon EC2 C8ine instances are available in US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), and Europe (Frankfurt) regions, offered via Savings Plans and On-Demand instances.

Amazon EMR Serverless now provides larger worker configurations of 32 vCPUs with up to 244 GB of memory, allowing you to run more compute and memory-intensive workloads. Previously, the largest worker configuration available on EMR Serverless was 16 vCPUs with up to 120 GB of memory. Larger workers can help improve runtime performance and cost profiles for your workloads. For shuffle-heavy workloads, larger workers reduce inefficient data transfers between executors. For jobs with data skew, larger workers reduce the chances of out-of-memory failures. For jobs that need to cache data, larger workers allow holding more data in memory, boosting job performance. To take advantage of these benefits, we recommend using larger workers for your compute and memory-intensive Spark and Hive workloads. To learn more about different worker configurations, please visit EMR Serverless documentation. Larger workers are available in all AWS Regions where EMR Serverless is available.

Amazon Elastic Container Service (Amazon ECS) Managed Instances now offers significantly reduced management fees for GPU and accelerated instance types. Starting July 1, 2026, G-series ECS management fees are reduced by 35%, and P-series and AWS Trainium fees are reduced by 60%. These reductions apply automatically, and no action is required from customers already using GPU instances with ECS Managed Instances. With ECS Managed Instances, customers get desired application performance and simplicity by defining task requirements such as vCPU count, memory size, and CPU architecture. Amazon ECS automatically provisions, configures, and operates optimal EC2 instances within the AWS account using AWS-controlled access. Customers can also specify desired instance types, including GPU-accelerated, network-optimized, and burstable performance instances. ECS Managed Instances includes capabilities specifically built for accelerated workloads, such as GPU metrics (utilization, memory, and temperature) through Amazon CloudWatch Container Insights, and automatic health monitoring that detects GPU-specific hardware failures and replaces unhealthy instances to minimize workload disruption. This pricing update is available in all AWS Regions where ECS Managed Instances is offered. For the complete updated rate table, see ECS Managed Instances pricing. Amazon EKS is implementing identical management fee reductions for GPU instances on EKS Auto Mode. To learn more about ECS Managed Instances, visit the feature page, documentation, and AWS News launch blog

Amazon SageMaker HyperPod now supports Disaggregated Prefill and Decode (DPD), an inference optimization that separates the two phases of large language model (LLM) inference-prefill and decode-onto dedicated GPU pools and transfers the key-value (KV) cache between them over Elastic Fabric Adapter (EFA) using GPU-Direct RDMA. With DPD, customers run compute-bound prefill on one set of GPUs and memory-bandwidth-bound decode on another, so the two phases no longer contend for the same resources. This delivers more consistent per-token latency under sustained concurrency, higher goodput at strict latency SLOs, and the ability to scale prefill and decode capacity independently to match the input and output distribution of the workload. An intelligent router automatically directs long-context requests through the disaggregated path and sends shorter prompts directly to the decoder. Customers enable DPD by adding a pdSpec section to the same InferenceEndpointConfig custom resource they already use for inference endpoints on the HyperPod Inference Operator, and DPD is composable with the existing KV cache offloading and intelligent routing features on HyperPod. DPD is available for SageMaker HyperPod clusters using the EKS orchestrator on EFA-capable instance types in all AWS Regions where Amazon SageMaker HyperPod is available.

Amazon SageMaker Unified Studio now supports connecting existing Amazon Managed Workflows for Apache Airflow (MWAA) environments to projects. Data engineers and platform teams who already operate MWAA environments can now manage their Airflow workflows from the same interface they use for analytics and machine learning, without recreating configurations or migrating DAGs. To connect an existing environment, open the Workflows tool in your Studio project and select "Add connection" in the connection selector. Provide the Airflow configuration options that reference your domain and project. Once connected, project members can sync, trigger, and monitor workflows directly from Amazon SageMaker Unified Studio. Environments running Apache Airflow 3 or later also get access to the visual authoring experience for creating new workflows using the drag-and-drop editor. This feature is available in all AWS Regions where Amazon SageMaker Unified Studio is available.

AWS Systems Manager now allows you to connect and manage Azure Virtual Machines without manual agent installation or per-instance tier fees. Create a Cloud Connector and automatically deploy the SSM Agent to your Azure VMs at scale. Once connected, Azure VMs appear alongside EC2 instances in a unified view, enabling you to use Session Manager, Automation runbooks, Run Command, State Manager, Patch Manager, and Inventory across both AWS and Azure from a single workflow. This release also eliminates the Advanced Instances Tier entirely, allowing unlimited connections of hybrid and multicloud nodes to Systems Manager with no upfront per-node fees. Beginning September 30, 2026, pay-as-you-go pricing will apply for Session Manager sessions and Run Command invocations on non-EC2 nodes.

Amazon S3 Express One Zone is now available in the AWS Europe (Frankfurt) Region. This storage class is purpose-built for high performance in a single Availability Zone, delivering consistent single-digit millisecond data access for frequently accessed data and latency-sensitive applications. It provides up to 10x faster data access speeds and up to 80% lower request costs compared to S3 Standard, enabling workloads such as machine learning training, interactive analytics, and key-value caching in AI search engines to achieve fast data access with high durability and availability. With this expansion, S3 Express One Zone is now available in 8 AWS Regions. For pricing details, visit the S3 pricing page. To learn more, visit the product page and documentation.

AWS has introduced declarative policies for VPC Encryption Controls, allowing customers to centrally define and manage their desired VPC Encryption Controls settings and apply them across all VPCs in their environment. This enhancement enables security teams to enforce encryption in transit consistently across all existing and future VPCs, simplifying compliance with standards such as HIPAA, FedRAMP, and PCI. Previously, customers had to configure these settings individually for each VPC. With this launch, a single declarative policy can be used to enforce encryption controls settings organization-wide, providing central visibility into the status of all accounts and VPCs. Declarative policies for VPC Encryption Controls are available in all AWS regions that support VPC Encryption Controls, with no additional charge when used with AWS Organizations.

Amazon SageMaker Studio now supports direct integration from Hugging Face, allowing users to go from discovering a model to working with it inside a fully configured Studio environment in a single click. By selecting any supported model on Hugging Face and choosing "Customize on SageMaker AI" or "Deploy on SageMaker AI," users land directly on the corresponding workflow page with the model pre-loaded and ready to use. Previously, getting from model discovery to a working environment required navigating the AWS Console to find SageMaker AI, configuring an environment, setting up IAM permissions for serverless model customization, and often requesting GPU quota increases through Service Quotas before running a first job. Now, new customers complete a standard AWS sign-up and receive a SageMaker Studio environment created in seconds with pre-configured permissions for serverless model customization jobs, including fine-tuning with custom reward functions for reinforcement learning, model evaluation, and deployment to SageMaker or Bedrock endpoints. Verified customers receive default GPU access to G5, G6, and G4dn instances across endpoint deployments, training jobs, and notebooks without requesting quota increases, and quota limit and utilization information is visible for each instance type directly inside the Studio environment. Returning customers signing in from Hugging Face or SageMaker product pages select their environment and land directly inside SageMaker Studio with the model ready to use. This feature is available in all AWS Commercial Regions where Amazon SageMaker Studio is supported.

