AWS Updates: Aug 2026

AWS Elastic Beanstalk now automatically joins Windows Server instances in an environment to an Active Directory domain managed via AWS Directory Service. Previously, domain-joined Windows workloads required custom scripts to maintain. This feature joins all instances-including those launched later by auto scaling-to the domain at boot, before application deployment, with no custom scripts. Domain-joined instances can use Windows-integrated authentication, apply group policy, and access domain resources such as file shares and SQL Server databases. Instances are placed in an organizational unit for group policy targeting and receive predictable computer names derived from their instance IDs. The feature is resilient: if an instance cannot join the domain, deployment still completes and reports the issue, ensuring join failures never block deployment. This capability is available for Windows Server platform versions released on or after August 18, 2026, in all AWS Commercial Regions and AWS GovCloud (US) Regions where Elastic Beanstalk is offered.

Why it matters

This update affects users running Windows applications on AWS Elastic Beanstalk, simplifying the management of domain-joined Windows workloads on the platform.

AWS has introduced an AI-driven toolkit for Automated Security Response on AWS, enabling users to generate custom remediations with built-in safety measures using any AI assistant. The service now automatically addresses findings from Amazon Inspector, GuardDuty, and Macie. An enhanced web console allows centralized configuration of automated remediations by account, OU, region, and resource tags. Additionally, users can set up notifications for AWS Security Hub findings through multiple channels-including Email, Slack, Jira, and ServiceNow-with severity-based filtering and configurable deadlines.

Why it matters

This update benefits customers who require security automation. Automated Security Response on AWS helps streamline rapid responses to security events, and these enhancements make custom remediation easier and improve response efficiency.

AWS Secrets Manager has launched one-click installation for the AWS Workload Credentials Provider on Amazon Linux and Windows. This change simplifies setup, moving from a multi-step build process to a single command. AWCP retrieves secrets from AWS Secrets Manager and caches them locally, allowing applications to access secrets via a local HTTP endpoint. Pre-built, signed binaries for Amazon Linux 2023 and Windows Server are now available, providing a ready-to-run agent with in-memory secret caching. The feature is available in all regions where AWS Secrets Manager is offered, at no additional cost beyond standard Secrets Manager pricing

Why it matters

This update affects developers and deployment teams using AWS Workload Credentials Provider on Amazon EC2 instances. It simplifies the setup process, making security management easier

Amazon Kinesis Data Streams has introduced streaming tables, a new fully serverless capability that continuously delivers data from Kinesis streams to Amazon S3 Tables in Apache Iceberg format. Streaming tables remove the need to build and operate self-managed Iceberg delivery pipelines, cutting data delivery costs by up to 50 percent. Intelligent inline compaction addresses the small file problem, keeping query performance predictable and reducing downstream query costs by up to 30 percent. Kinesis Data Streams automatically handles scaling, retries, compaction, and delivery reliability, delivering data in minutes without custom applications, self-managed compute, or operational overhead. Customers can configure streaming tables in just a few clicks via the console or APIs. Streaming tables support On Demand Advantage and On Demand Standard capacity modes with usage-based pricing, no setup fees, and no minimum commitments. Users are charged only for successfully delivered data. Streaming tables are available in all AWS Regions where Amazon Kinesis Data Streams is offered, including AWS GovCloud (US) and China regions.

Why it matters

This update benefits users who need to deliver streaming data to Apache Iceberg tables for near real-time analytics and AI/ML feature pipelines. Amazon Kinesis Data Streams is a serverless streaming data service that simplifies capturing, processing, and storing data streams at any scale.

Amazon Kinesis Data Streams now sends streaming data straight to general-purpose Amazon S3 buckets. This removes the need to chain multiple serverless services or build custom consumer applications, cutting operational overhead and costs. The S3 general-purpose delivery uses usage-based pricing for On Demand Advantage and On Demand Standard modes, charging only for successfully delivered data. It is available in all regions where Kinesis Data Streams is offered.

Why it matters

This change affects users who need to send streaming data to S3, simplifying delivery pipelines and reducing cost and management burdens

Amazon EMR on EKS now provides concurrency control for job runs on virtual clusters within EKS. Users can set maximum concurrent job runs and maximum queued job runs, preventing cluster overload in shared multi-tenant environments. When limits are reached, StartJobRun returns an exception, allowing traffic redirection to other clusters. Existing workloads are unaffected until explicitly enabled.

Why it matters

This update affects users running EMR workloads on shared multi-tenant EKS clusters

The AWS Transform service is now covered under FedRAMP Class C (formerly Moderate baseline) in the US East (N. Virginia) Region. This allows users to migrate and modernize resources located in any US East or US West Region to meet FedRAMP Class C compliance. Additionally, AWS Transform MGN is in scope for FedRAMP Class D and can be used independently for migrating resources requiring FedRAMP Class D compliance.

Why it matters

This update affects users who need FedRAMP compliance for federal government cloud services. AWS Transform is a migration and modernization service designed to compress enterprise transformation timelines from years to months.

Amazon Bedrock AgentCore Memory now includes fine-grained access control (FGAC), allowing you to enforce per-user and per-tenant memory isolation through an AgentCore Gateway with OAuth (JWT) authentication and Cedar policies. This restricts access based on the authenticated user's identity, ensuring each user accesses only their own data, limiting records to namespaces from user token claims, and allowing or denying specific operations. It moves access control from application code to infrastructure using cryptographic identity proof.

Why it matters

This update benefits developers and enterprises needing enhanced security for shared memory data across multiple users or tenants

Amazon EC2 has begun offering C8gn instances in the Europe (Paris) region, powered by the latest-generation AWS Graviton4 processors. These instances deliver up to 30% better compute performance compared to Graviton3-based C7gn instances and feature the latest 6th generation AWS Nitro Cards, providing up to 600 Gbps of network bandwidth-the highest among network-optimized EC2 instances. C8gn instances support instance sizes up to 48xlarge, with up to 384 GiB of memory and up to 120 Gbps of bandwidth to Amazon EBS. They also support Elastic Fabric Adapter (EFA) networking on 16xlarge, 24xlarge, 48xlarge, metal-24xl, and metal-48xl sizes, enabling lower latency and improved cluster performance for tightly coupled workloads.

Why it matters

This update impacts users requiring high-performance computing for network-intensive workloads and AI/ML inference

Amazon Aurora MySQL-Compatible Edition 3 now supports MySQL 8.0.45, incorporating community fixes and Aurora-specific enhancements. Minor version upgrades can be applied automatically during scheduled maintenance windows, with AWS Organizations Upgrade Rollout Policy enabling phased upgrades across clusters. Upgrades can be performed in-place or via snapshot restore. This release is available in all AWS Regions where Aurora MySQL is offered.

Why it matters

This update affects users running MySQL databases, enhancing functionality and compatibility for those using Aurora MySQL.

Amazon EC2 P6-B300 instances are now available in the Asia Pacific (Hyderabad) and South America (Sao Paulo) Regions. These instances feature 8xNVIDIA Blackwell Ultra GPUs, 2.1 TB of high bandwidth GPU memory, 6.4 Tbps EFA networking, 300 Gbps dedicated ENA throughput, and 4 TB of system memory. Compared to P6-B200 instances, P6-B300 offers twice the networking bandwidth, 1.5 times the GPU memory size, and 1.5 times the GPU TFLOPS (at FP4, without sparsity), making them well-suited for training and deploying large trillion-parameter foundation models and large language models efficiently.

Why it matters

This update impacts users who require AI model training and deployment, offering high-performance computing suitable for applications needing large computational resources and high-bandwidth networking.

AWS Backup now supports copying Amazon FSx for NetApp ONTAP backups to different AWS Regions or accounts. This feature helps meet cross-Region disaster recovery and business continuity goals while protecting backups from accidental deletion, operational errors, or account compromise. AWS Backup centrally manages these copies and allows automation across an organization using AWS Organizations. The capability is available in all commercial AWS Regions where both Amazon FSx for NetApp ONTAP and AWS Backup are offered.

Why it matters

This update benefits organizations seeking data protection and disaster recovery, especially those needing data availability across multiple Regions and accounts

Amazon Bedrock AgentCore is now available in two new AWS regions: US West (N. California) and Asia Pacific (Hyderabad). This platform allows engineers to build, connect, and optimize agents quickly, using any framework and model, while ensuring security at the infrastructure level. With this expansion, customers can run agents closer to their users, reducing latency. Features such as agent runtime, identity and access control, policy management, session persistence, tool connectivity, evaluations, and observability are available in these regions at launch.

Why it matters

Amazon Bedrock AgentCore is a platform for building, connecting, and optimizing agents; this update enables users to run agents with lower latency.

Amazon EC2 X8i instances are now available in the Europe (Milan) and Europe (Spain) regions. Powered by custom Intel Xeon 6 processors exclusive to AWS, these instances deliver up to 43% higher performance, 1.5x more memory capacity (up to 6TB), and 3.3x more memory bandwidth compared to previous generation X2i instances. Designed for memory-intensive workloads such as SAP HANA, large databases, data analytics, and EDA, X8i instances offer up to 50% higher SAPS performance, 47% faster PostgreSQL, 88% faster Memcached, and 46% faster AI inference. They come in 14 sizes from large to 96xlarge, including two bare metal options, and can be purchased via Savings Plans, On-Demand, or Spot instances.

Why it matters

High-performance instances for memory-intensive workloads, suitable for SAP HANA, large databases, data analytics, and more.

Amazon Redshift has integrated with the AWS Agent Toolkit, allowing AI agents such as Claude Code and Kiro to directly build, query, troubleshoot, and migrate Redshift data warehouses and data lakes. This integration uses the AWS MCP server for authenticated API execution and includes Redshift skills. These skills provide SQL syntax references, metadata discovery, data loading patterns, materialized view best practices, function and data type guidance, and extensions like Qualify, Pivot, and Super. They also guide end-to-end data warehouse migrations, covering discovery, schema and SQL conversion, data movement, validation, and performance comparison. The skills work with both provisioned clusters and Serverless workgroups, require no infrastructure changes, and are available at no extra charge in all regions where Amazon Redshift and the AWS MCP Server are offered. To get started, install the aws-data-analytics plugin in your agent, which includes the MCP Server configuration and Redshift skills. Agents with MCP Server access can also discover and load skills at runtime without pre-installation. For setup instructions, see the Agent Toolkit documentation or the Amazon Redshift skills documentation.

Why it matters

This update benefits data engineers and analysts who want to use AI agents to streamline Amazon Redshift management and operations. It enables automation and assistance in building, querying, and migrating data warehouses.

Amazon Redshift has increased the maximum record size for Amazon Kinesis Data Streams from 1MiB to 10MiB, aligning with Kinesis Data Streams' own limits. This allows users to stream larger payloads directly into Redshift without splitting records, simplifying ingestion pipelines and enabling new use cases for high-volume, large-record workloads. The feature is available in all commercial AWS regions where Amazon Redshift is offered.

Why it matters

This update benefits users handling streaming data processing and large-scale data analytics, particularly those leveraging direct streaming from Kinesis Data Streams to Redshift

The Muse-Glimmer-30B model from Meta is designed for autonomous agentic tasks with multi-step reasoning, tool use, and failure recovery, featuring a 131K+ context window and selectable reasoning strength. Qwen 3.8-27B from Alibaba excels in coding, multi-step agentic tasks, and multimodal understanding across text, images, and video, with a 262K context window (extendable to ~1M via YaRN scaling) and a score of 61.7 on SWE-bench Pro. Both models can be deployed on SageMaker JumpStart with just a few clicks.

Why it matters

AI developers can leverage these new foundation models available on SageMaker JumpStart to deploy high-performance AI solutions on AWS infrastructure

NVIDIA's Cosmos3-Edge, Cosmos3-Nano, and Cosmos3-Super models are now available on Amazon SageMaker JumpStart, expanding the portfolio of foundation models for AWS customers. These models form the Cosmos 3 family of open, frontier omnimodal world models designed for physical AI, enabling customers to build robots, autonomous vehicles, and vision AI systems that perceive, reason, plan, and act in the physical world. Cosmos3-Edge is optimized for on-device robot control, Cosmos3-Nano excels in physics-aware reasoning, and Cosmos3-Super provides high-fidelity simulation. All models can be deployed on SageMaker JumpStart with just a few clicks.

Why it matters

This update is relevant for developers and data scientists building physical AI applications. The new foundation models available on SageMaker JumpStart make it easier to develop robotics and autonomous systems.

Amazon Bedrock in AWS GovCloud (US) now includes SpaceXAI's Grok 4.6, the latest flagship model built for long-running agents and complex interactive and visual tasks. It features a 500k context window and configurable reasoning levels (low, medium, high, xhigh). The model runs on the bedrock-runtime endpoint, supporting Responses, Chat Completions, and Converse APIs, and can scale across AWS GovCloud (US) Regions with cross-Region inference routing. It is also available via the bedrock-mantle endpoint in AWS GovCloud (US-East).

Why it matters

This update affects developers and enterprises that require advanced AI models within the secure and compliant AWS GovCloud (US) environment

Amazon Elastic VMware Service (Amazon EVS) now supports the i7i.metal-48xl Amazon EC2 bare-metal instance type. Powered by 5th generation Intel Xeon Scalable processors, i7i instances deliver up to 23% better compute performance and more than 10% better price performance compared to i4i instances. The i7i.metal-48xl's larger memory and storage capacity enables running more VMs, reducing the need for additional EVS hosts and leveraging the latest VMware Cloud Foundation 9.x features.

Why it matters

This update affects users running VMware-based workloads on AWS, providing access to higher-performance computing resources within Amazon EVS environments.

Amazon FSx for NetApp ONTAP, a fully managed shared storage service based on NetApp's ONTAP file system, now allows copying backups not only within the same Region and account but also across different Regions and trusted accounts within an AWS organization. This feature provides an additional layer of data protection by storing secondary backup copies in a separate Region or account, simplifying compliance with business continuity, data protection, and regulatory requirements. Amazon FSx offers secure, highly durable, and incremental backups to meet data retention, archival, and compliance needs, with backups stored redundantly across multiple Availability Zones in the same Region as the file system.

Why it matters

This update benefits enterprises requiring data protection and business continuity, especially those looking to enhance their backup strategies

Amazon Connect Customer now automatically updates scheduling metrics on the scheduling page, giving managers immediate visibility into the impact of schedule changes. For example, adding a team meeting for ten agents from 10 AM to 11 AM automatically updates metrics such as net available headcount and projected service level. This enables workforce managers to make faster, more informed decisions throughout the day by seeing how schedule adjustments affect staffing coverage.

Why it matters

This update is particularly useful for schedule managers and HR leaders seeking to optimize staff scheduling

Amazon Connect Customer now supports generative AI-powered summaries, real-time call analytics, and real-time rules in the Africa (Cape Town) Region. These capabilities extend post-contact conversational analytics, providing companies with AI-driven insights to enhance customer experience, agent performance, and operational efficiency. Generative AI-powered summaries deliver concise, AI-generated summaries of customer interactions immediately after a contact ends, eliminating manual note-taking and reducing post-contact work. Real-time call analytics enable live transcription, allowing supervisors to monitor interactions as they occur and intervene when necessary. Real-time rules automatically categorize contacts and alert supervisors based on keywords, sentiment, and other criteria detected during live interactions, enabling immediate actions such as sending notifications or generating tasks.

Why it matters

This update is relevant for companies using customer service platforms, especially those operating in the Africa (Cape Town) Region. Amazon Connect Customer provides tools to analyze customer interactions and identify areas for improvement.

AWS Elastic Disaster Recovery (AWS DRS) has introduced Recovery Plans, enabling automated sequential startup of multi-server applications during recovery and drills. Users can define a recovery sequence once and execute it with a single action when needed. This groups servers into steps with configurable wait times, ensuring predictable and consistent application recovery. Non-disruptive drill mode allows procedure validation, approval steps can be added, and real-time progress monitoring is supported. The automation reduces recovery time and eliminates common errors from manual server launch coordination during high-stress disaster scenarios. Recovery Plans are available in all AWS Regions where AWS DRS is offered, at no additional cost beyond standard DRS usage.

Why it matters

This update benefits users managing applications composed of databases and application tiers, adding recovery automation to AWS DRS and streamlining disaster recovery processes.

AWS Glue 5.1 is now available in the AWS European Sovereign Cloud region. This version upgrades the core engine to Apache Spark 3.5.6, Python 3.11 and Scala 2.12.18, enhancing performance and security. Support for open table format libraries such as Apache Hudi 1.0.2, Apache Iceberg 1.10.0 and Delta Lake 3.3.2 has also been updated. Additionally, Apache Iceberg format version 3.0 support has been added, including new features like default column values and delete vectors. Fine-grained access control from AWS Lake Formation has been extended to write operations (DML and DDL) for Spark DataFrames and Spark SQL. Full table access control for Apache Hudi and Delta Lake tables has also been added, expanding data security options.

Why it matters

AWS Glue is a serverless, scalable data integration service that simplifies discovering, preparing, moving, and integrating data from multiple sources. This update enhances performance and security, improving data management and integration capabilities.

Amazon Aurora DSQL is a serverless, distributed SQL database with PostgreSQL compatibility and active-active multi-Region availability. It now supports adding foreign key constraints to both new and existing tables. Users can define application rules, such as ensuring a customer's primary address references an existing row in the address table. Aurora DSQL will then reject any write that would leave the customer pointing to an address that no longer exists. When a referenced row is deleted or updated, users can choose from options including NO ACTION, RESTRICT, CASCADE, SET NULL, and SET DEFAULT. This feature is available in all AWS Regions where Aurora DSQL is offered.

Why it matters

This update is useful for database users who need to ensure data integrity. Aurora DSQL provides a globally deployable relational database.

Amazon Cognito introduces a new admin API operation that allows administrators to reset a user's time-based one-time password (TOTP) multi-factor authentication (MFA) configuration. This enables users to enroll a new device during their next sign-in if they lose access to their TOTP device, eliminating the need to recreate accounts for recovery while maintaining MFA enforcement. The feature is available in all AWS regions where Amazon Cognito operates, accessible via the AdminDeleteSoftwareToken API through AWS CLI, SDKs, or APIs. See the developer guide for instructions.

Why it matters

This update provides a recovery method for users who lose access to their TOTP device, balancing security with usability

Amazon Connect Customer now supports point-based scoring for performance evaluations, allowing managers to assign points to each criterion based on its business importance. The total points earned determine the score, unlike percentage-based scoring where question weights must sum to 100%. For example, resolving a customer issue might be worth 40 points, meeting compliance requirements 20 points, and proper greetings 10 points-without needing scores to total 100%. Managers can control point allocation by combining compliance criteria into single questions, excluding call reasons from scoring, or awarding bonus points for strong customer rapport. This feature is available in all regions where Amazon Connect Customer is offered.

Why it matters

This update is relevant for managers and evaluators using Amazon Connect Customer, enhancing flexibility in the evaluation process to better reflect business priorities.

Mountpoint for Amazon S3 introduces memory usage controls, allowing users to set limits either automatically based on the environment or manually. This enables Mountpoint to run alongside memory-intensive applications, such as machine learning training or analytics workloads that share a memory budget. Previously, Mountpoint's memory usage could grow over time based on usage patterns, potentially causing performance or stability issues when competing with other memory-intensive applications. With this update, users can define a memory target for Mountpoint to reserve memory for their applications, or Mountpoint can automatically determine a safe default based on the environment. For example, in Amazon EKS, Mountpoint can detect a container's assigned memory budget and slow down operations under memory pressure to stay within that budget. Mountpoint is available in all AWS Regions; visit the Mountpoint GitHub repository to upgrade to the latest version.

Why it matters

This update benefits users who need to run Mountpoint in memory-constrained environments or those handling memory-intensive workloads like machine learning and analytics

Amazon Connect Customer now enables managers to input unplanned shrinkage directly into agent schedules, providing a more accurate view of staffing due to unscheduled absences such as late logins or unplanned sick leave. Managers can upload unplanned shrinkage assumptions into schedules and immediately see updated metrics like scheduled headcount, net staffing, and projected service levels-all adjusted for shrinkage. For example, if 10% of agents scheduled for 8 AM next Monday are expected to be unavailable due to late logins, the projected service level drops from 90% to 85%. This helps workforce managers proactively address staffing gaps from unplanned absences, improving schedule accuracy and service level maintenance. The feature is available in all AWS Regions where Amazon Connect Customer agent scheduling is offered.

Why it matters

This update affects users managing customer engagement platforms. Amazon Connect Customer is designed to efficiently manage customer interactions and improve operational accuracy, and this change enhances staffing schedule precision.

AWS Backup now allows copying Amazon DocumentDB backups across AWS Regions and storing them in logically air-gapped vaults in nine additional Regions: Asia Pacific (Hong Kong, Jakarta, Melbourne, Osaka), Europe (Spain, Stockholm, Zurich), Africa (Cape Town), and Israel (Tel Aviv). This enables copying DocumentDB backups into and out of these Regions using backup plans or on-demand jobs, supporting disaster recovery, business continuity, and compliance. Backups can also be stored in immutable, isolated vaults that are locked by default and encrypted with AWS-owned or customer-managed keys. Vaults can be shared for recovery using AWS Resource Access Manager (RAM), and access is protected during account compromise with multi-party approval.

Why it matters

This update benefits users who need to enhance their database backup strategies for disaster recovery and compliance requirements.

Starting today, you can add Amazon EC2 Capacity Blocks for ML and interruptible Capacity Reservations to Capacity Reservation Resource Groups. Previously, only On-Demand Capacity Reservations could be included. Now any type of Capacity Reservation can be added, simplifying EC2 instance launches across your entire reserved capacity portfolio. To use this, create a group, add any Capacity Reservation, and target it in your launch request. EC2 Fleet and Auto Scaling groups can also specify prioritization preferences across reservation types and configure automatic fallback to On-Demand capacity when no reserved capacity remains. There are no additional charges, and this feature is available in all AWS Regions where Capacity Blocks for ML and interruptible ODCRs are supported, excluding AWS GovCloud (US) and China Regions.

Why it matters

This change affects users who manage EC2 reserved capacity efficiently. It increases flexibility in Capacity Reservation Resource Groups, allowing unified management of Capacity Reservations for ML workloads and interruptible workloads.

Amazon EC2 R8id instances are now available in Asia Pacific (Mumbai, Malaysia, Sydney), Canada (Central), and Europe (Ireland, Stockholm). These instances feature up to 22.8TB of NVMe SSD local storage and three times more memory bandwidth than R6id, delivering up to 43% higher performance. They are ideal for memory-intensive workloads such as in-memory databases, real-time big data analytics, large in-memory caches, and data processing applications. Customers can adjust network and Amazon EBS bandwidth by 25% using EC2 instance bandwidth weighting configuration. The 24xlarge, 48xlarge, metal-24xl, and metal-48xl sizes support Elastic Fabric Adapter (EFA) networking. These instances can be purchased through Savings Plans, On-Demand, and Spot instances.

