AWS Updates: Sep 2026

Amazon Bedrock now offers Anthropic's Claude Opus 5, Claude Sonnet 5, and Claude Haiku 4.5 in India, Claude Opus 5 and Claude Sonnet 5 in South Korea, and Claude Sonnet 5 in Singapore. This allows customers requiring localized data processing in finance, healthcare, and public sectors to use these models at scale within their regions. In India, regional endpoints are provided via cross-region inference between Mumbai and Hyderabad. Indian customers can access these models in the India region while also using supported global cross-region inference. In South Korea, Amazon Bedrock supports the Claude Opus 5 and Claude Sonnet 5 models via in-region inference in the Seoul region (ap-northeast-2). In Singapore (ap-southeast-1), Amazon Bedrock supports the Claude Sonnet 5 model via in-region inference. Amazon Bedrock processes inference requests and data only within the called region. For the latest model availability in each region, see the Amazon Bedrock user guide's 'region availability per model' section.

Why it matters

Amazon Bedrock is a service that allows developers to access and integrate various large language models into their applications. In-region inference ensures that data does not cross borders, which is critical for meeting regulatory and security requirements.

Amazon Kinesis Video Streams now supports interface VPC endpoints via AWS PrivateLink, keeping traffic within the AWS network and off the public internet. Customers with strict security, compliance, or network isolation requirements can ingest, store, and play back video without internet gateways, NAT devices, or public IP addresses. Cameras or IoT video workloads in private subnets can send media to Kinesis Video Streams and retrieve it via private connections for playback and analytics. The endpoints can be created through the Amazon VPC console, AWS CLI, or AWS SDK, with VPC endpoint policies attached for access control. They are available in all AWS regions where Kinesis Video Streams is offered, including AWS GovCloud (US) and China (Beijing) region (operated by Sinnet).

Why it matters

Customers with strict security or compliance requirements can process video without internet gateways or public IP addresses.

Amazon Redshift simplifies troubleshooting and auditing queries on fine-grained access control-protected data. The new DEBUG permission lets data owners view unaltered secure logs across multiple Redshift data warehouses for specific identities. Consolidated permissions allow defining data permissions once, with Amazon Redshift automatically applying them across all warehouses in the AWS account. When a query accesses FGAC-protected data, sensitive values such as rewritten query text, error messages, and object names are masked in secure logs, protecting producer data from consumers. Authorized auditors and administrators can view these records without disabling secure logs to troubleshoot queries and meet compliance requirements. The DEBUG permission, granted via standard Redshift GRANT commands, is typically assigned to IAM users, roles, or IAM Identity Center users and groups, enabling those identities to view unaltered records of their own queries. Granting DEBUG to consumer account administrators provides full log visibility during troubleshooting and auditing. Permitted records remain unaltered when exported from Redshift system tables to Amazon S3 tables. This functionality is available in all AWS regions supported by Amazon Redshift. For more information, see the Amazon Redshift documentation on consolidated permissions, usage notes, and secure logs.

Why it matters

This update benefits Redshift administrators and auditors by enabling unredacted log access for troubleshooting without disabling secure logging, particularly useful for users employing federated permissions.

AWS Transform uses agent-based AI to provide assessments for migrating on-premises Apache Kafka clusters to Amazon MSK. It analyzes workloads, recommends suitable AWS services, and generates TCO business cases-including pricing options and next steps-within minutes. For Kafka workloads, the assessment agent checks compatibility, recommends appropriate MSK Express brokers, and provides cost forecasts, accelerating migration decisions. Typically, Kafka-to-MSK migration assessments require manual steps like topology mapping and compatibility checks over weeks; this feature starts by uploading a Kafka cluster inventory file or describing the cluster via chat. The agent verifies MSK compatibility (topology, version, settings, etc.), sizes MSK Express brokers, and forecasts costs across broker time, storage, data ingest, and cross-AZ transfers. Users can also create customized "what-if" scenarios to compare prices across regions, adjust retention, or explore alternative settings, generating comprehensive business cases for stakeholders. The Amazon MSK migration assessment is available in all AWS regions where AWS Transform is offered. For details, see the Amazon MSK Developer Guide "Evaluating MSK migration readiness with AI tools" or the AWS Transform User Guide.

Why it matters

This update simplifies the evaluation and decision-making process for enterprises migrating on-premises Apache Kafka clusters to Amazon MSK, accelerating migration efforts

Aws deadline cloud is a fully managed service that helps teams run compute-intensive workloads in the cloud for visual effects, animation, product design, simulation, and gaming. Customers can deliver their own software containers directly to the service using docker-enabled fleets. Those packaging software into container images can specify these images directly to deadline cloud, enabling any use case for container-deployed software such as rendering tools like blender or physics ai workloads like nvidia isaac sim and mujoco. With service-managed fleets, deadline cloud automatically deploys containerized software to all worker instances for large-scale rollout. Containers integrate with deadline cloud fleets and queues, so customers need not include container commands or image references in their job templates. This allows job bundles running locally with the open job description cli to be submitted to deadline cloud without additional changes, speeding transitions from existing containerized software workflows to fully managed rendering and compute farms. Container support is available in all aws regions where deadline cloud is offered.

Why it matters

AWS Deadline Cloud is a fully managed service that helps teams run compute-intensive workloads in the cloud for visual effects, animation, product design, simulation, and gaming. This update allows customers to bring their own containerized software directly to the service, simplifying the transition from existing workflows to a fully managed render and compute farm.

Amazon Bedrock Managed Agents (BMA), developed jointly by AWS and OpenAI, is a customized version of OpenAI's Agents API. It integrates with AWS resources, applying existing identity, permission, and governance controls. BMA manages how models maintain state, select and use tools, execute code, and coordinate multiple steps and decisions. It retains messages, tool calls, and intermediate results for sustainable sessions that can resume later with new information. Users can add reusable skills or connect agents to tools via the Model Context Protocol (MCP) server. Each agent operates under its own IAM role, supports human approval for critical actions, and logs API activity in AWS CloudTrail. During the preview period, there are no additional charges for BMA itself, though charges apply for AWS resources used. Pricing may change when BMA becomes generally available. Amazon Bedrock Managed Agents is currently in preview in US East (N. Virginia), US West (Oregon), and US East (Ohio). For more details, see the Amazon Bedrock documentation.

Why it matters

Amazon Bedrock Managed Agents is a new service that allows building agents optimized for OpenAI models entirely within AWS, useful for AI application development and automation.

AWS Deadline Cloud now supports flexible expressions and rich parameter types in job templates, allowing customers to better fit the service into existing production pipelines. The expressions include arithmetic, conditionals, string and path operations, and list inclusion or exclusion, usable with Python-style syntax. This enables splitting frame ranges per task, deriving output paths from scene names, and toggling optional flags directly within job templates. New boolean, list, and frame range parameter types align with how pipelines already describe work. Checkboxes add the --gpu flag and corresponding host requirements when set, and camera lists can become the task range for steps. Expressions are type-checked at submission and their evaluation is deterministic, ensuring predictable job execution each time. These features come from the new EXPR extension to the Open Job Description spec, available in all supported AWS regions.

Why it matters

AWS Deadline Cloud is a fully managed service that helps teams run compute-intensive workloads in the cloud for visual effects, animation, product design, simulation, and gaming. This update makes it easier to automate production pipelines.

Amazon S3 Tables now supports Apache Iceberg version 3's new data types: geometry, geography, unknown, and nanosecond timestamp. This allows native storage of geographic coordinates and nanosecond-precision event times without encoding into strings or integers, simplifying data architecture and improving storage efficiency and performance. S3 Tables supports all V3 data types, adding to existing support for variant data types, delete vectors, and row lineage. Geometry and geography columns store points, lines, and polygons natively, enabling location-based filtering for workloads like foot tracking and asset mapping. Nanosecond timestamps let telemetry and financial workloads record event times at source precision. Column defaults are automatically set without requiring backfills when adding new columns to existing rows. S3 Tables provides automatic table maintenance and compaction for Iceberg tables, ensuring performance and cost efficiency at scale across all available AWS regions.

Why it matters

Amazon S3 Tables is a service optimized for storing and querying large datasets, supporting Apache Iceberg table format to enhance data management and performance

AWS has generally released the AWS Marketplace metering agent skill, an AI-guided experience for building, deploying, and validating usage-based SaaS metering integrations. The skill assists sellers in completing integrations within an AI coding assistant, guiding them from collecting product types and pricing models to recommending appropriate metering APIs, generating tailored integration code and AWS CloudFormation stacks, and running end-to-end tests in AWS Marketplace. It validates dimensions against the seller's actual product configuration, applies built-in guardrails, deploys a serverless metering pipeline using the ResolveCustomer API, BatchMeterUsage API, and Amazon EventBridge, and verifies the integration through live testing. The skill supports concurrent agreements and helps existing sellers inspect, debug, and analyze metering records. It is available through the AWS MCP server for any AI coding assistant that supports MCP, including Amazon Q Developer and Kiro, without requiring plugin installation. To get started, see 'Setting up usage metering for SaaS subscriptions.'

Why it matters

This update benefits sellers offering SaaS products on AWS Marketplace by simplifying and improving the accuracy of building, deploying, and validating usage-based metering integrations.

AWS IAM Identity Center's identity store API now accepts Amazon Resource Names (ARNs) for users, groups, group memberships, or identity stores instead of resource IDs. This additive change allows using resource ARNs directly from IAM policy evaluations, CloudTrail events, or cross-service integrations, simplifying application code and eliminating parsing errors. The change applies to all request identifier fields in the identity store API, while responses still return resource IDs. Invalid format or incorrect resource type ARNs return a ValidationException. This feature is available in all AWS regions where AWS IAM Identity Center is offered at no additional cost. For details, see the identity store API reference.

Why it matters

Developers and administrators using AWS IAM Identity Center Identity Store APIs can now use resource ARNs directly, simplifying code and reducing errors

AWS Transfer Family now automatically approves up to 1,000 SFTP connectors per region per account, allowing additional connectors without manual approval as file transfer needs grow. The default quota remains around 100 per region and can still be increased via the AWS Service Quota console. Automatic approval applies to connectors using service-managed or Amazon VPC Lattice endpoints. For quotas exceeding 1,000, submit a higher quota request through the service quota console. This feature is available in all AWS regions where Transfer Family provides SFTP connectors. See AWS Transfer Family SFTP connector documentation for details.

Why it matters

This change affects users whose file transfer needs are growing. Users of AWS Transfer Family SFTP connectors can now add connectors without waiting for manual approval.

Partner revenue measurement (PRM) tracks AWS consumption driven by partner solutions. PRM adds multi-partner support to resource tagging, allowing revenue attribution to multiple AWS partners for the same AWS resource. This enables multiple partners contributing to the same workload to earn revenue. Previously, only one partner could be attributed as only one partner tag (aws-apn-id) existed per resource, even if multiple partners contributed to the same workload. In this update, each partner tags the resource with a new key in the format aws-apn-id-. When multiple partners tag the same resource, each partner receives revenue attribution. The existing aws-apn-id key continues to function, and resources tagged with aws-apn-id require no changes. Multi-partner support is available in all commercial AWS regions. Revenue attribution via both the existing aws-apn-id key and the new key is displayed using the "resource tagging" method, with no changes to the dashboard.

Why it matters

This update allows multiple partners to earn revenue for the same AWS resource, particularly useful when partners collaborate on a single workload, such as a consulting partner deploying and operating a software partner's product in an AWS account.

Amazon Aurora PostgreSQL-compatible edition now supports PostgreSQL versions 18.6, 17.11, 16.15, 15.19, and 14.24, including bug fixes from the PostgreSQL community and Aurora-specific enhancements. Upgrading to the latest minor version applies these improvements and addresses Common Vulnerabilities and Exposures (CVEs). Upgrades can be performed during scheduled maintenance windows. Enabling automatic minor version upgrades allows AWS Organizations to roll out upgrades gradually, starting with less critical environments and then proceeding to more important ones. For details, see upgrading Amazon Aurora PostgreSQL DB clusters. Amazon Aurora delivers high performance and availability at global scale with full PostgreSQL compatibility, offering scalable serverless compute, multi-region Aurora Global Database, Aurora I/O-Optimized for I/O-intensive workloads, and built-in security with continuous backups. To get started, see the getting started page.

Why it matters

Amazon Aurora is a managed database service compatible with PostgreSQL, offering high performance and availability. This update adds support for multiple PostgreSQL versions, providing security and performance improvements.

Amazon RDS for PostgreSQL has released Extended Support minor versions 13.23-rds.20260514, 12.22-rds.20260514, and 11.22-rds.20260514. Extended Support provides critical vulnerability and bug fixes for up to three years after major version standard support ends, extending the upgrade window to new major versions. Database upgrades can be performed using Amazon RDS Blue/Green Deployments, in-place upgrades, or restoration from snapshots. For details, see the Amazon RDS for PostgreSQL User Guide.

Why it matters

This update affects Amazon RDS users planning to upgrade PostgreSQL major versions. Extended Support extends the upgrade window and minimizes risk.

AWS announced the retirement and maintenance transitions for certain services and features. New customers cannot use the affected services after October 29, 2026, but existing customers can continue using them with ongoing AWS support. Services ending include Amazon Managed Blockchain (September 29, 2027), Amazon DevOps Guru (September 30, 2027), AWS Backint Agent for SAP ASE (September 29, 2027), and AWS Infrastructure Composer (standalone console on December 7, 2026). Amazon Mechanical Turk ended on September 29, 2026. AWS provides comprehensive migration guides and support for affected customers. For details, see the AWS Product Lifecycle page.

Why it matters

This update notifies users about AWS services transitioning to maintenance or reaching end-of-support, requiring affected customers to plan migrations in advance.

Amazon WorkSpaces Applications now offers a unified graphics image for all supported graphics instance families, including G4dn, G5, G6, and G7. This single image replaces the need for dedicated images per graphics generation, allowing you to build and manage fleets on any supported family. The console now displays all compatible instance types, helping you choose the right price and performance for your workloads. You can also change instance types between supported families for fleets built with the unified image, a capability previously limited to sizing within a single family. The unified graphics image is available in all AWS commercial and AWS GovCloud (US) regions where Amazon WorkSpaces Applications graphics instances are supported. Upgrade existing graphics images via managed image updates or start fresh by launching an image builder from the unified base image. For more information, see Amazon WorkSpaces Applications documentation.

Why it matters

Amazon WorkSpaces Applications is an enterprise desktop solution, and this update simplifies image management while allowing customers more flexibility in choosing instance types.

Amazon RDS now displays the full size of RDS snapshots in both the console and API. The total snapshot size can be retrieved programmatically using the FullSnapshotSizeInBytes field or viewed in the console under the Full Snapshot Size column. Because Amazon RDS snapshots are incremental, each snapshot stores only new blocks and references unchanged blocks from prior snapshots. The FullSnapshotSizeInBytes field shows the combined size of blocks stored directly in that snapshot and all blocks referenced from earlier snapshots. This feature is available for all Amazon RDS database instances across all commercial AWS regions, accessible today through the Amazon RDS Management Console, AWS command line interface (CLI), or AWS SDK.

Why it matters

This update benefits users who need to accurately understand snapshot sizes when managing database backups and restores.

Amazon ElastiCache Serverless for Valkey now supports public endpoints, enabling direct connections from laptops, serverless functions, or applications outside AWS. This eliminates the need for VPC setup or infrastructure provisioning and allows creation in under a minute. IAM authentication over TLS 1.3 removes the need for password management or rotation. Connections can be made using Valkey clients with Valkey GLIDE version 2.2 or later, or developer toolkits. Public endpoints are available in all commercial AWS regions and China regions at no additional cost beyond standard ElastiCache Serverless pricing. Serverless caches with Valkey 9.0 or later can be created and started using the AWS Management Console, AWS SDK, or AWS CLI.

Why it matters

This update is useful for developers and deployment teams who need direct cache access from applications or tools outside AWS.

Amazon CloudWatch Logs Insights now estimates the log data bytes scanned by a query on selected log groups and time ranges without executing it, allowing adjustments before running. The CloudWatch console shows estimates automatically when changing log groups, time ranges, or query text. With AWS CLI or API, append the estimate command to request explicitly. Queries using the estimate command do not incur CloudWatch Logs Insights query charges. This feature is available in all AWS commercial regions. For details, see Amazon CloudWatch Logs documentation.

Why it matters

This update benefits developers and operations teams using CloudWatch Logs Insights by allowing them to estimate query scan volumes beforehand, aiding in cost management and performance optimization.

AWS Systems Manager now allows sharing SSM documents across an organization or specific organizational units (OUs) using AWS Resource Access Manager (AWS RAM). Previously, documents could only be shared publicly or with individual account IDs, but now they can be easily shared with entire organizations or OUs, and Systems Manager automatically keeps the sharing up to date-so manual account tracking is no longer needed when accounts are added to or removed from the organization or OU. To share documents, create an AWS RAM resource share, add the SSM documents you want to share, and select the organizations or OUs to share with. Access is granted through standard AWS authentication, as sharing is managed by AWS RAM and resource-based policies. If sharing documents with accounts outside the organization, those accounts must accept the resource share invitation before access is granted, giving both document owners and consumers more control over shared access. This feature is available via the Systems Manager console, AWS CLI, and AWS SDK in all AWS Regions where Systems Manager is offered, at no additional cost. To get started, open the document page in the Systems Manager console or see the AWS Systems Manager User Guide.

Why it matters

This update enables AWS Systems Manager document sharing at the organization or OU level, aiding in automation and enhanced security for management.

Amazon Route 53 Resolver DNS Firewall now generally supports Palo Alto Networks Advanced DNS Security across 32 AWS regions. This allows security teams to detect and block malicious DNS traffic directly from VPCs using PANW Advanced DNS Security rules without altering firewalls or VPC configurations. The feature, previewed at AWS Summit New York City, enables security administrators to apply DNS threat protection-such as command and control, malware, phishing, and newly registered domains-using Route 53 DNS Firewall rules against queries from Amazon VPCs and hybrid clouds via Route 53 Resolver endpoints. Customers can subscribe and enable the feature directly in the Route 53 DNS Firewall console, share licenses across organization accounts via AWS License Manager, and associate DNS Firewall rule groups containing PANW rules with VPCs using AWS Resource Access Manager, Route 53 profiles, or AWS Firewall Manager.

Why it matters

This update enhances AWS's DNS firewall capabilities by integrating Palo Alto Networks' advanced DNS security, strengthening protection against DNS-based threats in cloud environments.

AWS Transfer Family now enables users to download multiple files and folders at once from web apps. End users can select any combination of files and folders and download them with a single action as a ZIP archive, preserving the original folder structure upon extraction. This feature is available in all AWS regions where the Transfer Family web app is offered and works with Chromium-based browsers such as Google Chrome, Mozilla Firefox, and Microsoft Edge, but is not currently supported on Safari.

Why it matters

AWS Transfer Family is a service that enables secure transfer of files and folders. This update allows web app users to download multiple items more efficiently.

AWS DataSync now supports shared virtual private clouds (VPCs). Using AWS resource access manager (RAM), you can create DataSync agents in shared subnets across AWS accounts and run transfer tasks. This enables private data transfers through shared subnets and VPC endpoints managed in a central account. Previously, customers centralizing networks needed to create separate DataSync VPC endpoints per account via AWS PrivateLink, consuming IP addresses and adding operational overhead. With shared VPC support, one endpoint in the VPC-owning account serves all accounts sharing the subnet, saving IP space and eliminating per-account endpoints. This release also helps when using a single account: one VPC endpoint can serve multiple subnets, removing the need for matching endpoints per subnet. Shared VPCs are supported for both extended and basic agent-based tasks. To get started, create a DataSync agent using the console or CreateAgent API, specifying the account and shared subnet through AWS RAM. AWS DataSync's shared VPC support is available in all AWS regions except secret regions owned by AWS.

Why it matters

AWS DataSync is a service that automates and optimizes data transfer. This update allows sharing VPC resources across multiple AWS accounts, simplifying network management.

AWS GovCloud (US) now offers Claude Sonnet 5.5, a smarter, more efficient model than Sonnet 5 for lower-cost, faster processing of coding and knowledge work, excelling in cloud-based sessions for code building, modification, and output validation. It also generates shareable knowledge work like one-page documents, charts, summary slides, and cleaned-up documents and spreadsheets. Amazon Bedrock provides Sonnet's capabilities while keeping data within AWS infrastructure and offering region-specific data residency, with unified access to AWS managed features such as Guardrails and Knowledge Bases.

Why it matters

AWS GovCloud (US) is a cloud service for U.S. government and regulated industries, where data residency and compliance are critical.

AWS has launched the smarter, more efficient AI model claude Sonnet 5.5, an evolution over Sonnet 5 that offers teams a natural upgrade. It excels in coding by completing well-scoped tasks as part of larger strategies within a single session, enabling function building, modification, and output validation against requirements. For knowledge work, it produces shareable artifacts-from editing documents and cleaning spreadsheets to summarizing pages and diagrams. Customers can access claude Sonnet 5.5 via Amazon Bedrock, which keeps data within AWS infrastructure and provides regional data residency plus AWS management features like Guardrails and Knowledge Bases, or through the claude Platform on AWS, offering direct access to Anthropic's native platform via the AWS console for integrated billing, authentication, building, testing, and deployment.