Amazon Cognito now supports self-service provisioned API rate limits, allowing users to increase or decrease their provisioned API rate limits on demand. Previously, adjusting Cognito API rate limits required a manual review through Service Quotas, necessitating advance planning for traffic spikes. Now, users can set their desired Cognito rate limit up to the account-level max limit using the Amazon Cognito console or the new limit provisioning API operations, with changes taking effect immediately. Self-service provisioned limits are available for adjustable API categories in all AWS Regions where Amazon Cognito is available. For pricing details, see the Amazon Cognito pricing page.

AWS Security Hub now adds impact analysis to exposure findings, helping security teams understand the full scope of what an attacker could reach if an exposure is exploited. Impact analysis extends exposure findings by mapping downstream resources that could be compromised beyond the initially exposed resource, providing deeper visibility into organizational risk. Security Hub analyzes the effective permissions of IAM principals associated with exposed resources to identify privilege escalation paths to other resources in the account. The resulting scope of impact is displayed in the potential attack path graph, and a new Impact Assessment tab shows prioritized chains of resources an attacker could traverse along with specific permissions at each step. Security Hub factors the scope of impact into its severity scoring for exposure findings, adjusting existing exposures as their scope of impact is identified or changes, ensuring exposures with greater downstream reach are prioritized appropriately.

Amazon Elastic Kubernetes Service (Amazon EKS) Auto Mode now offers significantly reduced management fees for GPU and accelerated instance types. Beginning July 1, 2026, G-series Auto Mode management fees are reduced by 35%, and P-series and AWS Trainium fees are reduced by 60%. These reductions apply automatically to all EKS Auto Mode clusters and no action is required from customers already using GPU instances with Auto Mode. EKS Auto Mode simplifies Kubernetes operations by automatically provisioning and managing infrastructure for machine learning inference, fine-tuning, rendering, and batch processing workloads. It includes capabilities built for accelerated workloads: automatic parallel image pulling and unpacking on GPU instances with local NVMe storage, so large container and model images start faster, and accelerator-aware node repair that detects GPU hardware failures and automatically replaces unhealthy nodes. With today's price reduction, customers can run GPU workloads on Auto Mode at lower management fees, making its fully managed infrastructure more cost-effective. This pricing update is available in all AWS Regions where EKS Auto Mode is available. Amazon ECS is implementing identical management fee reductions for GPU instances on ECS Managed Instances.

AWS announces Service Events for Amazon CloudWatch Application Signals, which automatically captures exception and latency event snapshots, function-level performance data, and deployment events from instrumented services without additional code changes. Customers can now quickly identify whether a deployment has introduced new exceptions by navigating to CloudWatch > Application Signals > [Service] > Errors in the CloudWatch console. Service Events is available to any application with CloudWatch Application Signals enabled. Customers instrument their applications with the ADOT SDKs or the Amazon CloudWatch Observability EKS add-on. Once Application Signals is active, Service Events begins capturing exception and latency event snapshots and deployment events automatically. Optionally, customers can gain deeper performance visibility by turning on function-call metrics. Service Events is available in all commercial AWS Regions. Supported languages are Java, Python, and JavaScript. To get started, see Monitor service events in the Amazon CloudWatch User Guide. Service Events data is captured as logs. Function call metrics are captured as OpenTelemetry metrics. Standard CloudWatch pricing applies.

AWS Certificate Manager (ACM) now allows you to provision a fully managed ACME server endpoint that issues public TLS certificates with a 45 day validity from Amazon Trust Services using any ACMEv2-compatible client, including Certbot, cert-manager for Kubernetes, and acme.sh. With the CA/Browser Forum mandating 47-day certificate lifetimes by 2029, manual management of public certificates becomes untenable. ACME support in ACM gives developers a standards-based path to fully automate certificate issuance and renewal. PKI administrators can create managed ACME endpoints with centralized governance controls: define domain scopes to restrict which certificates each client can issue, enforce policies on wildcard usage, and delegate certificate requests to application teams without distributing DNS credentials. Domain validation is performed once at the endpoint level, while application owners use standard ACME clients to request certificates. All activity is visible in the ACM console with AWS CloudTrail logging and Amazon CloudWatch metrics for auditability. ACME support in ACM is available in all commercial AWS Regions

Amazon Elastic VMware Service (EVS) now supports VMware Cloud Foundation (VCF) 9.0 and 9.1. Amazon EVS allows you to run the latest VCF software directly within your Amazon Virtual Private Cloud (VPC) on EC2 bare-metal instances. With this announcement, you now have complete control of the installation, operations, and management of the VMware virtualization solution running the VCF 9.0 and recently released VCF 9.1 versions. You can continue to use the same tools, processes, and skills on Amazon EVS that you use in your data center today, managing your VCF environment yourself or with an experienced AWS partner. Additionally, the Solutions for EVS GitHub repository is launching with examples, templates, and infrastructure as code artifacts to help you get started. This release is available in all regions where Amazon EVS is offered.

AWS Secrets Manager has extended its managed external secrets capability to include Paddle API Keys and GitLab Access Tokens. For Paddle, rotation uses its native API with a configurable grace period, allowing applications to transition seamlessly to new keys without interruption. GitLab supports rotation of three token types-Personal, Group, and Project Access Tokens-using its atomic rotation mechanism. These additions join existing integrations with BigID, Confluent Cloud, Datadog, MongoDB Atlas, Salesforce, and Snowflake, enabling management of third-party software-vended secrets. The new integrations are available in all AWS Regions where AWS Secrets Manager managed external secrets are supported.

Starting today, AWS CodePipeline is now available in the Asia Pacific (New Zealand) Region (ap-southeast-6). AWS CodePipeline is a continuous delivery service that enables you to model, visualize, and automate the steps required to release your software. With CodePipeline, you model the full release process for building your code, deploying to pre-production environments, testing your application and releasing it to production. CodePipeline then builds, tests, and deploys your application according to the defined workflow every time there is a code change. CodePipeline integrates natively with other AWS services (such as CodeBuild, CodeDeploy, and CloudFormation) and supports third-party integrations, such as GitHub or with your own custom plugin, offering a comprehensive solution for orchestrating end-to-end CI/CD pipelines. By integrating manual approval gates, IAM-based access controls, and encryption of artifacts at rest and in transit, CodePipeline helps teams enforce governance policies and maintain a robust security posture throughout the software delivery lifecycle. CodePipeline enables organizations to automate security scans and compliance checks directly within their CI/CD workflows, ensuring consistent and reliable validation against industry frameworks. To get started, you can sign in to the AWS Management Console and create a pipeline to start using the service. If you want an introduction to CodePipeline, see Getting Started, which includes step-by-step tutorials. With CodePipeline, you only pay for what you use. There are no upfront fees or long-term commitments. See the pricing page for additional details on CodePipeline.