Why it matters

This update announces the expansion of Amazon EC2 R8id instances to additional regions, providing high-performance computing and storage resources for memory-intensive workloads, impacting applications such as data processing and analytics

AWS Lambda MicroVMs now supports AWS PrivateLink, allowing private connectivity directly from Amazon Virtual Private Cloud (VPC) resources. This ensures that traffic does not travel over the public internet when interacting with Lambda MicroVMs, which is particularly useful for regulated industries such as financial services, healthcare, and government that require strict network isolation. Developers and IT teams can create PrivateLink VPC Endpoints within their VPC to access MicroVM APIs-for example, to create MicroVM images or launch MicroVMs-and to connect to each MicroVM's HTTP endpoint. This feature can be enabled using the AWS Management Console, AWS CLI, AWS CloudFormation, or AWS SDKs, and is available in all regions where Lambda MicroVMs is offered.

Why it matters

This update is significant for developers and IT teams using Lambda MicroVMs, especially in regulated industries that require strict network isolation for security and compliance.

AWS Batch now includes Amazon ECS Managed Instances (ECS MI) as a new compute option, allowing users to run GPU-accelerated and compute-intensive batch workloads on infrastructure managed by AWS. With this feature, users can access GPU-accelerated instances while AWS automatically handles AMI updates, security patching, and instance lifecycle management, eliminating the operational overhead of managing Amazon EC2 infrastructure. AWS Batch on ECS Managed Instances is available in all regions where AWS Batch is offered.

Why it matters

This update affects users who need to run GPU-accelerated and compute-intensive batch workloads. Amazon ECS Managed Instances are provided as a new compute option for AWS Batch, reducing operational overhead.

Amazon EC2 C8id and M8id instances are now available in additional regions, featuring up to 22.8 TB of local NVMe-based SSD storage. C8id instances are available in Asia Pacific (Sydney) and Canada (Central), while M8id instances are available in Asia Pacific (Mumbai) and Canada (Central). These instances provide three times more vCPUs, memory, and local storage compared to previous sixth-generation instances, with up to 43% higher compute performance and 3.3 times more memory bandwidth. They also deliver up to 46% higher performance for I/O-intensive database workloads and up to 30% faster query results for I/O-intensive real-time data analytics. C8id instances are ideal for compute-intensive tasks such as video encoding and image manipulation, while M8id instances suit workloads requiring a balance of compute and memory with high-speed local storage, like data logging and medium-sized data stores. Customers can adjust network and Amazon EBS bandwidth by 25% using EC2 instance bandwidth weighting configuration. These instances support Elastic Fabric Adapter networking on 24xlarge, 48xlarge, metal-24xl, and metal-48 sizes and can be purchased through Savings Plans, On-Demand, or Spot instances

Why it matters

These instances are designed for workloads requiring compute resources and high-speed local storage, particularly benefiting media processing and data analytics efficiency

Amazon Connect Customer now allows agents to change the customer profile associated with a case or select a profile after the case is opened. If a case is linked to the wrong customer, agents can update the profile to maintain accurate case histories. Additionally, agents can add a profile later when the customer is not identified at the time of case creation, such as for calls from shared phone numbers or issues requiring identity verification.

Why it matters

This update is particularly useful for customer support agents, improving the accuracy of case management.

Amazon RDS for PostgreSQL now includes the latest minor versions: 18.6, 17.11, 16.15, 15.19, and 14.24. This update enables users to address known vulnerabilities in earlier PostgreSQL releases and benefit from bug fixes and enhancements provided by the PostgreSQL community. Database upgrades can be performed during scheduled maintenance windows using automatic minor version upgrades. For large-scale environments, AWS Organizations' upgrade rollout policy helps manage phased upgrades, allowing validation in lower-priority environments before applying changes to critical systems. Additionally, Amazon RDS Blue/Green deployments can reduce downtime during minor version upgrades. For further details, refer to Upgrading the RDS for PostgreSQL DB Engine.

Why it matters

This update affects users running PostgreSQL databases on Amazon RDS who may want to apply security fixes and performance improvements.

AWS IoT Core now supports a new InfluxDB rule action that routes time-series data from IoT devices directly to InfluxDB databases. This action automatically converts time-series data from devices to InfluxDB's line protocol format and writes it to either an Amazon Timestream managed or a self-hosted InfluxDB cluster. It supports two batching modes-device-side batching, where devices send pre-batched payloads, and server-side batching, where the IoT rules engine aggregates messages before writing to InfluxDB. Users can connect their IoT devices to AWS IoT Core and define an InfluxDB rule action specifying the destination database along with authentication and batching parameters. This feature is available in all AWS Global Regions where Amazon Timestream for InfluxDB is offered

Why it matters

This update benefits developers and data engineers who need to collect and analyze time-series data from IoT devices. By supporting direct routing to InfluxDB, AWS IoT Core simplifies the construction of data pipelines

IAM Roles Anywhere provides a plugin for the AWS SDK for Java v2, enabling workloads running outside AWS to retrieve temporary AWS credentials directly within Java applications. The plugin runs in the same JVM as the application, eliminating the need to run the IAM Roles Anywhere credential helper in a separate process or configure credential_process in the AWS profile. Users can automatically resolve temporary credentials by configuring the plugin in the AWS SDK for Java v2 service client builder. The plugin calls CreateSession and automatically refreshes credentials before expiration. It supports RSA, elliptic curve (EC), and ML-DSA keys, requiring Java 8 or higher. Using this plugin incurs no additional charges. IAM Roles Anywhere is available in all AWS regions, including AWS GovCloud (US), AWS European Sovereign Cloud (Germany), and China regions.

Why it matters

IAM Roles Anywhere is a service that allows applications running outside AWS to securely access AWS resources. This update improves security and usability by enabling direct credential retrieval within Java applications.

Amazon RDS for Oracle now supports the July 2026 Release Update for Oracle Database versions 19c, 21c, and 26ai. This update includes security updates for Oracle database products. The naming format for updates in Oracle Database 19c changes to .ru-.mrp-.r. For example, the July 2026 quarterly update for Oracle Database 19c is named 19.0.0.0.ru-2026-07.mrp-2026-07.r1. Oracle Database 21c updates retain their existing naming format. You can apply the update via the Amazon RDS Management Console, AWS SDK, or CLI. Enable Automatic Minor Version Upgrade to apply updates automatically during your maintenance window. AWS Organizations upgrade rollout policy allows you to stagger updates across environments, validating in non-production before applying to production

Why it matters

This update is relevant for users of Amazon RDS for Oracle databases. As it includes security updates, users planning database upgrades are affected

Amazon Aurora PostgreSQL-Compatible Edition now includes PostgreSQL versions 18.4, 17.10, 16.14, 15.18, and 14.23. These releases incorporate bug fixes from the PostgreSQL community and Aurora-specific enhancements. Users are advised to upgrade to the latest minor versions to address known CVEs and benefit from these improvements. Databases can be upgraded during scheduled maintenance windows using automatic minor version upgrades. For large-scale operations, enable automatic minor version upgrades and use AWS Organizations Upgrade Rollout Policy to manage upgrades in phases, validating on lower-priority environments before applying changes to critical ones. For further details, refer to the documentation on upgrading Amazon Aurora PostgreSQL DB clusters.

Why it matters

This update affects users of Amazon Aurora PostgreSQL, enhancing database security and performance

AWS Glue now enables catalog federation for remote Iceberg REST catalogs in AWS GovCloud (US) regions. This feature allows secure, direct access to Iceberg tables stored in Amazon S3 and managed in remote catalogs using AWS analytics services. It synchronizes metadata in real time between AWS Glue Data Catalog and remote catalogs when querying tables, ensuring up-to-date results. Users can select the best price-performance options for analyzing remote Iceberg tables with preferred AWS analytics tools while maintaining consistent security controls. The feature supports various analytics engines including Amazon Redshift, Amazon EMR, Amazon Athena, AWS Glue, and third-party tools like Apache Spark. Access control is managed through AWS Lake Formation, providing fine-grained controls, cross-account sharing, and trusted identity propagation. Catalog federation is available via the Lake Formation console and AWS Glue and Lake Formation SDKs and APIs, and is generally available in the AWS GovCloud (US-East) and AWS GovCloud (US-West) regions.

Why it matters

This update impacts users performing data analysis in AWS GovCloud (US) regions. Direct access to remote Iceberg catalogs and real-time metadata synchronization enhance flexibility and efficiency in data analysis.

Amazon GameLift Servers now includes Enhanced DDoS Protection, which defends game servers against common network and transport layer DDoS attacks. This feature provides proactive, gaming-optimized traffic shaping to mitigate volumetric attacks at layers 3 and 4, such as UDP reflection and SYN floods. It builds on AWS Shield Standard's baseline protection and works alongside Player Gateway for advanced defense when enabled. Enhanced DDoS Protection is available at no extra cost in all supported regions except China (Beijing) and China (Ningxia), and applies to fleets using Amazon GameLift Servers SDK version 5.

Why it matters

This update is important for developers and operators hosting online or multiplayer games. Amazon GameLift Servers simplifies game server management, and this enhanced DDoS protection offers better defense against attacks on game servers.

Today, Amazon EC2 M8i and M8i-flex instances became available in the Canada West (Calgary) region. These instances use custom Intel Xeon 6 processors exclusive to AWS, delivering higher performance and faster memory bandwidth than comparable Intel processors in the cloud. The M8i and M8i-flex instances provide up to 15% better price-performance and 2.5x more memory bandwidth compared to previous Intel-based instances. They offer up to 20% better performance than M7i and M7i-flex instances, with even greater gains for specific workloads. M8i-flex instances are ideal for general-purpose workloads such as web and application servers, microservices, small to medium data stores, virtual desktops, and enterprise applications, offering sizes from large to 16xlarge. The SAP-certified M8i instances come in 13 sizes, including two bare metal options and a new 96xlarge size for the largest applications.

Why it matters

This update introduces new EC2 instance types for general-purpose computing workloads, particularly suitable for large applications and those requiring continuous high CPU utilization.

AWS Lambda has launched public preview of managed runtimes for Node.js 26 and Python 3.15. This enables customers and partners to test these versions before general availability and share feedback. During the preview, these runtimes may undergo breaking changes and are not covered by the Lambda SLA or AWS technical support. Functions using preview runtimes will automatically upgrade when the runtimes reach GA. To use them, select "Node.js 26 (Preview)" or "Python 3.15 (Preview)" in the Lambda console, or specify nodejs26.x or python3.15 in AWS CLI, CloudFormation, AWS SAM, or AWS CDK. These preview runtimes are available in all commercial regions, AWS GovCloud (US), and China regions at no additional cost.

Why it matters

This update is relevant for AWS Lambda users who want to test new runtime versions early, including those using deployment tools.

Amazon MSK Replicator now enables OAuth 2.0 (SASL/OAUTHBEARER) authentication for replicating data from external Apache Kafka clusters-including on-premises, self-managed on AWS, or other cloud providers-to Amazon MSK Provisioned clusters. This allows clusters using OAuth/OIDC authentication to migrate workloads to Amazon MSK, use MSK clusters for disaster recovery, and distribute data across hybrid and multi-cloud environments. MSK Replicator automates data replication between Kafka clusters, eliminating the need for custom infrastructure or open-source tools. In addition to previous SASL/SCRAM and mTLS support, it now allows OAuth 2.0 authentication. The service retains original topic names during replication and prevents infinite loops, while synchronizing consumer group offsets bidirectionally for flexible producer and consumer movement between clusters.

Why it matters

This update affects users needing data replication from external Kafka clusters to Amazon MSK. MSK Replicator automates replication between Kafka clusters, and this enhancement benefits those using OAuth 2.0 authentication.

Amazon ECS now continuously monitors agent connections across container instances. It detects disconnections caused by infrastructure problems such as EBS volume degradation, host thermal events, or network failures. For AWS Fargate and ECS managed instances, ECS automatically drains tasks and launches replacements while deregistering affected instances. Customers using ECS on EC2 can utilize these health change events to trigger instance replacement workflows. This capability is available at no extra cost in all AWS commercial and GovCloud (US) regions

Why it matters

Users of container management services can benefit from reduced workload failures and improved application availability without manual intervention

AWS Lambda now supports full Identity and Access Management (IAM) resource-based policies. This enables platform admins and security teams to define granular access permissions using the full capabilities of AWS IAM. Previously, Lambda functions required customers to add permissions individually per principal, offering limited flexibility. The new support includes the full range of IAM condition keys, providing broader policy capabilities and streamlining management for multi-account architectures. For example, you can now restrict access based on source IP or principal tags, and allow multiple services to invoke a function with a single policy. You can update resource-based policies using the JSON editor in the AWS Lambda console, AWS CLI, AWS SDK, or infrastructure as code tools such as AWS CloudFormation and AWS SAM. Full IAM resource-based policies are available in all AWS commercial regions at no additional charge.

Why it matters

This update is useful for platform admins and security teams who need more detailed management of Lambda function access permissions

AWS Secrets Manager now supports automatic rotation of Cisco Security Platform API keys and Netskope API tokens as managed external secrets. This allows users to rotate these third-party credentials directly from the AWS console without writing custom rotation code. For Cisco Security Platform, Secrets Manager rotates the API key's refresh token on a schedule, capturing new tokens issued by Cisco. For Netskope, it rotates RBACv3 service-account REST API tokens via Netskope's SCIM API and validates the new token before completion. Both integrations are self-authenticating, requiring no separate administrator credentials. These additions join existing support for other external services such as BigID, Confluent Cloud, and Salesforce.

Why it matters

This update is relevant for users of AWS Secrets Manager who manage API keys or tokens for Cisco Security Platform and Netskope. It expands AWS's secret management capabilities to include automatic rotation of third-party credentials

Amazon RDS for SQL Server now includes the latest Microsoft SQL Server cumulative updates, specifically version 2025 CU6 (KB5093421, RDS version 17.00.4055.5.v1). Users can apply these updates via the Amazon RDS Management Console, AWS SDK, or CLI. For details on changes and fixes, see Microsoft's KB5093421 documentation.

Why it matters

This update affects users running Microsoft SQL Server on Amazon RDS, allowing them to apply the latest engine patches for security and performance improvements

Amazon SageMaker HyperPod now enhances support for Ray with built-in observability, resilient training, accelerated inference, and managed development environments. Data scientists can create, edit, monitor, and delete Ray clusters from a web-based interface in Amazon SageMaker Studio, attaching JupyterLab, a code editor, or a local IDE to a running Ray cluster for interactive iteration. HyperPod provides Grafana dashboards with metrics in Amazon Managed Service for Prometheus and one-click access to the Ray Dashboard. For training, node auto-recovery and hung job detection handle GPU faults and job hangs, while tiered checkpointing and task governance optimize compute utilization. For inference with Ray Serve, a tiered KV cache reduces time to the first token, and SageMaker JumpStart models can be deployed directly. Open-source Ray code runs unchanged, and users can adopt the purpose-built experience in SageMaker Studio or integrate individual capabilities into their own ML platform.

Why it matters

This update aims to reduce operational burden when running Ray on Kubernetes and improve development efficiency and training reliability

Amazon EKS now allows up to 10 external OpenID Connect (OIDC) identity providers per cluster. This enables organizations to associate different identity providers for various user groups such as employees, contractors, and CI/CD systems directly with their cluster, eliminating the need to consolidate users into a single provider or run an intermediary broker. Each provider is configured and managed independently, allowing each group to authenticate through its own provider and identity mapping. Existing IAM authentication continues to work alongside all configured providers. Providers can be added using the AWS Management Console or the AssociateIdentityProviderConfig API via the AWS CLI and SDKs. This capability is available at no extra cost in all AWS Regions where Amazon EKS is offered.

Why it matters

This update affects Kubernetes users who need to integrate multiple identity providers with their clusters. It provides greater flexibility in authentication methods for Amazon EKS clusters.

SageMaker MLflow now allows customers to encrypt their data using customer-managed keys (CMK) through AWS Key Management Service (KMS). This enhancement helps organizations with strict security and compliance needs manage their own encryption keys, providing enhanced security control and comprehensive audit capabilities via AWS CloudTrail integration. Customer-managed keys must be created in the same AWS account and region as the MLflow app, and only symmetric AWS KMS keys are supported. The feature is generally available in all AWS Regions where the MLflow app is offered.

Why it matters

This update targets organizations with strict security and compliance requirements, offering enhanced control over data encryption.

OpenAI's GPT-5.6 Terra and Luna models are now generally available on Amazon Bedrock in AWS GovCloud (US-West) and AWS GovCloud (US-East). These models deliver high intelligence and efficiency, allowing users to solve complex problems faster. Terra offers balanced performance, while Luna provides fast, cost-effective inference. Both models support large context windows, enabling processing of extensive codebases and documents in a single request.

Why it matters

This update is important for developers and researchers using AI models for development and analysis, as it extends Amazon Bedrock's capabilities for advanced AI processing.

Amazon RDS for MySQL now supports the latest MySQL minor version, 8.4.11, which includes post-quantum TLS (PQ-TLS) key exchange for enhanced data-in-transit encryption. This update also provides fixes for CVEs in earlier versions, along with bug fixes, performance improvements, and new functionalities from the MySQL community. Users can utilize automatic minor version upgrades or Amazon RDS Managed Blue/Green Deployments for safer and simpler updates during scheduled maintenance windows.

Why it matters

This update affects users hosting MySQL databases on AWS, offering improved security and performance through the latest database version

AWS ParallelCluster 3.16 is now generally available with a new on-node diagnostics tool called pcluster-diag, which allows running diagnostic checks on any cluster node with a single command and provides a structured report to help identify issues. This release also enhances cluster stability during creation, updates, and image builds, and updates the software stack with newer versions of NVIDIA driver, CUDA, EFA installer, and Slurm.

Why it matters

This update is relevant for R&D users and IT administrators managing high-performance computing (HPC) clusters on AWS

Amazon Connect Customer now offers automatic information extraction from voice and chat interactions, capturing key data like account numbers, reservation IDs, and product names, as well as derived insights such as reason for contact, resolution provided, and next steps promised. Users can define conversational analytics rules to specify what to extract and when. Extraction works on raw contact content before redaction, allowing specific data points to be captured while still redacting sensitive values from recordings and transcripts. Agents see extracted values during After Contact Work, supervisors use them to search and review contacts, and developers can access them programmatically through APIs, Kinesis Data Streams, and S3 output files. Extracted values can also be fed directly into rule actions such as email notifications, task creation, and case creation, turning unstructured conversations into automated experiences.

Why it matters

This update is relevant for companies using customer service platforms, especially those looking to improve agent efficiency and data processing

Today, OpenAI lowered GPT-5.6 Sol API prices to $4 per million input tokens and $20 per million output tokens, a 20% input and 33.3% output reduction. This promotional pricing is valid until at least November 21, 2026, making scaling experiments, autonomous coding agents, complex multi-step analysis, and advanced research workflows easier. GPT-5.6 Sol delivers state-of-the-art results on agent coding benchmarks and becomes more accessible for heavy sustained workloads. Check AWS region pages for availability and Amazon Bedrock documentation for details and pricing.

Why it matters

This update impacts users engaged in AI development and advanced data processing. The lower pricing makes large-scale projects and experiments more feasible.

AWS Glue version 6.0 is now generally available, offering a 30% price reduction and full support for Apache Iceberg v3, newer versions of Apache Hudi and Delta Lake, along with runtime upgrades to Apache Spark 4.1, Python 3.13, and Scala 2.13. Iceberg v3 introduces the VARIANT data type with automatic shredding, deletion vectors for efficient row-level updates, geometry and geography data types, and flexible schema evolution. New features to improve developer productivity include Spark Declarative Pipelines, Real-Time Mode streaming for low-latency processing, and Arrow-native Python UDFs for enhanced PySpark performance. These enhancements support large-scale ETL, recurring batch workloads, streaming analytics, and AI application development. AWS Glue 6.0 is available across all AWS commercial regions, AWS GovCloud (US), and AWS China regions. Users can select Glue 6.0 from the version dropdown in the AWS Glue console or SageMaker Unified Studio, or migrate existing jobs using the Generative AI Upgrade Agent for Apache Spark.

Why it matters

This update is particularly relevant for data engineers and analytics developers who use AWS Glue for large-scale data processing and data lake management

The AWS Deadline Cloud Monitor application now displays progress, status, and health of automatic file downloads from jobs running in the cloud. A new "Download Status" column appears at both job and task levels, showing download progress and confirming when all output files are available on the drive. An indicator shows how current the status is, and if files are unavailable for any reason, the app provides clear guidance on next steps. This removes the need for manual drive verification and helps teams confirm output availability before downstream tasks begin, especially valuable in large-scale render pipelines.

Why it matters

Useful for teams running compute-intensive workloads in visual effects, animation, product design, simulation, and gaming

AWS Neuron 2.32.0 is now available, featuring NKI 0.6.0 with on-device top-K instructions, variable-length all-gather for differently sized tensors, and new loop constructs for data-dependent iteration. The update adds 13 new NKI Library kernels for MoE training and sparse attention, plus variable-size collectives for Trn2 and Trn3. The vLLM Neuron plugin has been updated to vLLM 0.24.0 and is included in all Neuron Deep Learning AMIs and containers.

Why it matters

This update impacts users of Trn2 and Trn3 instances, especially those training large transformer and MoE models

The Amazon EKS Capability for Argo CD now supports custom configuration through a standard argocd-cm ConfigMap in the cluster. This provides a fully managed GitOps continuous delivery experience that can be tuned to fit team workflows. Users can define custom health checks for Custom Resources, customize the Argo CD UI banner content, and adjust how the capability watches and compares managed resources. These settings are configured the same way as in upstream Argo CD, with AWS applying them to the managed capability. Custom health checks allow holding an Application at progressing until resources like databases are ready. Built-in health checks for AWS Controllers for Kubernetes (ACK) and kro resources ensure accurate health reporting without additional configuration. This capability can be configured in all AWS Regions where it is available.

Why it matters

This update affects developers and DevOps engineers using GitOps workflows with Argo CD on Amazon EKS, offering greater flexibility in customizing the Argo CD capability.

Amazon Connect Customer enables managers to chat with their data using natural language, receiving answers, evidence, and solutions in seconds. It analyzes over 150 metrics across self-service, agent performance, and queue performance to identify issues, explain causes, and recommend best actions. For example, managers can ask which queues are best candidates for automation, and the system returns a prioritized list with confidence scores and projected impact. This feature is available in all AWS Regions where Amazon Connect Customer AI Agents are supported.

Why it matters

This update provides Amazon Connect operations managers with streamlined data analysis and decision-making capabilities.

Amazon Redshift now integrates natively with Amazon S3 Tables to support long-term retention of system table data, exceeding the previous 7-day limit. This feature automatically writes system table data to S3 Tables in Apache Iceberg format, managing partitioning, compaction, and retention without additional development or operational overhead. For environments with multiple data warehouses, system table data is automatically replicated into a single location, enabling consolidated monitoring and analysis across warehouses. Stored in the open Apache Iceberg format, the data can be queried via Redshift, Amazon Athena, or any Iceberg-compatible engine, and used to build observability dashboards with AWS services or third-party tools. The AWS Agent Toolkit also offers skills to query system table data for performance insights and optimization recommendations. This capability is available for Amazon Redshift Provisioned RG and RA3 instances, as well as Amazon Redshift Serverless.

Why it matters

This update benefits users who need to retain system table data for longer periods to meet monitoring or compliance requirements in their data warehouses.