Why it matters

Claude Sonnet is an AI model that assists with development and knowledge work, and this update improves performance and efficiency, offering value to developers and business users.

Amazon Rekognition Face Liveness now returns feedback codes explaining why a live check scored low, helping users retry. These codes, included in the GetFaceLivenessSessionResults API response, identify conditions contributing to low scores, such as poor lighting, face obstruction, closed eyes, or low video quality. Customers can show these codes to end users, enabling targeted corrections and confident retries. Multiple feedback codes may be returned per session, allowing users to resolve all issues in one retry. This feature is especially useful for identity verification onboarding, re-authentication flows, and accessibility scenarios. The service returns a confidence score, a reference image for face matching, and session audit images via a brief guided selfie video check to confirm the person in front of the camera is a real human.

Why it matters

Amazon Rekognition Face Liveness is a critical service for verifying user authenticity in identity verification and security authentication. This update helps users identify issues and retry, improving the authentication process.

Amazon EC2 future-dated capacity reservations let you reserve required capacity, start date and commitment term up to 120 days in advance. If plans change, you can postpone the start date to match the new schedule. EC2 will provide a quote for the new start date and required commitment term, which may be extended depending on when the start date is postponed. After confirming and approving the quote, EC2 updates the reservation to the new start date. This feature is available to all future-dated capacity reservation customers. For region-specific availability, see the AWS feature availability by region list.

Why it matters

This update helps users who need to secure capacity in advance by allowing them to adjust their plans. Useful for users of EC2 Capacity Reservations.

Amazon SageMaker Unified Studio now supports two new connection features for external Apache Iceberg catalogs and Amazon DocumentDB. The Iceberg REST catalog connection allows linking to supported catalog types including Snowflake Open Catalog (Polaris), Databricks Unity Catalog, and generic IRC types. Users can browse catalogs in the data explorer, read and write in Visual ETL, and run queries from data notebooks. Authentication uses OAuth2 or bearer tokens, with temporary Amazon S3 credentials for data access. With IAM authentication, connections authenticate through IAM roles, eliminating the need to store database usernames or passwords. These connection features are available in all AWS regions where Amazon SageMaker Unified Studio is offered, at no additional cost.

Why it matters

Data engineers and scientists can leverage these features to simplify access to governed data sources and securely manage credentials

Amazon DocumentDB (MongoDB compatible) version 8.0.2 now supports retryable writes, five new aggregation stages, and enhanced change streams. Retryable writes automatically retry insert, update, and delete operations during transient network errors, improving application resilience during failovers. New aggregation stages include $setWindowFields with full window operators, $bucketAuto, $facet, $graphLookup for hierarchical queries, and correlated $lookup. Change stream improvements add the $changeStreamSplitLargeEvent stage to split change events larger than 16MB into fragments and now include createCollection and createIndex operation events. Query planner enhancements enable index-only scans for find and aggregation queries, index scans on expr predicates, incremental sorting, and faster count and countDocuments(). The reIndex command now supports partial indexes. These features are available in all regions where Amazon DocumentDB is offered.

Why it matters

Provides new capabilities to migrate MongoDB workloads to Amazon DocumentDB without application code changes

AWS Backup's logically air-gapped vault now supports Amazon FSx for NetApp ONTAP. Logically air-gapped vaults allow secure backup sharing between accounts or AWS Organizations, enabling direct restores to reduce recovery time from data loss events. Immutable backups are locked by default and encrypted with AWS-owned or customer-managed keys. FSx for NetApp ONTAP backups can be stored in logically air-gapped vaults in the same or another account or region, reducing downtime risk, ensuring business continuity, and meeting compliance and disaster recovery requirements. This can be initiated via the AWS Backup console, AWS CLI, or AWS SDK by specifying a logically air-gapped vault as the primary target or copy destination for FSx for NetApp ONTAP backups. Use AWS Resource Access Manager (RAM) to share vaults across accounts with multi-party approval to protect vault access during account compromise. Recovery jobs can be started directly from the target account, eliminating copy overhead. This support is available in all AWS regions where both logically air-gapped vaults and Amazon FSx for NetApp ONTAP are available.

Why it matters

This update is useful for organizations that need to reduce recovery time from data loss and ensure business continuity.

Amazon EC2 M8i and M8i-flex instances are now available in the AWS European Sovereign Cloud (Germany) region. Powered by AWS custom Intel Xeon 6 processors, they deliver the highest performance and fastest memory bandwidth among comparable Intel processors on the cloud. Compared to previous Intel-based instances, they offer up to 15% better price performance and 2.5x memory bandwidth, with up to 20% performance gains over M7i and M7i-flex instances, and even higher improvements for specific workloads. They accelerate PostgreSQL databases by up to 30%, NGINX web applications by up to 60%, and AI deep learning inference models by up to 40%. M8i-flex instances are the easiest way to gain price performance benefits for most common workloads, including web and application servers, microservices, small to medium databases, virtual desktops, and enterprise applications, offering sizes from large to 16xlarge and ideal for applications not fully utilizing compute resources. M8i instances suit all general workloads, especially those requiring the largest instance sizes or sustained high CPU utilization, with SAP-certified M8i instances available in 13 sizes, including two bare metal and a new 96xlarge size for maximum applications. To get started, sign in to the AWS Management Console. For more details, visit the M8i and M8i-flex instance pages or the AWS News Blog.

Why it matters

Amazon EC2 M8i and M8i-flex instances are new instance types for general-purpose workloads, featuring improved price performance and memory bandwidth, suitable for typical applications, databases, and AI workloads.

AWS Identity and Access Management (IAM) outbound identity federation now supports Amazon Virtual Private Cloud (VPC) endpoints for OpenID Connect (OIDC) discovery APIs. This allows accessing OIDC discovery metadata and JSON Web Key Set (JWKS) verification key endpoints from within a VPC using AWS PrivateLink, keeping traffic off the public internet. Instead of long-term credentials, workloads request short-lived JSON Web Tokens (JWTs) from AWS Security Token Service (AWS STS); external services validate these tokens using public verification keys and metadata from the OIDC discovery endpoints. Previously, these endpoints were reachable only via the public internet, limiting validation workloads in internet-free VPCs. This release creates interface VPC endpoints to keep verification key traffic within the AWS network, meeting network security requirements for internet-restricted VPCs while still allowing external services to validate JWTs. The feature is available in all commercial AWS regions, AWS GovCloud (US) regions, and China regions at no additional cost beyond standard AWS PrivateLink pricing. For more information, see the IAM user guide.

Why it matters

This update is useful for AWS workloads running in VPCs that need to securely access external services. IAM outbound identity federation allows requesting short-lived tokens without using long-term credentials.

AWS End User Messaging and Amazon SES have introduced AI agent skills for the AWS MCP Server, enabling developers to complete messaging tasks using natural language without navigating multiple documents or console screens. Each skill provides the agent with verified step-by-step guidance, covering tasks such as verifying sending identities, building branded RCS agents, and sending production emails. These skills integrate with popular AI coding agents like Claude Code, Codex, Cursor, and Kiro. To use them, connect the AWS MCP Server to your agent-via the aws-core plugin for Claude Code, Codex, and Cursor, or by adding the server to the MCP config file for Kiro and others. Then add the skill for your desired channel. For details on each skill's capabilities and installation, see the AWS End User Messaging agent setup guides for SMS, RCS, and WhatsApp, and the Amazon SES agent setup guide.

Why it matters

This update allows developers to leverage AI coding agents to efficiently execute messaging tasks, benefiting users of AWS End User Messaging and Amazon SES

AWS has launched the general availability of AWS Network Security Manager, supporting AWS WAF and AWS Shield Advanced, with AWS Network Firewall support coming soon. Security teams can automatically apply these protections to internet-facing assets like AWS Application Load Balancers and Amazon CloudFront, enabling efficient deployment and management of WAF rules and Shield Advanced protections across accounts and resources for consistent security posture. The service centrally manages security policies, automatically detecting and correcting configuration drift to reduce manual operational overhead while maintaining comprehensive protection. AWS Network Security Manager is now generally available in the US East (N. Virginia) region. For pricing, see the AWS Network Security Manager pricing page.

Why it matters

AWS Network Security Manager is a solution designed to automate consistent security policy enforcement across AWS organizations, helping security teams efficiently manage AWS WAF and AWS Shield Advanced.

Amazon EventBridge has re-released a new enhanced custom event bus to enable building event-driven applications. This new custom event bus allows applications to be built to match team separation and organizational scale. By creating a custom event bus and sharing it across accounts, teams can publish and consume events with strict ordering, open event formats, built-in retention, and advanced event transformation support. The EventBridge custom event bus is a serverless event broker that can create scalable event-driven applications by routing events between applications, SaaS integrations, and AWS services. It can be shared with one or more accounts through AWS Resource Access Manager, allowing publishers to send events directly to a central event bus. The new event publishing API allows events to be published in common JSON-based formats such as CloudEvents and retained without schema changes. The custom event bus has a built-in 24-hour retention period that can be extended up to a year, enabling recovery from application errors and hydration from historical data for new components. The new subscriber resource allows events to be filtered and delivered to over 250 AWS services. Native support for strictly ordered use cases ensures that customers can process events in the exact order they are received. New event evaluation enables automatic content-based deduplication. The new custom event bus can be created and shared using the AWS Management Console, AWS CLI, AWS SDK, serverless agent skills, and AWS CloudFormation. To keep existing custom event bus experiences separate from the new enhanced custom event bus, the existing bus has been renamed to "custom event bus - classic". All existing APIs remain unchanged.

Why it matters

Amazon EventBridge provides a foundation for event-driven applications. This update introduces an enhanced version of the Custom event bus, improving team decoupling and scalability.

AWS Billing and Cost Management now offers the ListBillingViewSegments API, which returns billing context for a specified period. It allows viewing the configuration of master accounts, billing groups, and accounts managing billing relationships, as well as the applicable pricing settings (chargeable or proforma) applied to billing data. The API returns only billing context, not cost or usage data, and can be called directly or via an AI agent. Billing context may change mid-period, so the API splits the requested period into time segments with valid date ranges. For example, if an account starts as its own payer, then becomes a member account of another organization, and later a new payer manages billing through AWS Billing Conductor, a request covering these periods returns three segments, each identifying the account and billing settings in effect. ListBillingViewSegments is available in all commercial AWS regions, incurs no additional charges, and supports major billing views. For details, see the AWS Billing API reference.

Why it matters

This update is relevant for technical and financial professionals managing AWS account billing structures and rate settings, helping them track billing relationships and configurations for better cost management.

AWS End User Messaging enables businesses to make voice calls to customers within WhatsApp, allowing a seamless transition from chat using existing verified business identities. Customers can call businesses within WhatsApp chats, and businesses can call permitted customers. WhatsApp voice calls are available in all regions where AWS End User Messaging Social is offered. For details and getting started, see the AWS End User Messaging Social user guide.

Why it matters

This update is for businesses looking to communicate with customers via WhatsApp. It allows seamless transition from chat to voice calls, maintaining conversation context.

AWS Elastic Disaster Recovery (AWS DRS) now supports disaster recovery for AWS Graviton-based (arm64) source servers. As more workloads shift to Graviton for its price-performance benefits, they require the same disaster recovery coverage as other environment components. DRS automatically detects arm64 source servers and recovers them to Graviton instances while maintaining end-to-end workload architecture. Recovery operates like other servers, requiring no additional configuration. This feature is available in all AWS regions where AWS DRS is offered, at no extra cost. For more information, see the AWS Elastic Disaster Recovery User Guide.

Why it matters

AWS Elastic Disaster Recovery is AWS's disaster recovery service. Adding support for AWS Graviton-based servers enables equal recovery protection for ARM architecture workloads.

Amazon RDS for PostgreSQL now supports post-quantum TLS key exchange, offering post-quantum encryption options for data in transit. From version 18 onward, ssl_groups parameters can be modified, allowing selection of cipher groups from the RDS for PostgreSQL allow list to meet organizational security standards. Amazon RDS simplifies setting up, operating, and scaling PostgreSQL deployments in the cloud, and its fully managed databases can be created or updated using the Amazon RDS Management Console or AWS CLI.

Why it matters

This update affects PostgreSQL users who need to enhance security for data in-transit. Amazon RDS for PostgreSQL users can now use post-quantum cryptography to prepare for future security threats.

Amazon RDS for PostgreSQL 19 Beta 4 is now available in the Amazon RDS database preview environment, allowing evaluation of the PostgreSQL 19 pre-release. It refines query performance and autovacuum management introduced in earlier releases, including bug fixes and stability improvements since Beta 3, such as updating pg_stat_autovacuum_scores for TOAST tables and adjusting freeze-score scaling for better autovacuum priority control. Parallel autovacuum rebalances cost limits between workers to keep maintenance within set limits for large tables. Database instances in the preview environment are retained for up to 60 days and are automatically deleted afterward. Snapshots created in the preview environment can only be used to create or restore instances within that environment. Databases can be imported or exported from the preview environment using PostgreSQL dump and load capabilities. Preview environment database instances are priced according to US East (Ohio) rates.

Why it matters

Database administrators and developers can verify the behavior of new PostgreSQL features in the preview environment before full deployment

Amazon RDS for MySQL has released extended support minor versions 5.7.44-rds.20260902 and 8.0.46-rds.20260908. This extended support provides critical common vulnerabilities and exposures (CVE) and bug fixes for up to three years after the standard end of support for the major version, allowing more flexible planning for upgrades to new major versions. Database upgrades can be performed using Amazon RDS blue/green deployment, in-place upgrade, or restoration from snapshots. Migration to MySQL 8.4 can be done from external MySQL sources using the AWS database migration service. For details, see the Amazon RDS for MySQL user guide.

Why it matters

Amazon RDS for MySQL is a managed service that simplifies setting up, operating, and scaling MySQL deployments in the cloud. This update increases flexibility for users planning major version migrations.

AWS Lambda Durable Functions are now available, adding primitives like steps and waits for checkpointing, automatic recovery, and pausing execution without compute charges. New functions based on Python (versions 3.13 and 3.14), Node.js (versions 22 and 24), or Java (17+) can be activated via the AWS Lambda API, AWS Management Console, or AWS SDK. Tools like AWS CloudFormation, AWS SAM, and AWS CDK are also supported. For details, see the AWS Lambda Durable Functions product page or developer guide. Pricing information is available on the AWS Lambda pricing page.

Why it matters

AWS Lambda durable functions allow developers to build reliable multi-step applications and AI workflows. Availability in the AWS European Sovereign Cloud region enables orchestration of complex processes while meeting compliance and security requirements

Amazon SageMaker HyperPod Inference Gateway is a Kubernetes-native GPU-aware routing system deployed as an EKS managed add-on over existing SageMaker HyperPod infrastructure, requiring no application code changes. It replaces traditional round-robin load balancing with real-time inference signal-based routing, reducing first-token latency by up to 82% and p99 TTFT by 97-98% in mixed hardware and burst traffic scenarios. Composed of three core components-Envoy endpoints terminating HTTPS traffic and exposing a single private endpoint per cluster, body-based routers reading model names directly from each incoming request to route to the correct GPU pool enabling many models behind one endpoint URL with no client-side changes, and endpoint pickers real-time scoring each model server pod across six inference-level signals to select the best pod for each request-it works arbitrarily with OpenAI-compatible model servers like vLLM and SGLang, also requiring no application code changes. Currently, per-cluster routing is available in all AWS regions supporting SageMaker HyperPod inference add-ons, with upcoming features including centralized fleet gateway cross-cluster and cross-region routing, global rate limiting, and cost-tier-aware traffic shaping.

Why it matters

A new routing system for improving large language model (LLM) inference performance. It integrates with existing SageMaker HyperPod infrastructure, providing optimal request routing based on real-time inference signals without application code changes.

Today, AWS announced Amazon EMR on EKS now supports running workloads on IPv6 Amazon Elastic Kubernetes Service (Amazon EKS) clusters. Amazon EMR on EKS enables running open-source big data frameworks like Apache Spark and Apache Flink on Amazon EKS. IPv6 support allows large teams to utilize IPv6's expansive address space as analysis workloads grow, eliminating the need for secondary CIDR ranges or prefix delegation to bypass IPv4 address limits. Large jobs, such as Spark jobs with 500 executors, can run concurrently without addressing constraints. Workloads can be submitted via StartJobRun, Spark Connect Interactive Endpoints, and Amazon SageMaker Unified Studio, with no additional configuration required, and Flink, Livy, and Spark operators are also supported. This feature is available from Amazon EMR releases emr-7.14.0 and emr-spark-8.0.0 at no extra cost, and IPv6 cluster support is available in all AWS regions where Amazon EMR on EKS and IPv6 Amazon EKS clusters are offered.

Why it matters

This update affects data platform and analytics teams running large-scale analytics workloads. The expanded IPv6 address space allows them to scale workloads without addressing limitations.

Amazon Kinesis Data Streams now supports service-managed partition keys for on-demand standard and on-demand advantage streams. This removes the need for customers to specify partition keys when publishing data, automatically distributing records across shards. The feature simplifies data ingestion for workloads where record ordering is unnecessary, eliminating hot partition keys and improving streaming workload productivity. Customers no longer need to generate random partition keys like UUIDs, as the service automatically distributes records based on available warm capacity, enabling scaling to gigabits per second. Service-managed partition keys are available in all AWS commercial regions at no additional cost. For more information, see the Amazon Kinesis Data Streams documentation.

Why it matters

Amazon Kinesis Data Streams is a serverless streaming data service that makes it easy to capture, process, and store data streams at any scale. This update is particularly useful for streaming use cases such as log aggregation, metrics collection, and IoT telemetry.

Amazon ElastiCache now supports resource tagging and tag-based access control for global data stores. This allows using AddTagsToResource, RemoveTagsFromResource, and ListTagsForResource, enabling tag-based conditions in IAM policies and service control policies. Tag changes automatically propagate to all regions where the global data store is deployed, ensuring consistent access control and cost allocation policies without per-region operations. The feature incurs no additional charges and requires no changes to creating or managing global data stores. It is available in all AWS regions where ElastiCache global data stores are offered.

Why it matters

This update affects users of Amazon ElastiCache Global Datastore, enabling consistent access control and cost allocation across regions through tag-based access control

Amazon RDS for SQL Server Developer Edition now supports Multi-AZ deployments using Always On Availability Groups, maintaining a synchronous standby replica in another Availability Zone for automatic failover during infrastructure failures. Offering all Enterprise Edition features without license costs, it enables building and testing high-availability configurations in non-production environments. This capability is available for SQL Server Developer Edition major versions 2019, 2022, and SQL Server 2025 Enterprise Developer Edition, but not supported in SQL Server 2025 Standard Developer Edition.

Why it matters

This update benefits developers and DevOps engineers who need to test high availability in development environments

Amazon Connect Customer now provides routing step data to the analytics data lake, enabling customers to analyze trends like queued and connected contacts per routing step using Amazon Athena or Amazon Quick without complex data pipelines. This allows analysts to report contact progress at each routing step, identify where agent adherence criteria are relaxed, and measure the impact of routing step configurations on wait times and agent utilization. Routing step data is available in all AWS regions where the Amazon Connect Customer data lake is provided. For more information, see the Amazon Connect Customer Administrator Guide or visit the Amazon Connect Customer website.

Why it matters

Amazon Connect Customer is an AWS service that helps manage and analyze customer contact centers. This update provides routing step data in the analytics data lake, making it easier to analyze routing decisions

AWS has launched Salesforce and Zendesk data source connectors for Amazon Bedrock managed knowledge bases, fully managed RAG services. These connectors automatically sync Salesforce knowledge articles and Zendesk articles and community posts by simply providing instance credentials, eliminating the need for custom ingestion pipelines. They handle data crawling, metadata extraction, and incremental syncing automatically, enabling easy building of AI agents or assistants based on support and product knowledge maintained in Salesforce or Zendesk. This ensures RAG applications always reflect the latest content without manual intervention.

Why it matters

Amazon Bedrock Managed Knowledge Base is a fully managed retrieval-augmented generation (RAG) service that now enables easier integration with Salesforce and Zendesk knowledge bases for building AI assistants

Today, AWS launched general availability of OpenAI's GPT-6 Sol and GPT-6 Luna on Amazon Bedrock. These models, along with Astra, expand the GPT-6 family, offering choices to balance intelligence, speed, and cost for each workload. Sol suits routine complex tasks and software development, halving error rates compared to GPT-5.6 Sol in OpenAI’s factuality evaluation. Luna efficiently handles high-load tasks like summarization, extraction, classification, and routing, adjusting per-request inference effort to balance quality, speed, and cost. Both models support maximum token context. Amazon Bedrock’s inference engine provides the performance, security, and scale needed for production workloads. Existing AWS controls enable workload protection, access management, and audit of model invocation activity. GPT-6 Sol and GPT-6 Luna are available programmatically via the Amazon Bedrock console or supported Amazon Bedrock API. For supported AWS regions, endpoints, APIs, features, inference profiles, and pricing, see Amazon Bedrock documentation.