AWS CodeBuild now supports Amazon Linux 2023 for on-demand build hosts through a new host kernel selection setting. This allows choosing between Amazon Linux 2 (Linux kernel 4) and Amazon Linux 2023 (Linux kernel 6). Amazon Linux 2023 includes an updated Linux kernel and glibc, along with package additions, upgrades, and removals. Users can validate Amazon Linux 2023 in non-production environments while keeping production builds unchanged. AWS GovCloud (US) and China Regions only support Amazon Linux 2023. Available in all AWS Regions where CodeBuild is offered

Amazon SageMaker HyperPod is purpose-built infrastructure for training and deploying foundation models at scale. This update provides cluster administrators with visibility into the exact AMI versions running on every instance group and node in semantic versioning format (major.minor.patch), enabling quick detection of version drift and rollback to previous versions-including prior NVIDIA drivers, CUDA, and other software stacks-using the UpdateClusterSoftware API. Auto-patching is an opt-in, per-instance-group capability that applies only backward-compatible security patches as nodes become idle, ensuring running workloads remain undisturbed and critical AI/ML packages such as NVIDIA drivers, CUDA versions, and operating system kernels are never upgraded to a different major or minor version. It can be enabled through the CreateCluster or UpdateCluster API. A new AMI support policy also publishes support timelines for different AMI versions after which HyperPod stops publishing security patches. Both AMI versioning and auto-patching are available for HyperPod clusters orchestrated by Amazon EKS in all AWS Regions where SageMaker HyperPod is supported.

Amazon SageMaker Unified Studio now supports Terraform for provisioning. Customers can use the open-source terraform-aws-sagemaker-unified-studio module to deploy a SageMaker Unified Studio domain through version-controlled templates. This enables platform teams to integrate SageMaker Unified Studio into their existing infrastructure-as-code pipelines, ensuring consistency across development, staging, and production accounts. The Terraform module manages the infrastructure of the SageMaker Unified Studio domain with provisioned IAM roles. Sub-modules allow teams to enable blueprints, compose blueprints into project profiles, and create projects independently. Customers can also create projects with existing IAM roles. This integration is enabled through the Terraform AWS Cloud Control Provider. This feature is available in all AWS Regions where Amazon SageMaker Unified Studio is available.

AWS Config now supports eight additional AWS resource types across key services including Amazon API Gateway, Amazon EC2, and Amazon S3 Vectors. This expansion provides greater coverage over your AWS environment, enabling you to more effectively discover, assess, audit, and remediate an even broader range of resources. If you have enabled recording for all resource types, AWS Config will automatically track these new additions. The newly supported resource types are also available in Config rules and Config aggregators.

Amazon EC2 is announcing support for AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) on Dedicated Hosts, enabling customers to run their confidential computing workloads on physical servers fully dedicated to their use. Customers can allocate a Dedicated Host with SEV-SNP enabled and launch SEV-SNP instances on it. This provides the benefits of Dedicated Hosts for confidential computing workloads, including control over instance placement and host affinity that allows customers to deploy instances to the same physical server over time. The physical host is provisioned with AMD security firmware during allocation, ensuring a customer’s confidential computing environment is up to date. Dedicated Host SEV-SNP is available in all AWS commercial Regions with AMD instances.

Amazon Elastic Compute Cloud (Amazon EC2) X8i instances are now available in the Asia Pacific (Seoul), Asia Pacific (Malaysia), and Asia Pacific (Tokyo) regions. Powered by custom Intel Xeon 6 processors exclusive to AWS, these instances are SAP-certified and deliver the highest performance and fastest memory bandwidth among comparable Intel processors in the cloud. They offer up to 43% higher performance, 1.5x more memory capacity (up to 6TB), and 3.3x more memory bandwidth compared to previous generation X2i instances. Designed for memory-intensive workloads such as SAP HANA, large databases, data analytics, and Electronic Design Automation (EDA), X8i instances provide up to 50% higher SAPS performance, up to 47% faster PostgreSQL performance, 88% faster Memcached performance, and 46% faster AI inference performance compared to X2i instances. Available in 14 sizes ranging from large to 96xlarge, including two bare metal options. X8i instances can be purchased via Savings Plans, On-Demand, and Spot instances.

Amazon Elastic Container Service (Amazon ECS) now provides more control over when a service deployment is considered failed and automatically rolled back. Users can now customize deployment circuit breaker settings to match their application's startup behavior, deployment needs, and tolerance for task failures. The ECS deployment circuit breaker automatically detects failed deployments and rolls them back to the last successful deployment once a failure threshold is reached. With this launch, users can set the deployment circuit breaker threshold using either a fixed task failure count or a percentage of the service's desired task count, and choose how failures are counted using either a consecutive model (where the counter resets when a healthy task starts) or a cumulative model (where failures keep adding up throughout the deployment). For example, lower thresholds can be set for faster rollbacks in development and test environments, or more tolerance can be allowed for applications that experience expected startup failures before stabilizing. This feature is available in all AWS Regions where Amazon ECS is offered. Deployment circuit breaker settings can be configured for new and existing ECS services using the AWS Management Console, AWS CLI, AWS SDKs, AWS CloudFormation, AWS CDK, and Terraform. For more information, see the ECS deployment circuit breaker documentation.

Amazon Elastic Container Service (Amazon ECS) now provides real-time deployment observability in the Amazon ECS Console. With this launch, customers can track deployment progress, monitor deployment health, and diagnose failures directly from the console, understanding exactly what is happening during a deployment, identifying issues as they occur, and reducing the time it takes to troubleshoot and resolve deployment failures. The enhanced deployment observability introduces a live deployment timeline showing each phase, service events, and task launch and termination progress with automatic refresh. Users can monitor deployment health in real time using circuit breaker status with live task failure proximity and threshold tracking, deployment alarm state, and health checks at both container and load-balancer levels. To diagnose deployment failures faster, users can view failed tasks directly in the deployment timeline with diagnostic context and deep links to related services such as AWS CloudTrail, reducing the need to navigate across multiple tools to pinpoint the root cause of a failure. These capabilities are available at no additional charge in all AWS commercial Regions and AWS GovCloud (US) Regions for all Amazon ECS services using the rolling update deployment type. To get started, navigate to any Amazon ECS service in the Amazon ECS Console and select the Deployments tab.