AWS partners can now use OAuth with AWS Sign-In to access Partner Central agents from tools like Amazon Quick and Kiro. This allows authorization using existing AWS identities, IAM permissions, and governance controls without installing extra authentication software. Partners can access agents for co-selling, funding applications, and Marketplace setup directly from their tools. Administrators can manage access with IAM policies, condition keys, token APIs, dynamic registration, and CloudTrail auditing. The feature is available in the US East (N. Virginia) Region.

Why it matters

This update targets AWS partners, providing a secure way to access Partner Central agents from existing development and management tools.

Amazon Bedrock AgentCore Memory now accepts JSON payloads through the CreateEvent API, allowing agents to extract long-term memories from structured data such as behavioral events, activity logs, and system events (up to 100 KB per payload) without reformatting them into synthetic conversations. The extraction pipeline treats JSON payloads like conversations, generating long-term memories across all four strategies: semantic, user preference, summarization, and episodic. This capability is available in all regions where AgentCore Memory is supported and works seamlessly with existing features. To begin, simply include JSON payloads in your events.

Why it matters

This update benefits developers who want to use structured data for long-term memory and AI agent developers. Amazon Bedrock AgentCore helps manage AI agent memory, and this feature simplifies extracting knowledge from non-conversational data.

Starting with patch P203, Amazon Redshift supports concurrency scaling for refreshes of streaming materialized views connected to Amazon Kinesis Data Streams. This enables low-latency, high-speed data ingestion from KDS to Redshift data warehouses, reducing data access time and storage costs. Users can configure streaming ingestion using SQL commands, with each refresh capable of ingesting hundreds of megabytes per second. With concurrency scaling enabled, streaming workloads automatically scale, freeing the main Redshift cluster or workgroup to run other higher-priority workloads. This capability is immediately available in all AWS regions where Amazon Redshift is offered, helping build resilient analytics applications with predictable service level agreements.

Why it matters

This update affects users of Amazon Redshift's streaming ingestion feature, particularly those handling large data streams for analytical workloads. Concurrency scaling improves resource utilization and performance.

AWS Direct Connect has announced inbound prefix controls, enabling users to allocate and manage inbound route-prefix allocations for private and transit virtual interfaces (VIFs) based on workload needs. Previously, Direct Connect VIFs could accept a maximum of 100 route prefixes advertised from on-premises networks. With inbound prefix controls, users can now allocate up to 1,000 prefixes per VIF and advertise routes directly. This feature introduces new prefix capacity pools at both the dedicated connection and Direct Connect gateway levels, allowing precise capacity allocation per workload. Connection pool sizes scale with connection speed, and LAG pools scale with the number of member connections. Prefix allocations can be configured via the AWS Direct Connect console or CLI/API, and are available at no additional cost in all regions where AWS Direct Connect is offered.

Why it matters

This update is particularly useful for users with large or growing networks that rely on AWS Direct Connect, as it removes previous route prefix limitations and enables more flexible routing configurations.

AWS has announced the general availability of a new AWS Local Zone in Las Vegas, Nevada. This Local Zone supports Amazon EC2 C7i, M7i, R7i, and C8gn instances, Amazon EBS volume types gp3, gp2, io1, sc1, and st1, Amazon ECS, Amazon EKS, Application Load Balancer, and AWS Direct Connect. AWS Local Zones extend core services such as compute, storage, and networking closer to metropolitan areas worldwide, enabling single-digit millisecond latency for end-user workloads, meeting data residency requirements, supporting AI/ML inference workloads, and accelerating migration and modernization of legacy applications to the cloud, all while maintaining consistent AWS APIs, tools, and services as AWS Regions.

Why it matters

AWS Local Zones deploy infrastructure closer to urban areas, providing faster performance and data residency

Amazon EC2 P6-B300 instances are now available in the Asia Pacific (Seoul) Region. These instances feature 8xNVIDIA Blackwell Ultra GPUs with 2.1 TB of high-bandwidth GPU memory, 6.4 Tbps EFA networking, 300 Gbps dedicated ENA throughput, and 4 TB of system memory. Compared to P6-B200 instances, P6-B300 offers twice the networking bandwidth, 1.5 times the GPU memory size, and 1.5 times the GPU TFLOPS (at FP4, without sparsity), making them well-suited for training and deploying large trillion-parameter foundation models and large language models. P6-B300 instances are available in p6-b300.48xlarge size in US West (Oregon), AWS GovCloud (US-East), US East (N. Virginia), and Asia Pacific (Seoul) Regions.

Why it matters

This update impacts users who require high-performance GPU resources for training and deploying AI models

Amazon SES now supports overriding open and click tracking settings directly within the SendEmail and SendBulkEmail APIs. This allows senders to enable or disable tracking on a per-request basis, rather than managing preferences through separate configuration sets. The overrides apply to each request and take precedence over settings defined in configuration sets, providing granular control without altering existing configurations. This feature is particularly useful for complying with data protection regulations like GDPR and CNIL by honoring per-recipient consent choices. There is no additional cost for using this capability, and it is available in all AWS Regions where Amazon SES is offered.

Why it matters

This update benefits users who need to apply recipient-specific tracking consent during email sends. Amazon SES is a service for managing email delivery and tracking, and this change simplifies configuration management and enhances compliance.

Starting today, Amazon CloudFront supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points (MRAP), allowing only designated CloudFront distributions to access origins. Previously, customers had to compute and forward Asymmetric Signature Version 4 (SigV4a) Authorization headers using custom Lambda@Edge functions. Now, CloudFront natively signs requests to S3 MRAP origins, providing faster cache-miss fills from the nearest region and secured MRAP access without custom header computation. This feature is available worldwide except in the China region, with no additional fees.

Why it matters

Developers and deployment managers seeking improved cache performance and security for globally distributed content delivery are the primary audience

Amazon EC2 now offers C8gd, M8gd, and R8gd instances in Singapore, Mexico Central, and Zurich regions. Powered by AWS Graviton4 processors, these instances deliver up to 30% better performance than Graviton3-based instances, with up to 40% higher performance for I/O-intensive database workloads and up to 20% faster query results for real-time analytics. Built on the AWS Nitro System, they provide access to high-speed, low-latency local NVMe-based SSD storage. Available in 12 sizes, they support up to 50 Gbps network bandwidth and 40 Gbps to Amazon EBS, with an option to adjust bandwidth by 25% using EC2 instance bandwidth weighting. C8gd suits compute-intensive tasks, M8gd balanced workloads, and R8gd memory-intensive applications.

Why it matters

New Graviton4-powered EC2 instances are now available in additional regions, offering improved performance and I/O efficiency for database and analytics workloads.

Amazon Aurora DSQL now includes a new Amazon CloudWatch Database Insights metric that provides per-statement, cluster-level performance monitoring. It captures sampled wait states and normalized SQL statements for all active cluster sessions, allowing users to diagnose performance issues and identify queries that consume the most resources. The metric is captured at one-minute intervals and is available by default at no additional cost. This feature is available in all AWS Regions where Aurora DSQL is offered.

Why it matters

This update is relevant for developers and database administrators who need to monitor and optimize database performance. Users of Aurora DSQL can now analyze cluster performance in more detail.

Amazon SageMaker AI now provides Generative AI Inference Recommendations within SageMaker AI Studio, offering customers a guided path to optimal inference configurations. Users specify their workload and priorities-such as latency, throughput, or cost-and SageMaker AI benchmarks various setups on real GPU hardware, applying techniques like speculative decoding or kernel tuning. It returns ranked, production-ready recommendations with performance metrics, enabling teams to achieve validated configurations in hours rather than weeks. The feature is available through a visual interface in SageMaker AI Studio, with no additional cost for generating recommendations.

Why it matters

This update benefits developers and data scientists deploying generative AI models, extending SageMaker's capabilities with more intuitive inference optimization tools.

The Amazon RDS Switchover Read Replica execution block has been added to ARC Region switch, automating recovery orchestration for Amazon RDS databases running Oracle Data Guard in multi-Region workloads. Previously, customers had to manually reverse the roles of the primary database and its read replica or promote a read replica to a primary database instance during a Regional failover. Region switch now automates this recovery process, enabling zero data loss role transitions between the primary database and read replica during planned failovers, or promoting the read replica to a primary database during unplanned failovers where speed is critical. With native cross-account support, you can orchestrate recovery of Amazon RDS instances hosted in a different account from your Region switch plan, enabling centralized management of recovery across your organization.

Why it matters

This update is relevant for customers who need to automate failover of multi-Region applications during regional impairments. ARC Region switch helps customers orchestrate failover to achieve bounded recovery time in case of regional failures.

Amazon EKS now supports certificate authority (CA) rotation with automated lifecycle management and safeguards. Clusters created since 2018 have CAs with a 10-year validity period and are approaching the point where rotation is needed. Amazon EKS manages the rotation lifecycle and automatically updates AWS-managed components to trust the new CA. Customers are responsible for replacing worker nodes and updating external clients to trust the new CA before activation. EKS Auto Mode and AWS Fargate nodes are updated automatically, but customers must still update any external clients connecting to the cluster's API server. Automated safeguards include advance notifications before CA expiration, automatic addition of a successor CA if not created by the customer, and automatic activation if the customer does not activate on schedule. A rollback capability allows reverting to the previous CA to resolve any issues during the transition. CA rotation is available at no additional cost in all commercial AWS Regions, accessible via AWS CLI, EKS APIs, CloudFormation, and the AWS console

Why it matters

This update affects all Amazon EKS users, particularly those needing to ensure cluster security and continuous operation

Amazon Timestream for InfluxDB now allows the use of customer managed keys from AWS KMS to encrypt data at rest for InfluxDB 2 database instances, InfluxDB 2 read replicas, and InfluxDB 3 clusters. Customers choose a symmetric key during resource creation, which cannot be changed afterward. This feature is available through the console, CLI, and API with no additional charges beyond standard KMS costs.

Why it matters

This update targets users running InfluxDB databases, offering enhanced security through improved data encryption options.

AWS IAM has raised the default quota for managed policies per role from 10 to 20. This change reduces the need for service quota requests when following IAM best practices, such as separating permissions into purpose-specific policies, or when onboarding to AWS Partner products that require attaching additional managed policies. If more than 20 managed policies per role are needed, a quota increase up to 25 can be requested using Service Quotas. The update applies automatically to all IAM roles across all commercial AWS Regions, AWS GovCloud (US), and China Regions with no action required.

Why it matters

This change affects users managing IAM policies, particularly those needing to attach multiple policies to roles.

AWS Marketplace has introduced support for launching selected Amazon Machine Images (AMIs) on Amazon Lightsail. This enables customers to deploy eligible AWS Marketplace AMIs on Lightsail with just a few clicks, benefiting from predictable pricing and simplified instance setup. Lightsail instance bundles include compute, storage, and generous data transfer at a fixed monthly price, along with managed databases, containers, and load balancers. When subscribing to supported products such as Microsoft Windows Server, Microsoft SQL Server Express, Ubuntu, cPanel & WHM, and Plesk, customers can now choose Amazon Lightsail alongside Amazon EC2. Selecting Lightsail redirects users to the Lightsail console with the chosen AMI and region pre-configured, allowing deployment at a fixed monthly cost in minutes. The 'Launch on Lightsail' option is available for eligible products across all regions where Lightsail is offered.

Why it matters

This update is particularly useful for users seeking simple pricing and management. Lightsail provides a suitable hosting solution for small to medium-sized applications.

Amazon DynamoDB Streams now supports attribute-based access control (ABAC), allowing the use of tag-based conditions in IAM policies. This approach simplifies access management by enabling different access levels for multiple teams and applications with fewer IAM policies. Users can attach up to 50 tags per stream and use these in IAM policy conditions to allow or deny specific actions-for example, permitting read access only to streams tagged with "environment:production". Stream tags are managed separately from parent table tags, providing flexibility for environment segregation and compliance without creating numerous individual IAM policies. ABAC is available in all commercial AWS Regions and AWS GovCloud (US) Regions where DynamoDB Streams is offered, at no additional cost.

Why it matters

DynamoDB Streams captures table activity in streams. This update enhances access control capabilities for more granular management.

Amazon Quick now includes a deny-by-default setting for custom permissions. This governance feature allows administrators to restrict AI capability categories within a custom permissions profile and assign it to users, roles, or the entire account. Quick then automatically denies any new AI capability at launch for those users. Restricting a category also restricts existing capabilities within it. Administrators must explicitly allow each capability when ready. The restriction applies only to the configured profile. Configure deny-by-default in Manage account in Amazon Quick or via the AWS CLI. This feature is available in all AWS Regions where Amazon Quick is offered.

Why it matters

This update targets administrators who need tighter control over AI capability access. It prevents users from immediately accessing new AI features in Amazon Quick, allowing administrators to grant access when ready

AWS has introduced a fourth Availability Zone in the Europe (London) Region (eu-west-2), expanding infrastructure capacity to meet growing demand for cloud computing. This new zone offers next-generation AI and ML capabilities, including Amazon EC2, Trn3, and P6 accelerated instances, alongside general-purpose compute. With eu-west-2d, customers can distribute applications across four zones in eu-west-2, improving fault tolerance and supporting high-availability designs. AI and ML teams can now run training and inference workloads on the latest accelerated instance types entirely within the London Region. The new zone is accessible via the AWS Management Console, APIs, and existing workflows without tooling changes, with standard Europe (London) Region pricing applying.

Why it matters

This update is relevant to customers seeking expanded cloud infrastructure capacity and improved processing power for AI and ML workloads, along with enhanced high availability

AWS Elemental MediaConnect Router now enables customers to configure latency settings for connections between inputs and outputs within the router. Previously, the service automatically set internal protocol latency. The update introduces two configuration options: balanced mode for general use and low-latency mode for latency-sensitive workflows. Each router output can be set independently, allowing the same input to feed multiple outputs with different latency requirements. A new CloudWatch metric, RouteFabricRecoveryLatency, shows the configured recovery latency for each route. Customers can configure and view these settings using the MediaConnect API, AWS Management Console, or AWS CLI. This feature is available in all regions where MediaConnect Router is currently deployed.

Why it matters

This update is relevant for customers using AWS Elemental MediaConnect Router for real-time video delivery or latency-sensitive workflows. Controlling internal router latency improves performance and reliability.

Amazon CloudWatch pipelines now includes three new processors that parse and enrich log data as it's ingested: an Amazon RDS log parser, an XML parser, and a GeoIP enrichment processor. These processors help address common log data challenges: RDS Aurora logs arrive in their native engine format, application logs contain embedded XML, and IP addresses lack location context. The RDS processor parses Aurora audit and error logs into structured fields, the XML parser converts XML strings into JSON, and the GeoIP processor adds geographic context (city, country, coordinates) to IP addresses. These processors can be used independently or combined in a single pipeline, with no additional cost beyond standard CloudWatch logs ingestion and storage rates. They are available in all regions where CloudWatch pipelines are generally available.

Why it matters

This update benefits developers and DevOps engineers who need to automate log data parsing and analysis. It enhances CloudWatch pipelines capabilities, simplifying complex log processing tasks.

Amazon EC2 now supports creating Amazon Machine Images (AMIs) using local snapshots from instances on AWS Outposts. This allows customers to store snapshots either on the Outpost itself or in the parent AWS Region. When keeping data local, EC2 automatically determines the target Outpost based on the instance's location, eliminating the need to manually specify an Outpost ARN. The feature integrates AMI creation into existing backup and lifecycle workflows for Outposts instances, ensuring compliance with data residency requirements. It is available in all AWS Regions where AWS Outposts supports local snapshot storage.

Why it matters

This update affects users who need to meet data residency requirements for instances running on AWS Outposts. It allows control over where snapshots are stored when creating AMIs from instances on Outposts.

Amazon Bedrock's Web Search now supports an external_web_access parameter that allows retrieval of content directly from the public web. To enable this, grant the bedrock-websearch:ExternalWebAccess IAM permission to the request identity and leave the parameter at its default value of true. This enables live fetching of content from the public web for use cases requiring the freshest information, such as sports scores, live pricing, or newly released documentation. For sensitive data, setting external_web_access to false keeps retrieval entirely within AWS, using only Amazon's in-AWS web index and knowledge graph with no data egress. This feature is currently available in US East (N. Virginia), US East (Ohio), and US West (Oregon) regions.

Why it matters

Amazon Bedrock provides capabilities for grounding foundation models with current information. The expansion of Web Search allows developers to directly access public web content

AWS Marketplace partners can now configure category-based notifications and multi-channel delivery through AWS User Notifications. Previously, notifications were sent only to the account's root email address. This update allows partners to choose which contacts receive each notification category and how they are delivered. Four categories are available: product listings, offers and agreements, payments and disbursements, and account management. By default, notifications are emailed to the root address, but partners can add recipients via additional emails, distribution lists, the AWS Console Mobile Application, or chat apps like Slack and Microsoft Teams. After enabling managed notifications, partners can select contacts and delivery channels for each category. This feature is available in all AWS commercial regions where AWS Marketplace is offered

Why it matters

Enhances notification management for AWS Marketplace partners, enabling more efficient delivery and team-based handling

AWS Lambda MicroVMs is now available in five new regions: Asia Pacific (Mumbai), Asia Pacific (Singapore), Asia Pacific (Sydney), Europe (Frankfurt), and Europe (Stockholm), bringing the total to ten regions. MicroVMs provide VM-level isolation, near-instant launch and resume speeds, and state preservation for executing user or AI-generated code. Developers can assign each user or job its own isolated compute environment without managing virtualization infrastructure. MicroVMs support secure, stateful, and responsive code execution for applications such as AI coding assistants, interactive development environments, and vulnerability scanners. Users can create a MicroVM image from a Dockerfile and launch MicroVMs from that image, with each instance receiving a dedicated HTTPS URL supporting protocols like HTTP/2, gRPC, and WebSockets. MicroVMs can be accessed via the AWS Lambda console, AWS CloudFormation, AWS Cloud Development Kit, or Agentic development tools using the Agent Toolkit for AWS.

Why it matters

Lambda MicroVMs benefits developers needing isolated, fast execution environments, particularly for AI assistants and interactive development setups.

Today, Amazon OpenSearch Ingestion becomes available in AWS GovCloud (US-East) and AWS GovCloud (US-West) regions. This fully managed service ingests and processes data before indexing into Amazon OpenSearch Service clusters or serverless collections. It provides a no-code experience for filtering, transforming, redacting, and routing data, automatically provisioning and scaling resources to meet fluctuating workload demands.

Why it matters

This update impacts users who operate OpenSearch Service in regulated environments. It enables secure and efficient data ingestion and processing within these environments using OpenSearch Ingestion

AWS Cost Anomaly Detection now monitors spending on third-party foundation models executed on Amazon Bedrock, including Anthropic Claude and other provider-hosted models. This enhancement enables teams running production generative AI workloads to receive automatic anomaly detection for their Amazon Bedrock model spend alongside other AWS costs. The service automatically evaluates these costs through AWS managed service monitoring with no setup needed. When unexpected spend changes occur, users receive alerts with a root-cause breakdown ranked by dollar impact across AWS services, accounts, regions, and usage types. This feature is available in all AWS commercial regions except AWS GovCloud and China regions.

Why it matters

This update affects users running generative AI workloads. AWS Cost Anomaly Detection is a machine learning-based service for cost management and budget monitoring, and this enhancement now allows monitoring of third-party models on Amazon Bedrock

Amazon SageMaker notebooks now support Trusted Identity Propagation (TIP) with Amazon Athena, Amazon Redshift, and Amazon EMR Serverless. This allows each notebook user’s IAM Identity Center identity to flow through to AWS Lake Formation when connected to a TIP-enabled compute in a TIP-enabled project. Users see only the tables, columns, and rows their permissions allow, without sharing a broad execution role. TIP reduces admin effort as identity propagates automatically through existing compute connections, requiring no extra login, token, or role management.

Why it matters

Useful for developers and data engineers who need per-user data access control in data analytics and machine learning development

Amazon Bedrock AgentCore's web search now includes domain and published date filtering, enabling agents to narrow results to trusted sources or block unwanted domains per request. Published-date filtering constrains results to specific time windows, ensuring responses reflect timely content. Admins gain gateway-level allowlist support and can specify up to 100 domains per list. These features are ideal for regulated industries and research workflows requiring strict control over information sources and recency. The web search tool is now available in Europe (Ireland) and Asia Pacific (Tokyo), joining existing US East (N. Virginia) availability.

Why it matters

This update benefits users who need strict control over information sources and recency when AI agents generate responses based on current web data.

Amazon WorkSpaces Applications now offers native monitoring embedded in the service console. Administrators can view real-time session metrics, instance-level resource data, and network performance without third-party tools or CloudWatch expertise. Previously, large deployments required external solutions or complex CloudWatch dashboards; now comprehensive monitoring is available with no configuration. The console provides fleet-level visibility, customizable session tables with filtering, and graphical views of metrics like frame rate and CPU usage. All metrics are also available in CloudWatch, giving customers flexibility. This functionality is available in all regions where Amazon WorkSpaces Applications is offered.

Why it matters

This update helps enterprise customers monitor and optimize performance for their WorkSpaces Applications resources more efficiently

AWS Security Agent, part of AWS Continuum, offers an AI-driven penetration testing service for web applications. Previously, teams lacked ways to cap test costs or confirm fixes for vulnerabilities. New features now allow setting maximum task-hour limits (preset, custom, or none) for tests, which stop gracefully when reached while preserving findings. Users can also revalidate individual findings after fixes without rerunning full tests, receiving clear active or resolved statuses with full history linked to original findings

Why it matters

Targeted at security teams and DevSecOps engineers, this update improves cost management and verification of vulnerability fixes

Amazon CloudWatch log centralization now copies tags from source log groups to destination log groups and keeps them synchronized based on the tag propagation behavior selected in the centralization rule setup. This allows platform teams to preserve tags such as Application and CostCenter on centralized log groups, then use those tags to scope access with IAM conditions and report centralized log spend by team in AWS Cost Explorer. Tag propagation is available in all AWS Regions where CloudWatch Centralization is offered. It can be enabled via the CloudWatch console, AWS CLI, or AWS SDKs.

Why it matters

This update benefits users centralizing logs from multiple accounts and regions, enabling more granular access control and cost management through preserved log group tags.

AWS announces the general availability of AgentCore payments within Amazon Bedrock AgentCore, allowing AI agents to autonomously discover, access, and pay for paid APIs, MCPs, and content using just a few lines of code. The feature integrates with Coinbase and Stripe Privy wallets for microtransactions, offers payment orchestration across protocols, enforces configurable payment limits at the infrastructure layer, and provides end-to-end observability via AgentCore Observability. At general availability, it includes Quick Create for Coinbase credential provisioning in the AgentCore console, a curated Coinbase Bazar MCP server with pay-per-use x402 endpoints through the AgentCore gateway, support for the Machine Payment Protocol (MPP), and the "upto" scheme in the x402 protocol for pay-per-inference and dynamic pricing scenarios. Developers can get started using coding assistant skills, the AgentCore CLI, or the AWS Management Console. AgentCore payments is available in listed regions.