Why it matters

Amazon Bedrock is a platform that allows secure and efficient use of AI models, enabling developers to utilize the latest AI models in production environments

AWS has begun offering Anthropic's latest model, claude Opus 5.5, the highest-performance Opus model in the claude 5 series for efficient long-duration coding and knowledge work with clear reporting. It completes tasks with fewer tokens than claude Opus 5, lowers cost per token, and improves cache read efficiency. Customers can access it through both Amazon Bedrock and claude Platform on AWS. Amazon Bedrock provides default zero-data retention (ZDR), keeping data within AWS infrastructure with regional data residency and unified access to AWS management features like guardrails and knowledge bases. With claude Platform on AWS, users can directly utilize Anthropic's native platform via the AWS console, executing build, test, and deploy steps using the same APIs, features, and console experience as when working directly with Anthropic, along with unified AWS billing and authentication.

Why it matters

This update impacts developers and enterprises performing AI-driven development or knowledge work, as it introduces a new AI model that offers more efficient task processing and clearer reporting capabilities.

Amazon DynamoDB global tables now offer multi-region strong consistency (MRSC) in five new regions: Canada (Central), Europe (Stockholm), Europe (Spain), Asia Pacific (Mumbai), and Asia Pacific (Singapore), bringing supported regions to 15 in total. Users can create MRSC global tables with three replicas or two replicas plus one witness region from any three of the supported regions, including configurations spanning North America, Europe, and Asia Pacific. MRSC enables zero-RPO high availability across regions, letting applications route to the nearest replica for strongly consistent reads and maintain availability during regional outages. It is ideal for global applications requiring strict consistency, such as user profile management, inventory tracking, order status, and rights management. For the full list of supported regions and configuration options, see the DynamoDB developer guide. Learn more about building resilient multi-region applications on the DynamoDB global tables page.

Why it matters

This update affects developers building globally distributed applications requiring strict consistency and high availability across multiple Regions.

AWS has launched Amazon CloudWatch Omni, the next evolution of Amazon CloudWatch. Omni uses AI to enhance monitoring, streamlining operations from team and application perspectives. It combines OpenTelemetry compatibility with CloudWatch scalability and reliability, centrally managing telemetry across multiple AWS accounts, regions, and Azure workloads. Omni auto-discovers services, maps dependencies, and highlights key metrics to optimize workflows. Users can interact with telemetry via chat, guided console actions, or the Agent Toolkit for AWS. Natural language queries enable Omni to locate relevant telemetry, build dynamic views, and assist in root cause analysis using AWS DevOps Agents. For AI workloads spanning frameworks like LangGraph, CrewAI, OpenAI Agents SDK, Vercel AI SDK, and Strands, Omni offers a dedicated agent monitoring experience and evaluation-driven development workflows, helping validate and refine each prompt, model call, and tool use. To get started, create an Omni space in the CloudWatch console, configure SSO, and sign in to a standalone web experience. Agent developers can install the free CloudWatch Omni extension for VS Code, Cursor, or Kiro to instrument, debug, and evaluate agents locally without needing an AWS account. CloudWatch Omni is generally available in US East (N. Virginia), US West (Oregon), and Europe (Ireland).

Why it matters

Amazon CloudWatch Omni is an AI-powered observability solution designed to enhance operational efficiency for development teams and applications, enabling unified monitoring across multiple clouds and regions with AI-driven root cause analysis.

Anthropic's latest claude Opus 5.5 model is now available on AWS GovCloud (US). As the first model in the claude 5.5 family, it completes tasks with fewer tokens and lower token prices than previous Opus 5. It efficiently handles long coding and knowledge work for enterprises and provides clear reporting of work and results. Amazon Bedrock offers default ZDR (zero data retention) support, keeping data within AWS infrastructure and ensuring data residency per region. It also provides AWS managed features like Guardrails and Knowledge Bases through a unified service.

Why it matters

AWS GovCloud (US) is designed for U.S. government agencies and regulated industries, offering enhanced security and compliance. This update allows users in these sectors to safely leverage the advanced AI capabilities of Claude Opus 5.5.

AWS Billing Transfer users can enable Auto-Billing Transfer billing group creation. This new AWS Billing Conductor setting eliminates manual billing group configuration for two-tiered billing transfer arrangements. Designed for downstream seller partners and their end customers, it automatically creates billing groups when end customers accept billing transfers from downstream seller partners, making proforma cost data immediately available to partners. The feature can be enabled once per inbound transfer relationship, requesting billing group creation when new indirect transfers occur through a partner's account. You can also assign AWS Billing Conductor pricing plans to automatically created billing groups. This configuration is accessible through two new API operations and the Billing Transfer details page in the AWS Management Console. For instructions on configuring Auto-Billing Transfer billing group creation and billing transfer settings, see the AWS Billing Conductor documentation.

Why it matters

This update benefits AWS Distributors managing billing for downstream seller Partners and their end customers.

Amazon EMR 7.14 is now available, featuring new capabilities and application updates for Amazon EMR on EC2, Amazon EMR on EKS, and Amazon EMR Serverless. Apache Spark has been upgraded to 3.5.8 and Apache Iceberg to 1.10.1, with materialized views now using change data capture to read only data files affected by updates or deletes, improving refresh speeds. Amazon EMR on EKS now supports interactive Spark sessions with token-based authentication and running workloads on IPv6 Amazon EKS clusters. Amazon EMR Serverless increases the storage limit for Spark jobs from 200 GiB to 1 TiB, boosting shuffle data capacity. Amazon EMR 7.14 is available in all AWS regions where Amazon EMR is offered.

Why it matters

For users performing data processing and big data analytics. The new Amazon EMR version enhances functionality across multiple platforms with improved processing speeds and expanded resource limits.

AWS Security Hub AI Inventory supports discovering and cataloging AI assets running on self-hosted instances in Microsoft Azure, extending existing self-hosted detection beyond AWS. This gives security teams a continuously updated view of organization-wide AI assets and security posture across multi-cloud environments. Each detected AI asset is mapped to its underlying infrastructure and correlated with security findings, allowing teams to filter, group, and query the AI inventory in both AWS and Azure. The feature is included with Security Hub Essentials at no additional cost and is available in all AWS commercial regions where Security Hub is offered.

Why it matters

This update benefits security teams that need to manage AI assets across multi-cloud environments. By supporting Azure self-hosted instances, AWS Security Hub enables centralized monitoring of organizational AI resources.

Amazon Connect Customer supports agent-to-agent collaboration, letting customers invoke specialized AI agents during live interactions. This enables open agent-to-agent (A2A) protocols between Connect Customer AI agents and external AI agents via text or interactive voice. For example, a bank's frontline AI agent can delegate fraud risk scoring to a specialized AI agent, instantly approve transactions, and resolve complex issues with the customer directly through another AI agent. Working with the A2A Technical Steering Committee (Linux Foundation), AWS extends the A2A protocol to support voice streaming and session continuity required for customer engagement. Using A2A, Connect Customer coordinates context passing between AI agents, ensuring customers receive a consistent experience with unified visibility, guardrails, and escalation controls applied to all AI agents during interactions. Administrators can view each agent's utterances, tools used, and time per step on a single contact record, captured as one interaction for analysis, AI quality control, and continuous improvement.

Why it matters

Amazon Connect Customer is an AI solution that helps enterprises deliver exceptional customer experiences at every touchpoint, and this update enables collaboration between AI agents, improving efficiency and accuracy in customer support.

Amazon EMR introduces a LTS release, starting with emr-spark-8.1.0 and Apache Spark 4.1. This LTS version supports specific AWS runtimes for 36 months, fixing critical security, bug, and data corruption issues. LTS allows production Spark workloads to run an additional version longer and upgrade on their own schedule without extra cost. The release adds full support for Apache Iceberg v3, bringing geospatial, high-precision timestamps, and schema evolution to tables. Spark SQL queries can reference catalogs by name, including cross-account and Amazon S3 Table Catalog, and automatically detect Apache Iceberg, Delta Lake, and Apache Hudi table formats. Fine-grained access control now covers more operations in Apache Iceberg and Delta Lake's VACUUM operation. Amazon EMR on EKS clusters support Spark Connect endpoints with token-based authentication. emr-spark-8.1.0 is available on Amazon EMR on EC2, Amazon EMR on EKS, and Amazon EMR Serverless in all AWS regions where Amazon EMR is offered.

Why it matters

This update affects users performing data processing and big data analytics. LTS releases provide long-term support and security updates, allowing flexible management of upgrade schedules.

Amazon Elastic VMware Service (EVS) is now a FedRAMP Class C service across all US regions. FedRAMP standardizes security assessment, authorization, and continuous monitoring for cloud products and services. Amazon EVS enables direct deployment of the latest VMware Cloud Foundation software within Amazon VPC on EC2 bare metal instances, allowing full VCF environments to be built in hours. This accelerates workload migration to AWS, helping remove legacy infrastructure, reduce operational risk, and meet critical data center migration timelines.

Why it matters

FedRAMP certification is crucial for government agencies using cloud services, and Amazon EVS meeting this standard enables secure migration of VMware-based workloads to AWS.

Amazon Elastic Container Service (Amazon ECS) provides real-time service deployment monitoring in the Amazon ECS console for native linear, canary, and blue/green deployment strategies. This integrates deployment monitoring and troubleshooting within the console, allowing users to track progress, monitor health, and diagnose issues without switching tools. The live deployment timeline shows progress for each phase, service events, and task start/stop as deployments occur, reflecting the current state at all times. It tracks traffic shift distribution between source and target revisions and instantly displays the current lifecycle stage, such as green task scaling, lifecycle hook waiting, or bake time. Deployment health signals, including live task failure thresholds, deployment alarm status, container and load balancer health checks, and lifecycle hook state, appear alongside the timeline. If a failure occurs, the timeline shows failing tasks and provides deep links and diagnostic context to services like AWS CloudTrail, enabling quick root cause analysis and action. These features are available at no additional cost for all Amazon ECS services using native linear, canary, or blue/green deployment types in AWS commercial regions and AWS GovCloud (US) regions. To get started, navigate to any Amazon ECS service in the Amazon ECS console and select the Deployments tab.

Why it matters

Amazon ECS is an AWS service that simplifies the deployment and management of containerized applications. This update enables developers to more intuitively monitor deployment progress and health, and quickly identify and address failures.

AWS Glue Data Quality has updated its functionality to reduce setup time for data quality checks on tables in the AWS Glue Data Catalog. The new advanced mode uses generative AI to detect data intent and suggest business-relevant rules, enabling quick initiation of rule setup for new datasets or baseline checks across entire data lakes without manually writing each rule. Users can review recommended rules, adjust as needed, save them as a rule set, and begin monitoring immediately. Advanced mode is available in major regions.

Why it matters

Data engineers and analysts can significantly reduce the time required to set up data quality checks, accelerating the construction of data pipelines and the transition to trusted data.

Amazon Route 53 Resolver is now generally available on second-generation AWS Outposts racks. It resolves DNS queries from workloads on the Outpost locally, reducing latency and eliminating the need for service links to the parent AWS region. Route 53 Resolver maintains cached DNS records during service link interruptions, ensuring continuous DNS resolution. The service runs entirely on AWS managed infrastructure within the Outpost and requires no customer compute capacity. For multi-rack second-generation Outposts, Route 53 Resolver is enabled by default, with an option to opt out by contacting AWS Support. It is available in all AWS regions that support second-generation Outposts. All customers, including current preview customers, receive a 91-day free trial until December 21, 2026. From December 22, 2026, the service is priced at $0.65 per rack per hour. For more information, see the Route 53 Resolver on Outposts documentation and the Amazon Route 53 pricing page.

Why it matters

This update is relevant for customers who need to optimize DNS resolution in their AWS Outposts environments. Local DNS resolution improves performance and reduces reliance on the cloud.

Amazon Simple Notification Service (Amazon SNS) has quadrupled its message payload limit from 256 KiB to 1 MiB, allowing workloads like application integration, IoT, and generative AI to exchange more data in a single message. By setting the new MaximumMessageSize topic attribute, you can publish up to 1 MiB message payloads on both SNS standard and SNS FIFO topics. Topics with MaximumMessageSize greater than 256 KiB support subscriptions to Amazon SQS, Amazon Data Firehose, and AWS Lambda, with up to 100 subscriptions per topic. This feature is available in all AWS regions where Amazon SNS is offered.

Why it matters

Amazon SNS is a fully managed pub/sub messaging service that helps decouple and scale microservices and serverless applications. This update is useful for workloads such as application integration, IoT, and generative AI that handle larger data volumes in single messages.

AWS RTB Fabric now supports configurable availability zone (AZ) affinity for responder gateways, allowing partners to connect within their own AZ or across any AZ the gateway spans. This enables AdTech companies to use infrastructure more efficiently. The feature is available in all AWS regions where AWS RTB Fabric is offered. AWS RTB Fabric connects with AdTech partners such as Amazon Ads, GumGum, Kargo, MobileFuse, Sovrn, TripleLift, Viant, and Yieldmo, achieving millisecond latency in three steps. RTB Fabric reduces standard cloud network costs by up to 80% without prerequisites.

Why it matters

This update benefits advertising technology companies and DSPs/SSPs by improving infrastructure efficiency when using RTB Fabric

Amazon EC2 I7ie instances are now available in the AWS Israel (Tel Aviv) region. Powered by 5th-gen Intel Xeon processors at 3.2 GHz all-core turbo, they deliver up to 40% better compute performance and 20% improved price performance versus I3en instances. I7ie instances offer up to 120TB of local NVMe storage density, doubling vCPU and memory compared to previous generations. Featuring 3rd-gen AWS Nitro SSDs, they achieve up to 65% higher real-time storage performance, 50% lower storage I/O latency, and 65% reduced I/O latency variability versus I3en instances. Ideal for large datasets requiring fast local storage and low-latency high-random read/write performance, I7ie instances come in nine sizes with up to 100Gbps network bandwidth and 60Gbps bandwidth for Amazon EBS.

Why it matters

Amazon EC2 I7ie instances are a new instance type designed for large storage I/O workloads, now available in the Israel region, offering enhanced performance and cost-efficiency for storage-optimized applications.

AWS Resilience Hub is a central resource that helps AWS platform engineering and site reliability teams assess and improve the resilience of workloads running on AWS. It now adds three new features. First, it supports EKS labels as a service input source, allowing teams to precisely define the scope of resources Resilience Hub detects and uses based on existing Kubernetes labeling conventions, aligning assessments with how teams organize EKS workloads. Second, it provides a new AI-powered capability to generate dependency analysis, analyzing detected application dependencies to highlight meaningful patterns, surface new dependencies, identify cross-region dependencies, and flag anomalous usage, accelerating dependency analysis and helping teams identify potential new risks. Finally, it enables sharing resilience policies through AWS Organizations, allowing central teams to build and manage policies across multiple accounts, making it easier to monitor which services use each policy and ensure consistent resilience posture across the organization. For more details, see the AWS console, product page, or documentation.

Why it matters

AWS Resilience Hub is a tool for platform engineering and site reliability teams to assess and strengthen the resilience of workloads running on AWS

Amazon Elastic Container Service Express Mode now supports the ARM64 CPU architecture, enabling deployment of ARM-based container images on AWS Graviton-powered compute for up to 40% better price performance than x86-based instances. It quickly launches containerized applications and orchestrates cloud architecture. Users supply container images while ECS Express Mode configures networking, load balancing, autoscaling, and deployments, providing an auto-generated URL. ARM64 support allows users to select compute architectures that fit workloads, including cost optimization, compatibility with existing fleets, and deployment of ARM-native images. This CPU architecture setting is available for new and existing ECS Express Mode services via the AWS Management Console, AWS CLI, AWS SDK, and infrastructure-as-code tools, and is accessible in all AWS commercial regions and AWS GovCloud (US).

Why it matters

Amazon ECS Express Mode simplifies rapid deployment of containerized applications by managing cloud architecture. This update adds ARM64 architecture support, improving cost efficiency and architecture alignment.

AWS Continuum for penetration testing provides on-demand customized penetration tests and real attack simulations, actively protecting applications throughout the development lifecycle. Previously, identifying all URLs an application reaches required manual effort, and authentication errors were only discovered after test cycles completed. With this new feature, adding login credentials during test configuration allows AWS Continuum to authenticate to the application like a real user, capturing all domains reachable during login and displaying them as proposed in-scope URLs. Developers can verify accessible domains and validate credentials before actual testing begins, ensuring the agent covers appropriate endpoints. Accessible domains are returned regardless of whether credential testing succeeds, fails, or times out. This feature is available in all regions where AWS Continuum for penetration testing is offered.

Why it matters

AWS Continuum is a penetration testing service that protects applications throughout the development lifecycle. This update enables developers and security teams to validate credentials and ensure proper scope before test execution.

Today, AWS launched a next-generation AgentCore runtime, a serverless micro VM compute within Amazon Bedrock AgentCore. This new runtime reuses unused memory during sessions, enabling billing only for actual usage and providing consistent cold start times independent of container image size or parallelism. It maintains the existing serverless model while reducing costs and shortening startup times. Each session starts with a small, efficient memory profile, allocating additional memory as needed. For cold starts, the agent environment is prepared once and a snapshot is saved, allowing new instances to restore from this snapshot instead of repeating the full startup sequence, ensuring consistent start times regardless of image size. Testing showed the new runtime achieved a P75 cold start time of 1.9 to 2.0 seconds for container images ranging from 200 MB to 2 GB, compared to 5.4 to 30 seconds in V1. The new AgentCore runtime is available in us-east-1, us-east-2, us-west-2, eu-west-1, and ap-northeast-1 regions. Users can start creating or updating the runtime by setting the platform version to V2.

Why it matters

Amazon Bedrock AgentCore is an AWS service for building AI agents. This update improves performance and cost efficiency, enabling developers to build agents more efficiently.

AWS has launched the general availability of new low-cost burstable Amazon EC2 T8i instances, featuring custom 6th generation Intel Xeon 6 processors and built on the latest 6th generation AWS Nitro Cards. Offering up to 30% price-performance improvement over T3 instances, T8i instances come in four sizes: nano, micro, small, and medium. They deliver up to 70% better compute performance, 1.25x network bandwidth, and 2.4x EBS bandwidth compared to T3 instances. Using the same CPU credit system as T3 (standard and unlimited modes), existing T3 customers can upgrade to T8i for immediate price-performance gains and reduced TCO. For first-time AWS users or those migrating from on-premises, T8i instances are among the most cost-effective entry points for running a variety of workloads. T8i.micro and T8i.small are available in the AWS free tier. T8i instances are available in US East (N. Virginia, Ohio), US West (Oregon, N. California), Europe (Frankfurt, Ireland, London, Paris), Asia Pacific (Hyderabad, Malaysia, Mumbai, Seoul, Singapore, Sydney, Tokyo), and Canada (Central) regions. They can be purchased as on-demand instances, with spot instances and savings plan options coming soon.

Why it matters

Amazon EC2 T8i instances are a new burstable instance type powered by 6th-gen Intel Xeon 6 processors, designed for workloads requiring low to moderate CPU utilization

AWS HealthOmics now supports IAM session policies, dynamically restricting permissions for each run. This simplifies management by eliminating the need for separate IAM roles per tenant or run. IAM session policies are inline policies that limit the maximum permissions of a run, where effective permissions are the intersection of the underlying identity-based policy and the temporary session policy. For example, in a multitenant application, you can pass a session policy to restrict a run's access to only that tenant's Amazon S3 bucket without provisioning a tenant-specific IAM role. You can also use IAM session policies to grant temporary access to specific Amazon S3 objects for a single run, isolating access to sensitive resources per run. IAM session policies are available in all AWS regions where AWS HealthOmics is offered. See the permissions section in the AWS HealthOmics user guide for details.

Why it matters

AWS HealthOmics is a service that helps healthcare and life sciences customers accelerate scientific breakthroughs with fully managed bioinformatics workflows. This update allows dynamic permission restriction for individual runs, reducing the overhead of managing separate IAM roles for each tenant or run.

When placing a network load balancer before an SFTP server using VPC host endpoints, AWS Transfer Family now retains the client's source IP address using Proxy Protocol v2. This enables IP-based auditing, access control, and compliance. Previously, the NLB replaced the client's source IP with its private IP, recording the NLB's address in Transfer Family logs and events, which prevented authenticating users with their true source IP. The feature can be enabled per Transfer Family server via the console, CLI, or API, and is available in all AWS regions where AWS Transfer Family is offered.

Why it matters

This update affects users who place a Network Load Balancer in front of their SFTP servers. It is useful for applications requiring IP-based auditing, access controls, and compliance.