Amazon CloudWatch has released the ability to create alarms from log queries. This allows you to configure an alarm on a log query and specify the alarm threshold directly, eliminating the need to first create metric filters or custom metrics as intermediate steps. This streamlines the path to actively monitoring the data in your logs and monitoring and alerting on it. For example, you can write a query to count error rates by service, set a threshold, and receive an alarm notification with log context when errors spike-all in a single workflow. Alarms created from log queries support all standard CloudWatch Alarm actions, including Amazon SNS notifications and Amazon EventBridge integrations. This feature is available in all commercial AWS Regions except Middle East (UAE) and Middle East (Bahrain). You can create log query-based alarms using the Amazon CloudWatch console, AWS Command Line Interface (AWS CLI), AWS CloudFormation, and AWS SDKs.

Starting today, AWS Security Agent (now part of AWS Continuum) is available in three additional AWS Regions: Asia Pacific (Mumbai), Asia Pacific (Singapore), and South America (São Paulo). Customers in these Regions can now access core capabilities of Security Agent to proactively secure their applications throughout the development lifecycle. This expansion provides access to STRIDE-based threat modeling (preview) that analyzes design documents and source code to surface risks early in the development lifecycle. Full-repo and PR-level code reviews (preview) are available across GitHub, GitLab, GitHub Enterprise Server, Bitbucket, and Confluence, with managed compliance packs and custom security requirements. Customers can trigger threat modeling, code reviews, and remediation directly from Kiro or Claude Code through new IDE plugins and MCP integration. On-demand penetration testing delivers validated findings with reproducible attack paths and ready-to-implement fixes, and retesting confirms that applied remediations are effective. Simulated validation remains available only in US East (N. Virginia). AWS Security Agent scales security expertise across applications to match development velocity while providing comprehensive security coverage.

Amazon Managed Service for Prometheus is now FedRAMP High and Department of Defense Cloud Computing Security Requirements Guide (DoD CC SRG) Impact Level (IL) 4 and 5 authorized in the AWS GovCloud (US) Regions. Federal agencies, public sector organizations, and other enterprises with FedRAMP High and DoD CC SRG IL-4/5 compliance requirements can now use Amazon Managed Service for Prometheus to monitor and alert on their workloads with confidence that it meets the security and compliance standards required for sensitive environments. Amazon Managed Service for Prometheus is a fully managed, Prometheus-compatible monitoring service that makes it easy to monitor and alert on operational metrics at scale. It automatically scales ingestion and storage for high-cardinality workloads, and integrates with AWS security services for fast, secure access to data.

Amazon Elastic Kubernetes Service (Amazon EKS) now supports Kubernetes version rollback, enabling you to revert to the previous Kubernetes minor version within 7 days if any issues arise after an upgrade. This provides an additional safety net for your upgrade workflow, allowing you to validate the new version under real production conditions and rollback if needed. You can initiate a rollback using the Amazon EKS console, AWS CLI, or AWS SDKs. Before proceeding, Amazon EKS evaluates your cluster rollback readiness insights that include automated checks covering API compatibility, version skew, add-on compatibility, cluster health, and more. For clusters running EKS Auto Mode, EKS automatically manages the rollback of worker nodes before reverting the control plane, honoring your configured disruption controls. Amazon EKS version rollback is available at no additional cost in all AWS Regions where Amazon EKS is available

Amazon Elastic Container Service (Amazon ECS) Express Mode now supports custom task definitions, providing the flexibility to use existing ECS application configurations and advanced task-level customizations with Express Mode's simplified deployment experience. This also enables you to reuse task definitions from your existing CI/CD pipelines and infrastructure-as-code workflows, allowing you to retain established operational practices while taking advantage of Express Mode's streamlined application deployment and infrastructure automation. Express Mode makes it easy to deploy containerized web applications and APIs by automatically handling load balancing, networking, auto scaling, monitoring, and deployments. With this update, you can extend Express Mode services with advanced task definition capabilities, including observability and security sidecars, custom container health checks, ulimits and Linux runtime settings, and FireLens for custom log routing. Once you associate a custom task definition with an Express Mode service, you can continue managing your application either through task definition updates or directly through Express Mode, whichever you prefer. This feature is available in all AWS Regions. To get started, create or update your ECS Express Mode service by passing your task definition using the AWS Management Console, AWS CLI, AWS SDKs, or infrastructure-as-code tools. To learn more, see the Amazon ECS Express Mode documentation and getting started walkthrough.

AWS AppConfig announces the general availability of experimentation tools that allow you to run A/B tests and feature experiments without building or managing separate experimentation infrastructure. Built on over 25 years of Amazon experimentation best practices, these tools use AI-driven guidance to help build robust experiments with exposure control and locked treatment allocations for confident, data-driven decisions. You can run A/B tests and multivariate experiments across your application stack-from UI changes and recommendation algorithms to AI model selections and prompt experiments. Define feature variations, target granular audiences with a rule builder, and set traffic allocation percentages via the AWS Management Console, CLI, API, or AWS CDK. AI-assisted experiment design validates your setup against Amazon's best practices to ensure sufficient statistical power. Customers set up and run experiments in AWS AppConfig, then analyze results using Amazon CloudWatch or existing analytics tools. At the end of the experiment, promote the winning treatment to production through a standard AWS AppConfig safe rollout. Experiments work across workloads on Amazon EC2, AWS Lambda, Amazon ECS, Amazon EKS, and on-premises servers through the AWS AppConfig Agent.

Amazon GuardDuty Runtime Monitoring now includes three new threat detections that alert security teams when sensitive files are modified on Amazon EC2 instances and container workloads running on Amazon EKS or Amazon ECS. These findings help identify post-compromise attacker activities by monitoring critical system files, including configuration files, authentication settings, and system logs. The new detections-Persistence:Runtime/SensitiveFileModified, PrivilegeEscalation:Runtime/SensitiveFileModified, and DefenseEvasion:Runtime/SensitiveFileModified-help identify attempts to maintain persistent access, escalate privileges, and evade detection after an initial system compromise. By monitoring five specific file operations (open-for-write, rename, symlink, link, and unlink) directly, these findings can detect threats even when attackers use obfuscated techniques that bypass traditional command-line monitoring. The correlation-based analysis distinguishes malicious behavior from legitimate administrative operations, helping reduce false positives while providing actionable intelligence with MITRE ATT&CK tactics mapping and remediation recommendations. These sensitive file modification findings are now available to all customers who have enabled GuardDuty Runtime Monitoring for their Amazon EC2, Amazon EKS, or Amazon ECS workloads. A 30-day free trial is available for new users.

Amazon Bedrock AgentCore is now available in four additional AWS Regions: Asia Pacific (Bangkok), Asia Pacific (Malaysia), Europe (Milan), and Europe (Spain). AgentCore is the platform to build, connect, and optimize agents. It helps engineers ship agents fast with any framework and any model, connect them to enterprise systems and tools, and optimize them continuously, with security enforced at the infrastructure layer that agents can't bypass. With this expansion, customers in these regions can build and run agents closer to their end users with lower latency. AgentCore capabilities including agent runtime, identity and access control, policy management, session persistence, tool connectivity, and observability are available in these regions at launch.