Why it matters

This update introduces a feature for developers allowing AI agents to automatically access and pay for external services and APIs, enhancing safety and monitoring in enterprise environments

Amazon EC2 has launched High Memory U7i-6TB instances (u7i-6tb.112xlarge) in the Europe (Zurich) region. Powered by fourth-generation Intel Xeon Scalable processors, U7i instances provide 6 TiB of DDR5 memory, enabling customers to scale transaction processing throughput in fast-growing data environments. These instances deliver up to 45% better price performance compared to existing U-1 instances, feature 448 vCPUs, and support up to 100 Gbps of Amazon EBS bandwidth, 100 Gbps network bandwidth, and ENA Express. They are ideal for running mission-critical in-memory databases such as SAP HANA, Oracle, and SQL Server.

Why it matters

This update impacts customers running databases or applications that require large memory capacity and high-throughput processing. High Memory instances are designed for large in-memory databases and transaction processing workloads.

Starting today, Amazon RDS for PostgreSQL 19 Beta 3 is available in the Amazon RDS Database Preview Environment, enabling evaluation of the pre-release version. This beta adds capabilities for query performance and autovacuum management, including the pg_stat_autovacuum_scores view for monitoring and tuning autovacuum prioritization, parallel autovacuum using multiple workers for faster maintenance on large tables, and the pg_plan_advice module to lock in efficient query plans. Eager aggregation improves analytical queries by grouping data earlier, reducing rows processed and speeding up completion. Beta 3 also includes bug fixes and stability improvements from the Beta 2 testing period. Preview Environment instances are retained for a maximum of 60 days and are automatically deleted afterward. Snapshots created in the Preview Environment can only be used to create or restore instances within that environment, with import/export possible via PostgreSQL dump and load functionality. Pricing aligns with the US East (Ohio) Region.

Why it matters

This update is relevant for database administrators and developers who want to evaluate new versions of PostgreSQL on Amazon RDS

Today, Amazon EC2 R8i instances became available in the Israel (Tel Aviv) region. Powered by custom Intel Xeon 6 processors exclusive to AWS, these instances deliver the highest performance and fastest memory bandwidth among comparable Intel processors in the cloud. They offer up to 15% better price-performance and 2.5x more memory bandwidth than previous generation Intel-based instances, providing 20% higher performance than R7i instances, with even greater gains for specific workloads. R8i instances are ideal for memory-intensive workloads, especially those requiring the largest instance sizes or continuous high CPU usage. They come in 13 sizes, including two bare metal options and a new 96xlarge size for the largest applications. SAP-certified, they deliver 142,100 aSAPS, the highest among comparable machines in on-premises and cloud environments, offering exceptional performance for mission-critical SAP workloads. Customers can access these instances via the AWS Management Console, purchasing them through Savings Plans, On-Demand, or Spot instances.

Why it matters

This update impacts users with memory-intensive workloads or high performance requirements. A new instance type for Amazon EC2 is now available.

Amazon SageMaker Unified Studio now includes data profiling and anomaly detection powered by AWS Glue Data Quality. Users can generate statistical profiles to understand data shape and completeness, and track changes over time. Anomaly detection identifies when data points drift from historical patterns without needing predefined thresholds or custom rules. These capabilities work for both static data in catalog tables and data in transit within Visual ETL jobs. A dedicated Data Profile tab offers on-demand and scheduled profiling for dataset and column-level statistics. As profile history accumulates, anomaly detection establishes a baseline of expected behavior and flags outliers. This is useful when specific thresholds are unknown or when expected values change over time. The same profiling and anomaly detection are available on the results page of any Visual ETL job with an Evaluate Data Quality transform. The feature is available in all regions where Amazon SageMaker Unified Studio is offered.

Why it matters

This update benefits data stewards, engineers, and analysts who manage and analyze data. The data profiling and anomaly detection capabilities help improve data quality monitoring and assurance.

Amazon EC2 R8a instances are now available in the Asia Pacific (Taipei) region. Powered by 5th Gen AMD EPYC processors with a maximum frequency of 4.5 GHz, they deliver up to 30% higher performance and 19% better price-performance than R7a instances. With 45% more memory bandwidth, R8a instances are ideal for latency-sensitive workloads. They offer up to 60% faster GroovyJVM performance, improving request throughput and response times for business-critical applications. Built on the AWS Nitro System with sixth-generation Nitro Cards, R8a instances suit high-performance, memory-intensive workloads like SQL and NoSQL databases, distributed web-scale in-memory caches, real-time big data analytics, and electronic design automation applications. The instances are SAP-certified, providing 38% more SAPS than R7a instances and come in 12 sizes, including two bare metal options.

Why it matters

This update introduces a new instance type for Amazon EC2 optimized for high-performance, memory-intensive workloads, impacting applications such as databases, caches, and real-time analytics

AWS IAM introduces outbound identity federation for the European Sovereign Cloud (Germany) Region, enabling AWS workloads to authenticate with external services using short-lived JSON Web Tokens (JWTs). This eliminates the need for long-term credentials and complex workarounds when accessing third-party cloud providers, SaaS applications, and self-hosted services. Administrators can control token generation and enforce token properties such as lifetime, audience, and signing algorithms using IAM policies, with usage auditable via CloudTrail logs to meet security and compliance requirements.

Why it matters

This update affects users operating AWS resources in the European Sovereign Cloud environment, providing a secure way to access external services and enhancing security and compliance.

AWS Storage Gateway now supports FIPS 140-3 validated endpoints over AWS PrivateLink for both Tape and Volume Gateway. This allows FIPS-compliant traffic to stay on the private AWS network instead of the public internet, simplifying use for regulated workloads. To use this feature, create a FIPS interface endpoint in your VPC and select the FIPS VPC endpoint option when activating the gateway. Gateway software version 3.2.7 or later is required. The update is available in eight AWS Regions that offer FIPS endpoints.

Why it matters

This update affects users of AWS Storage Gateway handling regulated workloads. It enables FIPS-compliant encryption over a private network, simplifying security compliance.

IAM Policy Autopilot, an open source tool launched at re:Invent 2025, previously analyzed application source code to create scoped-down IAM policies. It now accepts Terraform plan files as input, applying deterministic analysis to produce policies scoped to the CRUD functions of resources in that plan. Generated policies reference specific resource ARNs rather than wildcards when possible. This capability has been the most requested feature since launch and complements existing Terraform-aware analysis that cross-references Terraform resource definitions with SDK calls in application code to resolve ARNs. IAM Policy Autopilot is available at no additional cost and runs on your own machine. Visit the IAM Policy Autopilot GitHub repository to get started

Why it matters

This update is relevant for developers and DevOps engineers who deploy AWS infrastructure defined with Terraform, automating IAM policy generation for such deployments

Amazon Bedrock now supports OpenAI's GPT-5.6 models (Terra and Luna) in India, enabling customers with in-country processing requirements to use these models at scale. Cross-Region inference routes requests across AWS Regions in India (Asia Pacific Mumbai and Asia Pacific Hyderabad), ensuring data residency while scaling demand. These models run on the bedrock-runtime endpoint, supporting Responses, Chat Completions, and Converse APIs, with the same account-level controls as other Bedrock models, including logging, metrics, and cost tracking.

Why it matters

This update is important for customers requiring data processing within India. Amazon Bedrock is a service for managing AI model invocations.

Amazon Bedrock now supports the SpaceXAI Grok 4.6 model, designed for coding, agentic tasks, and knowledge work. Cross-region inference routes requests across multiple AWS regions, increasing throughput and lowering inference costs. The US Geo profile keeps processing within the United States, meeting data residency needs, while the Global profile serves requests from any available AWS region, providing maximum capacity and lower per-token costs during demand spikes. The model works with existing Bedrock controls, including logging, CloudWatch metrics, and cost tracking. Grok 4.6 is available in all regions where Amazon Bedrock is offered.

Why it matters

This update impacts AI model users, especially developers and enterprises requiring large-scale inference processing

On Aug 18, 2026, Amazon announced critical security patch update (CSPU) for Amazon Corretto Long-Term Support (LTS) and Feature Release (FR) versions of OpenJDK. Corretto 26.0.2.11.1, 25.0.4.8.1, 21.0.12.9.1, 17.0.20.10.1, 11.0.32.10.1, and 8u504 are now available for download. Amazon Corretto is a no-cost, multi-platform, production-ready distribution of OpenJDK. Visit the Corretto home page to download Corretto 26, Corretto 25, Corretto 21, Corretto 17, Corretto 11, or Corretto 8. Updates can also be obtained on your Linux system by configuring a Corretto Apt, Yum, or Apk repo.

Amazon Managed Workflows for Apache Airflow (Amazon MWAA) Serverless now supports running custom Python functions and shell scripts directly in the serverless runtime using PythonOperator and BashOperator. With this launch, data engineering teams can execute the code patterns they rely on daily, including data transformations, format conversions, and data quality checks, without provisioning additional infrastructure. Package your Python modules or shell scripts as code packages, upload them to Amazon S3, and reference them when creating or updating a workflow. The service snapshots your code at workflow creation time and uses that snapshot for all subsequent runs, ensuring consistency across executions. This feature is available in all AWS Regions where Amazon MWAA Serverless is available.

Amazon MSK Provisioned clusters now enable custom domain name configuration at the cluster level for both ZooKeeper and KRaft metadata modes. This eliminates the need to configure each broker individually, simplifying cluster migrations, disaster recovery, and scaling without reconfiguration. The setting applies automatically to all brokers and persists through scaling operations, supporting both management modes equally.

Why it matters

This change is particularly useful for customers who route traffic through Network Load Balancers, require persistent endpoints across cluster operations, or must adhere to organizational naming conventions for security and compliance.

Amazon Elastic Container Registry (Amazon ECR) has raised the maximum number of replication rules per registry from 10 to 25. This change benefits customers with complex multi-region or multi-account setups, enabling them to define up to 25 rules per registry. It supports more precise replication strategies, such as distributing images across many regions for low-latency access or replicating to multiple production and staging accounts. The increased limit is available in all AWS Regions where Amazon ECR is offered.

Why it matters

Amazon ECR is an AWS service that simplifies container image management and distribution. This update particularly benefits users with complex multi-region and multi-account architectures.

Amazon EC2 now offers R8i and R8i-Flex instances in the Canada West (Calgary) region. Powered by custom Intel Xeon 6 processors exclusive to AWS, these instances deliver up to 15% better price-performance and 2.5x more memory bandwidth than previous Intel-based instances. R8i instances provide up to 20% higher performance than R7i instances, with significant gains in specific workloads such as PostgreSQL databases, NGINX web applications, and AI deep learning models. R8i-Flex instances, the first memory-optimized Flex options, support common sizes from large to 16xlarge, ideal for applications not fully utilizing compute resources.

Why it matters

This update impacts users requiring high performance and cost efficiency for memory-optimized workloads

Amazon EC2 Auto Scaling now enables terminating up to 100 instances in a single API call through batch processing. This reduces the number of API calls required to scale down Auto Scaling groups. The feature is especially beneficial for workloads that need rapid scaling down, such as AI/ML training jobs, container orchestrators, and event-driven architectures that temporarily spin up large fleets. All instances in a batch are validated atomically before termination begins, and existing Auto Scaling behaviors such as lifecycle hooks and load balancer connection draining are preserved for each instance in the batch. The feature is available in all AWS Regions at no additional cost

Why it matters

This feature is useful for scenarios requiring rapid scaling down of Auto Scaling groups, particularly for managing large, temporary instance clusters

Amazon S3 metadata and annotations are now available in AWS GovCloud (US-East) and AWS GovCloud (US-West) regions. S3 metadata automatically captures system-defined details such as object size and source, storing them in Amazon S3 Tables for simplified business analytics and real-time inference. Annotations allow attaching rich business context directly to objects in JSON, XML, or YAML, up to 1 GB per object. This provides AI agents and analytics tools with the necessary context to locate and utilize the right data without building or maintaining separate metadata systems. Annotations share the same durability and consistency properties as the object, move with it during copy and replication, and are removed when the object is deleted.

Why it matters

This update benefits users who need to automate data management and analysis, particularly those in government or heavily regulated industries

Amazon WorkSpaces now enables nested virtualization for both Personal and Core Managed Bundles. This feature allows developers to run Docker Desktop, Windows Subsystem for Linux (WSL2), and other hypervisor-dependent tools directly on Windows WorkSpaces, as well as KVM-based workloads, Android emulators, and nested containers on Linux WorkSpaces-without requiring separate physical hardware or workaround environments. Supported operating systems include Windows Server 2019, 2022, and 2025; Windows 11; Ubuntu 22.04 and 24.04; Red Hat Enterprise Linux 8 and 9; and Rocky Linux 8 and 9, when using the DCV protocol. A Power instance (4 vCPU or higher) is recommended. GPU bundles, the PCoIP protocol, and Amazon WorkSpaces based on Windows Server 2016 and Windows 10 do not support this feature. Administrators can enable or disable nested virtualization at the individual workspace level via the console, API, or CLI. The functionality is available in all AWS Regions where Amazon WorkSpaces operates, except for China (Ningxia) and Israel (Tel Aviv) Regions.

Why it matters

This update provides developers and end users with greater flexibility in virtualized environments. Amazon WorkSpaces offers remote desktop services.

Amazon Bedrock now supports OpenAI's GPT 5.6 models (Sol, Terra, and Luna) on the bedrock-runtime endpoint, enabling the use of the Responses, Converse, and Chat Completions APIs. Cross-region inferencing automatically routes requests across multiple AWS regions for higher throughput without managing capacity manually. Global cross-region inferencing serves requests from any commercial AWS region where the model is available, providing the broadest access and highest throughput during demand spikes, while also lowering costs per token compared to in-region or geo inferencing. Geo cross-region inferencing routes requests within predefined geographies, allowing scale while keeping data processing within those regions. These OpenAI APIs integrate with Bedrock's existing controls, including usage logging, CloudWatch metrics, and cost allocation

Why it matters

This update impacts developers and enterprises using AI models. The expansion of Amazon Bedrock's features facilitates access to OpenAI models and improves cost efficiency and performance through cross-region inferencing

Amazon OpenSearch Service now supports automatic semantic enrichment for VPC-enabled domains, enabling customers with private network setups to use AI-driven semantic search without exposing their domains publicly. This feature transforms traditional keyword-only searches into context-aware retrieval by understanding query meanings, eliminating the need for managing machine learning models or integration overhead. Existing VPC configurations require no changes.

Why it matters

This update provides enhanced search relevance for customers with strict network security requirements

Amazon Quick has launched general availability of Microsoft 365 extensions for Excel, PowerPoint, Word, and Outlook. These tools allow users to perform complex tasks directly within their M365 environments using AI, such as redlining documents in Word, building financial models in Excel, creating presentation-ready decks in PowerPoint, and managing Outlook inboxes. Finance teams can build models by describing needs, sales teams can draft proposals pulling from CRM data, and marketing teams can produce branded presentations without manual formatting.

Why it matters

This update targets organizations seeking to enhance productivity within Microsoft 365 environments using AI, automating tasks for finance, sales, marketing, legal, operations, and IT teams

AWS Network Firewall now includes hit counts for stateful rules, allowing administrators to see how often each rule matches traffic. This feature helps identify active rules, uncover policy gaps, and verify new rule deployments. Hit counts are enabled by default for both custom and managed rule groups, with metrics updating every five minutes. The capability is provided at no extra charge, though standard logging costs apply. It is available in all supported AWS regions except the Middle East (UAE) and Middle East (Bahrain) regions

Why it matters

This update targets network administrators and security engineers, helping them monitor firewall policy effectiveness and identify issues

AWS Console-to-Code now supports 26 additional AWS services and introduces cross-region and cross-browser-tab action recording. This expansion increases total service coverage from 6 to 32 supported services, helping developers, DevOps engineers, and cloud architects more easily convert manual console workflows into repeatable, production-ready infrastructure as code (IaC). Previously, switching regions or working across browser tabs would reset or fragment recorded action lists. Actions are now consolidated into a single unified list, enabling customers to capture and automate complex, multi-region infrastructure deployments without losing context. Starting today, customers in all commercial AWS Regions can use Console-to-Code with all 32 supported services and the new cross-region recording capability.

Amazon Connect Customer dashboards now support reporting on routing steps and agent proficiencies, enabling supervisors to monitor and optimize how contacts are matched to agents based on agent proficiencies. Managers can filter agents by their assigned proficiencies, group metrics by routing steps, and track new metrics including the number of contacts queued in a routing step. For example, a supervisor notices a spike in queued contacts at a routing step requiring highly skilled agents, then relaxes the routing criteria to expand the agent pool and reduce wait times. Routing steps and agent proficiencies reporting on analytics dashboards is available in all AWS commercial and AWS GovCloud (US-West) regions where Amazon Connect Customer is offered.

AWS CloudShell now features a built-in visual file editor that can be launched directly from a shell session using a single 'edit' command, requiring no setup. This browser-based environment, which uses existing AWS Management Console credentials, now offers a GUI-based editing experience with syntax highlighting, find-and-replace, multi-line selection, copy-paste, and undo-redo capabilities-all within a single browser session. Developers, DevOps engineers, and cloud administrators can edit deployment scripts, infrastructure-as-code templates, agent steering files, and AWS Lambda functions more efficiently. The feature is available in all regions where AWS CloudShell is offered.

Why it matters

This update benefits developers, DevOps engineers, and cloud administrators managing scripts, infrastructure-as-code, and AWS Lambda workflows by integrating a GUI-based editor into CloudShell's browser environment, improving workflow efficiency

Amazon Location Service now includes Point of Interest (POI) category and density filtering in map styles. Developers can use the GetStyleDescriptor API to control which categories of places (such as Food & Drink, Transit, or Accommodations) and how many POIs appear on a map, all configured server-side. This ensures correct map display without additional client-side code, across web, mobile, and headless server-side renderers. Use cases include property listing sites showing only accommodations, logistics apps displaying only transit and fuel, and tourist maps highlighting sights and dining. Amazon Location Service is available in multiple AWS Regions including US East (Ohio), US East (N. Virginia), US West (Oregon), Asia Pacific (Mumbai), Asia Pacific (Sydney), Asia Pacific (Tokyo), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Spain), Europe (Stockholm), South America (São Paulo), and AWS GovCloud (US-West).

Why it matters

This update allows developers to customize map displays more specifically. Amazon Location Service is a fully managed service that helps developers add maps, places, routing, and tracking to applications using high-quality geospatial data.

Amazon Quick now integrates with Microsoft Purview to enforce data loss prevention policies across the Quick environment. IT administrators and security teams can apply existing Purview sensitivity labels to automatically control file handling in Quick features such as chat, spaces, and knowledge bases. Administrators can configure enforcement actions (block, warn, or allow) for each sensitivity label, providing granular control over sensitive file sharing. This integration allows customers to extend their Microsoft Purview governance policies into Quick without additional tools. The feature is available in all AWS Regions where Amazon Quick agent capabilities are supported.

Why it matters

This update provides organizations with security features to ensure sensitive files are not shared outside approved channels

Amazon Quick now includes approval policies, enabling administrators to govern how assets are shared across their organization. These policies allow administrators to create rules for specific asset types such as knowledge bases, spaces, and custom chat agents. When a user requests to share an asset covered by a policy, the request is sent to a designated approver group for review. Approvers can evaluate the asset directly before approving or denying the request, with all workflow events logged in AWS CloudTrail for full auditability. For custom chat agents, approvers can review and act on the entire dependency package in a single request. This feature is available for Professional and Enterprise plans in all AWS Regions where Amazon Quick agent capabilities are supported.

Why it matters

This update is relevant for administrators and security officers who need to manage sharing of sensitive assets within their organization. It enhances governance of Amazon Quick's sharing capabilities, improving compliance and auditability.

Amazon Quick now enables administrators to impose per-user caps on index storage and agent hours, giving them direct control over subscription costs. With limit management, administrators can create limit profiles that restrict per-user consumption, helping to avoid unexpected overage charges and ensuring efficient use of subscription entitlements across the organization. When a user reaches their limit, new consumption is blocked while existing content remains preserved. This feature is available for Professional and Enterprise plans in all AWS Regions where Amazon Quick agent capabilities are supported

Why it matters

This update affects administrators deploying Amazon Quick across their entire organization or managing large user bases. Resource limits enable better cost control and optimization of subscription entitlements

Amazon RDS for Oracle now supports Oracle APEX version 26.1. Oracle APEX is a low-code development platform that enables developers to build scalable, secure enterprise applications with modern user interfaces. This update brings new capabilities to developers using Oracle APEX on Amazon RDS for Oracle. The feature is available in all AWS regions where Amazon RDS for Oracle is offered, with detailed documentation available for supported versions and configuration options.

Why it matters

This update is relevant for users managing Oracle databases in the cloud. It enables access to the latest version of Oracle APEX, enhancing application development capabilities.

Amazon Quick now supports custom no data messages for visuals. Authors can replace the default 'No data to display' message with a tailored title, subtitle, and hyperlink. These elements can be enabled or disabled independently, and all text fields support parameters for dynamic reflection of current filter selections. The hyperlink supports http://, https://, and mailto: URL schemes. This feature is available in all AWS Regions where Amazon Quick is offered. For more information, see Analysis Settings in the Amazon Quick User Guide.

Why it matters

This update targets analysts and business users who create data visualizations, enabling them to provide more specific and helpful messages when no data is available.

AWS Certificate Manager (ACM) now enables changing the domain validation method on existing public TLS certificates from email to DNS without reissuing the certificate or altering its Amazon Resource Name (ARN). Due to the CA/B Forum's mandate to deprecate email-based validation for publicly trusted certificates by March 15, 2028, ACM will phase out email validation support throughout 2027. Switching to DNS validation now allows customers to transition before the deadline and enables fully automated renewals. The certificate ARN remains unchanged, so existing references in CI/CD pipelines, load balancer configurations, and other AWS service integrations continue to work. To switch, use the ACM console or the UpdateCertificateOptions API, adding the provided CNAME records to DNS within 72 hours. DNS validation is recommended for new certificates, while HTTP validation is suggested for Amazon CloudFront distributions. This feature is available in all regions where ACM certificates are offered.

Why it matters

This update affects developers and security professionals managing public TLS certificates. It extends AWS Certificate Manager's certificate management capabilities, facilitating migration away from email validation ahead of its deprecation.

AWS Billing and Cost Management (BCM) Dashboards now feature Managed Dashboards-preconfigured, read-only views populated with account data, requiring no setup. Five curated dashboards cover cost overview and trends, compute and database spending, and reservation and savings plan performance. All are read-only and maintained by AWS, with options to duplicate, add widgets, or export as PDF/CSV. Available across all commercial AWS Regions at no extra cost via the Billing and Cost Management console or user guide.

Why it matters

This update is particularly useful for users focused on cost management and financial operations (FinOps), offering immediate cost visibility and analysis without setup

Security teams can now access OpenAI's Daybreak Red and Daybreak Blue models on Amazon Bedrock. These models support defensive workflows such as vulnerability discovery and incident response, as well as advanced tasks like vulnerability research. They run on Bedrock's next-generation inference engine with zero-operator access enforced at the chip level. Inference data is not used for model training, and no data sharing with OpenAI is required.