AWS PrivateLink now allows customers to privately and securely access network segments in another VPC or account using a VPC endpoint. By creating a new "tunnel" endpoint, customers can tunnel into the network segment and access resources placed within it. Previously, sharing resources with external vendors required creating a resource configuration per resource; now, customers can create a single resource configuration representing the CIDR range of their network and share it with vendors through AWS Resource Access Manager. Vendors create a tunnel endpoint and tunnel into the customer's VPC using GENEVE encapsulation to access resources within the specified CIDR range. Tunnel endpoints are charged hourly and per GB of data processed. For pricing details, see the AWS PrivateLink pricing page. This feature is available in the US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Africa (Cape Town), Asia Pacific (Hong Kong), Asia Pacific (Hyderabad), Asia Pacific (Jakarta), Asia Pacific (Malaysia), Asia Pacific (Melbourne), Asia Pacific (Mumbai), Asia Pacific (Osaka), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Canada (Central), Canada West (Calgary), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Milan), Europe (Paris), Europe (Spain), Europe (Stockholm), Europe (Zurich), Mexico (Central), and South America (São Paulo) regions.

Why it matters

AWS PrivateLink is a technology that enables private access across VPC and account boundaries. This update significantly simplifies the management of resource sharing.

Amazon Connect Customer provides standard metrics, but custom metrics enable business-specific measurements. Manual management across instances causes definitions to drift and values to mismatch, which is worse than having no metrics. Seven new api operations (CreateMetric, DeleteMetric, DescribeMetric, ListMetrics, SearchMetrics, UpdateMetricContent, UpdateMetricMetadata) allow programmatic metric definition and management, ensuring consistent definitions as queues, teams, and environments scale. For example, a customer experience leader can define a custom metric to track the percentage of interactions where customers request a live agent within 90 seconds after noticing a drop in self-service completion rates. Using the api, an ai-powered operations assistant can automatically create metrics and publish them to monitoring dashboards, eliminating manual console work and definition inconsistencies across environments. All changes are tracked in AWS CloudTrail, enabling complete audit trails.

Why it matters

Amazon Connect Customer is a cloud-based contact center solution for optimizing customer experience. This update enables consistent management of custom metrics, facilitating data-driven decision making based on business-specific KPIs

Amazon Elastic Container Service (Amazon ECS) now supports Amazon S3 Files for tasks run on Amazon EC2 launch type, allowing customers to directly connect containerized applications to S3 data using standard file system semantics. Customers running ECS workloads on EC2 instances can execute file-based applications, AI agents, and data processing workloads on S3 data without code changes, file duplication, or staging. Previously available for AWS Fargate and ECS managed instances, S3 Files support now extends to EC2 launch type, providing consistent access across all three ECS launch types. Based on Amazon EFS, S3 Files offers a shared file system that directly links AWS compute resources to S3 data, delivering full file system semantics, low-latency performance, and keeping data in S3. It works with both new and existing data, requiring no migration. Customers can mount S3 Files volumes in ECS tasks to read and write data in S3 buckets using standard file operations, with no application code changes or data copying required. S3 Files support is available in all AWS commercial regions and AWS GovCloud (US).

Why it matters

Amazon ECS is a service for managing containerized applications, and this update allows tasks running on EC2 instances to directly access S3 data as a shared file system, simplifying file-based applications and data processing workloads.

AWS Elemental MediaTailor supports two lifecycle hooks for monetization functions. The first runs after resolving all VAST wrappers but before ad selection and transcoding, allowing customers to call secondary ad sources, remove disallowed ads, or add house ads and promotions if the primary ADS does not return sufficient demand. The second runs just before MediaTailor returns ad pods to the viewer, providing a single call to receive all new personalized ad breaks for a final check on playback content, such as inserting personalized slates if breaks remain unfilled. Pre-built recipes in the MediaTailor console offer customers a starting point for these use cases. Both hooks are fail-open; on timeout, expression errors, or resource limits, MediaTailor discards the function output and continues with default ad insertion, ensuring uninterrupted viewer playback. The new hooks are available in all AWS regions where AWS Elemental MediaTailor is offered.

Why it matters

AWS Elemental MediaTailor is a video service that personalizes and inserts ads into live and on-demand streams. This update enhances flexibility for ad monetization, eliminating the need for a middleware tier.

Amazon Connect Customer now supports tag-based access control for custom metrics, allowing admins to manage who can view, create, or modify each metric. This prevents unintended changes by one team to metrics used by others. By assigning tags to metrics and setting access rules on those tags, teams can fully control their own metrics while only viewing others, with no access to restricted metrics. Search also follows these access rules, showing only metrics users are permitted to view or manage.

Why it matters

Amazon Connect Customer is a cloud-based contact center service that helps manage and analyze customer service. This update allows more granular control over access to custom metrics shared across multiple teams.

Amazon Connect Customer lets managers import PDF evaluation forms from third-party quality applications and automatically recreate them using AI within Connect, simplifying migration of existing quality programs. By uploading a PDF and choosing percentage or point-based scoring, Connect Customer automatically extracts sections, questions, answer options, and ratings to draft the form. Natural language instructions can further refine the import or adjust the form during creation, minimizing manual edits before activation. This feature is available in US East (N. Virginia), US West (Oregon), Canada (Central), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Europe (Frankfurt). For details and pricing, see the documentation and pricing page.

Why it matters

Amazon Connect Customer is a tool for customer service evaluation and feedback management. The ability to import evaluation form PDFs using AI enables more efficient migration of existing quality programs.

Amazon WorkSpaces Personal and Amazon WorkSpaces Core now support the Graphics G7 bundle with NVIDIA RTX PRO 4500 Blackwell Server Edition GPU and Intel Xeon 6 processors. The Graphics G7 bundle delivers up to 2.1x higher performance for graphics-intensive workloads versus the Graphics G6 bundle. It offers four sizes ranging from 8 vCPU, 32 GB memory and one GPU to 48 vCPU, 192 GB memory and two GPUs. The Graphics G7 enables higher fidelity and frame rates for demanding professional applications such as CAD/CAM, 3D rendering, scientific visualization, video editing and AI-assisted design workflows. Each GPU features 32 GB GDDR7 memory, supporting larger and more complex 3D scenes and models. Running Windows and supporting bring-your-own-license, the Graphics G7 bundle is available for both WorkSpaces Personal and WorkSpaces Core in US East (N. Virginia), US East (Ohio) and US West (Oregon), with additional regions coming as availability expands.

Why it matters

Amazon WorkSpaces provides remote desktop services. The addition of Graphics G7 bundles enhances performance for applications requiring advanced graphics processing, allowing users to run more complex 3D models and visualizations smoothly.

AWS offers a new experience that simplifies how developers turn ideas into code on AWS. The streamlined sign-up process uses existing Google, GitHub, Apple, or Amazon credentials, eliminating the need for a credit card for most new customers, who receive up to $200 in free credits as part of the AWS Free Tier. Once signed up, developers can connect a coding agent to AWS with a single prompt, which automatically installs the AWS CLI and Agent Toolkit. The coding agent connects to the project and uses built-in guidance to deploy resources following best practices. As the project grows, team members can be invited via email, and project access is configured automatically. Many AWS resources created are automatically granted access to other AWS service resources through a new IAM role manager feature tailored for the project. When ready to upgrade the payment plan, monthly spending limits can be set based on usage patterns to stay within budget; reaching the limit pauses the project for the month. Additional projects can be created with one click, each with its own spending limit and different team members. Advanced features such as multiple AWS regions and custom governance controls can be enabled at any time without migration or downtime. To try the new experience, create a new AWS account.

Why it matters

This update benefits developers and new customers looking to simplify project initiation and development processes on AWS.

Amazon Elastic Container Service (Amazon ECS) provides a managed daemon deployment monitoring view, showing progress, failures, and blockers in one place. It includes lifecycle timelines with timestamps and total time, progress bars for each capacity provider, and monitoring panels for deployment circuit breakers, alarms, and container health checks. If a deployment halts, it shows rollback paths and, for failed daemon tasks, affected capacity providers with stop reasons, task links, logs, and troubleshooting guides. It also displays target and source revisions, instance counts, drain pages, and bake times. This feature is available only in the console, in all AWS commercial regions at no extra cost.

Why it matters

Amazon ECS Managed Daemons provide centralized deployment monitoring in the AWS Management Console, allowing developers and deployment teams to quickly assess progress and resolve issues

Amazon SageMaker AI supports serverless model customization for the NVIDIA Nemotron 3.5 Lightning model, NVIDIA's latest open-weight model with a hybrid Mixture-of-Experts architecture using 3B active and 30B total parameters. Customization allows fine-tuning the foundation model on proprietary data to maintain state-of-the-art quality with smaller, suitable models, reducing cost and latency. Use SFT with labeled data to improve domain-specific task accuracy, DPO to align outputs with organizational tone, and RFT with reward signals to enhance new task performance. Serverless customization lets SageMaker AI handle all infrastructure provisioning and training orchestration, enabling focus on data and evaluation instead of cluster management, with pay-as-you-go pricing. It is available in US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), and Europe (Ireland). Start customization jobs from the Amazon SageMaker Studio model page or via the SageMaker Python SDK; see Amazon SageMaker AI model customization documentation for details.

Why it matters

This update is useful for developers and data scientists who need to customize AI models for specific domains or tasks. SageMaker AI's serverless capabilities reduce infrastructure management overhead and improve cost efficiency.

Amazon Corretto 27 is now generally available. Amazon Corretto is a free, multi-platform OpenJDK distribution downloadable on Linux, Windows, and macOS. Corretto 27 will be supported until April 2027. Key new features include setting G1 as the default garbage collector across all environments, supporting post-quantum hybrid key exchange with TLS 1.3, compacting object headers, and performing redaction of in-process data in JFR. It also offers preview and incubator features such as pattern matching for primitive types, structured concurrency, delayed constants, and the Vector API. Further details are available on the OpenJDK 27 project page. Amazon Corretto 27 is distributed under an open source license.

Why it matters

Amazon Corretto is an open-source OpenJDK distribution that helps developers and enterprises build reliable Java applications. This update adds new features to improve memory efficiency, security, and code simplicity.

Amazon Quick extends Generate Analysis with two new features to accelerate dashboard creation. The first, Generate Sheet, lets users create new sheets in existing analyses using natural language, automatically adding appropriate visuals, filter controls, and calculated fields like year-over-year growth. The second generates analyses from images by attaching dashboard screenshots from other BI tools as prompts, which Amazon Quick reconstructs as editable analyses. Both features integrate with existing public workflows, embeddings, CI/CD pipelines, and point-and-click editing. Enterprise subscriptions and Author Pro users can access these features at launch, with Author users receiving promotional access until December 2026. For details, see Generating analyses using natural language prompts in the Amazon Quick user guide.

Why it matters

Aimed at business intelligence and data analysis professionals, this update streamlines and automates dashboard creation.

Amazon Simple Email Service (SES) now supports tenant-level deliverability analysis with Virtual Deliverability Manager (VDM). Tenant management lets senders isolate email sending by customer, business unit, or application. Previously, VDM provided deliverability metrics at the account, ISP, sending identity, and configuration set levels; now customers with VDM enabled can monitor deliverability for each tenant. The VDM dashboard adds a tenant view showing metrics per tenant (volume, deliveries, bounces, complaints, opens, clicks) and allows detailed checks by email provider and related identities or configuration sets. Customers can search and export tenant messages or programmatically query tenant metrics using the new TENANT_NAME dimension in the BatchGetMetricData API, enabling them to identify and fix delivering issues for specific tenants without affecting others. Virtual Deliverability Manager is available in all AWS regions where Amazon SES is offered.

Why it matters

This update benefits organizations sending email to multiple customers or business units, enabling them to monitor and resolve deliverability issues at the tenant level

AWS Builder Center is now available as a mobile app for iOS and Android, enabling users to read trending articles, follow fellow builders, check the Builder Loft event calendar, manage wishlists, and view updates on AWS Heroes, community builders, and user group leaders. Users can subscribe to topics and communities of interest via push notifications to receive alerts when new content is published. The app maintains login status across sessions using AWS Builder ID and is available globally on the Apple App Store and Google Play Store.

Why it matters

The AWS Builder Center is now accessible via mobile platforms, enabling developers and technicians to connect with the community and resources from anywhere

AWS Elastic Beanstalk has introduced cluster mode, a new deployment mode that allows running and managing multiple applications on shared infrastructure. In this mode, simply provide your source code, Dockerfile, or container image from Amazon ECR, and Elastic Beanstalk handles containerization, provisioning, and ongoing operations through the console, CLI, and API. Elastic Beanstalk manages deployment, scaling, and application lifecycle tasks, freeing developers to focus on coding by handling infrastructure. Currently, Elastic Beanstalk offers two deployment modes: standard mode, which retains the existing experience and continues to support all currently available platforms such as .NET, Node.js, and Python, and cluster mode, which uses Amazon EKS to run multiple applications on pooled infrastructure within an account, reducing compute costs per application. Cluster mode supports event-driven autoscaling, OpenTelemetry-based monitoring to Amazon CloudWatch and third-party providers, integration with AWS Secrets Manager, and default HTTPS protection via AWS Certificate Manager. To get started, create an environment in the Elastic Beanstalk console and select cluster mode. Deployment is also possible using the AWS CLI, GitHub Actions, or agent skills. Cluster mode is available in all commercial AWS regions where Elastic Beanstalk is offered, at no additional cost. You are charged only for the AWS resources your application consumes, including those for the EKS cluster or EKS Auto Mode infrastructure.

Why it matters

AWS Elastic Beanstalk is a service that helps developers deploy, scale, and manage applications. This update introduces Cluster Mode, allowing multiple applications to run on shared infrastructure, reducing costs and simplifying management.

Amazon S3 Express One Zone storage class is now available in seven additional regions, bringing the total to 15 AWS regions. It is designed for frequently accessed data and latency-sensitive applications, providing consistent single-digit millisecond data access. This class enables fast data access for workloads such as machine learning training, interactive analytics, and key-value caching in AI search engines, while maintaining high durability and availability. For pricing details, see the S3 pricing page. More information is available on the product page and documentation.

Why it matters

Amazon S3 Express One Zone is a new high-performance storage class designed for low-latency workloads such as machine learning, interactive analytics, and AI search engines

Amazon Keyspaces (for Apache Cassandra) is now generally available in 11 additional regions, allowing customers to build low-latency, Cassandra-compatible applications while meeting data residency requirements. It is a serverless, scalable, and highly available managed Apache Cassandra-compatible database service that charges only for resources used, supporting thousands of requests per second with virtually unlimited throughput and storage. For a list of available regions, see AWS Capabilities by Region.

Why it matters

Amazon Keyspaces is a scalable, highly available, managed Apache Cassandra-compatible database service. This update expands its availability to 11 additional Regions, enabling lower-latency application development that meets data residency requirements.

Amazon Connect Customer provides agents shift bidding to improve scheduling. Schedulers upload agent rankings via CSV or use random generation; Connect Customer then generates available shifts based on demand forecasts and shift profiles, presenting them to agents. After the bidding period, Connect Customer auto-assigns each agent their highest-ranked available shift, using rankings as tiebreakers. This reduces manual shift assignments, enhances agent satisfaction, and boosts scheduling efficiency. The feature is available in all AWS regions where Amazon Connect Customer agent scheduling is offered.

Why it matters

This update benefits customer service centers and organizations facing scheduling challenges, enhancing agent flexibility and reducing scheduler workload.

AWS CloudTrail records API activity across an AWS account for security auditing, compliance, and operational troubleshooting. Now integrated with Amazon Q Console, it allows natural language queries about account activity. Users can ask about CloudTrail configurations, query logged events for security investigations, or troubleshoot operational issues without writing queries or manually parsing logs. The console can verify trail configurations, identify logging gaps, and confirm tracked data event sources. For security, users can inquire about users accessing specific IAM roles, VPC changes, or unauthorized access in the past week. For operations, they can ask about users creating or deleting resources, error-causing API calls, activity from specific IP addresses, or reasons for sudden cost spikes. Amazon Q Console queries CloudTrail trails, related CloudWatch log groups, and event data stores on their behalf, providing answers based on actual account activity. This integration is available in all AWS commercial regions supported by Amazon Q Console. To get started, open Amazon Q in the AWS Management Console and ask questions about CloudTrail configurations or account activity. For more information, see AWS CloudTrail documentation.

Why it matters

Enables security, compliance, and operations teams to investigate AWS account activity using natural language instead of writing queries or parsing logs.

Today, Amazon SageMaker AI introduced instance priority lists for training and processing jobs, simplifying how customers find compute capacity for their workloads. Previously, users had to specify a single instance type, leading to unpredictable wait times during peak gpu demand and requiring complex retry logic. Now, by providing a priority list of acceptable instance types, SageMaker runs jobs on the first available configuration, potentially accelerating job start times. Users specify instance type and count priorities when submitting jobs, such as prioritizing two ml.g6.48xlarge instances or four ml.g5.48xlarge instances. SageMaker processes the list and starts jobs with the first available capacity. Capacity sources can also be configured within the same job submission, using either on-demand or reserved SageMaker flexible training plans. This feature simplifies compute acquisition during high-demand periods and reduces manual retries, available today across all AWS regions via the SageMaker CLI, API, SDK, and console UI. For more details, see the documentation or launch blog.

Why it matters

This update benefits users performing AI model training or data processing by enabling more efficient allocation of compute resources required for these tasks.

AWS Step Functions is a visual workflow service that orchestrates over 220 AWS services. This update automatically adds AWS SDK integrations for new services and features, such as AWS Lambda Core and AWS Lambda MicroVMs, within weeks of their release, enabling orchestration of the latest AWS services without waiting for updates. Lambda MicroVMs provide isolated secure runtimes for each agent task and automatically retry on environment start failures. Step Functions' parallel and map states allow multiple tasks to run simultaneously, automatically terminating the environment upon task completion. Lambda Core can configure private networks so MicroVM environments can securely access internal databases and APIs. This expansion also includes AWS Partner Central revenue measurement, AWS Resilience Hub V2, AWS Support approvals, and Amazon SageMaker job runtime. New AWS services will automatically appear in Step Functions integrations within weeks of release, requiring no additional configuration or action. Updates will be ongoing, so new posts highlighting new AWS SDK service integrations will no longer be published. These features are generally available in all AWS regions where AWS Step Functions is offered. Specific services and API actions depend on whether the target service is available in the AWS region. For more details on the SDK integrations for AWS Step Functions, see the developer guide or check the full list of supported services in the AWS SDK service integrations and integration release history.

Why it matters

AWS Step Functions is a visual workflow service that orchestrates multiple AWS services, and this update allows developers to integrate the latest AWS resources more quickly.

AWS Billing Conductor lets you define custom rates for AWS services, enabling tiered usage pricing. Customers and partners can easily apply negotiated prices to proforma billing data when modeling commercial agreements with subsidiaries, associates, or end customers. You can enter custom rates using SKU-limited price rules and set usage tier thresholds, allowing direct control over accurate pricing and tier breaks without calculating markups or markdowns on public on-demand rates tied to predefined AWS usage tiers. This feature is available across all commercial AWS regions except Amazon Web Services China (Beijing) region (operated by Sinnet) and Amazon Web Services China (Ningxia) region (operated by NWCD).

Why it matters

AWS Billing Conductor is a tool for accurately modeling inter-company billing prices, and this update enables custom rates and usage tier configurations, allowing negotiated prices to be accurately reflected in pro forma billing data.

AWS Direct Connect now offers a flat-rate pricing model for 10G and 100G dedicated connections. This model eliminates data transfer charges (DTO) within selected tiers, requiring only a fixed monthly fee. Customers can choose from five geographic tiers, ranging from same metro to global, paying a consistent monthly rate aligned with their traffic patterns. The flat-rate model also introduces port pairs, allowing two dedicated connections at different devices or locations to share the same bandwidth and geographic scope-one handling traffic while the other remains on standby for redundancy, included at no extra cost. While port pairs are optional, they are recommended. The flat-rate pricing is available across all commercial AWS regions (excluding China regions) and applies only to dedicated connections. Pricing is set per connection, and customers can switch billing modes at any time.

Why it matters

AWS Direct Connect provides dedicated network connectivity between on-premises environments and AWS. This update offers predictable budgeting for workloads with large, sustained data transfer.

AWS today announced support for the Detected Anomalies widget in the BCM dashboard. This widget lets you view cost anomalies alongside monthly costs, usage, budgets, cost efficiency, and savings plan or reserved instance coverage. It shows the number of detected anomalies and their total cost impact, helping you quickly assess anomaly severity. You can review cost impact, root cause, and duration for each anomaly, and filter by severity, service, account, and region for the most relevant issues. Adding the widget to your BCM dashboard allows finance and cloud teams to monitor anomalies without leaving existing cost management workflows. The widget links directly to the AWS Cost Anomaly Detection console for easy investigation and recording of assessments. It integrates with dashboard exports for scheduled email reports or offline analysis as CSV or PDF, and is included in cross-account dashboard sharing. The Detected Anomalies widget is available at no extra charge in all commercial AWS regions. See the user guide for details.

Why it matters

This update is useful for users focused on cost management and budget planning, especially finance teams and cloud administrators.

AWS security token service (STS) has unified session token size limits to a single 4,096 bytes, increasing flexibility for combining session policies and tags. STS now returns response elements showing token size and usage limits, which are logged to AWS cloudtrail and published as metrics to Amazon cloudwatch. A new optional API parameter allows generating larger tokens up to 4,096 bytes to test application and infrastructure handling. These features are available in all commercial AWS regions, AWS govcloud (US) regions, and AWS european sovereign cloud regions.