Cross-Region Automated Backup replication for Amazon RDS is now available in four additional AWS Regions. This launch allows you to set up automated backup replication between Mexico (Central) and Europe (Ireland) or US West (N. California); between Asia Pacific (Taipei) and Asia Pacific (Singapore) or Asia Pacific (Tokyo); between Asia Pacific (New Zealand) and Asia Pacific (Singapore), Asia Pacific (Sydney), or Asia Pacific (Melbourne); and between Asia Pacific (Thailand) and Asia Pacific (Singapore) or Asia Pacific (Jakarta) Regions. Automated Backups enable recovery capability for mission-critical databases by providing the ability to restore your database to a specific point in time within your backup retention period. With Cross-Region Automated Backup replication, RDS will replicate snapshots and transaction logs to the chosen destination AWS Region. In the event that your primary AWS Region becomes unavailable, you can restore the automated backup to a point in time in the secondary AWS Region and quickly resume operations. As transaction logs are uploaded to the target AWS Region frequently, you can achieve a Recovery Point Objective (RPO) of within the last few minutes. You can set up Cross-Region Automated Backup replication with just a few clicks on the Amazon RDS Management Console or using the AWS SDK or CLI. Cross-Region Automated Backup replication is available on Amazon RDS for PostgreSQL, Amazon RDS for MariaDB, Amazon RDS for MySQL, Amazon RDS for Db2, Amazon RDS for Oracle, and Amazon RDS for Microsoft SQL Server.

Today, AWS announces that partners can associate one or more AWS Marketplace solutions and product listings from their AWS Marketplace catalog directly to co-sell opportunities in AWS Partner Central. Previously, opportunities required partners to use solutions specially created for co-selling, meaning partners managed their solutions for the AWS Marketplace catalog and solutions for co-selling separately. Partners can now associate their existing AWS Marketplace listings with opportunities to track fulfillment more effectively. When creating or editing an opportunity in AWS Partner Central in the AWS Console, Partners can select one of the following options: (1) AWS Marketplace solutions and products, (2) AWS Marketplace solutions only, (3) AWS Marketplace products only, or (4) Other. Partners can associate up to 10 AWS Marketplace Solutions and up to 10 AWS Marketplace Products with a single opportunity. This includes AWS Marketplace listings within AWS accounts that have an established subsidiary account connection. The same capability is available programmatically through the AWS Partner Central Selling API. To progress an opportunity to the Committed or Launched stage, an AWS Marketplace Solution, AWS Marketplace Product, or Partner Solution must be associated. This capability is generally available in AWS Partner Central in the AWS Console.

AWS Artifact now includes Assurance Assistant, an AI-powered capability that generates citation-backed responses to security and compliance questions about AWS services. Assurance Assistant helps third-party risk managers, compliance officers, security engineers, and auditors by providing sourced answers from verified AWS compliance documentation. It offers two modes: single-question mode for immediate responses and questionnaire upload mode for processing XLSX files, including industry-standard formats like CAIQ and SIG. All responses include citations from AWS compliance documentation, such as SOC reports and ISO certifications, allowing customers to verify information against source materials. Responses can be exported selectively or in full, with or without citations, in the original file format. Two new IAM managed policies-AWSArtifactComplianceInquiriesReadOnlyAccess and AWSArtifactComplianceInquiriesFullAccess-are available for access control. Assurance Assistant is available at no additional charge through the AWS Artifact console in all commercial AWS Regions. AWS Artifact is globally accessible, and customers do not need to select a specific Region to use Assurance Assistant.

Amazon Bedrock AgentCore has increased the default runtime quota limits, giving customers greater capacity to scale their agent-based workloads. The new default limits support up to 5,000 active concurrent sessions in US East (N. Virginia) and US West (Oregon), and 2,500 in all other supported Regions. All AWS Regions where AgentCore is available now support 200 agent interactions per second and 25 new sessions created per second.

AWS announces Dynamic Instrumentation for Amazon CloudWatch Application Signals, enabling developers to capture runtime state from live applications without requiring restarts or redeployments. This allows debugging production issues by inspecting variable values, method arguments, return values, and stack traces at specific code locations. Dynamic Instrumentation eliminates the need to add logging statements, redeploy, and wait to reproduce a problem, making it practical to investigate issues difficult to replicate locally. Customers start by instrumenting their application with the AWS Distro for OpenTelemetry (ADOT) SDKs, then configure which code locations to monitor using the CloudWatch Application Signals MCP server or manually via the AWS CLI and SDK. When execution reaches an instrumented location, the agent captures a snapshot containing the runtime context and delivers it to CloudWatch Logs, correlated with the active trace. Customers can tune how much data to capture, including which arguments and local variables to collect. Dynamic Instrumentation is available in all commercial AWS regions, supporting Java, Python, and JavaScript/TypeScript. The feature is disabled by default in the ADOT SDKs and must be enabled via a flag. For more information, see Debug applications with Dynamic Instrumentation in the Amazon CloudWatch User Guide. Dynamic instrumentation data is captured as logs, with standard CloudWatch Logs ingestion and storage rates applying.

Amazon Connect Customer now supports assigning up to 7 security profiles per user, increased from the previous limit of 2. This allows an agent serving multiple lines of business to have a distinct, scoped permission set for each one, enforced through tag-based or hierarchy-based access controls. The increased limit provides greater flexibility to align your security model directly with your organizational structure. For example, a financial services company with separate lines for credit cards, mortgages, auto loans, personal banking, investments, insurance, and fraud can now assign an agent seven security profiles, one per line of business, each granting access only to resources tagged for that specific division. This ensures least privilege access without requiring a single overly broad profile. This feature is available in all AWS regions where Amazon Connect is offered

Amazon Connect Customer now enables you to protect sensitive information in agent screen recordings by defining rules to redact specific applications or URLs. When a rule condition is met, the system automatically redacts the matching content in the post-contact screen recording. This feature is available on Windows operating systems in all AWS Regions where Amazon Connect is offered.

Amazon Elastic Compute Cloud (Amazon EC2) has launched C9g and C9gd instances powered by AWS Graviton5 processors. C9g instances are ideal for workloads such as high-performance computing (HPC), batch processing, gaming, video encoding, scientific modeling, distributed analytics, CPU-based machine learning (ML) inference, real-time analytics, and ad serving. C9gd instances provide local NVMe-based SSD block-level storage for compute-intensive workloads requiring high-speed, low-latency local storage for scratch space, temporary files, and caches. These instances deliver up to 25% better compute performance compared to AWS Graviton4-based C8g and C8gd instances, with up to 30% faster performance for databases, up to 35% faster for web applications, and up to 35% faster for machine learning. They feature a 5x larger cache and the fastest memory of any processor instances in the cloud. Built on the sixth-generation AWS Nitro System, these instances are the first to feature the Nitro Isolation Engine, using formal verification to provide mathematical assurance that customer workloads are isolated from each other and AWS operators, pioneering a new standard for mathematically proven cloud security. C9g and C9gd instances are available in US East (N. Virginia, Ohio), US West (Oregon), and EU (Frankfurt) regions and can be purchased via Savings Plans, On-Demand, Spot instances, Dedicated instances, or Dedicated hosts.