Why it matters

Intended for security teams and cybersecurity professionals

Amazon Redshift introduces rg.large and rg.12xlarge instance sizes for RG instances in the AWS GovCloud (US-West) and AWS GovCloud (US-East) Regions. These instances deliver up to 2.4x better performance and 30% lower cost per vCPU compared to previous RA3 instances. They include Redshift's custom vectorized data lake query engine, enabling SQL analytics across data warehouses and data lakes with a single engine. The new sizes are available in patch version P202 and later. Customers can resize existing RG or RA3 clusters using Elastic Resize or Classic Resize, and RA3 customers can upgrade to RG via Snapshot & Restore. RG instances come in four sizes-rg.large, rg.xlarge, rg.4xlarge, and rg.12xlarge-with flexible pricing, including On-Demand and 1-year/3-year Reserved Instances with various payment options.

Why it matters

This update introduces new instance types for improved data warehouse and data lake performance, particularly relevant for users operating in regulated or government environments.

Amazon SES now simplifies mobile deep linking through a new ses:custom-path HTML attribute. Adding this attribute to an <a> tag ensures SES passes the path segment to the tracking URL, allowing mobile operating systems to match it with Universal Links on iOS or App Links on Android. This enables mobile deep linking without disabling engagement tracking. The feature is available in all AWS Regions where Amazon SES operates. To use it, you need a custom redirect domain for click tracking with either an Apple App Site Association (AASA) or Digital Asset Links verification file hosted on that domain, then add the ses:custom-path attribute to links in HTML emails.

Why it matters

This update is relevant for developers and marketers who need mobile app deep linking functionality. It allows users to implement direct links to their apps while maintaining engagement tracking when sending email campaigns with Amazon SES.

Claude Opus 5 is now available in AWS GovCloud (US) regions via the bedrock-runtime endpoint. This latest Opus model provides significant advances in coding, long-running agents, and complex document analysis. Amazon Bedrock enables zero data retention (ZDR) by default, ensuring data governance compliance while offering AWS-managed features like Guardrails and Knowledge Bases.

Why it matters

AWS GovCloud (US) is designed for government and regulated industries. This update enables secure access to advanced AI capabilities within compliant cloud environments

AWS Client VPN introduces a rebuilt v6.0.x client with CLI support, enterprise administration controls, and faster connection setup. The CLI offers full GUI feature parity, allowing integration into automation workflows and infrastructure-as-code deployments. Administration controls enable centralized VPN policy enforcement and profile management. Rebuilt with OpenVPN3, the client delivers faster connections across all OS platforms while maintaining backward compatibility with existing endpoints. The updated client is available for Windows, macOS, and Linux with no additional charges beyond standard pricing.

Why it matters

This update targets organizations managing remote and hybrid work environments, particularly where automation and centralized VPN control are needed

Today, AWS announces support for AWS Local Zones in Spot placement score, helping you identify locations where your Spot capacity request is most likely to succeed. Spot placement score evaluates your target capacity and compute requirements and returns scores for AWS Regions or Availability Zones. Previously, Spot placement scores excluded local zone capacity information when reporting zonal and regional scores. Now, you can optionally request local zones to be included in the zonal and regional score responses giving you a broader view of your Spot capacity options. You can use Spot placement score through EC2 Spot Console, AWS CLI, or SDK. To learn more about Spot placement score see Spot placement score documentation.

Amazon Quick announces the general availability of Microsoft 365 extensions for Excel, PowerPoint, Word, and Outlook. These extensions allow Quick to perform tasks directly within users' M365 environments using AI to handle complex local tasks such as redlining documents, building financial models, creating presentation-ready decks, and managing Outlook inboxes. The Excel extension assists with complex spreadsheet analysis, pivot tables, and data cleaning. The PowerPoint extension helps create and refine presentations using organization-defined templates. The Word extension generates formatted documents, enables sweeping edits with track changes, and participates as a reviewer in comments. The Outlook extension manages inbox and calendaring tasks like prioritizing emails, organizing inboxes, scheduling meetings, and drafting replies using Quick data and full inbox context. These extensions transform daily work across teams, enabling finance teams to build complex models by description, sales teams to draft proposals pulling from CRM data, marketing teams to create branded presentations without manual formatting, legal teams to streamline contract reviews, operations teams to manage email workflows and schedule meetings intelligently, and IT teams to automate routine data analysis. The extensions are available in US East (N. Virginia), US West (Oregon), Asia Pacific (Sydney), Europe (Ireland), Asia Pacific (Tokyo), and Europe (Frankfurt).

Amazon S3 now includes the specific ARN of the AWS IAM and AWS Organizations policy in HTTP 403 Access Denied error messages for requests within the same account or organization. This allows users to quickly identify the exact policy causing a denied request and address the issue directly. Previously, error messages only indicated the policy type and reason for denial, requiring manual inspection of multiple policies of the same type to find the root cause. The update now displays the specific policy ARN for explicit deny cases, covering Service Control Policies, Resource Control Policies, identity-based policies, session policies, and permission boundaries. This feature is available in all AWS Regions, including AWS GovCloud (US) and AWS China Regions.

Why it matters

This change benefits users managing access control policies for Amazon S3 and those troubleshooting access denied issues

AWS Deadline Cloud now shows costs for Amazon EBS persistent volumes in the Usage Explorer within the Deadline Cloud Monitor app. Previously, only compute and license costs were visible. This update allows tracking of each EBS volume's cost from creation to deletion, independent of jobs or sessions. Costs appear as a new usage type in the Usage Explorer and statistics APIs, attributed to the owning fleet, enabling aggregated spending by fleet, farm, or time period. This helps identify idle volumes and decide whether to adjust time-to-live settings or let them expire. Cost tracking is automatically enabled with no additional charges and is available in all regions where Deadline Cloud is offered.

Why it matters

This update benefits teams running compute-intensive workloads in the cloud for visual effects, animation, product design, simulation, and gaming. Tracking EBS volume costs helps optimize resources and manage expenses more effectively.

Amazon Elastic Kubernetes Service (Amazon EKS) now allows configuration of parameters for Kubernetes control plane components, including the scheduler, controller manager, and API server. This enables tuning pod placement strategies to enhance resource utilization, adjusting the speed at which horizontal pod autoscaling reacts to demand changes, and setting resource lifecycle parameters such as event retention duration. Cluster administrators gain greater control over Kubernetes control plane settings beyond defaults, for example setting the scheduler's node resource fit strategy to MostAllocated to pack pods onto already utilized nodes, thus running the same workloads on fewer nodes.

Why it matters

This update affects Kubernetes cluster administrators and DevOps engineers managing Amazon EKS. It provides finer control over control plane settings, which is particularly useful in environments requiring performance and resource efficiency optimization

AWS has added an interactive map view to AWS Global View in the AWS Management Console. This feature allows customers to toggle between the map view and the existing list view, making it easier to visualize their global AWS infrastructure. The map displays all AWS Regions and Local Zones, helping users make informed infrastructure planning decisions by seeing enabled locations and the full range of available options at a glance. The capability is available across all public AWS Regions and can be accessed via the Regions and Zones page in the AWS Global View console.

Why it matters

This update benefits customers who need to visually explore AWS's global infrastructure. AWS Global View is a tool that helps users manage and plan AWS Regions and Local Zones.

AWS Clean Rooms now includes support for minimum aggregation thresholds within custom analysis rules. This feature helps safeguard individual privacy by preventing queries from returning results about single users or small groups. Data providers can apply these thresholds to custom SQL queries, ensuring each output row represents at least a specified number of distinct values, such as user IDs. Previously, enforcing such thresholds required pre-approved templates and manual code reviews; now providers can configure them directly through custom analysis rules without structured queries or approvals. Additionally, providers can define which columns can be filtered or joined across datasets.

Why it matters

This update benefits companies and partners looking to safely analyze multiple datasets together. AWS Clean Rooms enables collaborative analysis without sharing or copying underlying data.

AWS announces the general availability of role manager in AWS Identity and Access Management (IAM), which automatically sets up the IAM roles your AWS services need. When setting up a supported service in the console, role manager creates a default role on your behalf or reuses an existing one if it matches required permissions. Currently supporting six AWS service consoles including AWS Lambda and Amazon EventBridge, role manager applies AWS-managed templates for workflows. Roles created via role manager appear in the IAM console as standard IAM roles that you fully control, with identification of role manager-created roles. Available in all AWS Regions except AWS GovCloud (US) and China Regions, it also allows disabling to refine permissions using IAM Access Analyzer.

Why it matters

This change affects users who manually configure IAM roles for AWS services, automating role setup and enhancing security and efficiency in IAM role management.

Amazon Quick now integrates with Microsoft Purview to enforce data loss prevention (DLP) policies across your Quick environment. Organizations need to ensure that sensitive files aren't shared outside approved channels. With this integration, IT administrators and security teams can apply their existing Purview sensitivity labels to automatically control how files are handled in Quick capabilities such as chat, spaces, and knowledge bases. Administrators can configure enforcement actions (block, warn, or allow) for each sensitivity label, giving organizations granular control over sensitive file sharing across Quick. For example, a financial services company can block files labeled "Highly Confidential" from being uploaded to shared spaces while allowing "Internal" files with a warning notification. With this integration, customers can extend their existing Microsoft Purview governance policies into Quick without additional tools. This feature is available in all AWS Regions where Amazon Quick agentic capabilities are supported.

Amazon Quick custom permissions now include deny by default, a governance setting that automatically restricts new AI capabilities before they reach users. Previously, new AI capabilities were available to all users upon release, requiring administrators to react after the fact. With deny by default, administrators restrict the AI capability category in a custom permissions profile and assign it to users, roles, or the entire account. Quick then denies any new AI capability at launch for those users. Restricting a category also restricts existing capabilities within it. Administrators must explicitly allow each capability when ready. The restriction applies only to the profile configured. Configure deny by default in Manage account in Amazon Quick or through the AWS CLI. To learn more, see Custom permissions deny by default. Deny by default is available in all AWS Regions where Amazon Quick is available.

Amazon Quick now enables administrators to set per-user limits on index storage and agent hours, giving them direct control over subscription costs. With limits management, administrators can create limit profiles that cap per-user consumption, helping prevent unexpected overage charges and ensuring subscription entitlements are used efficiently across their organization. For example, an organization deploying Quick enterprise-wide to thousands of users can set account-level limit profiles to establish cost-predictable baselines, then assign higher limits to specific roles that require more agent hours. Administrators can create and assign limit profiles at the user, role, or account level, with a priority hierarchy that ensures the right users get the right capacity. When a user reaches their limit, new consumption is blocked while existing content is preserved. This feature is available for Professional and Enterprise plans, in all AWS Regions where Amazon Quick agentic capabilities are supported

Amazon Quick now offers approval policies, giving administrators governance controls over how assets are shared within their organization. With approval policies, administrators can require designated approvers to review and approve share requests before access is granted, helping organizations ensure that sharing of sensitive assets is deliberate, compliant, and auditable. Administrators can create approval policies scoped to specific asset types, including knowledge bases, spaces, and custom chat agents. When a user submits a share request for an asset covered by a policy, it is routed to the assigned approver group for review. Approvers can evaluate the asset directly before approving or denying the request, and all workflow events are captured in AWS CloudTrail for full auditability. For custom chat agents, approvers can review and act on the entire dependency package in a single request. This feature is available for Professional and Enterprise plans, in all AWS Regions where Amazon Quick agentic capabilities are supported.

Amazon Connect Customer now lets agents view and self-assign queued agent-first callbacks alongside emails, tasks, and chats. This gives agents the option to prioritize work that needs immediate follow-up or for which they already have relevant context. For example, an agent familiar with a customer’s issue can assign the callback to themselves, avoiding another handoff and helping resolve the issue faster. This feature is available in all AWS Regions where Amazon Connect Customer is available. To learn more about how to use queued callbacks, refer to our documentation Access the Worklist app and Set up queued callbacks. For more information about Amazon Connect Customer, visit our product page.

NVIDIA's LocateAnything-3B, Qwen's Qwen-AgentWorld-35B-A3B, and Qwen's Qwen3.5-122B-A10B models are now available on Amazon SageMaker JumpStart, expanding the portfolio of foundation models for AWS customers. These models provide specialized capabilities in visual grounding, object localization, agent environment simulation across seven interaction domains, and large-scale multimodal reasoning. LocateAnything-3B uses a Parallel Box Decoding framework for fast, high-quality visual grounding from natural language instructions. Qwen-AgentWorld-35B-A3B simulates agent environments across tool calling, search, terminal, software engineering, Android, web, and OS interaction domains, predicting next environment states through long chain-of-thought reasoning. Qwen3.5-122B-A10B delivers high-performance multimodal reasoning with a hybrid architecture integrating Gated Delta Networks and sparse Mixture-of-Experts, activating only 10B parameters per token. With SageMaker JumpStart, customers can deploy any of these models with just a few clicks.

Why it matters

Amazon SageMaker JumpStart is a platform that allows AWS customers to easily deploy and use AI foundation models, and the addition of these new models makes it easier to develop various AI applications such as visual grounding and agent simulation

Amazon EC2 R8a instances are now available in the Canada (Central) Region. Powered by 5th Gen AMD EPYC processors with a maximum frequency of 4.5 GHz, they offer up to 30% higher performance and 19% better price-performance than R7a instances. With 45% more memory bandwidth, R8a instances are ideal for latency-sensitive workloads. They provide up to 60% faster GroovyJVM performance, improving request throughput and response times for critical applications. Built on the AWS Nitro System with sixth-generation Nitro Cards, R8a instances suit high-performance, memory-intensive tasks such as databases, in-memory caches, real-time analytics, and EDA applications. The instances come in 12 sizes, including two bare metal options, and are SAP-certified with 38% more SAPS than R7a instances.

Why it matters

Amazon EC2 R8a instances are a new instance type designed for high-performance and memory-intensive workloads, particularly suitable for databases, caches, and real-time analytics applications

Today, Amazon Quick's agentic AI capabilities are available in AWS GovCloud (US-West), providing government and regulated industry teams with an AI teammate in an isolated, FedRAMP Class D (formerly High) authorized environment. Quick turns questions into actions, accelerating mission-critical decisions without switching applications. Teams can build custom chat agents for mission-specific workflows such as procurement, ATO compliance, and grants management, with all data hosted and processed entirely within the AWS GovCloud (US-West) Region. Spaces enforce least-privilege access, ensuring analysts only see mission-relevant data. Quick integrates with existing tools like Microsoft 365, SharePoint, and OneDrive via GCC High connectors, as well as browser extensions. AWS GovCloud (US) Regions are isolated AWS Regions operated by U.S. citizens on U.S. soil, built to host sensitive data and regulated workloads. Customers can meet stringent U.S. government security and compliance requirements, including FedRAMP Class D (formerly High), DoD SRG Impact Levels 4 and 5, ITAR, CJIS, and FIPS 140-3. Authorized foundation model inference is processed within the AWS GovCloud (US-West) Region, with enterprise governance features available at launch. Amazon Quick's agentic AI capabilities are now available in eight AWS Regions: US East (N. Virginia), US West (Oregon), Europe (Frankfurt, Ireland, London), Asia Pacific (Sydney, Tokyo), and AWS GovCloud (US-West).

Why it matters

This update makes Amazon Quick's agentic AI capabilities available in AWS GovCloud (US-West) for government and regulated industry teams, helping them make mission-critical decisions faster

Amazon Nova Multimodal Embeddings is now generally available in AWS GovCloud (US-West). This advanced embedding model processes text, documents, images, video, and audio through a single model, enabling accurate cross-modal retrieval. It eliminates the need for multiple specialized models, reducing complexity, cost, and data silos. Developers can now search video archives with complex queries, find relevant product images from customer questions, or search financial documents containing infographics and text explanations-all using one model. The model supports inputs up to 8K tokens and video/audio segments up to 30 seconds, with the ability to segment larger files. Multiple output embedding dimensions allow organizations to balance accuracy and performance with storage and computation costs. Both synchronous and asynchronous APIs are available, optimizing for latency-sensitive and high-volume workloads

Why it matters

This update impacts developers building cross-modal search or RAG agents and organizations managing multiple content types

NVIDIA's Nemotron 3.5 Lightning model is now available on Amazon SageMaker JumpStart, providing AWS customers with access to the fastest open model in its class for persistent agent workloads and rapid task execution. Engineered for persistent agents and high-throughput enterprise automation across domains including personal assistants, financial document processing, cybersecurity triage, and telecom operations, it features a hybrid Mixture-of-Experts (MoE) architecture with 30B total parameters and only 3B active per forward pass, achieving up to 4x the throughput (~410 tokens/sec) and 30% faster task completion over comparable models. Distilled from Nemotron 3 Ultra, it handles up to 1M tokens of context via DFlash speculative decoding and integrates directly with popular agent harnesses. The model is fully open-trained on open datasets, allowing enterprises to post-train for their own tools, workflows, and policies, and deploy with complete ownership across edge, on-premises, or cloud infrastructure. With SageMaker JumpStart, customers can deploy this model in a few clicks to power their specific AI workloads.

Amazon Bedrock is a fully managed service that provides secure, enterprise-grade access to high-performing foundation models from leading AI companies, enabling you to build and scale generative AI applications. It now supports cost allocation by AWS Identity and Access Management (IAM) principal, including IAM users and roles, for model inference requests made through the bedrock-mantle endpoint. This extends the capability previously available for the bedrock-runtime endpoint, helping customers attribute inference costs across users, teams, projects, and applications. Customers can tag IAM users and roles with attributes such as team, project, or cost center, activate them as cost allocation tags, and analyze bedrock-mantle inference costs by those tags in AWS Cost Explorer or at the line-item level in AWS Cost and Usage Report 2.0 (CUR 2.0). This feature is available in all AWS Regions where the bedrock-mantle endpoint is available

Amazon Connect Customer has introduced a performance dashboard for cases, allowing managers to monitor case volume, resolution trends, and service level agreement (SLA) target performance. The dashboard enables comparison of current and prior-period performance across metrics such as cases created, average resolution time, first-contact resolution percentage, and SLA achievement rate. It also supports trend analysis across dimensions like case template, assigned user, or assigned queue. For instance, a manager can identify if the billing team missed more SLA targets for refund cases than in the prior period, investigate causes, and prioritize process improvements.

Why it matters

This update benefits Amazon Connect Customer administrators by enhancing case management efficiency and performance monitoring. It is particularly useful for organizations needing to track case volumes and SLA attainment.

AWS Clean Rooms now supports exporting privacy-enhanced analysis logs for SQL analyses, allowing customers to export these logs to an S3 bucket for SQL queries run in an AWS Clean Rooms collaboration. This provides insight into Spark execution details, helping users optimize and troubleshoot their queries. Collaboration owners can grant members the ability to export analysis logs when creating a collaboration or by submitting a change request. For example, a third-party measurement provider collaborating with a publisher can identify anomalous data skew causing a query to run slower than usual, accelerating time-to-resolution and optimizing costs.

Why it matters

This update is useful for users of AWS Clean Rooms who collaborate on analyzing datasets without sharing underlying data, particularly beneficial for optimizing query performance in joint analysis scenarios

AWS Glue now provides direct access to Amazon SageMaker Unified Studio, helping data engineers and analysts move from viewing the catalog in the Glue console to querying their data, running data quality checks, and building data pipelines in SageMaker Unified Studio with a single click. This integration allows users to work with catalog data or query using SageMaker Notebooks with the same IAM role. For those who haven't set up SageMaker Unified Studio yet, a new inline permissions panel helps create and configure required IAM policies directly within the setup workflow, eliminating the need to navigate to the IAM console and switch browser tabs. Users can utilize their existing IAM role and customize permissions in-context, reducing steps to get started.

Why it matters

This update enables data engineers and analysts to directly access SageMaker Unified Studio from the AWS Glue console, improving workflow efficiency

Amazon Managed Streaming for Apache Kafka (Amazon MSK) now supports in-place migration from Apache ZooKeeper to KRaft, enabling customers to migrate existing clusters to KRaft without provisioning new infrastructure, migrating data, or reconfiguring client applications. KRaft is Apache Kafka's consensus protocol that eliminates the dependency on Apache ZooKeeper for metadata management. KRaft shifts metadata management from external ZooKeeper nodes to a group of controllers within Kafka itself, allowing metadata to be stored and replicated as topics within Kafka brokers, resulting in faster metadata propagation, improved scalability, and a simplified cluster architecture. Kafka 3.9.x is the last version to support ZooKeeper, and Kafka 4.x only supports KRaft. This in-place migration gives customers an easy path to move to KRaft on their existing clusters and upgrade to Kafka 4.x. To get started, customers first upgrade to Kafka 3.9.x if they are on an older version, then customers can initiate the migration and the cluster remains available throughout the process. All steps can be performed through the MSK console, AWS CLI, or APIs. The in-place migration from Apache Zookeeper to Kraft is available today across all AWS regions where Amazon MSK provisioned is offered except European Sovereign Cloud (Germany). To learn how to get started, see the Amazon MSK Developer Guide.

AWS Marketplace buyers can now configure category-based notifications and multi-channel delivery through AWS User Notifications. Previously, buyer email notifications were limited to the AWS account root email with no way to choose which categories to receive or route them to different teams. This meant teams responsible for procurement, renewals, or cost management either missed critical notifications or had to rely on email forwarding. With this launch, buyers can choose which notification categories they receive and how they're delivered. Four notification categories are available: Products and Solutions notifications cover product version updates, instance type changes, and availability restrictions; Agreements and Subscriptions notifications cover agreement lifecycle events including starts, cancellations, renewals, and payment failures; Private Offers notifications cover new private offers and acceptance confirmations; Pricing Changes notifications cover hourly, monthly, and usage-based price increases for products you subscribe to. By default, all categories are enabled and delivered via email to the account's root address. You can add more recipients through additional email addresses, distribution lists, the AWS Console Mobile Application, or team channels in Slack and Microsoft Teams, and tailor each to receive only the notification categories relevant to their role. In January 2027, AWS Marketplace will automatically enable these category and delivery controls for all customers. Your existing notifications will continue unchanged. Opt in now to start customizing sooner. To learn more, see AWS Marketplace buyer notifications in the AWS Marketplace Buyer Guide. To enable managed notifications, visit the AWS User Notifications console. AWS Marketplace managed buyer notifications are available in all AWS Commercial Regions where AWS Marketplace is available.

AWS Identity and Access Management (IAM) has launched account access manager, a feature that streamlines the assignment of IAM roles to workforce users. Administrators can use account access manager to assign IAM roles in their AWS accounts to workforce users and groups in AWS IAM Identity Center. This feature combines permissions management flexibility, user awareness, and a single point of federation. It is accessible through the AWS IAM console, AWS SDK, and CloudFormation/CDK. Previously, customers granting workforce access to AWS accounts could use one of two alternative access management approaches. They could federate users separately into each AWS account and define user permissions narrowly using IAM roles in each AWS account. Alternatively, they could federate users once through IAM Identity Center and tailor and manage their access centrally by adjusting and provisioning AWS managed permission sets. The newly released account access manager offers a solution for customers who want the single federation point and user awareness of IAM Identity Center along with the flexibility of IAM roles. Account access manager is provided at no additional cost and is available in all AWS Commercial Regions enabled by default.