Why it matters

This update to AWS STS affects all AWS users who manage security tokens

Amazon Connect Talent is now generally available. This solution accelerates large-scale candidate selection using AI. Based on Amazon's decades of recruitment science, AI agents conduct structured voice interviews and perform evidence-based evaluations, scoring candidates consistently. Recruiters can focus on strategic decision-making while candidates take interviews anytime, anywhere. Recruiters review AI-generated scores, transcripts, and detailed candidate assessments for faster, consistent decisions. Features include competency-based assessments, adaptive AI-led voice interviews, a customizable mobile-first candidate portal, and onboarding tools for system administrators. Amazon Connect Talent evaluates hundreds of candidates simultaneously, supporting hiring surges, and is available in AWS US East (N. Virginia) and US West (Oregon) regions. For more information, visit the Amazon Connect Talent page.

Why it matters

Targeted at talent acquisition leaders and recruiters, it streamlines large-scale hiring processes and supports objective evaluation and faster decision-making.

AWS now offers root user sign-in across US East (N. Virginia), US East (Ohio), and US West (Oregon), distributing sign-in traffic to reduce dependency on US East (N. Virginia) and improve resilience during service disruptions. AWS automatically routes root user sign-ins to these supported regions without requiring region selection or method changes. This enhancement is available for all AWS accounts, with CloudTrail logging ConsoleLogin events in the region that handled the sign-in request. Update monitoring and alerts to cover US East (N. Virginia), US East (Ohio), and US West (Oregon) for full visibility into root user sign-in activity.

Why it matters

This change enhances the availability and resiliency of root user sign-in, which is critical for AWS account administrators.

Google DeepMind's Gemma-4-31B-it-assistant and NVIDIA's Gemma-4-31B-IT-NVFP4 models are now available on Amazon SageMaker JumpStart. These models adapt Google's flagship 31B dense architecture for enterprise workloads, offering both full-precision and optimized quantized variants. The Gemma-4-31B-it-assistant specializes in multimodal inference, coding, and agent workflows, accepting text and image inputs (video as frame sequences) and outputting text, supporting a 256K token context window and over 140 languages, ranking in the top three open models on the Arena AI text reader board. The Gemma-4-31B-IT-NVFP4 model is quantized to 4-bit FP4 precision using NVIDIA's ModelOpt framework, reducing memory usage to about 18.5 GB (68% smaller than the base model) and speeding up inference by approximately 2.5x while maintaining 97-99% of the original model's quality. These models are ideal for cost-effective, high-throughput production deployments on NVIDIA RTX, DGX Spark, and data center GPUs. Using SageMaker JumpStart, customers can deploy these models in a few clicks to address specific AI use cases. Access the SageMaker JumpStart model catalog via the SageMaker console or deploy models to your AWS account using the SageMaker Python SDK. For details on deploying and using foundation models with SageMaker JumpStart, see the Amazon SageMaker JumpStart documentation.

Why it matters

Amazon SageMaker JumpStart is a platform that allows AWS customers to access AI foundation models, and the addition of these new models makes it easier to deploy enterprise AI workloads.

Mistral AI's Ministral-3-3B-Instruct-2512 and Ministral-3-8B-Instruct-2512 models are now available on Amazon SageMaker JumpStart. Designed for edge deployment and resource-constrained environments, they enable AWS customers to deploy high-performance, scalable AI solutions on AWS infrastructure. The Ministral-3-3B-Instruct-2512 model, with a 3.4B language model and a 0.4B vision encoder, fits within 8GB VRAM (FP8) and supports a 256K token context window. It provides vision analysis, multilingual instruction understanding (English, French, Spanish, German, Chinese, Japanese, Korean, Arabic, etc.), strict adherence to system prompts, and native function calling with structured JSON output under the Apache 2.0 license. The Ministral-3-8B-Instruct-2512 model, comprising an 8.4B language model and a 0.4B vision encoder, fits within 12GB VRAM (FP8) and uses an interleaved sliding window attention pattern for fast, memory-efficient inference. While offering the same vision, multilingual, agent, and function calling capabilities as the 3B model, it delivers more powerful inference and generation performance. Using SageMaker JumpStart, these models can be deployed in just a few clicks to address specific AI use cases. You can access the JumpStart model catalog via the SageMaker console or deploy models to your AWS account using the SageMaker Python SDK. For details on deploying and using foundation models with SageMaker JumpStart, see the Amazon SageMaker JumpStart documentation.

Why it matters

Amazon SageMaker JumpStart is a platform that allows AWS customers to easily deploy and use foundation models. These new models are particularly useful for developers and data scientists deploying AI applications in edge computing and resource-constrained environments.

AWS Glue zero-ETL integration with Salesforce now captures archived records into target tables, providing a complete replica for analytics and reporting. Archived records are accurately identified and reflected via the isArchived field, ensuring full synchronization with Salesforce sources. This feature is especially useful for high-volume entities like events, tasks, and activities that Salesforce automatically archives, enabling full visibility in analytics data stores. It applies automatically to zero-ETL integrations with no action required; new integrations capture archived records from day one, and existing ones are backfilled automatically without resyncing, resetting, or schema changes. Existing pipelines remain uninterrupted with the isArchived field set accurately. The feature is available in all AWS commercial and AWS GovCloud (US) regions where AWS Glue zero-ETL Salesforce integration is supported. To get started, continue using or create AWS Glue zero-ETL integrations for Salesforce via the AWS Glue console, CLI, or SDK.

Why it matters

This update affects users who require Salesforce data analytics and reporting. Users of AWS Glue zero-ETL can now automatically capture archived records, enabling complete data visibility.

Amazon SageMaker JumpStart now offers NVIDIA's Qwen3.6-35B-A3B-NVFP4 and Wan2.1-T2V-1.3B-Diffusers models from Aliyun. These models expand the portfolio of foundation models available to AWS customers. Qwen3.6-35B-A3B-NVFP4 is NVIDIA's quantized variant optimized for agent-based coding, multimodal inference, and long-context understanding, activating 3B parameters per token and supporting a 262K token context window. Wan2.1-T2V-1.3B-Diffusers excels at text-to-video generation on consumer hardware, requiring 8.19 GB of VRAM for its 1.3B parameter model and producing a 5-second 480p video in about 4 minutes on an RTX 4090. Using SageMaker JumpStart, these models can be deployed in a few clicks to address specific AI use cases.

Why it matters

Amazon SageMaker JumpStart is a platform that allows AWS customers to easily access a variety of foundation models, and these new models offer specialized solutions for tasks such as agentic coding and video generation.

AWS Glue zero-ETL integration now detects conflicting table properties and tracks integration ownership. When configuring source tables and target catalogs, Glue associates the resulting table properties with the owning integration, ensuring no two integrations point to the same target table. This feature works with Amazon S3 tables and SageMaker Lakehouse catalogs, giving data teams predictable control when running multiple zero-ETL integrations. If an integration's table properties are owned by another integration, Glue identifies the owning integration and guides users to select a different target or update the existing one, keeping pipelines isolated and data placed precisely where intended. This functionality is available in all AWS commercial and AWS GovCloud (US) regions where AWS Glue zero-ETL integration is supported.

Why it matters

This update is particularly useful for data teams running multiple zero-ETL integrations, providing predictable control over where source tables land.

AWS End User Messaging improves SMS deliverability via phone pools by automatically failing over to the next best-performing number in the pool if delivery is impacted by downstream issues. This reduces drops and delays during routing from AWS to messaging providers or carriers, supporting critical message programs such as delivery notifications, temporary passcodes, and reminders. Customers automatically gain this benefit when sending through a phone pool, and can enable it manually if not using a phone pool. The feature is available in all AWS regions where AWS End User Messaging is offered.

Why it matters

This update benefits businesses that need to automatically avoid disruptions and delays affecting SMS message deliverability.

AWS End User Messaging supports dynamic flows on WhatsApp, enabling users to complete bookings, surveys, sign-ups, and transactions within chat. You can create flows using Meta's starter templates or customize from scratch, calling HTTPS endpoints on each screen to show live availability or provide personalized steps. Flows are built and managed via the AWS End User Messaging Social console or API, defined in JSON schema and delivered to customers using message templates. WhatsApp flows are available in all regions where End User Messaging Social is offered.

Why it matters

This update benefits businesses looking to deliver richer interactive experiences through WhatsApp

AWS DevOps Agent enables engineers to manage AWS, multi-cloud, and on-premises production operations within Slack. This update integrates both surfaces into a single unified place for incident response, eliminating context switching. Engineers can start and control investigations by mentioning AWS DevOps Agent in a connected Slack private channel, with all research activities-including team context contributions, agent findings, and recommended actions-captured in a single thread. Queries about AWS resources, system metrics, alarm statuses, deployment history, and incident patterns reduce cognitive load and significantly streamline production operations. The feature is available in all commercial AWS regions currently supported by AWS DevOps Agent.

Why it matters

This update enables DevOps teams and operations personnel to consolidate incident investigation and response within Slack, eliminating workflow fragmentation during high-severity incidents and improving efficiency.

AWS Lambda now supports direct read settings, allowing functions to choose between high-performance storage for S3 Files or S3 buckets for reading. This enables optimizing throughput and latency for application needs. S3 Files provides low-latency data from high-performance storage or high-throughput reads from S3 buckets, automatically routing each operation to the optimal storage. By default, Lambda only supports direct reads from S3 buckets for functions configured with 512 MB of memory, lacking control over the direct read setting for specific application requirements. This release allows explicit enabling or disabling of direct reads for S3 Files regardless of function memory size. Enabling direct reads fetches files larger than 1 MB directly from S3 buckets at maximum throughput, while smaller files are served from high-performance storage. Disabling direct reads serves all reads from high-performance storage with minimal latency. This feature is available in all AWS commercial regions, AWS GovCloud (US-East) and AWS GovCloud (US-West) regions, except Asia Pacific (New Zealand), Middle East (Bahrain), and Middle East (UAE). The direct read setting can be configured via the AWS Management Console, AWS CLI, AWS SDK, and AWS CloudFormation, with no additional charges beyond standard Lambda and S3 Files fees. For details on using S3 Files with Lambda functions, see the AWS Lambda developer guide.

Why it matters

This update is useful for developers who need to optimize the integration between Lambda functions and S3 Files, particularly those building scalable data processing pipelines or stateful agentic workloads.

Amazon SageMaker HyperPod now supports model caching, preloading model weights and container images onto cluster nodes to cut pod startup from minutes to seconds for inference optimization. This solves cold-start bottlenecks in large-scale LLM inference, with two features: weight caching stores model weights on local NVMe, avoiding network reads via S3 or FSx, while image caching preloads container images, skipping ECR downloads entirely. If a pod lands on a node without a warm cache, it automatically reloads from the original source, eliminating pod failure risks. Benchmarks for 57 GB to 145 GB models show about 60% faster scale-out, with image caching reducing image pull time by over two minutes (a 97% reduction), with greater benefits for larger models. Customers enable model caching by adding a modelCacheConfig section to their InferenceEndpointConfig or JumpStartModel resources via the HyperPod Inference Operator, which manages the full lifecycle without manual configuration or cleanup. Model caching is generally available in all regions where SageMaker HyperPod is offered.

Why it matters

Solves cold start bottlenecks in large-scale LLM inference, especially beneficial for large model deployments

AWS Elemental MediaLive now supports Video Aligned Locking, enabling pipeline synchronization without source timecode. Previously, frame-accurate synchronization required special hardware or complex external workflows. While timecode is common in high-production broadcasts, it is often hard to obtain and manage in typical digital streaming workflows. This feature uses visual signatures to automatically identify and align specific frames across multiple video streams, allowing frame-accurate input switching and linked cross-region single-pipeline channels over standard pipeline channels. It supports outputs such as HLS, MediaPackage, CMAF Ingest, UDP, and SRT. For setup details, see the documentation on Video Aligned Locking requirements, and for channel synchronization details, refer to the pipeline synchronization implementation guide.

Why it matters

This update affects users who need frame-accurate synchronization in digital streaming workflows, offering a new solution that replaces traditional timecode-dependent synchronization methods.

AWS HealthOmics publishes real-time execution metrics to Amazon CloudWatch, allowing users to monitor resource usage of running workflows. The 14 new metrics cover CPU/GPU utilization, memory usage, filesystem utilization, I/O metrics, network throughput, and temporary storage usage. This helps identify CPU or GPU bottlenecks, detect memory or storage exhaustion early, and track filesystem throughput without opening support cases. By comparing actual usage with allocated resources, users can fine-tune compute and storage configurations for workflows. These metrics are emitted using the Amazon CloudWatch OpenTelemetry standard and can be integrated with native CloudWatch dashboards and alarms as well as third-party monitoring tools. Real-time execution metrics are available in AWS HealthOmics regions in US East (N. Virginia, Ohio), US West (Oregon), Europe (Frankfurt, Ireland, London), and Asia Pacific (Singapore, Seoul, Tokyo). Amazon CloudWatch charges for these execution metrics based on data volume. For pricing details, see the Amazon CloudWatch pricing page.

Why it matters

AWS HealthOmics is a HIPAA-eligible service that helps healthcare and life sciences customers accelerate scientific breakthroughs at scale with fully managed bioinformatics workflows. This update provides users with more detailed visibility into resource utilization during workflow execution.

Amazon EC2 X2idn instances with memory optimization are now available in the Asia Pacific (Hong Kong) region, featuring third-generation Intel Xeon Scalable processors and built on the AWS Nitro system for memory-intensive workloads, offering improved performance over previous X1 instances and SAP certification for running SAP Business Suite on HANA, SAP S/4HANA, and other HANA-based workloads.

Why it matters

Users running SAP HANA-based applications can leverage these instances to improve performance and memory efficiency

Amazon Bedrock managed knowledge base now offers TwelveLabs Marengo 3.0 as an embedding model, generating multimodal embeddings from video, audio, and images. It encodes visual scenes, audio, and video cues directly, capturing meaning beyond traditional transcription-based text embeddings. Upload media assets from sources like Amazon S3, sync them, and search in natural language without managing infrastructure. Marengo 3.0 produces compact 512-dimension vectors for state-of-the-art search accuracy, with results including segment start and end times for direct video jumps. This enables use cases in sports analytics, media and entertainment, security, education, and retail. The model provides content-structure-aligned segmentation options. For details, see the TwelveLabs Marengo 3.0 embedding model integration in the Amazon Bedrock knowledge base user guide or the Amazon Bedrock knowledge base product page.

Why it matters

Amazon Bedrock Managed Knowledge Base simplifies the integration of AI models with external data. This update enables more accurate searching of video, audio, and image content.

Amazon Redshift RG instances are now available in the AWS Europe (Zurich) region, powered by AWS Graviton processors. They run data warehouse and data lake workloads up to 2.4x faster than previous RA3 instances and reduce cost per vCPU by 30%. RG instances include Redshift's custom-built vectorized data lake query engine, processing Apache Iceberg and Parquet data on cluster nodes for SQL analytics across data warehouses and data lakes. They are offered in four sizes: rg.large, rg.xlarge, rg.4xlarge, and rg.12xlarge. Customers with existing RA3 clusters can upgrade to RG using snapshot and restore, elastic resize, or classic resize. RG instances are available on demand and as 1- and 3-year reserved instances with flexible payment options. For pricing details, see the Amazon Redshift pricing page.

Why it matters

Amazon Redshift is a cloud-based data warehouse service for large-scale data analysis and business intelligence. The introduction of RG instances enhances performance and cost efficiency in the Europe (Zurich) Region.

Amazon OpenSearch Serverless is now available on Vercel's AI Powered Platform v0, enabling full-stack search and AI app creation from natural language prompts in minutes. It removes infrastructure management, scaling automatically with demand, allowing focus on app development instead of cluster oversight. The v0 interface builds applications for RAG workloads using full-text and vector search via OpenSearch Serverless, generating complete full-stack apps that auto-provision collections, index data, and handle search queries. It automates environment variables and settings, producing code aligned with best practices, and can provision resources in a new AWS account or link to an existing one.

Why it matters

This update allows developers to build search and AI applications quickly with natural language prompts without managing infrastructure.

AWS has launched general availability of second-generation single-rack AWS Outposts. This 42U rack integrates compute, storage, and networking into one compact unit for low-latency, local data processing, and data residency needs, delivering up to 2,688 vCPU and 100 TB of Amazon EBS storage. It supports the latest x86-powered EC2 instances (general purpose M7i/M8i, compute-optimized C7i/C8i, memory-optimized R7i/R8i, Outposts accelerated networking Bmn-sf2e/Bmn-cx2/Bmn-cx3a) like multi-rack Outposts. Ideal for space-constrained industries such as manufacturing and gaming, it helps modernize operations by utilizing available space and power. Both single-rack and multi-rack Outposts provide the same AWS APIs, management consoles, automation, governance policies, and security controls across AWS regions and on-premises locations. Available regions and countries are listed on the Outposts rack FAQ page, and access begins by opening the AWS Outposts console.

Why it matters

AWS Outposts provides AWS compute, storage, and networking services on-premises. The second-generation single-rack Outposts enables organizations to access the latest AWS resources in space and power-constrained environments.

Amazon MQ now supports RabbitMQ version 4.3. This version adds features to quorum queues, including compaction to reduce disk usage, native support for 32 strict priority levels, delayed retry to automatically set and redeliver failed messages after a configured cooldown delay, and graceful handling of consumer timeouts. Consumer timeouts have moved from the global protocol channel to quorum queues and can be configured per protocol. Both consumer timeouts and delayed retries can be set and managed using RabbitMQ policies. However, migratable non-exclusive queues, global QoS, and Classic queue v1 storage are no longer supported in RabbitMQ 4.3, and consumer timeouts do not apply to Classic queues. To use RabbitMQ 4.3 with Amazon MQ, simply select it when creating a new broker with an m7g instance type via the AWS Management Console, AWS CLI, or AWS SDK. Amazon MQ automatically manages patch version upgrades for RabbitMQ 4.3 brokers, so only the major and minor versions need to be specified. For details on the changes, see the Amazon MQ release notes and development guide. This version is available in all regions where Amazon MQ m7g instance types are offered.

Why it matters

Amazon MQ provides RabbitMQ as a managed message queuing service. The new RabbitMQ version includes quorum queue enhancements and performance improvements, enabling developers and operators to handle messages more efficiently

Today, AWS Lambda Durable Functions announced integration with Pydantic AI, an open-source framework for building AI agents in Python. This integration allows Pydantic AI agents to resume from their last completed step after interruptions like timeouts, eliminating redundant processing. It provides fault tolerance without requiring custom checkpointing or retry logic, ensuring completed model or tool calls are not repeated. This avoids unnecessary costs from token reuse and prevents side effects like double-charging customers. As agents run on AWS Lambda, there is no server management, and you only pay for the compute used. This integration is available in all AWS regions where AWS Lambda Durable Functions are offered. To get started, install Pydantic AI and see the AWS Lambda durability page; detailed information is in the durable execution SDK reference. For more on AWS Lambda Durable Functions, see the developer guide and AWS Lambda product page.

Why it matters

This update is useful for developers building AI agents in Python. The integration of AWS Lambda durable functions with Pydantic AI provides seamless resumption capabilities after execution interruptions.

AWS Lambda now supports detecting recursive loops in the Europe sovereign cloud. This feature automatically identifies and stops recursive calls between Lambda functions and supported services, preventing unexpected charges from unintended loops. When misconfigurations or code defects cause events to return to the same source (like Amazon S3, Amazon SQS, or Amazon SNS) that triggered the Lambda function, recursive loops may occur. Upon detection, recursive loop detection automatically halts event processing and sends an AWS Health Dashboard notification with troubleshooting steps. The feature is enabled by default for Lambda functions using supported SDK versions, and can be disabled for intentional recursive loops using the PutFunctionRecursionConfig API.

Why it matters

Useful for developers building event-driven applications with Lambda functions and event sources like S3, SQS, and SNS. Prevents unexpected billing and resource overuse caused by recursive loops.

Amazon RDS for Oracle now supports the July 2026 release update supplemental patch bundle for Oracle Database versions 19c and 26ai. Starting with the April 2026 release, the Oracle Spatial patch bundle is renamed to supplemental patch bundle, which includes additional database patches recommended by Oracle for specific use cases such as Oracle Spatial, Oracle Data Pump, and Oracle GoldenGate. To apply this update to a new database instance or upgrade an existing instance to engine version 19.0.0.0.ru-2026-07.spb-1.r1 or 26.0.0.0.ru-2026-07.spb-1.r1, select the supplemental patch bundle engine version checkbox in the AWS console. For details on supported Oracle SPBs for each Amazon RDS for Oracle engine version, see the Amazon RDS for Oracle release notes. You can also use AWS Organizations' upgrade rollout policy to gradually apply minor version automatic upgrades to Amazon RDS database instances, allowing automatic updates to non-production environments first, followed by production environments after validation.

Why it matters

This update affects users of Amazon RDS for Oracle, especially those using specific Oracle features such as Spatial, Data Pump, and GoldenGate, who may need to apply the update.