AWS has launched AWS Interconnect - last mile, a fully managed connectivity service that enables customers to connect their branch offices, data centers, and remote locations to AWS with just a few clicks, eliminating the friction and complexity of network setup. Now in gated preview with AT&T, AWS Interconnect - last mile combines AWS cloud innovation with AT&T’s extensive network footprint. Customers can instantly establish private, high-speed connections to AWS by selecting their preferred AWS Region, bandwidth speed, Direct Connect Gateway ID, and partner subscriber ID. Once initiated, AWS generates an activation key to complete provisioning with AT&T. The launch simplifies the connectivity experience by pre-provisioning capacity and automating complex network configuration, including BGP peering, VLAN configuration, and ASN assignment. Customers benefit from zero down-time maintenance. The service is designed for high availability and backed by an SLA. AWS Interconnect - last mile is available as a gated preview with AT&T for customers in the US starting today. Partners can also easily adopt it via a published open API package on GitHub. For more information, see the AWS Interconnect - last mile documentation and request access here.

AWS now offers Claude Sonnet 5, Anthropic's most capable Sonnet model and the first Sonnet model of Anthropic's latest generation, providing top-tier intelligence at Sonnet pricing for coding, agents, and everyday professional work at scale. Claude Sonnet 5 delivers strong performance across coding, professional work, and agentic tasks while maintaining the balance of capability, cost, and speed that teams get from Sonnet. For coding, it navigates large codebases, implements multi-file changes, and carries debugging and refactoring tasks through to completion with fewer rounds of correction. For agents, it calls tools precisely, holds state across many steps, and recovers from errors so more runs finish correctly the first time. For knowledge work, it builds spreadsheets, drafts documents, and turns unstructured material into structured analysis. Customers have two ways to access Claude Sonnet 5: Amazon Bedrock and Claude Platform on AWS. Amazon Bedrock keeps your data within AWS infrastructure and provides access to Claude Sonnet 5 through a unified service with AWS-managed features like Guardrails, Knowledge Bases, and regional data residency. Claude Platform on AWS gives you direct access to Anthropic's native platform experience and capabilities via the AWS Console. Build, test, and deploy with the same APIs, features, and console experience you'd get working with Anthropic directly, unified with AWS billing and authentication.

AWS announces container attribute-based rules for AWS Network Firewall, simplifying security for containerized workloads on Amazon EKS and Amazon ECS. Users can now define firewall policies using native container constructs such as Namespace, Cluster Name, and Labels for EKS, and Cluster Name and Container Instance Attributes for ECS, eliminating the need to manage complex IP-based rules that break when pods scale or restart. As organizations adopt generative AI on EKS and ECS, this feature provides enterprise-grade network security controls for dynamic environments. Container attribute-based rules support TLS decryption for deep packet inspection, FQDN-based filtering, URL category filtering, and GeoIP filtering-all automatically adapting as containers scale. The native integration between AWS Network Firewall, EKS, and ECS enables centralized, multi-cluster security, helping meet compliance requirements. This feature is available at no additional cost as part of AWS Network Firewall. For a full list of supported regions, visit the AWS Capabilities by Region page.

Amazon OpenSearch Service now offers a new engine optimized for log analytics workloads. This engine delivers up to 4x better price-performance on internal benchmarks, combining full-text search capabilities with efficient aggregations and trend analysis. It reduces storage by up to 70% with a new columnar storage format for aggregation workloads, allowing users to retain up to 3x more data at the same cost. The engine also provides up to 2x higher ingestion throughput and 2x faster analytical queries on the same hardware. To get started, create a new domain on OpenSearch 3.5 or above using the AWS console, select the observability use case, and set the engine mode to optimized. Users can build visualizations and explore data through PPL in the OpenSearch UI, or query via SQL using the API, JDBC/ODBC drivers, and Query Workbench. The engine supports combining full-text search predicates with analytical SQL in the same query. The optimized engine is available across 12 regions globally at no additional charge.

Amazon Relational Database Service (Amazon RDS) for Db2 now allows customers to directly join their RDS for Db2 DB instances to the domains of self-managed Microsoft Active Directory (AD). Self-managed AD can be on-premises, on AWS, or in another cloud. Customers use Kerberos as the authentication protocol to enable single sign-on for their database users. Previously, to use Kerberos authentication against a self-managed AD with their RDS for Db2 instances, customers were required to deploy AWS Managed Microsoft AD and establish a trust between the AWS managed domain and the self-managed domain. Now, customers can use their existing self-managed AD directly to authenticate and authorize database users without the additional complexity of a managed directory or a directory trust - helping them meet compliance requirements with their existing identity infrastructure. Customers can domain-join their RDS for Db2 instance by either creating a new instance or modifying an existing one, supplying the credentials of a delegated AD service account stored in AWS Secrets Manager and encrypted with AWS KMS. Customers can use self-managed AD free of charge. Self-managed Active Directory with Amazon RDS for Db2 is now generally available in all AWS Regions where Amazon RDS for Db2 is available, including the AWS GovCloud (US) Regions.

Amazon SageMaker AI now supports serverless model customization for Gemma 4 E4B and 31B models using supervised fine-tuning (SFT), direct preference optimization (DPO), and reinforcement fine-tuning (RFT). Gemma is a family of open models built by Google DeepMind. In addition to deploying these models on SageMaker AI, you can now adapt them to your specific domains and workflows. This launch also extends the variety of models available for serverless customization on SageMaker AI, including models from the Nova, Nemotron 3, Qwen, Llama, gpt-oss, and DeepSeek families. Model customization enables you to tailor these foundation models with your proprietary data, whether that's improving accuracy on domain-specific tasks, aligning outputs with your organization's tone, or enhancing performance on new tasks using your labeled data. With serverless customization, SageMaker AI handles all infrastructure provisioning and training orchestration, so you can focus on your data and evaluation rather than cluster management, and only pay for what you use. Serverless model customization on SageMaker AI is available in US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), and EU (Ireland). To get started, navigate to the Models page in Amazon SageMaker Studio to launch a customization job, or use the SageMaker Python SDK for programmatic access.

IAM Identity Center now enables customer managed applications to programmatically access AWS accounts on behalf of their users when they authenticate through an external identity provider (IdP). By configuring the IdP as a trusted token issuer (TTI) in IAM Identity Center, users can access their assigned AWS accounts and obtain temporary security credentials for their authorized roles without a separate authentication flow. This eliminates redundant sign-in prompts that previously required users to re-authenticate even after signing in through their external identity provider. This feature is available for organization instances of IAM Identity Center, and administrators must explicitly enable AWS account access for each customer managed application. Only management account administrators or delegated administrators can enable this capability, ensuring centralized governance over which applications can access account-level resources. The feature is available in all commercial AWS Regions, AWS GovCloud (US) Regions, and China Regions.