Z.ai's GLM-5.2 FP8, NVIDIA's Nemotron-Nano-12B-v2, and Z.ai's GLM-OCR models are now available on Amazon SageMaker JumpStart, expanding the portfolio of foundation models for AWS customers. GLM-5.2 FP8 is optimized for long-horizon tasks and agentic engineering workflows, offering a 1M-token context window. NVIDIA-Nemotron-Nano-12B-v2 provides high inference throughput for unified and non-reasoning tasks with a hybrid Mamba-2 and Transformer architecture and a 128K context length. GLM-OCR delivers accurate document understanding for complex materials like scanned PDFs and handwritten notes, converting them into clean Markdown, JSON, or LaTeX. Customers can deploy any of these models with just a few clicks using the SageMaker console or Python SDK

Amazon EC2 High Memory U7in-24TB instances (u7in-24tb.224xlarge) are now available in the AWS South America (São Paulo) region. U7i instances are part of AWS's 7th generation and are powered by custom fourth-generation Intel Xeon Scalable processors (Sapphire Rapids). U7in-24TB instances offer 24 TiB of DDR5 memory, enabling customers to scale transaction processing throughput in fast-growing data environments. These instances deliver 896 vCPUs and support up to 100 Gbps of Amazon EBS bandwidth for faster data loading and backups, 200 Gbps of network bandwidth, and ENA Express. U7i instances are ideal for customers running mission-critical in-memory databases such as SAP HANA, Oracle, and SQL Server.

Redis's langcache-embed-v3-small, JetBrains' Mellum2-12B-A2.5B-Thinking, and LightOn's LightOnOCR-2-1B models are now available on Amazon SageMaker JumpStart, expanding the portfolio of foundation models for AWS customers. These three models provide specialized capabilities in semantic caching optimization, code-focused reasoning, and end-to-end document OCR, enabling customers to deploy high-performance, scalable AI solutions on AWS infrastructure. langcache-embed-v3-small is optimized for semantic caching in LLM applications. It maps sentences and paragraphs into a dense vector space designed for identifying semantically equivalent queries regardless of phrasing, enabling intelligent cache hits that reduce redundant LLM calls and accelerate response times in high-volume inference workloads. Mellum2-12B-A2.5B-Thinking excels in code generation, debugging, multi-step reasoning, and agentic coding workflows. It uses a Mixture-of-Experts architecture (64 experts, 8 activated per token), activating only 2.5B of its 12B total parameters per forward pass with a 131,072-token context length. It emits explicit chain-of-thought reasoning traces before final answers, delivering high-throughput, low-latency inference ideal for routing, RAG, sub-agents, and private deployments. LightOnOCR-2-1B provides end-to-end multilingual document-to-text conversion for PDFs, scans, and images without brittle OCR pipelines. This 1B-parameter vision-language model directly transduces page images into clean, naturally ordered text, achieving state-of-the-art performance on OlmOCR-Bench while being ~9× smaller and significantly faster than competing approaches. With SageMaker JumpStart, customers can deploy any of these models with just a few clicks to address their specific AI use cases. To get started with these models, navigate to the SageMaker JumpStart model catalog in the SageMaker console or use the SageMaker Python SDK to deploy the models to your AWS account. For more information about deploying and using foundation models in SageMaker JumpStart, see the Amazon SageMaker JumpStart documentation.

Black Forest Labs' FLUX.2-small-decoder and Google's gemma-4-12B-it models are now available on Amazon SageMaker JumpStart. FLUX.2-small-decoder is optimized for faster image decoding with lower VRAM usage in FLUX.2 image generation pipelines, offering approximately 1.4× faster decoding speed at 1.4× lower VRAM consumption. gemma-4-12B-it excels in unified multimodal understanding across text, image, and audio inputs, supporting function calling and agentic workflows. With SageMaker JumpStart, customers can deploy these models with just a few clicks.

Amazon RDS for MariaDB now supports MariaDB major version 12.3, the latest Long-Term Support release from the MariaDB community. This release includes compatibility with the Oracle TO_DATE() function, reducing code changes needed when migrating applications from Oracle to MariaDB. It adds an IS JSON predicate for native JSON document validation in the database. The query optimizer now handles reorderable LEFT JOIN statements and ordered scans over RANGE partitions more efficiently, improving performance for these queries without application changes. Users can upgrade their database using Amazon RDS Blue/Green Deployments, in-place upgrades, or by restoring from a snapshot. Migration to RDS for MariaDB 12.3 from external MariaDB sources is also possible using AWS Database Migration Service.

AWS Secrets Manager now extends its managed external secrets capability to include Jenkins API Tokens and SonarQube Tokens, enabling you to automatically rotate these third-party credentials directly from the AWS console without writing any custom rotation code. For Jenkins, Secrets Manager mints a new token and revokes the old one only after the replacement is verified active, so your continuous integration and continuous delivery (CI/CD) jobs transition without interruption. Rotation supports both self-rotation, where the token being rotated authenticates its own replacement, and admin-assisted rotation, where a separate admin token performs the generate and revoke operations. For SonarQube, you can rotate three types of tokens - User Tokens, Global Analysis Tokens, and Project Analysis Tokens - via SonarQube's Web API. User Tokens support self-rotation, while analysis tokens are rotated using an admin token. These integrations join existing managed external secrets support for BigID, Confluent Cloud, Datadog, GitLab, MongoDB Atlas, Okta, Paddle, Salesforce, and Snowflake. Jenkins and SonarQube managed external secrets are available in all AWS Regions where AWS Secrets Manager managed external secrets is supported.

The next generation of Amazon OpenSearch Serverless now supports up to 10,000 collections within a single collection group, increased from the previous limit of 1,500. Collection groups organize multiple collections and allow them to share OpenSearch Compute Units (OCUs), even when collections are encrypted with different AWS KMS keys. With this higher limit, you can consolidate significantly more collections into a single collection group and manage them under a shared set of capacity limits. Customers use collection groups to reduce costs by sharing compute across many collections rather than provisioning separate OCUs for each KMS key, while still maintaining collection-level security and access controls. As customer workloads have grown, particularly for multi-tenant applications that provision a collection per tenant, the previous limit of 1,500 collections per group constrained how many tenants could benefit from a shared compute pool. Raising the limit to 10,000 collections on the next generation of Amazon OpenSearch Serverless allows you to scale these workloads further, improve compute utilization, and lower per-collection cost without creating and operating additional collection groups. The higher limit applies automatically to new and existing next-gen collection groups. The increased limit is available on the next generation of Amazon OpenSearch Serverless in all AWS Regions where it is offered. To learn more, see Amazon OpenSearch Serverless technical documentation and quotas.

Amazon EC2 has introduced application status checks, a new status check that helps customers detect and respond to application-level issues on their EC2 instances. With application status checks, EC2 monitors applications to detect issues such as a web server that has stopped accepting requests, a Docker daemon that is not running, an incorrect networking configuration, or a network interface that is no longer passing traffic. Customers can create a check by specifying the protocol, port, and path to monitor, along with the response codes that indicate a healthy application. After associating the check with their instances by instance ID or tag, Amazon EC2 sends HTTP or HTTPS requests to that port and path and reports on the application’s status every 60 seconds. Auto Scaling groups act on application status, initiating recovery by replacing instances when their applications report unhealthy. Application status checks are available in all commercial AWS Regions and AWS GovCloud (US) Regions.

Amazon GameLift Streams now manages shader cache capture and distribution for applications. Users capture a shader cache from a stream session, and the service automatically makes it available for future sessions across streaming locations, with no application changes required. This reduces loading times and visual stuttering during sessions. Users can monitor shader cache status and storage size using the ListApplicationShaderCaches API or the Amazon GameLift Streams console. The feature supports Linux (Ubuntu 22.04), Proton, and Windows Server 2022 runtimes. Users are charged for storage of the latest version of each shader cache.

AWS Elastic Disaster Recovery (AWS DRS) now preserves UEFI boot mode when recovering Linux source servers that boot with UEFI firmware. Previously, DRS launched these Linux servers in legacy BIOS mode, which could require extra configuration after recovery. Now, your recovered Linux instances launch with the same UEFI boot mode as your source servers. This means your recovery instances more closely match your source environment, so applications that depend on UEFI boot behavior come back exactly as you expect - with no additional post-recovery steps. Boot mode preservation is automatic, with nothing to configure. This capability is available in all AWS Regions where AWS DRS is offered, at no additional cost.

Amazon VPC IPAM now supports BGP route protection monitoring and delegated Resource Public Key Infrastructure (RPKI) management for Bring Your Own IP (BYOIP) prefixes. Network administrators can centrally monitor BGP route protection and automate Route Origin Authorization (ROA) management across their organization. Using BGP route monitoring, you can view RPKI validity status, ROA strength, and route overlap detection for all BYOIP prefixes across accounts and regions from a single dashboard. With Delegated RPKI, administrators perform a one-time setup with their Regional Internet Registry (ARIN, RIPE, APNIC, or LACNIC), after which IPAM automatically creates ROAs during BYOIP provisioning, renews them before expiration, and manages ROAs for on-premises prefixes. This feature is available within Amazon VPC IPAM in all commercial AWS Regions, excluding AWS GovCloud (US) Regions and China (Beijing, operated by Sinnet) and China (Ningxia, operated by NWCD).

Amazon EC2 R8i and R8i-Flex instances are now available in the Europe (Milan) region. Powered by custom Intel Xeon 6 processors exclusive to AWS, these instances deliver the highest performance and fastest memory bandwidth among comparable Intel processors in the cloud. The R8i and R8i-Flex instances offer up to 15% better price-performance and 2.5x more memory bandwidth compared to previous generation Intel-based instances. R8i instances are SAP-certified and deliver 142,100 aSAPS, the highest among all comparable machines in on-premises and cloud environments. R8i-Flex instances provide flexible options for memory-intensive workloads in common sizes from large to 16xlarge.

Today, Amazon Bedrock AgentCore introduces new capabilities in AWS GovCloud (US-West). AgentCore is the platform to build, connect, and optimize agents. These capabilities enable teams in regulated environments to develop context-aware agents and accelerate their journey from prototype to production, with the necessary controls for scaling across the organization. AgentCore memory provides agents with short-term memory for immediate conversation context and long-term memory that extracts persistent insights and preferences across sessions, delivering more intelligent, personalized experiences without requiring teams to manage complex memory infrastructure. Policy in AgentCore offers centralized, fine-grained controls for agent-tool interactions outside agent code. Teams author policies in natural language that automatically convert to Cedar, AWS's open-source policy language, and attach them to an AgentCore gateway that evaluates each request before allowing or denying tool access. The managed harness allows developers to declare an agent's model, tools, and instructions through configuration and run it with just a few API calls, without writing orchestration code, while AgentCore handles the environment, compute, memory, identity, and observability.

AWS IAM Identity Center now simplifies enabling multi-Region support when creating a new organization instance. Previously, enabling multi-Region support required multiple steps including creating a customer managed KMS key, configuring key policies, and manually adding Regions. Now, customers creating a new IAM Identity Center instance in supported Regions can enable multi-Region in one click. When enabling a new organization instance, you can choose from three instance configuration options: single-Region instance, multi-Region instance, or custom instance. The multi-Region instance option automatically creates a customer managed multi-Region KMS key in your account and replicates your instance to an additional Region. This enables resilient AWS account and application access - your workforce can continue to access their AWS accounts even if IAM Identity Center experiences a disruption in the primary Region. The custom instance option lets you configure your Region settings individually, including the ability to use an existing customer managed KMS key from your account. Instance configuration options are available in 17 enabled-by-default commercial AWS Regions for organization instances of IAM Identity Center. Standard AWS KMS charges apply for the customer managed key created with the multi-Region instance option. IAM Identity Center is provided at no additional cost.

Amazon Cognito is now available as a core skill (aws-auth) in the Agent Toolkit for AWS. AI coding agents using the toolkit can now set up, configure, secure, and troubleshoot Amazon Cognito using best-practice workflows, helping developers implement secure sign-in flows for users, AI agents, and microservices faster. The Amazon Cognito (aws-auth) skill covers user pool and app client configuration, managed login and OAuth 2.0 flows, token management, JWT authorizers, passkey/WebAuthn enrollment, threat protection, Lambda trigger wiring, and identity pools. When paired with the AWS MCP Server, agents execute AWS CLI commands with IAM-based guardrails and CloudTrail audit logging. The skill also works standalone via the AWS CLI.

Amazon Timestream for InfluxDB now allows you to create and manage your own backups and restore your data on demand. You can trigger one-time, on-demand backups, schedule automated recurring backups at the frequency and retention you choose, and restore a backup to a new resource or in place of an existing one. This capability is available for both the InfluxDB 2 and InfluxDB 3 engines through the AWS Management Console, the AWS CLI, and the Timestream for InfluxDB API. With this capability, you control your data protection strategy. You can take an on-demand backup before a risky migration or configuration change. You can also define up to four automated backup configurations per resource using hourly, daily, weekly, monthly, or custom schedules, each with its own retention period. The first backup captures a full copy of your database, and subsequent backups are incremental, reducing the performance impact of ongoing backups. When you restore a backup, you can create a new resource that inherits the source configuration or replace an existing resource. If the source resource uses a Customer Managed key (KMS), its backups use the same key. Customer-driven backup and restore is available in all AWS Regions where Amazon Timestream for InfluxDB is available.

Amazon Connect Customer now gives supervisors visibility into how well agents followed their schedules with historical agent adherence metrics on dashboards. The new metrics include scheduled time, adherent time, non-adherent time, and adherence percentage. You can group these metrics by shift activity to understand adherence patterns across different parts of an agent's day, such as work, break, or training. For example, a supervisor reviewing weekly performance identifies that an agent consistently returns late from lunch, enabling a targeted coaching conversation. Historical agent adherence metrics are available in all AWS Regions where Amazon Connect Customer agent scheduling is available.

Amazon CloudWatch announces wall clock evaluation windows for metric alarms, enabling customers to align alarm evaluations to fixed calendar boundaries such as the top of the hour, midnight, or the start of the week. This new option complements the existing sliding window behavior and is designed for customers who monitor scheduled or business-aligned workloads. With wall clock evaluation windows, customers can avoid false alarms that occur when events cross rolling window boundaries. For example, a daily backup alarm using a sliding window can trigger incorrectly if consecutive backups are slightly more than 24 hours apart, even though each calendar day had a successful backup. A wall clock window evaluates each calendar day independently, eliminating this issue. Customers can also specify a time zone so that daily alarms align to their local business day, with daylight saving time transitions handled automatically. Wall clock evaluation windows for CloudWatch Alarms are available in all AWS Regions where Amazon CloudWatch is available, except the Middle East (UAE) and Middle East (Bahrain) Regions.

Amazon Connect Customer dashboards now support drilling down into real-time queue and routing profile performance. With a single click, supervisors can drill from a summary view into pre-filtered routing profile, queue, agent, or routing step widgets. For example, a supervisor who sees a spike in queue wait times can immediately drill down to agent activity for a specific queue and reassign agents to reduce the backlog. This one-click drill-down on real-time metrics dashboards is available in all AWS commercial and AWS GovCloud (US-West) regions where Amazon Connect Customer is offered.

Amazon OpenSearch Service now supports network access controls for OpenSearch UI applications. OpenSearch UI is the fully managed web service for search, analytics, and unified observability across multiple AWS data sources. With network access controls, you can restrict access to your OpenSearch UI applications to approved networks using the same IAM condition keys (aws:SourceVpce, aws:SourceVpc, and aws:SourceIp) that you already use elsewhere in AWS, helping you establish a consistent data perimeter across your environment. You can enforce network restrictions at three levels: identity-based policies for specific principals, VPC endpoint policies to control which applications users reach through an endpoint, and resource control policies (RCPs) to enforce access uniformly across every account in your AWS organization. With RCPs, you can block off-network users before they authenticate, preventing anyone outside your corporate network or VPC from reaching the login page. Network access controls are available in all AWS Regions where OpenSearch UI is available.

AWS WAF now supports the Salt Security managed rule group, available through AWS Marketplace: Salt Managed Rules for AWS WAF - AI Agent & API Security. This rule group provides AWS WAF customers with detection and mitigation for API-focused attacks and traffic from AI agents and Model Context Protocol (MCP) endpoints, without writing or maintaining custom rules. The rule group detects common and complex API attack vectors, including credential brute force, excessive GraphQL queries, server-side request forgery (SSRF), prototype pollution, and JSON Web Token (JWT) anomalies. It identifies and labels traffic from Model Context Protocol (MCP) endpoints, blocks unauthenticated MCP access, and adds observability into MCP interactions in AWS WAF. The rule group also applies rate limiting to sensitive request parameters, such as user identifiers and email addresses, to help mitigate enumeration and abuse. To support detection and downstream analysis, it labels request attributes including authorization headers, user identifiers, and GraphQL queries. You can subscribe to the rule group and add it to a web ACL directly in the AWS WAF console through AWS Marketplace, with no additional configuration. The rule group supports versioning, and pricing is set by Salt Security through AWS Marketplace. For a full list of supported Regions, visit the AWS Regional Services page. To get started, visit the AWS WAF console or find the Salt Security rule group in AWS Marketplace. For more information, see the AWS WAF Developer Guide.

AWS Parallel Computing Service (PCS), a managed service that simplifies running and scaling high performance computing (HPC) workloads on AWS using Slurm, has expanded its security and compliance coverage. PCS is now in scope for FedRAMP Class C (formerly Moderate baseline) in the US East (Ohio), US East (N. Virginia), and US West (Oregon) Regions, and FedRAMP Class D (formerly High baseline) in the AWS GovCloud (US) Regions. PCS is included in the System and Organization Controls (SOC) 1, 2, and 3 reports, certified under ISO, holds CSA STAR certification under CCM 4.0, and is included in AWS PCI DSS and PCI 3DS attestations for workloads handling payment card data. PCS is also HIPAA eligible.

In November 2024, Amazon OpenSearch Service announced Extended Support for legacy Elasticsearch and OpenSearch engine versions. Since that announcement, many customers have upgraded to newer versions. However, some customers need more time to plan and complete their migrations. To provide this flexibility, security and operating system patch coverage for these versions is being continued for an additional 12 months, through November 7, 2027, at an updated support rate. Security and operating system patch coverage for Elasticsearch versions 1.5 to 7.8 (except Elasticsearch version 5.6, which already has extended support until November 7, 2028), OpenSearch versions 1.0 to 1.2, and OpenSearch versions 2.3 to 2.9 is being continued for an additional 12 months through November 7, 2027. Domains on these versions will not be isolated. From November 7, 2026, the Extended Support surcharge will be equal to your instance pricing for these versions. Storage costs are not affected. For Elasticsearch version 5.6, the existing extended support charges will continue. Amazon OpenSearch Service now announces Standard and Extended Support dates for Elasticsearch versions 6.8, 7.9, and 7.10, OpenSearch version 1.3, and OpenSearch versions 2.11 to 2.19. Elasticsearch versions 6.8 and 7.10 and OpenSearch versions 1.3 and 2.19 will receive 3 years of Extended Support. Elasticsearch version 7.9 and OpenSearch versions 2.11 to 2.17 will receive 1 year of Extended Support. The Extended Support charge for these versions is $0.0065 per Normalized Instance Hour (NIH) in US East (N. Virginia). For exact region pricing, see the pricing page. Customers are recommended to upgrade to the latest available OpenSearch version for improved performance, security, and new features. For more details, see the blog post, Extended Support documentation, and pricing page.

Amazon GameLift Servers now supports 21 additional Amazon EC2 instance types for managed EC2 fleets and managed container fleets. This expansion includes compute-optimized C-series (C8a, C8i, C9g) and general-purpose M-series (M8a, M8i, M9g) instances. Customers can choose between x86 and Arm architectures, selecting from 5th-generation AMD EPYC, custom Intel Xeon 6, or AWS Graviton5 processors to optimize game server workloads for performance, cost, and engine compatibility. C-series instances are ideal for running CPU-intensive multiplayer game server logic, while Graviton5-powered M9g instances enable cost-effective scaling of general-purpose fleets. These instance types are available in Amazon GameLift Servers supported regions, except AWS China.

Amazon ElastiCache now supports Graviton4-based M8g, R8g, and C8gn node families for Valkey and Memcached. Graviton4-based nodes deliver up to 47% higher throughput, up to 43% lower P99 latency, and up to 31% better price-performance for on-demand pricing over equivalent-size Graviton3-based nodes, depending on node family, size, and workload configuration. These nodes also offer more memory per node compared to equivalent Graviton3-based nodes; for example, an m8g.8xlarge provides 124.65 GiB versus 103.68 GiB on an m7g.8xlarge, up to 20% more memory at the same node size. C8gn nodes offer up to 200 Gbps of network bandwidth, enabling you to scale performance and throughput while optimizing the cost of running network-intensive workloads. M8g, R8g, and C8gn nodes are available in sizes from large to 16xlarge across over 30 AWS Regions, including AWS GovCloud (US) Regions and China Regions.

AWS announces the general availability of runtime instances, a new feature in Amazon Bedrock AgentCore that allows you to run agents on your own Amazon EC2 instances without managing infrastructure. AgentCore runtime provides purpose-built infrastructure to deploy and operate AI agents securely at scale. Runtime instances complement the existing microVM-based option in AgentCore runtime and give teams running sustained, resource-intensive, or specialized-hardware agents access to the breadth of EC2 instance types, while AgentCore handles provisioning, patching, scaling, and lifecycle management. Using the AWS Management Console, CLI, SDKs, or APIs, you create a capacity provider that specifies the EC2 instance types your agents need, including GPU-accelerated, memory-optimized, and compute-optimized families, and attach your agents to it. Runtime instances support long-running agent sessions of up to 14 days, while the default serverless, microVM-based runtime is designed for sessions of up to 8 hours that need fast startup. You can choose the right compute for each agent, or run a mix, without changing how you deploy or invoke your agents. Runtime instances are available in the following AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Mumbai), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Frankfurt), and Europe (Ireland). You are charged for the management of the compute provisioned, in addition to your Amazon EC2 costs.

Amazon Elastic Compute Cloud (Amazon EC2) G7 instances powered by NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs are now available in the Europe (Spain) Region. G7 instances deliver up to 4.6x AI inference performance and up to 2.1x graphics performance compared to G6 instances. They also provide faster performance for GPU-accelerated data analytics workloads. Customers can use G7 instances for deploying AI models for language translation, video and image analysis, and speech recognition. They also accelerate graphics workloads such as creating and rendering real-time, cinematic-quality graphics and game streaming. Additionally, G7 instances support video transcoding, spatial computing, and data analytics workloads such as recommender systems, Retrieval Augmented Generation (RAG) inference, and real-time data pipelines. G7 instances feature up to 8 NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs with 32 GB of memory per GPU and custom Intel Xeon 6 processors. They support up to 192 virtual CPUs (vCPUs) and up to 700 Gbps of Elastic Fabric Adapter (EFA) networking bandwidth. They also support up to 768 GiB of system memory, and up to 7.6 TB of local NVMe SSD storage. You can start using Amazon EC2 G7 instances today in four AWS Regions: US East (N. Virginia and Ohio), US West (Oregon), and Europe (Spain). You can purchase G7 instances as On-Demand Instances, Spot Instances, or as part of Savings Plans. To get started, visit the AWS Management Console, AWS Command Line Interface (CLI), and AWS SDKs. To learn more, visit the G7 instance page.