Amazon SageMaker Unified Studio now supports ODBC connections, allowing data users to connect directly to managed data within SageMaker Unified Studio projects via the Amazon Athena ODBC driver using tools like Microsoft Power BI. Connection strings and parameters can be copied from the project's JDBC and ODBC connections tab for DSN-less connections or named DSN configuration. The Amazon Athena ODBC driver (version 2.2.0.1 or later) integrates directly with SageMaker Unified Studio in two modes: SageMakerBrowserIdc and SageMakerIam. SageMakerBrowserIdc mode requires signing in via AWS IAM Identity Center and an external identity provider in the browser, while SageMakerIam mode uses temporary AWS credentials. ODBC connections are available in all AWS regions where SageMaker Unified Studio is offered at no additional cost. For details, see the Amazon SageMaker Unified Studio user guide and Amazon Athena ODBC driver documentation.

Why it matters

Data analysts and business intelligence professionals can access governed data using their existing tools and workflows, improving efficiency in data analysis and reporting

Amazon Elastic Container Service (Amazon ECS) now supports CPU and memory resource IAM condition keys for the RunTask and StartTask APIs. This allows administrators to apply consistent CPU and memory limits across all ECS task launch methods, preventing unexpected cost overruns and keeping workloads aligned with resource policies. Previously, the ecs:task-cpu and ecs:task-memory condition keys were only available for RegisterTaskDefinition, CreateService, and UpdateService APIs. With this enhancement, these keys are also available for RunTask and StartTask APIs, enabling unified resource allocation control across the entire ECS environment. This feature is available in all AWS regions for Amazon ECS at no additional cost. For more information on using condition keys with Amazon ECS, see the documentation.

Why it matters

This change affects administrators who need to uniformly manage CPU and memory resources for ECS tasks through IAM policies

Amazon CloudWatch synthetic monitors now assess network performance issues on routes via AWS Transit Gateway inter-region peering, helping operators and developers quickly identify performance bottlenecks. Previously limited to AWS Direct Connect routes, this release extends health indicators to routes reaching peered regions through Transit Gateway peering. These indicators reflect AWS network health up to the peering connection and are published to CloudWatch accounts, enabling dashboard creation and alarm configuration.

Why it matters

This update is useful for network operators and application developers who need to quickly identify network performance issues over AWS Transit Gateway inter-Region peering connections.

Sellers who enable the request demo or private offer call-to-action buttons on AWS Marketplace can respond within minutes of a customer submitting a request. When a customer submits a request, they can provide use case details, and AWS Marketplace evaluates these details in the agent workflow to create an active prospect for the seller, including the defined use case. Each opportunity arrives in AWS Partner Central with the customer's contact information and use case, allowing the seller to contact them directly. Previously, an AWS representative qualified all requests, which took days to share, but now sellers receive all active leads instantly without waiting for manual qualification by AWS. Even if a customer provides only contact information without additional details, the seller receives the lead for completion in the AWS lead prospecting workflow. Sellers who have not yet added the request demo or private offer buttons can enable them by following the steps in the AWS Marketplace seller guide. This allows customers to request demos or private offers directly from the seller's product listing page, accelerating product evaluation and shortening the procurement cycle.

Why it matters

This update streamlines request handling and accelerates lead acquisition for AWS Marketplace sellers.

Amazon Quick desktop app is now generally available for macOS and Windows, offering full Quick functionality on computers, integrating with local files, and connecting to calendars, email, and business apps in the background. It synchronizes conversations, context, and agents between desktop and mobile apps, enabling seamless continuation of tasks across devices. The agent continues running in the background after the computer is closed, allowing extended work sessions. Users can start agents before leaving the office, provide additional input via the mobile app during commuting, and review final outputs upon arrival. The app ensures production-grade stability, maintains AWS SLAs, and provides governance and management controls for enterprise deployments. It is available in seven regions: US East (N. Virginia), Asia Pacific (Sydney), US West (Oregon), Europe (Ireland), Europe (London), Asia Pacific (Tokyo), and Europe (Frankfurt). Existing Quick users can download it here, with the Quick mobile app available free on the Apple App Store and Google Play Store.

Why it matters

Amazon Quick is an AI-driven agentic application that streamlines workflow automation. The desktop app enhances seamless integration between local environments and cloud resources, improving continuity between mobile and desktop workflows.

Amazon Quick activity feeds are now available in the Amazon Quick mobile app for iOS and Android, providing a single prioritized view of all required work from corporate communications and tools. Users can select important notifications, allowing Quick to learn priorities and display only critical items. Routines can also post to the feed from connected data sources. Context is maintained between desktop and mobile, enabling users to continue tasks on another device where they left off. This feature is included with existing Amazon Quick access at no additional cost. Existing customers can download it from the App Store and Google Play Store, while new customers can create a free account on the Quick product page.

Why it matters

Amazon Quick is an enterprise communication tool, and this update improves mobile workflow efficiency.

Amazon Quick enhances organization-wide management and collaboration, delivering reliable answers wherever teams work. Available on desktop and mobile, it provides enterprise-level administration, richer collaboration, and always-on intelligence. Scheduled tasks and monitoring agents run in the cloud, delivering results to feeds even when laptops are closed. The activity feed adds top-level filters, an improved catch-up view, a daily briefing updated three times a day, and search capabilities for up to seven days of feed data. Administrators gain mobile device management support, custom per-user permissions, and Microsoft Purview data loss prevention integration. Teams can share files and publish agents or skills for others to discover and install. Quick Spaces and Quick apps run natively on desktops, turning indexed local folders into searchable spaces with inline citations for answer sources. All Quick subscribers also receive more agent time monthly-professionals from four to eight hours and enterprises from eight to eighteen hours-consolidated into a single, simpler allocation. New users can create a free account and start using Quick in minutes.

Why it matters

Amazon Quick is a platform for improving enterprise information management and collaboration, and these new features will further enhance team efficiency and security.

Amazon Elastic VMware Service (Amazon EVS) is now available in the Asia Pacific (Osaka), Asia Pacific (Taipei), Europe (Spain), and Israel (Tel Aviv) regions. This expansion gives customers more options to run VMware workloads on AWS, offering scale and flexibility. Amazon EVS runs VMware Cloud Foundation (VCF) directly within Amazon VPC on EC2 bare-metal instances powered by AWS Nitro, enabling full VCF environments in hours. It helps remove legacy infrastructure, reduce operational risk, and meet data center migration deadlines. All existing Amazon EVS features, including support for VCF 9.0 and 9.1, are available. These added regions let customer VMware workloads run closer to end users, reducing latency, meeting data residency requirements, and providing extra options for high availability and resilience. For more information, see the Amazon EVS product details and user guide.

Why it matters

Amazon EVS is a service for running VMware workloads on AWS, particularly useful for VMware users. This region expansion allows for deployment in multiple locations, providing greater flexibility to meet customer requirements.

AWS Storage Gateway now supports a FIPS 140-3 validated endpoint for Amazon S3 File Gateway via AWS PrivateLink. Previously, File Gateway FIPS endpoints were only available over the public internet; this change enables maintaining FIPS-compliant traffic over a private AWS network, simplifying storage gateway use for regulated workloads. File Gateway can now privately access storage gateway service endpoints through a FIPS interface VPC endpoint within a VPC. You can create NFS and SMB file shares to reach Amazon S3 via the S3 FIPS interface endpoint, enabling end-to-end FIPS-compliant private connectivity for file transfer workloads. To get started, create storage gateway and Amazon S3 FIPS interface endpoints in your VPC, and select the FIPS VPC endpoint option when activating the gateway and configuring file shares. Activating the gateway with the FIPS PrivateLink endpoint requires software version 2.1.10 or later. This release is available in eight AWS regions where storage gateway provides FIPS endpoints.

Why it matters

This update affects users who run regulated workloads with AWS Storage Gateway. FIPS-compliant private connectivity makes it easier to use Storage Gateway while meeting security requirements.

AWS Elemental MediaPackage now offers dynamic multi-view, tiling multiple live video sources server-side for on-demand delivery in the viewer's chosen layout. This enables content providers to deliver personalized experiences with multiple angles or games as standard HLS and DASH streams, playable on most modern consumer devices, TVs, and set-top boxes without custom player development. Operating in the compression domain, dynamic multi-view combines individually encoded sources without re-encoding or compositing. Customers encode each source once in AWS Elemental MediaLive, and MediaPackage assembles the composition on demand for native playback on existing devices and players, requiring no app changes or SDK integration. It supports AVC and HEVC codecs, DRM encryption, SCTE-35 ad marker pass-through, and full-screen ad replacement.

Why it matters

This update impacts content providers and media companies using AWS Elemental MediaPackage for live video content delivery. The new Dynamic Multiview feature allows them to offer enhanced viewing experiences by tiling multiple video sources for viewers.

AWS Elemental MediaTailor now offers revenue optimization that automatically monetizes unused ad inventory during live server-side ad insertion (SSAI) with demand from Amazon Ads. This feature is available for publishers enrolled in the Amazon Publisher Services (APS) streaming TV program, requires no additional cost or infrastructure, and inserts ads directly into the stream for seamless playback across all devices. Key features include scalability for large live events, brand safety, easy activation, and performance visibility in CloudWatch. Revenue optimization is available in all AWS regions where MediaTailor is offered.

Why it matters

This update targets publishers looking to maximize ad revenue from live streaming content. It allows automatic monetization of unfilled ad slots without additional cost or infrastructure, integrating seamlessly into existing ad insertion workflows.

Amazon Bedrock Managed Knowledge Base introduces the CheckIngestedDocumentAcl and GetIngestedDocumentAcl APIs. These APIs allow customers to verify if a specific user has access to a given ingested document and retrieve the full access control list (ACL) attached to a document, enabling auditing of permissions and detection of misconfigurations. The console adds a new Document Access Control section on the data source details page, where users can check access by entering a document ID and user email, or retrieve a document's full ACL by document ID. Together, these features provide administrators with the visibility needed to manage access control at scale across enterprise knowledge bases.

Why it matters

Amazon Bedrock Managed Knowledge Base securely connects enterprise documents and databases to large language models. This update provides administrators with tools to efficiently verify and correct access control settings, improving security management for knowledge bases.

AWS Lambda extends function timeouts from 15 to 90 minutes for asynchronous and event source mapping calls on Lambda managed instances (LMI), enabling long-running jobs like data processing, media transcoding, financial calculations, AI inference, and batch processing without application redesign. LMI handles multiple concurrent requests per instance, accesses specialized compute configurations, and improves cost efficiency through EC2 pricing advantages. The extended timeout also applies to calls within Lambda durable functions, supported by checkpoint and replay capabilities, allowing multi-step durable executions to run for up to one year. The 90-minute timeout can be set via the AWS management console, AWS CLI, Lambda API, infrastructure-as-code tools, or AWS agent toolkit, while synchronous calls retain the existing 15-minute maximum. This feature is available in all AWS regions where Lambda managed instances are offered.

Why it matters

This update affects users with long-running workloads such as data processing and AI inference, extending the capabilities of Lambda Managed Instances

AWS Lambda now supports C9g, C9gd, M9g, and M9gd instances powered by AWS Graviton5 on Lambda managed instances. This enables Lambda functions to run on the latest Graviton processors, delivering up to 25% better compute performance than Graviton4-based instances. Lambda managed instances let you run Lambda functions on AWS EC2 instances while maintaining Lambda's operational simplicity. They fully manage infrastructure tasks such as instance lifecycle, OS and runtime patching, routing, load balancing, and autoscaling, allowing you to focus on writing code. When creating a capacity provider, you can specify the desired Graviton5 instance type (C9g, C9gd, M9g, M9gd). By default, Lambda automatically includes Graviton5 instances in the instance selection list based on the function's configured architecture, memory size, and memory-to-vCPU ratio. AWS Lambda managed instances support C9g, C9gd, M9g, and M9gd instance types in all AWS regions where Lambda managed instances and these EC2 instances are available. For more information, see the Lambda managed instances documentation and the AWS Lambda pricing page.

Why it matters

Lambda Managed Instances allow running Lambda functions on EC2 instances while maintaining Lambda's operational simplicity, and this update delivers performance improvements

AWS has launched general availability of AWS-managed transformations for .NET modernization. The transformations can be triggered via a single CLI command, run interactively, or scripted into existing pipelines and workflows. The CLI experience integrates seamlessly with existing web applications, Visual Studio IDE, Kiro Power, and MCP agents. AWS Transform custom enables organizations to modernize and transform code at scale using AWS-managed and custom transformations. It supports language version upgrades, framework migrations, performance optimization, and codebase analysis, offering ready-to-use or customizable transformations. These transformations continuously improve, learning from each engagement to deliver more accurate and efficient results. AWS Transform custom and AWS Transform for .NET are available in eight AWS regions: US East (N. Virginia), Asia Pacific (Mumbai, Tokyo, Seoul, Sydney), Canada (Central), and Europe (Frankfurt, London). The .NET modernization transformation includes 50,000 free agent minutes per month. For details, see AWS Transform user guide for AWS-managed transformations.

Why it matters

AWS Transform for .NET is a tool that automates the modernization of .NET applications, helping developers efficiently upgrade code and optimize performance

Amazon Connect Customer now lets contact center managers set concurrency limits per task and email work type. Previously, concurrency settings applied at the channel level for all contacts. This feature allows classifying work types by complexity, priority, or business function, and assigning unique concurrency and interruption rules to each. For example, up to three simple low-load tasks can run simultaneously, while complex high-load tasks process one at a time. The feature is available in all AWS commercial and AWS GovCloud (US-West) regions where Amazon Connect Customer is offered.

Why it matters

This update is for contact center managers looking to improve operational efficiency. It allows for resource optimization based on task complexity and priority.

Amazon Connect Customer Profiles now sends segment membership events, enabling real-time and scheduled notifications when profiles join or leave segments like high-value or low-satisfaction customers. Previously, exporting full segments regularly and running custom scripts to find changes was resource-intensive, error-prone, and caused delays of hours. Segment membership events let Customer Profiles automatically evaluate membership changes and stream them directly to Amazon Kinesis Data Stream. For standard segments built on criteria, changes are detected near real-time as profile attributes update. For advanced segments using Spark SQL, period snapshots evaluate membership at configurable intervals and notify changes. Each event includes profile ID, segment name, operation type (join or leave), and whether the change occurred in real time or during a scheduled run, providing everything needed to activate outbound campaigns, personalization workflows, or retention actions in seconds. Segment membership events are available in all AWS regions where Amazon Connect Customer Profiles is offered. To get started, configure an Amazon Kinesis Data Stream in your domain settings and subscribe to segments. For more information, see the admin guide and product page.

Why it matters

This update impacts businesses that need to automate and streamline customer engagement and marketing activities. Real-time detection of segment changes enables faster responses.

AWS Entity Resolution now provides machine learning-based matching workflows with record-level confidence scores, assigning each record a score that reflects actual match quality rather than a uniform group-level score. This allows higher confidence for automatic merging and lower thresholds for additional qualifying records, enabling more records to be activated and improving target audience reach and lead conversion. It also maintains compliance-level match transparency by providing auditable evidence for each record. In incremental ML workflows, the existing RecordConfidenceLevel column reflects per-record scores without requiring schema changes, and AWS Entity Resolution is available in all AWS regions.

Why it matters

AWS Entity Resolution is a service that helps unify customer data and eliminate duplicates. This update allows for more detailed evaluation of machine learning-based matching accuracy, improving the precision and efficiency of data integration.

AWS Private Certificate Authority now offers AWS Private CA connectors for Kubernetes and Active Directory in the AWS GovCloud (US) region as an Amazon EKS add-on. This lets AWS GovCloud (US) customers managing government workloads extend certificate automation features. The Kubernetes connector simplifies installation, configuration and lifecycle management through the EKS console, CLI and API, automating certificate requests, distribution to Kubernetes secrets and updates in partnership with cert-manager, enabling TLS for ingress controllers and protecting service-to-service communication in service meshes such as Istio and Linkerd. The Active Directory connector enables AWS GovCloud (US) customers to use AWS Private CA as a certificate authority for Active Directory registration objects, providing automatic certificate issuance for domain-joined users, computers and other objects, supporting enterprise scenarios such as smart card authentication, LDAPS and network device authentication (802.1x). AWS Private CA protects private key material using FIPS 140-3 level 3 hardware security modules. For more information, see the AWS Private CA product page, Amazon EKS add-on user guide and AWS Private CA Active Directory connector documentation.

Why it matters

AWS Private CA is a service for managing private certificates within an organization. AWS GovCloud (US) is a dedicated region for government-related workloads, and this update enhances certificate automation for Kubernetes and Active Directory environments.

Amazon Elastic Block Store (Amazon EBS) volume cloning now supports cross-account volume copying with re-encryption. Users can copy volumes to any AWS account and re-encrypt them using the target account's AWS Key Management Service (AWS KMS) key. This enables organizations with separate production and development accounts to copy data across account boundaries. Cross-account copying is supported for all volume types, including unencrypted volumes and those encrypted with customer-managed keys. To copy volumes between accounts, share the volume with the target account using AWS Resource Access Manager (AWS RAM), then create a copy of the shared volume in the same Availability Zone within the target account. The feature is accessible via the AWS Management Console, AWS Command Line Interface (CLI), and AWS SDKs, and is available in all AWS regions that support Amazon EBS volume cloning, including all commercial regions, AWS GovCloud (US) regions, AWS China regions, and supported Local Zones.

Why it matters

This change benefits organizations that separate production and development workloads into different accounts or require separate encryption keys across environments.

Amazon API Gateway's REST API now supports presenting ACM certificates during TLS handshakes for backend integrations, enabling mutual TLS. Previously limited to self-signed certificates, it now uses certificates signed by trusted CAs. Integration endpoints validate the certificate to confirm connections originate from the API. Certificates can be imported from existing PKIs or issued and managed via AWS Private Certificate Authority. API Gateway automatically reflects certificate re-imports or updates without redeployment or downtime. Combined with existing client mTLS support, this allows mutual authentication for both client-to-API and API-to-backend connections, a common requirement in regulated environments like financial services and healthcare, as well as zero-trust settings. Backend mTLS integration is available in all commercial AWS regions and AWS GovCloud (US), configurable via the API Gateway console, AWS CLI, or AWS CloudFormation.

Why it matters

This change is useful for developers who need to enhance security between APIs and backend systems, particularly in highly regulated industries.

Amazon SageMaker Feature Store is a fully managed feature store for training and deploying AI models. It now supports updating individual features in a record, allowing data scientists to modify one or more feature values in a single request without rewriting the entire record, reducing write latency and cost. When multiple pipelines write to the same feature group, each updates only its computed features, enabling independent updates by streaming and nightly batch jobs. This allows updating high-volume single features without building merge logic in data ingestion pipelines. The feature is available in all AWS regions where Amazon SageMaker Feature Store is offered.

Why it matters

This update is relevant for data scientists and developers who need to optimize machine learning model feature management. Users of Feature Store can achieve more efficient data updates and cost savings with this functionality

Amazon Timestream for InfluxDB now supports running custom Python plugins on managed InfluxDB 3 Core and Enterprise editions. Users can host plugin code in public or private repositories, and the engine fetches and executes it based on triggers, enabling workload-specific logic without external infrastructure. Plugins run with supported trigger types for custom data transformations, alerts, aggregations, and integration with proprietary services, executing in a managed Python environment with standard libraries and Amazon-verified packages. This is enabled by setting the plugin repository in a DB parameter group and applying it to a cluster, then creating triggers via the influxdb3 CLI or HTTP API. Private repositories authenticate using tokens stored in AWS Secrets Manager. Custom plugins are available in all AWS regions where Amazon Timestream for InfluxDB is offered.

Why it matters

This update is useful for users who need to implement custom processing in managed versions of InfluxDB databases.

Today, AWS Systems Manager extended its diagnostics to identify six additional problem categories that prevent Amazon EC2 instances or hybrid-activated nodes from being managed. Previously, diagnostics focused on network connectivity; now they also detect IAM permissions, SSM agent version, instance status checks, OS configuration, default host management settings, and hybrid activation issues. This enables faster troubleshooting by returning specific, actionable causes for more instances. The diagnostics run in the Systems Manager unified console, reporting identified issues per category, each with step-by-step guidelines. For some problems, you can resolve them directly from the console by running AWS Systems Manager Automation runbooks. The feature is available by default in all AWS regions and is billed as a standard Systems Manager Automation runbook execution. For details, see the AWS Systems Manager user guide or product page.

Why it matters

AWS Systems Manager provides unified management and control of EC2 instances and hybrid environments. This update enables more accurate identification of causes for unmanaged instances, allowing faster resolution and recovery of managed status

AWS has launched a Confluence Data Center data source connector for Amazon Bedrock managed knowledge bases, a fully managed RAG service. Customers running self-hosted Confluence Data Center instances can simply provide their instance credentials to automatically crawl blogs and pages, extract metadata, and perform incremental syncs. This provides access to team knowledge stored in Confluence, such as wiki pages and blog posts, allowing filtered ingestion of specific spaces or content types to maintain a cost-effective knowledge base. It simplifies building internal assistants based on engineering documents, runbooks, and team knowledge bases hosted in Confluence Data Center.