AWS Security Hub CSPM announces the AI Security Best Practices standard, a set of 31 automated security controls that detect when deployed AI resources do not align with security best practices. Developed by AWS security experts, this standard helps continuously evaluate Amazon Bedrock, Amazon Bedrock AgentCore, and Amazon SageMaker workloads against recommended security configurations-without requiring manual assessments or custom rule authoring. The AI Security Best Practices standard covers critical security domains including network isolation, encryption at rest and in transit, VPC placement, KMS key usage, private container registry requirements, and authorization controls. Controls span the breadth of AI infrastructure: from Bedrock AgentCore runtimes, gateways, memory stores, and custom browsers to SageMaker notebook instances, endpoints, models, monitoring jobs, and feature groups. Each control is assigned a security category and generates findings when resources deviate from best practices, enabling security teams to quickly identify and remediate misconfigurations across their AI workloads. The AI Security Best Practices standard is available in all AWS Regions where Security Hub CSPM is currently available, including AWS GovCloud (US) and the China Regions. The standard identifier is standards/ai-security-best-practices/v/1.0.0. To learn more, see the AWS Security Hub CSPM User Guide. You can also try Security Hub CSPM at no cost for 30 days with the AWS Free Tier.

Amazon SageMaker Inference now supports container image caching, which enables up to 2x faster end-to-end scaling for generative AI models during scale-out events. When your endpoint scales out, the service pre-caches your container image so new instances can start serving traffic faster, without waiting for large container images to be pulled from Amazon ECR. Generative AI workloads typically use large container images (10 GB or more) for deep learning frameworks and model serving. Previously, every new instance launched during scale-out had to pull the full image from ECR, adding several minutes of cold-start latency. Container image caching eliminates this bottleneck by pre-pulling the image so new instances launch with the container already available locally. Customers don't need to make any changes. The service automatically caches whatever image URI is specified in your endpoint or inference component configuration. This capability supports accelerator instance types, single-model endpoints, and inference component-based endpoints. With this launch, SageMaker Inference now offers a comprehensive scaling optimization suite for generative AI: sub-minute concurrency metrics for up to 6x faster load detection, instance-store container caching for faster scaling on existing instances, and container image caching for up to 2x faster scaling on new instances. Container image caching is available in all AWS commercial regions where SageMaker Inference is supported.

AWS announces the launch of Capability Insights, an open-source solution that enables you to deploy regional capabilities data inside your own Amazon Virtual Private Cloud (VPC). This self-hosted dashboard addresses the needs of teams building multi-Region architectures requiring regional capabilities data deployed as infrastructure they own, inside their network, and under their governance. Designed for organizations with data residency requirements, compliance teams needing internal reporting, and teams planning regional expansion or multi-Region recovery strategies, the dashboard auto-refreshes every 24 hours with AWS capabilities data across all Regions, covering services, features, API operations, and CloudFormation resource types. The Workload Analysis component scans your AWS CloudTrail logs and AWS CloudFormation stacks to filter 200+ services down to the number of services your account actually uses, reducing multi-week gap analysis to quick reviews. All data remains within your VPC perimeter, supporting compliance and data residency requirements while providing full ownership and control over the infrastructure hosting the regional capabilities data.

Amazon EC2 Auto Scaling now offers reservations-then-balanced, a new Availability Zone distribution strategy that prioritizes launching instances into capacity reservations before distributing remaining capacity evenly across Availability Zones. This enables you to maximize utilization of pre-purchased capacity such as On-Demand Capacity Reservations, Capacity Blocks, and Interruptible Capacity Reservations, while retaining the operational simplicity and resilience of Auto Scaling. You can configure reservations-then-balanced by setting the capacity distribution strategy in the AvailabilityZoneDistribution configuration of your Auto Scaling group and targeting reservations by Capacity Reservation Group ARN or by individual Capacity Reservation IDs. There is no additional charge to use reservations-then-balanced; you continue to pay standard EC2 pricing for your reservations and any On-Demand or Spot instances launched by the group. Reservations-then-balanced is available today in all AWS commercial Regions.

Amazon WorkSpaces for AI agents is now generally available, allowing AI agents to securely access and operate desktop applications through managed WorkSpaces environments. Enterprises rely on desktop applications such as ERP systems, CRMs, mainframes, and proprietary tools for critical business processes. These applications often have years of customization, undocumented logic, and strict compliance requirements, making them too critical to abandon and costly to modernize. WorkSpaces for agents provides AI agents with a managed cloud workspace where they can view the screen and operate these applications as humans do, without requiring application modernization or custom integrations. WorkSpaces uses the same infrastructure trusted for over a decade to deliver secure, managed desktops at scale. Agents inherit the same identity controls, network isolation, and compliance boundaries as human users, enabling organizations to automate workflows such as claims processing, patient record updates, trade settlement, and back-office operations without sacrificing governance. The service works with any agent framework using Model Context Protocol (MCP), and pricing scales based on active session time. Since launching in preview, customer and partner feedback has shaped new capabilities. MCP tool forwarding allows agents to interact with applications and the desktop operating system through direct MCP calls rather than using computer use tools, improving accuracy, reducing latency, and lowering cost. Real-time session control gives operators live visibility into agent activity with the ability to revoke access mid-session. Domain-joined fleet support lets agents operate under existing Active Directory identities, extending the same access policies and audit attribution that apply to employees.

Amazon Time Sync Service introduces support for microsecond accurate time on 26 additional EC2 instance types across all commercial regions. Built on Amazon's proven network infrastructure and the AWS Nitro System, microsecond accurate time and nanosecond precision hardware timestamps directly leverage reference clocks running in the Nitro System. This enables customers to easily order application events, measure one-way network latency, and increase distributed application transaction speeds. Customers can access microsecond accurate time on these additional instance types by creating a Precision Time Placement Group (PTPG), a new placement strategy that allows instances to be launched with Precision Time Protocol hardware clock (PHC) enabled. For workloads requiring both low network latency and precision time, customers can associate a PTPG with their Cluster Placement Group (CPG), ensuring that low-latency workloads also benefit from microsecond accurate time. For more information, refer to the Amazon Time Sync Service documentation.

AWS End User Messaging now supports rich media and interactive messaging for RCS across all 22 supported countries. The new SendRcsMessage API allows sending rich cards, carousels, images, videos, and interactive suggestion buttons, enabling recipients to confirm appointments, browse product catalogs, complete payments in a webview, share their location, or interact with an AI agent-all without leaving their messaging app. Each interaction runs on the same AWS infrastructure used to build applications, with RCS acting as the interface layer connecting backend services, data, and AI directly to end users. AWS now supports four RCS message types (text, files, rich cards, carousels) usable with six actions (replies, URLs, webviews, phone calls, maps, calendar events), bringing web and mobile app experiences into conversations. Each message includes configurable SMS or MMS fallback for recipients without RCS. RCS Conversation pricing is introduced for 21 countries, offering a flat rate for unlimited messages within a 24-hour session, enabling back-and-forth workflows without per-message cost pressure. RCS messaging is available in all AWS Regions where AWS End User Messaging is offered.