The AWS Lambda console now extends its console-to-IDE integration to support Kiro and Cursor IDEs. This expansion builds on the existing console-to-IDE transition for Visual Studio Code (VS Code), providing a seamless transition between cloud and local development environments for serverless developers using these popular IDEs. With the expanded console-to-IDE integration, developers can start from the Lambda console and follow a guided setup to begin local development in Kiro or Cursor while preserving their existing code and configurations. This capability also enables developers to easily convert their applications to an AWS Serverless Application Model (AWS SAM) template using Kiro and Cursor, simplifying their Infrastructure as Code (IaC) practices and CI/CD pipeline integration. This feature is available in all commercial AWS Regions where Lambda is available, at no additional cost. To get started, click the "Open in Kiro" or "Open in Cursor" button in the Lambda console's Code tab or in the Getting Started popup when creating a new function. This will automatically open your function in the selected IDE on your local device.

Amazon Elastic Container Service (Amazon ECS) now supports fractional GPU scheduling with Amazon EC2 G6f instances, allowing you to run workloads on GPU partitions as small as one-eighth of an NVIDIA L4 Tensor Core GPU with 3 GB of GPU memory. Fractional GPUs provide the flexibility to right-size containers for small-model AI inference, model experimentation, graphics rendering, and other workloads that do not require a full GPU, helping reduce infrastructure costs compared to provisioning a full GPU instance. You can request a fractional GPU by setting GPU=0.125, GPU=0.25, or GPU=0.5 in the container definition of your Amazon ECS task definition. Amazon ECS then places the task on a G6f instance that satisfies the request. Fractional GPU configuration is supported on both Amazon ECS Managed Instances and Amazon ECS on EC2. With ECS Managed Instances, you get a fully managed experience where ECS automatically handles instance provisioning, scaling, patching, and lifecycle management, allowing you to focus on your GPU workloads rather than infrastructure operations. ECS Managed Instances also include capabilities built specifically for accelerated workloads, such as GPU metrics through Amazon CloudWatch Container Insights, and automatic health monitoring that detects GPU hardware failures and replaces unhealthy instances to minimize workload disruption. This capability is available in all AWS Regions where Amazon EC2 G6f instances are available.

Amazon WorkSpaces now publishes additional performance and session health metrics to Amazon CloudWatch, enabling IT administrators to gain deeper visibility into their virtual desktop workloads. These new metrics cover network performance, compute and storage resource utilization, and session lifecycle events-all available at no additional cost. With these metrics, administrators can proactively identify and troubleshoot issues impacting end-user experience. For example, TCP retransmission rate and congestion window help pinpoint network degradation, GPU usage and CPU queue length reveal compute bottlenecks, and storage metrics like disk I/O queue lengths and memory page hard faults provide visibility into disk saturation and memory pressure. Administrators can set CloudWatch alarms for rapid detection of performance issues, build custom dashboards for fleet-wide visibility, and reduce mean time to resolution. These metrics are available in all AWS Regions where Amazon WorkSpaces is supported.

Amazon WorkSpaces Applications now publishes additional performance and session health metrics to Amazon CloudWatch, enabling IT administrators to gain deeper visibility into their application streaming workloads. These new metrics cover network performance, compute resource utilization, and session lifecycle events-all available at no additional cost. With these metrics, administrators can proactively identify and troubleshoot issues impacting end-user experience. For example, metrics such as TCP retransmission rate and congestion window help pinpoint network degradation, while GPU utilization and memory page hard faults reveal resource bottlenecks before they affect session quality. Session lifecycle metrics like connection failures and connection duration allow teams to set CloudWatch alarms for rapid detection of connectivity issues, build custom dashboards for fleet-wide visibility, and reduce mean time to resolution. These metrics are available in all AWS Regions where Amazon WorkSpaces Applications is supported.

Amazon RDS now provides visibility into the initialization status of database storage volumes created from snapshots. This allows you to determine when your storage is fully initialized after a restore and ready to support latency-sensitive database workloads at fully provisioned performance. When restoring a database instance to a point-in-time, creating a read replica, or converting from Single-AZ to Multi-AZ, Amazon RDS creates storage volumes from a snapshot. These volumes undergo initialization, during which storage blocks are downloaded from Amazon S3 and written to the volume before they can be accessed. The initialization rate varies depending on the workload and which blocks are accessed, and during this period you may notice increased I/O latency. Previously, Amazon RDS reported the instance as available throughout initialization, giving no direct signal for when performance would stabilize. The new StorageOperationStatus and StorageOperationPercentProgress fields on the RDS Console and DescribeDBInstances API let you monitor your storage initialization progress in real time, so you can validate when all blocks have been written. You can use this information to time your workloads to align with completion. The fields also report storage optimization progress so you can plan for full provisioned performance after a storage modification. Storage volume initialization status is accessible by default for all Amazon RDS database instances in all commercial AWS Regions and US GovCloud Regions. You can start using it today through the Amazon RDS Management Console, the AWS Command Line Interface (CLI), or the AWS SDKs.

AWS Security Agent now enables penetration testing of applications that use email-based multi-factor authentication (MFA) as part of their login flow. Previously, applications requiring one-time codes or verification links sent by email were out of scope for automated pentesting because the agent had no mechanism to intercept those messages. This launch expands coverage for penetration testing customers whose target applications rely on email-based authentication. To use this feature, AWS Security Agent generates a unique forwarding address per credential, allowing you to route your application's MFA emails directly to the agent using a forwarding rule in your existing email provider. During a pentest, the agent automatically reads the forwarded message and submits the code or link to complete authentication - no email account credentials are stored, preserving a strong privacy posture. This capability complements existing TOTP support, giving customers a unified solution for testing applications across multiple MFA methods. This feature is available in all AWS Regions where AWS Security Agent is supported.

AWS Transform now automates the configuration and execution of post-launch actions through the migration workflow. Define actions at the account level and apply them automatically to each source server across your target accounts, including multi-account migrations. This automation removes the slow, error-prone work of configuring actions server by server, enabling your team to migrate more servers with less hands-on effort. Post-launch actions run through AWS Systems Manager (SSM) immediately after test or cutover launch. You can use predefined actions or bring your own SSM document. For bulk configurations of source servers, the migration inventory file now includes a new structure for post-launch actions, making it easier to review and modify actions per source server. The AWS Transform for migrations agent automates end-to-end migration configuration, including replication templates, EC2 launch templates, EC2 right-sizing, and post-launch actions, with the flexibility to create and edit any of these at the source server level. This new capability is available in all AWS Regions where AWS Transform is offered.

The AWS Glue Schema Registry is now available in ten new regions: Asia Pacific (New Zealand), Asia Pacific (Thailand), Asia Pacific (Hyderabad), Asia Pacific (Osaka), Asia Pacific (Malaysia), Asia Pacific (Melbourne), Mexico (Central), Israel (Tel Aviv), Asia Pacific (Taipei), and Canada West (Calgary). This serverless and free feature allows you to validate and control the evolution of streaming data using registered Apache Avro, JSON, and Protobuf schema formats. The Schema Registry acts as a centralized repository for managing data format and structure between decoupled applications in data streaming systems. By using it, you can eliminate data validation logic and cross-team coordination, improve streaming data quality, and reduce downstream application failures. Through Apache-licensed serializers and deserializers, the Schema Registry integrates with C# and Java applications developed for Apache Kafka/Amazon Managed Streaming for Apache Kafka, Amazon Kinesis Data Streams, Apache Flink/Amazon Managed Service for Apache Flink, and AWS Lambda.

Amazon Managed Streaming for Apache Kafka (MSK) now supports Authorizer Log Delivery for Provisioned clusters, including both Standard and Express brokers, at no additional cost. With authorizer logs, you gain detailed visibility into user and application access, identify and address client authorization issues, and meet your organization's security requirements. Each denied authorization request is captured with the client's IP address and the API it attempted, allowing you to pinpoint the root cause. You can deliver logs to Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose. Authorizer Log Delivery is available for both new and existing Provisioned clusters and can be enabled from the Amazon MSK console or AWS CLI. Amazon MSK is a fully managed service for Apache Kafka that simplifies ingesting and processing streaming data in real time. Authorizer Log Delivery is supported in all AWS Regions where Amazon MSK Provisioned clusters are available, except for the AWS European Sovereign Cloud (eusc-de-east-1) Region. To get started, visit the Amazon MSK Developer Guide.

Amazon Simple Email Service (SES) now helps identify automated email interactions. Open and Click event notifications now include an isBotEvent field that indicates whether the event was likely triggered by an automated system or a human recipient. Customers who publish Open or Click events through a configuration set event destination will now see an isBotEvent field with a value of Likely or Unlikely in event notifications. This field can be used as a signal to better understand how much of your engagement is driven by human recipients versus automated systems. This feature is available in all AWS Regions where Amazon SES is available. If you already publish Open or Click events to an event destination, the isBotEvent field is automatically included, no additional configuration is needed. To learn more, see Contents of event data that Amazon SES publishes to Amazon SNS and Contents of event data that Amazon SES publishes to Firehose in the Amazon SES Developer Guide.

AWS Backup for Amazon S3 now supports creating S3 Access Points, providing immediate read-only access to backup data using standard S3 APIs without initiating a restore. This enables targeted file recovery, data validation, compliance auditing, and forensic investigation while your backup data remains protected in your backup vault. You can create an access point for an S3 recovery point and read backup data using standard S3 operations such as GetObject, HeadObject, and ListObjectsV2. Access points work with both snapshot and continuous (point-in-time) recovery points stored in standard backup vaults or logically air-gapped vaults, including recovery points shared across accounts through AWS Resource Access Manager or Multi-party approval. While an access point is active, the associated recovery point is protected from deletion. Get started with this capability by creating access points for your S3 recovery points using the AWS Backup console, API, or CLI. This capability is available in select AWS Regions.

AWS Marketplace now supports configurable net payment terms on private offers, with options including Net 30, Net 45, Net 60, or Net 90. Previously, net payment terms were uniform across all AWS Marketplace purchases, based on the buyer's payment terms with AWS. This new feature allows sellers to configure when payment is due, aligning invoice due dates with negotiated terms between buyers and sellers. Buyers see the configured payment terms on the procurement page before accepting a private offer. The net payment terms apply uniformly to all AWS Marketplace charges within a private offer, including upfront fees, scheduled payments, and usage-based charges. For Channel Partner Private Offers (CPPO), ISVs set maximum payment terms and channel partners can offer terms at or below that ceiling. This capability is generally available in all commercial AWS Regions for sellers creating private offers. No additional setup or onboarding is required. Flexible net payment terms apply to buyers who pay by invoice. The default behavior remains unchanged; if no custom payment terms are set, the buyer's standard AWS payment terms continue to apply.

AWS IAM Identity Center now allows you to decide whether to enable management of AWS account access when you create a new organization instance. This allows you to use IAM Identity Center to manage access to AWS applications only, without the need to manage access to AWS accounts. This feature is available at the time of initial configuration of an IAM Identity Center instance and does not affect existing IAM Identity Center instances. When you choose not to enable management of AWS accounts, IAM Identity Center does not provision its service-linked role into your member accounts, which reduces the access surface in your environment. You can enable account management permissions later through instance settings or the UpdateInstance API. This capability is available in all AWS Regions where IAM Identity Center is available.

AWS Glue Data Catalog is a centralized metadata repository that helps you discover and understand data, with semantic search and support for adding business context to datasets currently in preview. Today, we are adding two new capabilities to this preview: exporting catalog metadata exports to S3 Tables for metadata querying, and expanding the semantic search preview to catalogs encrypted with AWS Key Management Service (AWS KMS) customer managed keys. When you enable the Glue metadata export, your catalog's technical and business metadata, including glossary terms, custom metadata attachments, and asset descriptions, are written to tables in the managed aws-catalog S3 table bucket. Metadata is stored in Apache Iceberg format, enabling you to query, audit, and perform time travel queries for historical analysis using standard SQL in query engines that support Iceberg, such as AWS analytics services like Amazon Athena and Amazon QuickSight as well as third-party tools. This lets you join catalog metadata with other AWS service data for additional analysis, such as auditing glossary usage and metadata changes. Catalogs encrypted with customer managed keys now support the same business context enrichment and semantic search. You can use these capabilities in the following AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), and Europe (Ireland). S3 Tables requests and storage are charged based on S3 pricing. To learn more, see the AWS Glue User Guide.

AWS Glue Data Quality now offers improved anomaly detection with a new observation mode that reduces detection of false anomalies and removes pricing for anomaly detection in ETL jobs. This new capability handles irregular data arrival intervals gracefully by avoiding over-extrapolation of trends using a constant baseline instead of a linear trend, delivering more accurate alerts and reducing noise. The new observation mode is particularly useful for exploratory data analysis, datasets with flat or random patterns, workloads without predictable trends, and cases where data quality checks are run on varying schedules or in interactive environments like notebooks. Additionally, anomaly detection for AWS Glue ETL jobs is now available at no additional cost, allowing monitoring of data quality anomalies across all Glue pipelines without pricing concerns. These improvements are available in all AWS commercial regions and AWS GovCloud (US) regions. To get started, visit the AWS Glue Data Quality documentation. For pricing details, see the AWS Glue pricing page.

Starting today, Amazon Elastic Compute Cloud (Amazon EC2) M8g instances are available in the AWS Asia Pacific (Taipei) and AWS Mexico (Central) regions. These instances are powered by AWS Graviton4 processors and deliver up to 30% better performance compared to AWS Graviton3-based instances. Amazon EC2 M8g instances are built for general-purpose workloads, such as application servers, microservices, gaming servers, midsize data stores, and caching fleets. These instances are built on the AWS Nitro System, which offloads CPU virtualization, storage, and networking functions to dedicated hardware and software to enhance the performance and security of your workloads. AWS Graviton4-based Amazon EC2 instances deliver the best performance and energy efficiency for a broad range of workloads running on Amazon EC2. These instances offer larger instance sizes with up to 3x more vCPUs and memory compared to Graviton3-based Amazon M7g instances. AWS Graviton4 processors are up to 40% faster for databases, 30% faster for web applications, and 45% faster for large Java applications than AWS Graviton3 processors. M8g instances are available in 12 different instance sizes, including two bare metal sizes. They offer up to 50 Gbps enhanced networking bandwidth and up to 40 Gbps of bandwidth to Amazon Elastic Block Store (Amazon EBS). To learn more, see Amazon EC2 M8g Instances. To explore how to migrate your workloads to Graviton-based instances, see AWS Graviton Fast Start program and Porting Advisor for Graviton. To get started, see the AWS Management Console.

Amazon Bedrock AgentCore announces two new controls: temporal policies for stateful agent authorization and rate limiting for AI traffic. Temporal policies let you define stateful authorization rules that evaluate each request in the context of an agent's prior actions within a session, because a single tool call can be safe in isolation yet harmful given what preceded it. With temporal policies you can enforce workflow sequencing, require that a tool argument exactly matches the output of a prior call, require human approval before taking privileged actions, and enforce data freshness. Rate limiting enables per-user or per-group controls over how much traffic flows to the tools, models, and agents connected to your gateway. Using rules scoped by OAuth or AWS IAM, you can set rate limits on requests across all target types, tokens for inference targets, and concurrent connections to cap long-lived concurrent sessions, aiding downstream service availability and enforcing fair limit distribution.

Amazon Quick has announced general availability of multi-dataset topics, enabling users to model relationships across multiple datasets within a single topic and utilize that model to build dashboards and answer questions in natural language. Previously, answering a question in a Quick Sight visual that spanned datasets required pre-joining the data into a single dataset-adding manual JOIN logic during data preparation, consuming extra SPICE capacity, and requiring users to rebuild multiple datasets for different use cases or when the model changed. With multi-dataset topics, a topic becomes a reusable relational data model: users add multiple datasets, define the relationships once, and Quick performs the joins at runtime. This capability applies to both dashboard building and natural-language Q&A. For dashboard building, the topic acts as the data model, allowing a single visual to draw fields from multiple datasets with Quick generating the underlying join automatically-users author the semantic model once and reuse it across every visual in the dashboard. For natural-language analytics, users can direct a chat agent to a topic and ask questions; the agent reads the relationships defined in the topic and performs runtime joins across datasets to answer, with no need to pre-join tables or prepare data first. Since both experiences query the same topic, one governed semantic model serves as the single source of truth for both people and agents. Multi-dataset topics reuse existing dataset permissions and support row-level and column-level security (RLS/CLS), ensuring established governance carries through every cross-dataset visual and every answer. Multi-dataset topics are now generally available in all AWS Regions where Amazon Quick is offered.

AWS Backup now supports logically air-gapped vaults for Amazon Neptune in three additional AWS Regions: Asia Pacific (Melbourne), Europe (Spain), and Europe (Zurich). With this expansion, you can store Neptune backups in logically air-gapped vaults in these Regions. Logically air-gapped vaults are immutable, locked by default, and encrypted using AWS owned keys or customer-managed keys. You can copy backups across accounts and Regions, share vaults for recovery using AWS Resource Access Manager (RAM), and protect vault access during account compromise with Multi-party approval. This helps reduce recovery time and meet your disaster recovery and compliance requirements. To get started, visit the AWS Backup console, AWS Command Line Interface (CLI), or AWS SDKs. For a complete list of supported Regions and features, visit the AWS Backup documentation. To learn more about logically air-gapped vaults, visit the product page and pricing page.

Amazon Aurora serverless now delivers higher initial capacity during scale-up events, reaching up to 12 ACUs within a second and continuing to scale up to 256 ACUs as your workload grows. When the workload finishes, Aurora serverless automatically scales down to zero. This makes it especially well-suited for agentic AI applications, which typically have bursts of activity, long idle windows, and unpredictable traffic patterns. Aurora serverless handles all of it automatically, scaling capacity with your agents, so you only pay for what you use. This enhancement is enabled by default on all Aurora serverless clusters running on platform version 3 or 4, with no configuration changes required. Existing clusters on platform versions 1 and 2 can upgrade directly to the latest platform version 4 to benefit from these improvements.

AWS announces the general availability of vector search for Amazon DynamoDB, a new feature to index and search vectors in real time. As vector datasets grow into the billions or trillions, vector search at scale traditionally trades off search speed, scale, and accuracy: latency climbs with vector count unless you accept lower recall or throughput. DynamoDB now supports native vector search with single-digit millisecond latency at 99%+ recall and is designed for any scale, even trillions of vectors. With DynamoDB vector search, you store vector embeddings alongside your other attributes and generate them using a model of your choice, including models available on Amazon Bedrock. You create a vector index and run approximate nearest neighbor searches, pick the vector index partition key to scale, and filter on attributes to scope results. You get the same serverless benefits you rely on today: zero infrastructure management, zero downtime, zero maintenance windows, and pay for only what you use. You can already use DynamoDB to store memory for AI agents, and with vector search you can now add semantic retrieval over that memory for agentic grounding, along with product similarity search, personalized advertising, retrieval augmented generation, and recommendation systems, with predictable performance.

AWS Marketplace now provides AI Insights, allowing buyers to understand how a product's pricing works before purchase. Available in the pricing section of each listing, AI Insights explains pricing in plain language: what a pricing unit maps to, how billing changes as usage scales, how multiple pricing dimensions combine into one cost, and what is and isn't included. Previously, answering these questions required visiting multiple websites and piecing together details. Now, the context is on the listing itself, enabling buyers to evaluate pricing and proceed to purchase without switching tabs. AI Insights cites sources, drawing from the pricing the seller publishes on the Marketplace listing and additional pricing context on the seller's public website. It is live today on most listings where external pricing context is available, in all commercial AWS Regions where AWS Marketplace operates. Sellers can review and request edits to their listing's AI Insights content at any time via the Contact Us form linked on the AI Insights page in the AWS Marketplace Seller Guide.

Amazon Keyspaces (for Apache Cassandra) is now available in the Canada West (Calgary) Region (ca-west-1), allowing customers in the Canada West Region to build Cassandra-compatible applications with lower latency while keeping their data within the Region to meet data residency requirements. Amazon Keyspaces is a scalable, highly available, and managed Apache Cassandra-compatible database service. It is serverless, so you pay only for the resources you use, and you can build applications that serve thousands of requests per second with virtually unlimited throughput and storage. This regional expansion enables organizations in Canada to build highly scalable, low-latency applications using familiar Cassandra Query Language (CQL) without the operational burden of managing Cassandra clusters.

AWS Lambda now supports scalable network bandwidth for Lambda functions outside a VPC. Functions configured with 2 GB or more of memory can access network bandwidth that scales proportionally, from 625 Mbps at 2 GB up to 3,000 Mbps at 10 GB. This feature helps reduce function execution times and per-invocation costs for latency-sensitive workloads that need to transfer large volumes of data from external sources. To enable, submit a request through AWS Service Quotas under the Network bandwidth per execution environment quota. Once enabled, bandwidth scales automatically based on the function's memory configuration for all functions outside a VPC. This feature is available at no additional charge in all commercial AWS Regions.

Amazon Connect Customer now allows you to generate capacity plans at the interval level (15-minute or 30-minute intervals), giving workforce planners visibility into more granular staffing requirements across Voice, Chat, Task, and Email channels. Interval-level plans capture how demand shifts throughout the day - such as a lunchtime surge in chat contacts or an end-of-day change in call volume - so you can align agent capacity with demand as it changes and staff precisely for each part of the day. You can also provide shrinkage assumptions and available headcount at the interval level for more accurate plans. Together, these capabilities improve planning accuracy and help you reduce over- and under-staffing, improving service levels and operational efficiency.

Amazon S3 Vectors is now available in the AWS European Sovereign Cloud (Germany) Region. S3 Vectors is purpose-built vector storage for AI agents, inference, Retrieval Augmented Generation (RAG), and semantic search at billion-vector scale. It offers the same elasticity, durability, and availability as Amazon S3, with dedicated APIs for storing, accessing, and querying vectors without provisioning infrastructure.

AWS Network Firewall now includes explicit forward proxy functionality. Previously, the Network Firewall proxy was a standalone product separate from the transparent firewall, using its own proxy security policy. Based on customer feedback, the explicit proxy is now reintroduced as a feature of Network Firewall. With this launch, you can configure Network Firewall with your existing firewall policy in a new no-source-preservation deployment, using it as an explicit proxy with all existing features, including managed rule groups, active threat defense, Geo-IP filtering, URL and domain category filtering, and container attribute-based rules for Amazon EKS and Amazon ECS. You can create a single security policy and use it for both explicit proxy and transparent firewall functionalities. Currently available in the US East (Ohio) region for testing environments. No-source-preservation Network Firewall is free during the public preview.

Amazon EC2 I8g instances are now generally available in the AWS Europe (Paris) and Asia Pacific (Jakarta) regions. Powered by AWS Graviton4 processors, I8g instances are optimized for storage-intensive workloads. They utilize third-generation AWS Nitro SSDs, delivering up to 65% better real-time storage performance per TB compared to I4g instances, with up to 50% lower storage I/O latency and up to 60% lower storage I/O latency variability. Built on the AWS Nitro System, these instances offload CPU virtualization, storage, and networking functions to dedicated hardware and software, enhancing performance and security for workloads. I8g instances are designed for I/O-intensive workloads requiring rapid data access and real-time latency from storage, excelling in transactional and real-time distributed databases (MySQL, PostgreSQL, HBase, Aerospike, MongoDB, ClickHouse, Apache Druid), real-time analytics platforms (Apache Spark), data lakehouse, and AI LLM pre-processing for training. Available in eleven sizes, including two metal sizes, with 1.5 TiB of memory and 45 TB of local instance storage, they deliver up to 100 Gbps of network bandwidth and 60 Gbps of dedicated bandwidth for Amazon Elastic Block Store (EBS).