Why it matters

Organizations using Confluence Data Center can now directly leverage their existing knowledge base as a source for AI assistants

Today, AWS HealthOmics introduced a resource fallback directive. This allows defining a list of preferred accelerator types for tasks in Workflow Description Language (WDL) workflows, automatically trying alternate options if the specified accelerator is unavailable, with the option to include CPU instances as the final fallback. Each accelerator profile can have a timeout set, choosing whether to expedite fallback ordering or increase the likelihood of securing the preferred accelerator. This feature is available in US East (N. Virginia, Ohio), US West (Oregon), Europe (Frankfurt, Ireland, London), Israel (Tel Aviv), and Asia Pacific (Seoul, Singapore, Tokyo) regions.

Why it matters

AWS HealthOmics is a HIPAA-eligible service that helps healthcare and life sciences customers accelerate scientific breakthroughs at scale with fully managed bioinformatics workflows. This update reduces the time spent diagnosing and resubmitting runs due to accelerator constraints, keeping production workflows running.

Amazon Bedrock AgentCore Memory allows developers to send content directly to long-term memory. The IngestData API receives content, distributes it to the configured long-term memory strategy, and makes the resulting memory records available through the same retrieval operations as other long-term memory records. It enables independent use of long-term memory without creating short-term memory events. IngestData supports conversation and JSON payloads, optionally accepting metadata that feeds into the same extraction pipeline as CreateEvent. After processing, extraction results can be verified with ListMemoryRecords or RetrieveMemoryRecords, streamed for real-time notifications via Kinesis, and extraction failures can be redriven using ListMemoryExtractionJobs. IngestData is available in all AWS regions where Amazon Bedrock AgentCore Memory is supported.

Why it matters

Amazon Bedrock AgentCore Memory is a service that allows AI agents to remember information and maintain more natural conversations. This update provides developers with greater flexibility in managing long-term memory.

Amazon RDS for MariaDB now supports the latest community MariaDB minor versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, and 12.3.3. These versions introduce post-quantum TLS key exchange, providing post-quantum encryption options for data in transit. We recommend upgrading for fixes to CVEs, bug corrections, performance improvements, and new features. Upgrades can be performed using Amazon RDS blue/green deployment, in-place upgrade, or restoration from a snapshot. Enabling automatic minor version upgrades allows AWS Organizations to roll out upgrades across clusters using upgrade rollout policies. RDS for MariaDB simplifies deploying, operating, and scaling MariaDB in the cloud.

Why it matters

This update affects users hosting MariaDB databases on AWS. It enhances database security and performance by introducing the latest security patches and features

AWS Transform is now available in the AWS GovCloud (US-West) region, enabling government agencies and regulated organizations to plan and execute large-scale migrations within AWS GovCloud (US). It automates server migrations for VMware, bare metal, Hyper-V, and database workloads, allowing isolated environment migrations. The region supports migrations to both AWS GovCloud (US-East) and AWS GovCloud (US-West) target regions. Modernization, custom transformation, and assessment features are not included in this launch and remain available in supported commercial regions.

Why it matters

AWS GovCloud (US) is a cloud environment designed for government agencies and regulated organizations, and this update allows these organizations to execute large-scale migrations in a secure and compliant environment.

Amazon S3 Object Lock supports event holds, allowing object retention periods based on future events like contract signings or audit completions. Event holds apply a specified retention period to objects, with S3 protecting them while active; upon release, objects remain retained for the set duration. They can be applied individually, set as a bucket default, or applied at scale using S3 batch operations. New AWS IAM and bucket policy condition keys control who can set or release holds and enforce minimum or maximum hold periods. AWS CloudTrail logs all hold actions, and S3 Inventory reports hold status for entire buckets. Event holds are available in all AWS regions, including China, at no additional cost.

Why it matters

This change is useful for organizations that need to accurately manage data retention periods based on events such as contracts or audits. S3 Object Lock provides features to support WORM compliance.

Version 1.0 of the Nx Plugin for AWS is now available. This open-source plugin extends Nx with generators for scaffolding full-stack applications on AWS, including AI agents, APIs, websites, and databases built with TypeScript and Python. Each generator produces deployable code with infrastructure defined via AWS CDK or Terraform constructs, incorporating best practices such as AWS WAF protection, CloudWatch logging, and X-Ray tracing. The generated code has no runtime dependency on the plugin, and Nx migrations can apply improvements to customized workspaces. The plugin is available under the Apache 2.0 license at no additional charge; users only pay for the AWS resources their applications consume.

Why it matters

This update benefits developers and teams looking to quickly build full-stack applications on AWS. Using templates allows for easily creating a robust foundation with built-in security and monitoring features.

Today, AWS announced four new features for dynamic image transformation (DIT) in Amazon CloudFront. Customers can now use advanced smart cropping with combinations of faces, labels, text, logos, and custom Amazon Rekognition models, along with refined control over composing products, text, logos, and custom objects. Image optimization has also been enhanced, leveraging CloudFront's multi-tier device detection to deliver appropriately sized images for all browser and device types, from phones and tablets to smart TVs. DIT now includes an interactive playground for testing and validating image transformations, with a fully integrated ECS and Lambda architecture.

Why it matters

This update is useful for developers and marketers who need to optimize and customize image delivery

AWS Builder ID is a profile for accessing AWS Builder Center, AWS Training and Certification, Amazon Quick, Kiro, and more. New features enhance profile protection and recovery, allowing self-service recovery in more scenarios without contacting AWS Support by adding a recovery email. Forgotten passwords can be reset via links sent to the main or recovery email. If MFA device access is lost, verification of both the main and recovery emails can restore access. Users signed in with Google, Apple, GitHub, or Amazon can register MFA devices directly with AWS Builder ID, extending strong account protection to these methods. If third-party account access is lost, the sign-in method can be permanently switched to email and password. For details on AWS Builder ID and how to set up account recovery and MFA, see the AWS Builder ID documentation.

Why it matters

AWS Builder ID is a profile for accessing AWS developer platforms, and this update enhances account security and recovery

AWS has introduced user-managed settings (3LO) for SharePoint, OneDrive, and Confluence data sources in Amazon Bedrock managed knowledge bases. Previously, configuring these sources required generating 2LO credentials from the third party, which was time-consuming and inaccessible to users without system admin rights. With user-managed settings, users can sign in with existing third-party credentials, allowing Amazon Bedrock managed knowledge bases to handle authentication and complete data source setup in minutes. This streamlined experience lowers barriers to using managed knowledge bases, enabling teams to quickly prototype AI assistants based on SharePoint documents, OneDrive files, and Confluence wikis without needing service account credentials from IT administrators. User-managed settings complement existing service account authentication, accelerating data connections while maintaining programmatic enterprise-grade options for production workloads. For details, see the Amazon Bedrock user guide sections on SharePoint, OneDrive, and Confluence user-managed settings.

Why it matters

Amazon Bedrock Managed Knowledge Base integrates enterprise data into AI applications. This update simplifies connecting SharePoint, OneDrive, and Confluence data sources, benefiting users without admin privileges and teams needing rapid prototyping

Amazon Managed Workflows for Apache Airflow (MWAA) Serverless is now available in AWS GovCloud (US-East) and AWS GovCloud (US-West) regions, automatically eliminating Apache Airflow infrastructure management overhead and provisioning and scaling compute resources on demand, with pay-per-use billing charged only for actual workflow runtime.

Why it matters

AWS GovCloud (US) is designed for U.S. government-related workloads, making MWAA Serverless available in environments with high security and compliance requirements.

Amazon GuardDuty now offers custom detection rules, providing 35 pre-built rules for CloudTrail management events to extend threat detection for your environment. These rules generate 26 unique detection types mapped to 10 MITRE ATT&CK tactics without requiring log collection, normalization, or storage. Because certain threat techniques like external AMI sharing or disabling flow logs may be routine in some accounts but problematic in others, custom rules can be enabled only for unexpected activity. Accessible via the GuardDuty console or API, they can be tested in dry-run mode before live deployment and are available in all AWS commercial and AWS GovCloud (US) regions.

Why it matters

Amazon GuardDuty is a security service that detects malicious and unauthorized behavior, and this update allows organizations to customize their detection scope

The AWS Model Context Protocol Server (AWS MCP Server) now adds serverless capabilities, enabling code agents like Claude Code and Kiro to efficiently diagnose AWS Lambda functions and connected resources. Agents can inspect Lambda functions and resources such as API Gateway, EventBridge, S3, DynamoDB, SNS, SQS, and Step Functions, correlate errors against a 7-day baseline to identify recurring issues, retrieve function and resource deployment configurations, provide timelines of recent changes, and analyze service delays between resources. By fetching comprehensive data in a single call, agents avoid the token consumption of multiple API calls. The AWS MCP Server is available through the Agent Toolkit for AWS or as a standalone install, accessible in all commercial AWS regions with no additional cost for serverless diagnostics.

Why it matters

This update provides developers with efficient diagnostic capabilities for AWS Lambda functions using AI code agents

Amazon Bedrock managed knowledge bases now support scheduled automatic synchronization for data source connectors. Users can set daily, weekly, or monthly sync schedules for all native data source connectors without manual intervention or custom solutions, reducing operational overhead and keeping retrieval-augmented generation applications aligned with current enterprise data.

Why it matters

This update impacts developers and organizations implementing RAG (retrieval-augmented generation) solutions. Automating data source synchronization helps maintain data freshness while reducing management overhead.

AWS has launched a ServiceNow data source connector for Amazon Bedrock managed knowledge bases, a fully managed retrieval-augmented generation service. Customers can now connect their ServiceNow instances to crawl knowledge articles and service catalog items directly into managed knowledge bases. Previously, building and maintaining custom ingestion pipelines was required to import ServiceNow content into Bedrock knowledge bases; now, only ServiceNow instance credentials are needed to automate data crawling, metadata extraction, and incremental synchronization. The ServiceNow connector crawls knowledge articles and service catalog items, including file attachments, allowing AI agents to access organizational knowledge stored in ServiceNow. Using sys IDs, users can restrict imports to specific knowledge bases, article categories, or service catalogs, enabling easy development of IT assistants, HR help desks, and customer support agents based on the organization's latest ServiceNow content.

Why it matters

This update benefits organizations looking to integrate ServiceNow knowledge articles and service catalog items into their AI applications. Amazon Bedrock Managed Knowledge Base is a service that uses retrieval-augmented generation (RAG) to enhance large language model (LLM) responses with specialized knowledge, and the direct connection to ServiceNow eliminates the need for custom ingestion pipelines.

Amazon Elastic Container Service (Amazon ECS) now supports early success criteria for rolling update strategies. Users can set the healthy percent of tasks running and in healthy state for a target service revision to define deployment success. For example, with 100 desired tasks and a 90% healthy percent, Amazon ECS marks the deployment as successful once 90 tasks are healthy, while the remaining tasks continue to launch via normal service scaling. This benefits workloads running on specialized hardware or constrained capacity, such as GPU-accelerated inference workloads. Early success criteria also allow control over the deployment rollback monitoring period, enabling the next scale-out to proceed via normal service scaling while protecting the deployment until the set criteria are met. Users can choose to clean up the source service revision as BLOCKING or DEFERRED. With BLOCKING, the source revision cleanup completes before declaring success. With DEFERRED, success is declared when criteria are met, and source revision tasks are drained asynchronously outside the deployment, which is useful for services with active long-lived connections or task scale-in protection. This feature is available for all AWS commercial and AWS GovCloud (US) regions with rolling update strategies and can be configured for new and existing Amazon ECS services using the AWS Management Console, AWS CLI, AWS SDKs, and infrastructure-as-code tools.

Why it matters

Amazon ECS is a service for managing containerized applications, and this update increases flexibility in the deployment process, particularly useful for workloads with constrained hardware resources.

Amazon EC2 now lets AMI owners specify compatible instance types, automatically blocking launches on unsupported types to reduce launch failures from incompatible combinations. By default, AMIs remain launchable on all instance types, preserving existing workflows until restrictions are explicitly applied. This feature is available in all AWS regions at no additional cost; see documentation for details.

Why it matters

This change affects AMI owners and users who need to restrict launches to specific instance types. It allows control over AMI and instance type compatibility, helping prevent unnecessary launch errors.

Amazon EC2 M9g and M9gd instances are now available in Europe (Ireland) and Asia Pacific (Singapore, Sydney, Tokyo) regions. Powered by AWS Graviton5 processors, these instances deliver optimized performance for memory-intensive workloads. The fifth-generation custom-designed CPU enhances price-performance for memory-intensive workloads on Amazon EC2. Compared to M8g and M8gd instances based on AWS Graviton4, M9g and M9gd instances offer up to 25% higher performance and up to 30% faster databases. Built on the sixth-generation AWS Nitro System, they feature the Nitro Isolation Engine, mathematically guaranteeing workload isolation from each other and from AWS operators through formal verification, setting a new standard in cloud security. M9g instances are ideal for open-source databases, in-memory caches, big data analytics, and memory-intensive applications. M9gd instances provide local NVMe-based SSD block-level storage for scratch space, temporary files, and caches, in addition to memory-intensive workloads. These instances can be purchased through Savings Plans, On-Demand, Spot Instances, Dedicated Instances, or Dedicated Hosts in these four regions.

Why it matters

Amazon EC2 M9g and M9gd instances are new instance types optimized for memory-intensive workloads, offering enhanced performance and security, which can improve efficiency for applications such as databases and big data analytics.

AWS Transfer Family SFTP Connectors now support credential rotation for remote SFTP servers without interrupting file transfers. Connectors automatically use the latest AWS Secrets Manager version, attempting authentication in order, so transfers continue even if credentials rotate. No manual reset is required. This feature is available in all supported AWS regions.

Why it matters

AWS Transfer Family is a service that enables secure and efficient file transfers between AWS and SFTP/SFTP servers using managed AWS services. This update eliminates manual steps during credential rotation, improving transfer reliability

Amazon EC2 P6-B200 instances with NVIDIA Blackwell GPUs are now available in the Asia Pacific (Hyderabad) region, delivering up to 2x performance over P5en instances for AI training and inference. They feature eight Blackwell GPUs, 1440 GB high-bandwidth GPU memory, 60% higher GPU memory bandwidth than P5en, 5th-gen Intel Xeon processors (Emerald Rapids), and up to 3.2 Terabits per second Elastic Fabric Adapter (EFAv4) networking. Powered by the AWS Nitro system, they scale AI workloads reliably and securely to tens of thousands of GPUs within Amazon EC2 UltraClusters. The P6-B200 instances are available as p6-b200.48xlarge in US West (Oregon), US East (N. Virginia, Ohio), AWS GovCloud (US-West, US-East), and Asia Pacific (Hyderabad, Mumbai) regions.

Why it matters

This update impacts users who require AI training and inference. A new instance type powered by NVIDIA Blackwell GPUs is now available, offering improved performance.

Amazon EC2's C9g and C9gd instances with AWS Graviton5 processors are now available in the Tokyo region. The Graviton5 processor, a 5th-gen custom CPU, delivers performance optimized for compute-intensive workloads. These instances offer up to 25% higher compute performance than C8g and C8gd instances, with up to 30% faster databases and up to 35% faster web applications and machine learning. Built on 6th-gen AWS Nitro systems and using the Nitro Isolation Engine for mathematically verified workload isolation, they are ideal for HPC, batch processing, gaming, video encoding, scientific modeling, distributed analytics, CPU-based ML inference, real-time analytics, and ad serving. C9gd instances also suit scratch space, temp files, and caching due to their high-speed, low-latency local storage. They can be purchased as Savings Plans, On-Demand, Spot, Dedicated, or Dedicated Hosts in the Tokyo region.

Why it matters

AWS Graviton-based EC2 instances are popular among developers and enterprises for their compute efficiency and cost performance. These new instances are expected to offer performance improvements, especially for data processing and machine learning workloads.

Amazon EC2 P6-B300 instances are now available in the Asia Pacific (Jakarta) region, featuring 8xNVIDIA Blackwell Ultra GPUs, 2.1TB high-bandwidth GPU memory, 6.4 Tbps EFA networking, 300 Gbps dedicated ENA throughput, and 4 TB system memory. With double the network bandwidth, 1.5x GPU memory, and 1.5x GPU TFLOPS (FP4, non-sparse) versus P6-B200 instances, P6-B300 is ideal for training and deploying large transformer-based models, including LLMs. Currently available as p6-b300.48xlarge in US West (Oregon), AWS GovCloud (US-East), US East (N. Virginia), Asia Pacific (Hyderabad, Jakarta, Seoul), and South America (Sao Paulo) regions. See the Amazon EC2 P6 instances page for details.

Why it matters

Amazon EC2 P6-B300 instances provide high-performance computing resources tailored for training and deploying large-scale foundation models and LLMs, offering users more efficient processing for AI workloads.

Amazon Elastic Container Service (Amazon ECS) now supports non-critical managed daemons on ECS managed instances. Configuring daemons as non-critical ensures mission-critical application tasks continue running uninterrupted, even if the daemon fails, stops, or becomes unhealthy. If a non-critical daemon task fails, stops, or becomes unhealthy, the container instance remains active, existing application tasks keep running without interruption, and ECS continues placing new application tasks without blocking instance registration. This means tasks start immediately, whether the daemon starts or fails. Amazon ECS issues an EventBridge event when a daemon task fails to start and records service action logs for both critical and non-critical daemons, providing full visibility into daemon health. To get started, create or update a daemon with the critical parameter set to false using the AWS console, CLI, CloudFormation, or AWS SDK. Non-critical daemons are available in all AWS regions where Amazon ECS managed daemons are supported. For more information, see the documentation page.

Why it matters

This update affects users running mission-critical container applications. By ensuring that daemon failures do not impact application tasks, it improves system stability and reliability.

Amazon SageMaker AI now supports Amazon EC2 G6e instances for batch transforms, enabling offline inference for gpu-intensive workloads like large language models and diffusion models that generate images, video, or audio. The G6e instances feature up to eight NVIDIA L40S Tensor Core GPUs and third-generation AMD EPYC processors, making them ideal for large datasets that do not require a persistent inference endpoint. Supported regions include US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Mumbai), and Asia Pacific (Hyderabad).

Why it matters

This update affects users running large-scale offline inference tasks that require GPU resources. Users of Amazon SageMaker AI's batch transform functionality can now perform inference with higher performance.

Amazon Elastic Compute Cloud (Amazon EC2) C8g instances are now available in AWS Asia Pacific (Taipei, New Zealand) and AWS GovCloud (US-East) regions. Powered by AWS Graviton4 processors, they deliver up to 30% better performance than AWS Graviton3-based instances. Built on the AWS Nitro System, they offload CPU virtualization, storage, and networking to dedicated hardware and software, enhancing workload performance and security. These instances support compute-intensive workloads such as high-performance computing (HPC), batch processing, gaming, video encoding, scientific modeling, distributed analytics, CPU-based machine learning (ML) inference, and ad serving. They offer larger instance sizes with up to three times more vCPUs and memory than Amazon C7g instances and provide up to 50 Gbps enhanced networking bandwidth and 40 Gbps bandwidth to Amazon Elastic Block Store (Amazon EBS). The AWS Graviton4 processor is up to 40% faster for databases, 30% faster for web applications, and 45% faster for large Java applications compared with AWS Graviton3 processors. C8g instances are available in twelve sizes, including two bare metal options.

Why it matters

Amazon EC2 C8g instances are designed for compute-intensive workloads, particularly for high-performance computing and CPU-based machine learning inference.

Amazon MWAA now offers built-in monitoring in the environment details page of the AWS Management Console, providing a new metrics dashboard that displays key CloudWatch metrics for the environment and a table listing all related CloudWatch alarms. Users can quickly start monitoring important metrics by bulk-creating recommended alarms from AWS-managed templates with one click. This feature is available for provisioned Amazon MWAA environments in all regions where Amazon MWAA is offered. Standard CloudWatch rates apply for metric queries and alarms.

Why it matters

This update helps Amazon MWAA users more effectively monitor the performance and health of their Apache Airflow managed workflow service.

Amazon SageMaker Unified Studio Workflows supports PythonOperator and BashOperator, enabling execution of custom Python functions or shell commands within serverless workflows. This eliminates the need to offload custom logic, such as data transformations or shell script execution, to Lambda or ECS. To use these operators, open a serverless visual workflow, search for PythonOperator or BashOperator in the task panel, and drag them onto the canvas. Configure the workflow settings to specify Python or shell script files, ensuring each operator points to the relevant functions or commands. This feature is available in all AWS regions where Amazon SageMaker Unified Studio is offered.

Why it matters

This update is useful for developers and data engineers building data processing or automation workflows, as it allows custom logic to be integrated into workflows without provisioning additional resources.

Amazon Aurora MySQL-Compatible Edition 8.4 now supports MySQL 8.4.8. Key enhancements include PQ-TLS for post-quantum encryption of data in transit, transaction timeouts to prevent long-running transactions from blocking innoDB purge, and multi-source replication for integrating data from multiple sources. Delayed replication allows setting replication lag to prevent accidental data loss. These replication features are detailed in the release notes. This update is available in all AWS regions where Aurora MySQL is offered. Database upgrades can be performed during scheduled maintenance windows, and enabling automatic minor version upgrades allows using AWS Organizations' rollout policy for phased cluster-wide upgrades.