Amazon Neptune now supports dual-stack mode, enabling database clusters to accept connections over IPv4, IPv6, or both protocols simultaneously. This allows organizations to adopt IPv6 while maintaining backward compatibility with existing IPv4 deployments. Neptune dual-stack mode supports two configurations. Private dual-stack mode provides IPv6 endpoints that remain isolated from the internet, suitable for internal applications and private graph databases. Public dual-stack mode enables IPv6 endpoints accessible from the internet, supporting internet-facing applications and hybrid network environments. Clients connect seamlessly using their preferred protocol with no application changes required. Dual-stack mode is available in all AWS Regions where Amazon Neptune is supported.

Amazon ElastiCache now supports T4g node types in the following AWS Regions: Africa (Cape Town), Asia Pacific (Jakarta), Asia Pacific (Osaka), AWS GovCloud (US-East), and AWS GovCloud (US-West). T4g nodes are powered by AWS Graviton2 processors and provide a baseline level of CPU performance with the ability to burst CPU usage at any time, making them ideal for applications that experience temporary spikes in usage. For complete information on pricing and regional availability, please refer to the Amazon ElastiCache pricing page. To get started, create a new cluster or modify an existing cluster using the AWS Management Console, AWS CLI, or API. To learn more, see Supported node types in the Amazon ElastiCache User Guide.

AWS Parallel Computing Service (PCS) now supports managed in-place Slurm version upgrades for existing clusters. You can upgrade your clusters up to three Slurm major versions ahead with no disruption to running jobs. To upgrade, update your Cluster configuration with your target Slurm version using the AWS Management Console, AWS CLI, or UpdateCluster API. PCS handles the upgrade of all managed Slurm components - the controller, accounting database, and REST API. Running jobs continue uninterrupted during the upgrade, queued jobs resume once the operation completes, and any accounting data is preserved in the database. You can then update your compute nodes to the new Slurm version at your convenience. PCS is a managed service that simplifies running and scaling HPC workloads on AWS using Slurm. You can build complete, elastic environments that integrate compute, storage, networking, and visualization tools, while the service handles cluster operations with managed updates and built-in observability features. This feature is available in all AWS Regions where PCS is available.

Amazon Relational Database Service (Amazon RDS) now offers dynamic connection scaling for IAM database authentication, allowing connection rates to scale with instance resources. IAM database authentication performance now scales with available instance resources, enabling enterprise workloads to leverage IAM authentication for high-volume connection patterns. The number of new IAM authentication requests your instance can handle depends on available resources and workload characteristics. For optimal performance, we recommend reusing IAM user or IAM assumed role principals to generate authentication tokens, or reusing the authentication tokens themselves, when possible. This update is available in all AWS Regions, including the AWS GovCloud (US) Regions, where IAM database authentication is supported for Amazon Aurora and Amazon RDS database engines including PostgreSQL, MySQL, and MariaDB.

AWS CloudFormation and CDK have introduced an express mode, which reduces deployment time by up to 4x for developers and AI agents building infrastructure, based on internal benchmarks. Express mode completes stack operations when CloudFormation confirms that resource configuration has been applied, rather than waiting for extended stabilization checks such as traffic readiness, region propagation, and resource cleanup. This enables faster iteration cycles for developers and AI agents building infrastructure. When iterating on infrastructure in development environments, developers and AI agents need faster iteration cycles to build infrastructure incrementally. Previously, every deployment waited for full resource stabilization regardless of whether the workflow required it. For example, creating a CloudFront distribution required waiting 5-10 minutes for propagation to all edge locations before the deployment completed, even when the developer only needed the distribution domain name to continue. With express mode, deployments complete in seconds once configuration is applied, and propagation continues in the background. CloudFormation still processes resources in dependency order and handles dependent resource failures within the same stack. Express mode disables rollback by default, enabling immediate fix-and-retry without waiting for rollback operations. To get started, set --deployment-config '{{"mode": "EXPRESS"}}' when creating, updating, and deleting stacks or creating a change set through the AWS CLI, AWS SDKs, or the AWS Management Console. For AWS CDK users, activate express mode with cdk deploy --express. No template changes are required. Express mode works with all existing CloudFormation templates and nested stacks. This feature is available in all AWS Regions where CloudFormation is supported. Refer to the AWS Region table for service availability details.

AWS CloudFormation now runs pre-deployment validation automatically on Create Stack and Update Stack operations, catching common deployment errors before resource provisioning begins. This accelerates development velocity across all deployment workflows, from manual iteration to CI/CD pipelines to AI agents provisioning infrastructure. Previously, pre-deployment validation was available only during change set creation. With this release, the same validations now run automatically on Create Stack and Update Stack operations. Three new validation checks are also available as warnings during change set creation: service quota limits validation, AWS Config Recorder conflict detection, and ECR repository delete readiness validation. When validation detects an issue, users can view errors using the DescribeEvents API with the operation ID, or in the CloudFormation console by navigating to the stack's Events tab and clicking the operation ID. Each error includes the logical resource ID and property path, enabling users to pinpoint and fix problems before any resources are provisioned. In CDK, both cdk deploy and cdk validate display validation results with construct-level tracing in a unified report, allowing AI agents and automation tools to parse structured responses and self-correct immediately. Pre-deployment validation is enabled by default on all stack operations with no configuration required. Users can skip validation for a specific operation using the new DisableValidation parameter on CreateStack, UpdateStack and CreateChangeSet API calls, or the --disable-validation flag in the CLI. This feature is available in all AWS Regions where CloudFormation is supported, excluding China.

Amazon CloudWatch Logs now enriches log events with resource tags, making it easier to filter, search, and analyze logs by metadata that matters most to your organization, such as team ownership, environment, cost center, or application name, without requiring changes to your logging instrumentation. With tag enrichment, Amazon CloudWatch Logs adds resource tags directly to your log events at ingestion time. You can immediately use tags in log queries to scope your analysis without building custom pipelines or manually adding context to your application logs. For example, you can quickly filter all logs from production resources owned by a specific team, or filter by cost center during an incident investigation. Tag enrichment for logs is available in all commercial AWS Regions except Middle East (UAE), Middle East (Bahrain), and Israel (Tel Aviv). To get started, enable resource tags on telemetry in the Amazon CloudWatch Settings, or through the AWS Command Line Interface (AWS CLI), and AWS SDKs to use your existing AWS resource tags to enrich your log events. Tag enrichment is available at no additional cost.