AWS Application Load Balancer (ALB) and Network Load Balancer (NLB) now support new TLS-based security policies that comply with RFC 9151 TLS server requirements for Commercial National Security Algorithm (CNSA) 1.0 suite requirements. These policies implement cryptographic requirements defined by the US National Security Agency (NSA) for secure communications using TLS 1.2 and TLS 1.3 protocols. Customers required to meet CNSA 1.0 TLS security requirements can now use ALB and NLB with RFC 9151 compliant security policies. Broader interoperability policies are also supported, allowing you to implement CNSA by default while maintaining compatibility with non-CNSA clients during their transition to RFC 9151 compliance, minimizing service disruption. This feature is available for ALB and NLB in all AWS Commercial Regions, AWS GovCloud (US) Regions, and the China region at no additional cost. To use this capability, update existing ALB HTTPS listeners or NLB TLS listeners to an RFC 9151 compliant security policy, or select a compliant policy when creating new listeners through the AWS Management Console, CLI, API, or SDK.

Amazon EC2 C8g instances are now available in the AWS Europe (Paris), AWS Africa (Cape Town), AWS Israel (Tel Aviv), and AWS Canada West (Calgary) regions. These instances are powered by AWS Graviton4 processors and deliver up to 30% better performance compared to AWS Graviton3-based instances. Amazon EC2 C8g instances are built for compute-intensive workloads, such as high performance computing (HPC), batch processing, gaming, video encoding, scientific modeling, distributed analytics, CPU-based machine learning (ML) inference, and ad serving. These instances are built on the AWS Nitro System, which offloads CPU virtualization, storage, and networking functions to dedicated hardware and software to enhance the performance and security of your workloads. C8g instances are available in 12 different instance sizes, including two bare metal sizes. They offer up to 50 Gbps enhanced networking bandwidth and up to 40 Gbps of bandwidth to Amazon Elastic Block Store (Amazon EBS).

The AWS Security Hub Extended plan now includes Supply Chain Security as its 10th security category, with Chainguard and Socket as the curated partners. As developers adopt open-source libraries at scale, security teams need confidence that the packages entering their environments are trustworthy and free from malicious code. With this addition, you can detect and block malicious dependencies before they are built into your applications, with the same streamlined activation and pay-as-you-go pricing as every other Extended category. This brings the Extended plan to 23 curated partner solutions. All solutions are on a single AWS bill and no required long-term commitments. Security Hub Extended is a plan within AWS Security Hub that helps simplify how you procure, deploy, and integrate a full-stack enterprise security solution across endpoint, identity, email, network, data, browser, cloud, AI, security operations, and supply chain. Security findings from all participating solutions are emitted in the Open Cybersecurity Schema Framework (OCSF) and automatically aggregated in AWS Security Hub. The two new curated partner solutions are available today in all AWS commercial Regions where Security Hub is available.

Amazon EMR on EC2 now supports interactive Apache Spark sessions with Spark Connect. Data engineers and data scientists can develop and debug Apache Spark applications interactively from managed notebooks in Amazon SageMaker Unified Studio and their own IDEs, such as Jupyter and Visual Studio Code, with each session running on dedicated EMR on EC2 clusters. An interactive session provides a persistent Spark context that spans across cells and scripts, allowing you to blend local Python code execution with remote Spark operations. Spark Connect's client-server architecture decouples your application client from the Spark driver and allows you to maintain your preferred development environment and tooling while Spark infrastructure runs on the cluster. This architecture supports workflows including ad hoc data exploration, iterative step-by-step debugging, and incremental PySpark job development before deploying to production. For observability, you get real-time session monitoring via the Spark UI, history tracking through the Spark History Server, and session management from the EMR console or API/CLI/SDK. Interactive Sessions is available on Amazon EMR on EC2 with AWS runtime for Apache Spark (emr-spark-8.0) and later, in all AWS Regions where Amazon EMR is available, except the AWS GovCloud Regions and the China Regions. The Amazon SageMaker Unified Studio experience is available in supported regions.

Amazon Bedrock has launched Web Search in general availability. This built-in server-side tool performs web search entirely within AWS, allowing OpenAI models (GPT-5.4, GPT-5.5, and GPT-5.6 Sol/Terra/Luna) to ground responses with current web knowledge while keeping data residency within the secured AWS environment with zero data egress. Previously, adding web grounding required onboarding third-party search providers, managing separate API keys and billing, building custom orchestration, and conducting additional compliance reviews for each external vendor. Web Search removes this overhead by enabling grounding with a single parameter in an existing API call, with no vendor onboarding, no external APIs to orchestrate, and no additional vendor security reviews. Built by Amazon with years of experience from Alexa+, Amazon Quick, and Kiro, Web Search combines a web index spanning tens of billions of documents refreshed continually with a built-in knowledge graph providing verified facts. Instead of returning raw pages, it performs semantic snippet extraction, delivering context-efficient results optimized for the model's context window with low latency. It integrates through a standardized tool-use interface compatible with the OpenAI Responses API. Simply add the web search tool to the API call, and Bedrock handles the entire search lifecycle server-side; a single API call returns a grounded response with citations. Web Search on Amazon Bedrock is now available in US East (N. Virginia), US East (Ohio), and US West (Oregon).

Amazon Connect Customer now supports exporting cases to a CSV file directly from the agent workspace, making it easier to share case data with internal teams and external stakeholders such as vendors, legal teams, or business partners. Agents can filter and select cases and choose which case fields to include in the export. Admins can control access using a security profile permission. The Cases feature is available in the following AWS regions: US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (London), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Africa (Cape Town).

Amazon SageMaker Studio notebooks now support G7 instances powered by NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs. G7 instances deliver up to 4.6x AI inference performance compared to previous-generation G6 instances. With up to 8 GPUs and 700 Gbps of EFA-enabled network bandwidth, G7 instances help run AI inference, graphics, and data analytics workloads more efficiently. Custom Intel Xeon 6 processors, 7x EFA-enabled bandwidth and 1.5x higher FP16 Flops than G6 enable deploying models with lower latency for applications like conversational assistants, content generation tools, and recommendation engines. G7 instances are available for SageMaker Studio notebooks in the AWS US East (N. Virginia and Ohio) and US West (Oregon) regions.

AWS Lambda now supports a maximum of 10,000 event pollers for Provisioned Mode for Amazon SQS event source mappings (ESMs), a 5x increase from the previous limit of 2,000. This enables customers to reach up to 100,000 concurrent invocations, allowing them to build highly responsive and scalable event-driven applications with stringent performance requirements. Customers use Amazon SQS as an event source for Lambda to build mission-critical applications such as real-time order processing, financial transaction pipelines, IoT telemetry ingestion, and large-scale fan-out workloads. Provisioned Mode for SQS ESM allows customers to configure a minimum and maximum number of event pollers and optimize throughput for their application. However, the maximum number of pollers was previously limited to 2,000, constraining the number of concurrent invocations per ESM and requiring customers to split their workload across multiple ESMs. With this launch, customers can reach up to 10,000 event pollers and 100,000 concurrent invocations per ESM. This feature is generally available in all AWS Commercial Regions. Customers can activate Provisioned Mode for SQS ESM by configuring a minimum and maximum number of event pollers using the ESM API, AWS Console, AWS CLI, AWS SDK, AWS CloudFormation, and AWS SAM. Usage of event pollers is billed based on a billing unit called Event Poller Unit (EPU).

AWS Organizations customers can now view their maximum number of accounts quota and its utilization directly through AWS Service Quotas instead of relying on AWS Support or AWS account teams. By logging into the management account and accessing the Service Quotas console or calling the Service Quotas GetServiceQuota API, customers can monitor their current account quota utilization and request increases before reaching their limit. This quota visibility is now available in US East (N. Virginia). For more information, see viewing service quotas in the AWS Service Quotas documentation.

OpenAI GPT-5.6 Sol, Terra, and Luna models on Amazon Bedrock now support 1 million token context windows. This allows processing of entire codebases, lengthy documents, and multi-turn agent histories in a single request, enabling models to reason over broader context and return more accurate, coherent responses without chunking or information loss. With a context window size of 1 million tokens, you can analyze entire repositories for code review and migration, process long-form legal or regulatory documents end-to-end, and maintain full conversation history in multi-step agentic workflows. Prompt caching with explicit cache breakpoints applies to long context requests, so repeated context is billed at a caching discount.

AWS Transform continuous modernization is now generally available in all AWS Regions where AWS Transform is supported. This capability helps engineering teams analyze and remediate technical debt across source code repositories at scale. Teams can connect GitHub organizations, GitLab groups, and Bitbucket workspaces, run analyses on demand or on a recurring schedule, and prioritize findings across technical debt, security, agentic readiness, modernization readiness, and custom analysis criteria. With today's launch, users can connect source code providers, initiate and schedule analyses, review findings, and create remediations directly from the AWS Transform web application. For findings with an associated remediation, continuous modernization creates branches and opens pull requests or merge requests containing validated code changes for review. Analysis and remediation run in the user's AWS account using their credentials, while source code remains under their control. Users can also use the AWS Transform Kiro Power, agent plugins, or AWS Transform CLI to work from their IDE or terminal, analyze local repositories, organize repositories using labels, and run analyses locally or remotely using Amazon EC2 or AWS Batch. To get started, open the AWS Transform web application or use the AWS Transform Kiro Power and agent plugins. For more information, see AWS Transform continuous modernization in the AWS Transform User Guide.

Amazon Relational Database Service (Amazon RDS) for SQL Server now supports publishing SQL Server Audit logs to CloudWatch. SQL Server Audit is a native SQL Server feature that tracks and logs events occurring on the Database Engine. On Amazon RDS, you can create audits and audit specifications just as you would on-premises. You can now publish audit logs to S3, CloudWatch, or both. If both S3 and CloudWatch options are enabled, the audit log publication is marked as 'completed' only after the log files are uploaded to both destinations. Once in CloudWatch, you can perform real-time analysis of the log data. If retention is enabled, RDS keeps your audit logs on your DB instance for the configured period.

Amazon Relational Database Service (Amazon RDS) for SQL Server Developer Edition is now available in 13 additional AWS Regions: Asia Pacific (Hong Kong, Taipei, Hyderabad, Jakarta, Malaysia, Melbourne, New Zealand, Thailand), Canada West (Calgary), Europe (Milan, Spain), Israel (Tel Aviv), and Mexico (Central). SQL Server Developer Edition includes all the functionality of Enterprise Edition and is free of license charges for use as a development and test system. This expansion allows you to build and test applications in more regions closer to your data and end users, reducing latency and simplifying development workflows.

Amazon Relational Database Service (Amazon RDS) for SQL Server now supports Bring Your Own Media (BYOM) in 10 additional AWS Regions: Asia Pacific (Taipei, Hyderabad, Jakarta, Malaysia, Melbourne, New Zealand, Thailand), Europe (Milan, Spain), and Mexico (Central). With BYOM, customers can adopt Amazon RDS as a managed database service and reuse their existing Microsoft SQL Server licenses with active Software Assurance through Microsoft's License Mobility program. BYOM is supported on SQL Server 2019, 2022, and 2025. Amazon RDS for SQL Server BYOM integrates with AWS License Manager, enabling customers to track license usage across their AWS environment for compliance.

AWS Config now supports 15 additional AWS resource types across key services including Amazon Bedrock, Amazon OpenSearch Serverless, and Amazon SageMaker. This expansion provides greater coverage over your AWS environment, enabling you to more effectively discover, assess, audit, and remediate an even broader range of resources. If you have enabled recording for all resource types, AWS Config will automatically track these new additions. The newly supported resource types are also available in Config rules and Config aggregators. Supported resource types include AWS::AppSync::DomainName, AWS::OpenSearchServerless::AccessPolicy, AWS::Bedrock::AutomatedReasoningPolicy, AWS::SageMaker::ImageVersion, among others.

Amazon Elastic Container Registry (Amazon ECR) has increased the maximum image layer size limit to 200 GB for images pushed via Docker push. Previously, packaging assets required splitting data across multiple layers or offloading to external storage systems. With this update, customers can store up to 200 GB in a single image layer, eliminating extra complexity for use cases like embedding large language models, bundling genomics datasets, or packaging large binary dependencies directly into container images. Images pushed using the AWS SDK or CLI (UploadLayerPartAPI) remain limited to 50 GB. This feature is available in all AWS Regions and partitions where Amazon ECR is available except the Middle East (Bahrain) and Middle East (UAE) Regions.

AWS WAF now supports two new partner managed rule groups from Miggo Security, available through AWS Marketplace: Miggo Rules for AWS WAF - High Emerging Application Threats, and Miggo Rules for AWS WAF - AI/ML Application Protection. These rule groups provide AWS WAF customers with continuously updated protection against vulnerabilities that are actively exploited, have public proof-of-concept code, or appear in the CISA Known Exploited Vulnerabilities (KEV) catalog-without writing or maintaining custom rules. The High Emerging Application Threats rule group targets vulnerabilities under active exploitation, while the AI/ML Application Protection rule group focuses on generative-AI application stacks such as AI agent frameworks, LLM gateways, and model-serving infrastructure. Customers can subscribe to either rule group and add it directly to a web ACL in the AWS WAF console through AWS Marketplace, with no additional configuration required. Both rule groups support versioning, and pricing is set by Miggo through AWS Marketplace. To get started, visit the AWS WAF console or find the Miggo rule groups in AWS Marketplace. For more information, see the AWS WAF Developer Guide. For a full list of supported Regions, visit the AWS Regional Services page.

AWS Transform for full-stack Windows modernization has announced the general availability of offline source transformation, enabling customers to modernize Microsoft SQL Server databases to Amazon Aurora PostgreSQL without requiring a live database connection. AWS Transform now converts SQL Server storage objects, powered by AWS DMS, and code objects (stored procedures) using an agentic, interactive experience. Enterprises modernizing legacy .NET applications and their dependent SQL Server databases can now start their modernization by directly uploading the Data Design Language (DDL) source files from their databases. With offline source transformation, customers upload SQL Server data design language (DDL) files, assess database and stored procedure complexity, and generate a customizable transformation plan. AWS Transform converts tables, schemas and converts code objects such as stored procedures and functions, validates functional equivalence, and deploys the converted schema to Aurora PostgreSQL. The same workflow transforms database dependent .NET applications to be PostgreSQL compatible .NET applications with updated connection strings, ADO.NET and Entity Framework data-access calls. To address remaining conversion issues, customers can iterate directly in the web console or hand off to their preferred IDE using the AWS Transform MCP server. A separate synthetic data workflow populates Aurora PostgreSQL with test data for end-to-end application validation. AWS Transform for full-stack Windows modernization and offline source transformation is available in US East (N. Virginia). To get started, you can go to the AWS Transform product page or see AWS Transform for full-stack Windows documentation.

Amazon SageMaker AI serverless model customization now supports full fine-tuning for over 25 open-source models, including popular models from the gpt-oss, Gemma, Llama, Nemotron, and Qwen model families. In addition to parameter-efficient methods such as LoRA, which update a small subset of model weights, you can now update all parameters in the model for deeper adaptation when your use case requires it. Full fine-tuning allows the model to more thoroughly learn your domain-specific patterns, terminology, and task structure. This is particularly valuable when you need the model to acquire capabilities beyond surface-level style adjustments, such as learning specialized reasoning patterns, adopting complex output formats, or internalizing domain knowledge from large proprietary datasets. With serverless model customization, SageMaker manages all infrastructure provisioning and training orchestration, so you can run full fine-tuning jobs without provisioning or managing any infrastructure and you pay only for what you use. Serverless full fine-tuning on SageMaker is available in US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), and Europe (Ireland). To get started, navigate to the JumpStart and Models page in Amazon SageMaker Studio to launch a customization job, or use the SageMaker Python SDK. To learn more, and see the supported list of models, see the Amazon SageMaker AI model customization documentation.

Amazon Web Services (AWS) announces the availability of high performance Storage Optimized Amazon EC2 I7i instances in the Asia Pacific (Thailand) and Israel (Tel Aviv) Regions. Powered by 5th Gen Intel Xeon Processors with an all-core turbo frequency of 3.2 GHz, these new instances deliver up to 23% better compute performance and more than 10% better price performance over previous generation I4i instances. Powered by 3rd generation AWS Nitro SSDs, I7i instances offer up to 45TB of NVMe storage with up to 50% better real-time storage performance, up to 50% lower storage I/O latency, and up to 60% lower storage I/O latency variability compared to I4i instances. I7i instances provide compute and storage performance for x86-based storage optimized instances in Amazon EC2 ideal for I/O intensive and latency-sensitive workloads that demand very high random IOPS performance with real-time latency to access small to medium size datasets. Additionally, torn write prevention feature supports up to 16KB block sizes, enabling customers to eliminate database performance bottlenecks. I7i instances are available in eleven sizes - nine virtual sizes up to 48xlarge and two bare metal sizes - delivering up to 100Gbps of network bandwidth and 60Gbps of Amazon Elastic Block Store (EBS) bandwidth.

AWS Resilience Hub now offers recommended resilience tests that help platform engineering and site reliability teams validate how their services respond to and recover from known failure scenarios. Resilience Hub provides pre-configured tests based on your service's architecture, configuration, and resilience policy. It uses AWS Fault Injection Service (FIS) to inject controlled faults and then evaluates whether your service recovers within your defined recovery objectives. With the AWS-recommended resilience tests, teams can validate readiness for scenarios such as Availability Zone impairment, Regional impairment, and dependency failure. Each test automatically targets resources in the service, injects the required faults, produces a pass or fail outcome based on alarm evaluation and recovery objectives, then generates a detailed test report. The recommended testing on the next generation of the AWS Resilience Hub is available in the following AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Europe (Ireland), Europe (London), Europe (Frankfurt), Europe (Paris), Europe (Stockholm), Asia Pacific (Mumbai), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Asia Pacific (Seoul), and South America (São Paulo).

AWS HealthOmics now supports task-level timeout for Workflow Description Language (WDL) workflows, allowing you to set maximum execution duration for individual tasks. This feature helps healthcare and life sciences customers control costs and enable automated error recovery by defining time bounds on WDL tasks. You can add the omicsTimeout runtime attribute to any task's runtime section to specify the maximum duration a task is allowed to run. When a task exceeds the specified duration, HealthOmics stops the task and sets both task and run statuses to failed. The omicsTimeout attribute accepts duration values with standard time units (such as 90s, 2h, 1d), preventing tasks from consuming unnecessary resources and helping set cost guardrails during workflow development. This capability is available in all supported AWS HealthOmics Regions: US East (N. Virginia, Ohio), US West (Oregon), Europe (Frankfurt, Ireland, London), Israel (Tel Aviv), and Asia Pacific (Seoul, Singapore, Tokyo).

Amazon GameLift Streams now offers stream URLs, providing end users with temporary, unauthenticated access to playable stream sessions in supported web browsers. Recipients need no AWS account, credentials, or software installation. To share a playable stream, create a stream URL for a stream group and one of its applications, set how long the stream URL stays valid and how many sessions it can start, and send the link. Each person who opens the link starts an independent stream session, and Amazon GameLift Streams routes them to a nearby streaming location from the locations selected. No client integration or backend service is required. Stream URLs can be created, monitored, and revoked in the Amazon GameLift Streams console or with the new CreateStreamUrl, GetStreamUrl, ListStreamUrls, and RevokeStreamUrl APIs. There is no additional charge for stream URLs; you are charged for the stream capacity that sessions started from a stream URL consume, as described on the Amazon GameLift Streams pricing page. For a full list of supported Regions, see the AWS Region table. To get started, see Share stream sessions with stream URLs in the Amazon GameLift Streams Developer Guide and the CreateStreamUrl API Reference. To learn more about the service, see the Amazon GameLift Streams product page.

Amazon SageMaker Unified Studio now supports Teradata Vantage as a data source, allowing you to query and analyze enterprise data warehouse data directly alongside other data assets. This integration enables you to combine business-critical data stored in Teradata with data from sources like Amazon Redshift, Amazon S3, and relational databases-all within a single, governed environment. This is particularly valuable when correlating data across analytical and operational workloads. For example, you can join historical enterprise data and business metrics stored in Teradata with real-time datasets to gain deeper insights into customer behavior, financial performance, and operational trends. Data engineers and analysts can build data pipelines that bring together enterprise data warehouse assets with cloud-native datasets, streamlining cross-source workflows without switching between tools. To get started, add a Teradata Vantage connection under your project’s data section. Your Teradata data now appears in the data explorer alongside your other project data. From there, you can query it directly using the query editor, explore it in notebooks, or incorporate it into a visual ETL job-all without leaving the studio. Support for Teradata Vantage connections is available in all AWS Regions where Amazon SageMaker Unified Studio is available.

Amazon RDS for Oracle now offers 1-year and 3-year Reserved Instances for R8i and M8i instances, providing up to 53% cost savings compared to On-Demand prices. These instances are powered by custom Intel Xeon 6 processors, available only on AWS, delivering the highest performance and fastest memory bandwidth among comparable Intel processors in the cloud. R8i and M8i instances offer up to 15% better price-performance and 2.5x more memory bandwidth compared to previous generation Intel-based instances. Reserved Instance benefits apply to both Multi-AZ and Single-AZ configurations, allowing customers to freely switch between configurations within the same database instance class type, making them ideal for varying production workloads. Amazon RDS for Oracle Reserved Instances also provide size flexibility for the Oracle database engine under the Bring Your Own License (BYOL) licensing model. With size flexibility, the discounted rate for Reserved Instances automatically applies to usage of any size within the same instance family. Customers can now purchase Reserved Instances for Amazon RDS for Oracle in all AWS regions where R8i and M8i instances are available, except the South America (São Paulo) Region. For information on specific Oracle database editions and licensing options that support these database instance types, refer to the Amazon RDS user guide. To get started, purchase Reserved Instances through the AWS Management Console, AWS CLI, or AWS SDK. For detailed pricing information and purchase options, visit Amazon RDS for Oracle Pricing.

Starting today, Amazon Aurora DSQL supports multi-Region clusters in four additional AWS Regions: Europe (Stockholm), Europe (Spain), Asia Pacific (Mumbai), and Asia Pacific (Singapore). Aurora DSQL is the fastest serverless, distributed SQL database, with active-active high availability and multi-Region strong consistency. Each multi-Region cluster provides a writable endpoint in both peered Regions, presenting a single logical database that remains available even if one Region becomes unavailable. With this launch, Aurora DSQL multi-Region clusters are available in the following AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Mumbai), Asia Pacific (Osaka), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Tokyo), Canada (Central), Canada West (Calgary), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Spain), and Europe (Stockholm). Aurora DSQL single-Region clusters are available in all of these Regions and in Asia Pacific (Hong Kong), Asia Pacific (Melbourne), Asia Pacific (Sydney), and South America (São Paulo). Get started with Aurora DSQL for free with the AWS Free Tier. To learn more, visit the Aurora DSQL webpage and documentation.