Why it matters

Amazon Aurora is a high-performance, globally scalable database service that is fully compatible with MySQL. This update enhances security and replication capabilities, enabling safer and more efficient operations in cloud-based database environments.

Amazon Redshift now supports single-node clusters with rg.large instances featuring AWS Graviton processors. These instances are up to 2.4x faster and 30% cheaper per vCPU than previous RA3 instances. They include Redshift's custom vectorized data lake query engine, enabling SQL analytics on Apache Iceberg and Parquet data across data warehouses and lakes with a single engine. Available in patch versions after P204, these RG instances suit small workloads without high availability requirements.

Why it matters

Amazon Redshift is AWS's service for querying large-scale data warehouses and data lakes. This update supports single-node clusters for smaller workloads, improving cost efficiency.

Amazon WorkSpaces Applications supports Graphics G7 instances with NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs and Intel Xeon Scalable (6th Gen) processors. This enables streaming demanding professional applications such as CAD/CAM, 3D rendering, scientific visualization, video editing, and AI-assisted design workflows at higher fidelity and frame rates. G7 instances offer 32 GB of GDDR7 memory per GPU and 2.67x memory bandwidth for streaming larger, more complex 3D scenes and models. They come in six sizes with 1 to 8 GPUs, 8 to 192 vCPUs, and 32 GB to 768 GB of system memory, available in US East (N. Virginia), US East (Ohio), and US West (Oregon).

Why it matters

This update affects users with graphics-intensive workloads. Users running applications that require high-performance graphics processing can now achieve smoother performance and more detailed rendering.

AWS Gateway Load Balancer (GWLB) supports sending TCP Reset (RST) packets when targets fail, are deregistered, or TCP flows time out. This allows TCP endpoints to quickly detect bad connections and establish new flows, reducing traffic disruption from minutes to seconds. Previously, existing TCP connections would continue to the failed target, causing delays of several minutes due to retries and backoff mechanisms. Enabling this feature causes GWLB to send TCP Resets to incoming traffic, indicating the connection is no longer valid. TCP Reset is disabled by default for compatibility, but can be enabled per target group using the AWS Management Console, AWS CLI, or API. The three triggers-target failure, deregistration (after connection drain), and TCP idle timeout expiration-are supported independently. This feature is available for both new and existing Gateway Load Balancers in all AWS regions where GWLB is offered, at no additional cost.

Why it matters

This update is relevant for users who need to accelerate failure recovery for network traffic and developers of applications using AWS Gateway Load Balancer. GWLB is AWS's gateway load balancer that provides fast traffic forwarding and security, and this feature improves recovery during failures.

Amazon Quick has introduced a new Max plan, offering 5x the usage and storage of the Plus plan. This allows users to run large, concurrent workloads without interruption all month long. Available with both monthly and annual billing options, the plan delivers more value per dollar the more it is used. New users can sign up for free in minutes, and existing Plus users can upgrade by selecting 'Upgrade plan' in the navigation bar. All available plans can be compared on the Amazon Quick pricing page.

Why it matters

This update impacts users who require large-scale concurrent processing and long-term workloads in Quick. Amazon Quick is a platform for AI and automated workflow management.

Customers can now subscribe to and manage flat-rate plans via AWS CLI, AWS SDKs, CloudFormation, CDK, or the PricingPlanManager API. The CloudFront flat-rate plan covers global content delivery, WAF, DDoS, DNS, logging, and edge computing for one monthly fee, eliminating overages from traffic spikes or attacks. Previously limited to the console, subscriptions can now be automated through APIs and infrastructure-as-code tools. Paid plans support a two-step activation flow-create then approve-to prevent unintended charges, ideal for automated provisioning. Free plans activate immediately without approval. Using the PricingPlanManager API incurs no additional cost.

Why it matters

This update enables programmatic management of CloudFront flat-rate pricing plans, which is useful for users configuring CloudFront using infrastructure as code or automated workflows

AWS CloudFormation now supports contract test v2 for resource types. Enabled via the cfn test command's --v2 flag, it extends testing beyond basic CRUD handlers to detailed scenarios across all handler operations. All new resource types can run contract test v2 through the test-type API at registration, with Java-based types requiring only Docker and a built handler package to run cfn test --v2 locally. Contract test v2 introduces live state validation to ensure actual resource state matches the requested state after create, update, and delete operations. Developers also benefit from schema backward compatibility checks, test input linting that detects hardcoded regions, account IDs, and partitions, and detailed HTML and JUnit XML reports for local contract test runs. These improvements significantly shorten iteration cycles by catching issues before registration, and contract test v2 is available in all AWS regions where AWS CloudFormation is offered.

Why it matters

This update affects developers and end-users who develop or manage resource types with AWS CloudFormation. Enhanced testing and verification capabilities improve the reliability and stability of resource types.

AWS Transform has generally available support for Amazon FSx for NetApp ONTAP for block storage workloads, enabling direct migration of compute and network from NetApp ONTAP, other block storage platforms, and VMware environments to FSx for ONTAP in a single wave, eliminating the need for intermediate storage platforms or separate migration tools. FSx for ONTAP is a fully managed production-ready shared storage service that combines ONTAP enterprise capabilities with AWS scalability and resilience.

Why it matters

This update benefits organizations planning cloud migrations, especially those using NetApp ONTAP or other block storage platforms. The integration of AWS Transform and FSx for ONTAP simplifies migration processes and reduces operational overhead.

Amazon Simple Email Service (SES) now supports Secure/Multipurpose Internet Mail Extensions (S/MIME) signing. Recipients can verify that emails were sent by the From address holder and that the content was not altered in transit. Instead of signing each message before sending it to SES, users can store a signing certificate in AWS Certificate Manager and enable S/MIME signing for the sender identity, allowing SES to automatically sign messages. Recipients using email clients that do not support S/MIME can read messages as usual. This feature is available in all AWS regions where Amazon SES is offered.

Why it matters

This update affects developers and organizations prioritizing email security. Users of Amazon SES can enable S/MIME signing to automatically verify the authenticity of their sent emails

AWS has announced the public preview of Amazon Linux 2027 (AL2027), built on AL2023. It targets web applications, databases, containerized microservices, AI/ML workloads, and large-scale infrastructure. The update features a kernel version 7.1+, default-enforced SELinux, improved cryptographic performance via AWS-LC, and accelerator drivers including AWS Neuron support. Preview AMIs for both x86-64 and ARM are available across all commercial regions, with container base images on Amazon ECR Public Gallery. Feedback can be submitted through the AL2027 GitHub repository, with full change details in the AL2027 documentation.

Why it matters

Amazon Linux is AWS's operating system for cloud-native workloads. The new version enhances security and performance, with added support for AI/ML workloads

AWS Config will now support 60 new resource types across key services including Amazon Bedrock, Amazon EC2, Amazon SageMaker, and AWS Organizations. This expansion broadens the scope of AWS environments, enabling more effective detection, evaluation, auditing, and remediation of diverse resources. When recording is enabled for all resource types, these new resources are automatically tracked. The new resource types are also available for Config rules and Config aggregators. You can monitor the supported new resource types in all available AWS regions.

Why it matters

This update affects engineers and developers responsible for resource management and compliance. The expansion of AWS Config's supported resource types enables broader automatic monitoring and assessment of infrastructure

Second-generation AWS Outposts racks are now supported in the AWS GovCloud (US-East) and AWS GovCloud (US-West) regions. This allows organizations from startups to enterprises and public sector bodies to order Outposts racks connected to these regions to optimize for latency and data residency requirements. Outposts enables customers to run latency-sensitive workloads locally while remaining connected to their home region for application management. Customers requiring on-premises data management and processing to meet data residency needs can achieve this using Outposts and AWS services. This regional expansion increases flexibility for customers to connect their Outposts to AWS regions.

Why it matters

AWS Outposts extends AWS infrastructure, services, APIs, and tools to virtually any on-premises data center or colocation space for a consistent hybrid experience. This update makes Outposts available in AWS GovCloud (US) Regions, helping customers in government and regulated sectors meet data residency requirements while managing low-latency workloads.

Amazon Connect Customer has launched general availability of agent-based CX designer. This no-code tool enables designing and deploying AI-driven self-service solutions. Users define logic and guardrails on a visual canvas, allowing AI to handle natural conversations. For precision-critical scenarios, workflows guide conversation execution. All design, testing, and production deployment occur in one place, eliminating engineering coding requirements.

Why it matters

This update is relevant for businesses looking to enhance their customer service platforms with AI. The new feature in Amazon Connect Customer allows users to quickly build AI-powered self-service experiences without requiring technical expertise.

Amazon Quick connectors let you integrate tools like Outlook, Slack, Salesforce, Jira, and custom MCP servers directly into chats, agents, apps, flows, and deep research. Today, Amazon Quick adds new tool settings and MCP sync support, giving admins and connector owners finer control over deployment and updates. Owners can selectively enable or disable individual tools, ensuring only approved tools are available to end users. New tool permission settings let owners require consent for certain tools or let end users decide. MCP sync keeps connectors up to date with external MCP servers as they add tools, update descriptions, or evolve features. These features are available in all AWS regions where Amazon Quick is offered. See the Amazon Quick user guide for details.

Why it matters

Amazon Quick is a service that integrates various business tools through chat and agents, and this update provides administrators with more detailed control over connector settings and updates

Amazon Connect Customer enables AI-driven automated evaluation of conversations spoken in Malay, using generative AI for both human and AI agents. Managers can define custom criteria in natural language, with AI generating results and rationale. The system supports cross-language evaluation, allowing English assessments of Malay conversations. This allows multilingual contact centers to use a unified evaluation framework regardless of language, and is available in eight AWS regions including US East (N. Virginia), US West (Oregon), Europe (Frankfurt), Europe (London), Canada (Central), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Asia Pacific (Singapore).

Why it matters

This update is useful for organizations operating multilingual contact centers, contributing to the standardization and efficiency of the evaluation process.

Web Search on Amazon Bedrock is now available in AWS GovCloud (US-West). This feature allows supported OpenAI GPT models to ground responses with web information and include source citations. It keeps request data within AWS boundaries by default and is managed via IAM. Web Search is used only when the model determines current information is needed. Available regions include US East (N. Virginia), US East (Ohio), US West (Oregon), and AWS GovCloud (US-West).

Why it matters

Government and public sector users can now utilize a compliance-aware web search capability

AWS Marketplace now offers 0% registration fees for professional services purchased as part of multi-product solutions, further reducing transaction costs following a recent reduction to 0.5%. This change, combined with features like AI-driven service discovery and single-transaction bundling of software and services, lowers costs for partners selling solutions. Professional services must be bundled with at least one active paid subscription. The fee applies to new subscriptions, with existing ones retaining original terms, across all commercial AWS regions where AWS Marketplace operates. Partners can register multi-product solutions via AWS Partner Central, and customers can view them directly on AWS Marketplace.

Why it matters

This update affects partners selling solutions through AWS Marketplace by reducing their costs. AWS Marketplace is a platform that facilitates the discovery and purchase of software and services, and this change makes it easier for partners to offer solutions at more competitive prices

Amazon MemoryDB now supports AWS PrivateLink in the AWS GovCloud (US-West) and AWS GovCloud (US-East) regions. With AWS PrivateLink, applications within a VPC can privately access Amazon MemoryDB APIs. By creating an interface VPC endpoint, you can access the VPC endpoint from other VPCs using VPC Peering or from on-premises environments using AWS VPN or AWS Direct Connect.

Why it matters

This update affects users of Amazon MemoryDB in AWS GovCloud (US) regions, enabling secure access via private networks.

Amazon Bedrock AgentCore Identity now offers a managed consent portal, eliminating the need to build, host, and maintain custom OAuth callback infrastructure when connecting agents to third-party services like GitHub, Salesforce, and Slack. Each AgentCore Gateway is assigned a dedicated managed consent portal, allowing platform administrators to share the portal URL with their team before starting sessions to obtain consent for the agent to call external tools. End users can check their connection status at any time through the self-service interface without contacting the administrator. Agent IDE-based clients can also use this managed consent portal to present OAuth consent URLs and handle post-consent session joining. This feature is available in all commercial regions where Bedrock AgentCore Identity is offered.

Why it matters

This update is relevant for developers and platform administrators who use AgentCore Gateway to connect agents with third-party services. The managed consent portal eliminates the need to build infrastructure for OAuth flows, improving development efficiency and management ease.

Amazon SageMaker Unified Studio CI/CD expands its open-source deployment toolkit with two new capabilities. The first is an AI agent skill that automates manifest authoring by inspecting project connections, storage, and workflows, applying least-privilege IAM guidance and substituting environment variables for hardcoded resource identifiers. The second is native notebook promotion, which supports promoting SMUS Notebooks alongside code, workflows, and catalog assets using an in-place synchronization model that preserves run history. Both features are open source and available in all AWS Regions where Amazon SageMaker Unified Studio is offered.

Why it matters

Helps data teams move projects from development to production faster while maintaining best practices across stages

AWS Marketplace now supports automatic renewal for private offers, allowing sellers and buyers to maintain subscriptions without renegotiation or repurchase at contract end. Sellers define renewal terms, including price changes, while buyers select options upon receipt and can modify them later. Both parties receive renewal notifications with term comparisons and can decline renewal. Upon completion, buyers can link updated purchase orders. This feature is generally available across all commercial AWS regions for sellers setting contract prices in direct private offers, requiring no additional setup or onboarding.

Why it matters

This update affects users who buy or sell software and services on AWS Marketplace. Sellers and buyers using private offers can manage automatic subscription renewals and set contract terms for future updates in advance.

Amazon RDS for SQL Server now supports 18 new trace flags, enabled via database parameter groups, to modify SQL Server engine behavior. These flags adjust query optimizer cardinality estimates, lock escalation, statistics handling, and memory processing, allowing DBAs to tune performance for workload-specific issues. Supported flags include 647, 652, 1448, 3654, 4138, 4139, 7745, 8285, 8780, 9432, 9481, 9492, 9592, 11024, 11042, 12502, 12618, and 12656, addressing query plan optimization, DDL performance, availability group replication, query store behavior, automatic plan correction, and known engine bugs. As trace flags alter core engine operations, they should be tested in non-production before applying to production instances. Some flags may impact system performance, increasing memory usage or altering query execution plans unexpectedly. These flags are available in all AWS regions where Amazon RDS for SQL Server is supported. To enable, update an RDS parameter group with the desired flags and apply it to your DB instance. For details, see the Amazon RDS for SQL Server user guide.

Why it matters

This update is relevant for Amazon RDS users interested in tuning SQL Server performance or addressing specific issues. It provides more granular control over SQL Server behavior within the managed RDS environment.

Starting today, AWS Lambda supports SnapStart for functions packaged as container images, reducing invocation latency from seconds to sub-seconds. SnapStart caches runtime snapshots at function deployment and resumes from these snapshots on invocation. Previously limited to managed runtimes (Python, .NET, Java), SnapStart is now available for container images. This improves startup times for latency-sensitive workloads like ML inference and interactive APIs. SnapStart can be enabled for new and existing container image functions. For AWS-based container images (Java 11+, Python 3.12+, .NET 8+), it provides experiences similar to .zip archive functions. Other base or custom images require consulting the developer guide. SnapStart is available in all commercial AWS regions except Asia Pacific (New Zealand) and Asia Pacific (Taipei). For details, see Lambda documentation, and visit the AWS Lambda pricing page for cost information.

Why it matters

AWS Lambda SnapStart helps build more responsive applications, especially useful for container-based deployments and functions with large dependencies.

AWS User Experience Customization (UXC) is now available in all commerce regions, allowing account administrators to set custom account colors and control services and regions displayed in the AWS Management Console. Previously limited to the US East (N. Virginia) region and requiring API calls there, UXC can now be managed from any commerce region using AWS CLI, AWS SDK, or AWS CloudFormation, simplifying integration with existing infrastructure automation. UXC remains free of charge; see AWS UXC documentation for details.

Why it matters

UXC is a feature that allows account administrators to customize the AWS Management Console experience by adjusting its appearance and displayed items. This update enables customers to manage settings from any Region, simplifying integration with infrastructure automation.

Amazon Managed Workflows for Apache Airflow (MWAA) now supports Apache Airflow version 3.3.1, introducing state management tasks and multi-language support for persistent task state storage, crash-safe reconnections for long-running jobs, and cursor tracking. New features include experimental language task SDKs for Java and Go, extended asset partitioning, pluggable retry policies, and bulk actions for DAG runs and task instances. Stability, security, and UI improvements are also included. You can launch a new Apache Airflow 3.3.1 environment or upgrade from version 3.2 or later in the AWS Management Console with just a few clicks.

Why it matters

Users who need to manage and orchestrate data pipelines can now benefit from advanced features and improved performance with this update.

Amazon Kinesis Data Streams now supports a dry run feature that allows customers to verify API request success without executing operations. By setting the new 'DryRun' parameter to true in API requests, users can validate permissions before operating streams in production. Previously, customers had to send intentional requests that failed due to service limits to test permissions, an approach that was fragile. When the DryRun parameter is set to true and all checks pass, a DryRunOperationException is returned, confirming that the request would have succeeded without the DryRun parameter. This dry run capability is available for the PutRecord, PutRecords, GetRecords, GetShardIterator, and SubscribeToShard APIs in all AWS regions where Amazon Kinesis Data Streams is offered.

Why it matters

This change is useful for developers and deployment managers using Amazon Kinesis Data Streams, as it allows for safe validation of API request permissions, helping to avoid errors in production environments.

AWS Deadline Cloud now supports sharing job bundles, allowing teams to distribute and reuse rendering job templates without manual file distribution. Job bundles include job templates, parameters, and asset references. Previously requiring shared drives or manual copying, users can now publish bundles to a queue via the submitter or command line, making them immediately available to all queue users. Shared bundles are packaged as portable archives and stored in Amazon S3's existing job attachment bucket for the queue, requiring no additional infrastructure or configuration. This feature is available in all AWS regions where Deadline Cloud is offered.

Why it matters

This update benefits teams running compute-intensive workloads for visual effects, animation, product design, simulation, and gaming. Sharing job bundles allows pipeline teams to publish standard job templates that artists can easily access and use.

Amazon Quick is now generally available, enabling users to build project trackers, customer dashboards, training portals and more in minutes using natural language-no coding required. It integrates directly with existing business systems such as Salesforce, Jira, Asana, ServiceNow, Microsoft 365 and Google Workspace, automatically updating apps when underlying data changes while respecting existing identity, permissions and access policies. Apps can be instantly shared with selected users or the entire organization. Updates like adding AI, changing visual styles or connecting to another system are handled by Quick through natural language instructions. During preview, New York Life built an e-learning portal for its institutional life team, while the Amazon Quick team tracked pipelines, customer requests and hiring metrics using a weekly leadership review app. Plus, Professional and Enterprise customers can start using it on September 1, 2026.

Why it matters

This update announces the general availability of a new service that allows users to build applications using natural language, which is useful for users looking to automate and streamline business processes.

Amazon Connect Customer now includes compact mode on its analytics dashboards, reducing widget size and font while minimizing filters to maximize screen space. For example, enabling compact mode on a 13-inch laptop decreases row height, allowing supervisors to view all team agents on a single screen without scrolling and quickly identify non-compliant agents. This feature is available in all AWS regions where Amazon Connect Customer is offered.

Why it matters

This update targets supervisors and analysts managing Amazon Connect Customer, enhancing visibility on analytics dashboards.

AWS Backup previously supported up to 1,000 buckets per account, but this update aligns backup capabilities with the Amazon S3 bucket quota configured for each account, enabling protection of more than 1,000 general purpose buckets. Existing backup plans and configurations continue to work without changes if using default AWS Backup managed policies. Required permissions for custom policies are documented in the AWS Backup documentation. This feature is available across all AWS commercial and AWS GovCloud (US) Regions.

Why it matters

This change affects users managing large numbers of Amazon S3 buckets who require data protection. It enhances flexibility in AWS Backup's core role of cloud resource backup and recovery by removing a previous limit.

AWS has announced support for self-managed PostgreSQL databases in Amazon CloudWatch Database Insights. This allows monitoring of self-managed PostgreSQL instances running on Amazon EC2 alongside Amazon RDS and Amazon Aurora, providing a unified view of the entire database fleet in one console. CloudWatch Database Insights is an observability solution that helps monitor database health, diagnose issues, and resolve performance bottlenecks. With this update, the CloudWatch agent collects health and performance data from self-managed PostgreSQL instances. Databases appear in the fleet view with live performance data, including load, wait event analysis, query-level statistics, and host metrics. Users can monitor and troubleshoot self-managed PostgreSQL instances using the same familiar console and workflows already used for AWS-managed databases. This support is available in all AWS commercial regions.

Why it matters

This update benefits database administrators and developers who need database monitoring tools, allowing unified monitoring of self-managed and managed databases.

Claude Fable 5.1 is now generally available on Amazon Bedrock in AWS GovCloud (US), bringing Anthropic's most capable frontier model to regulated industry customers. Fable 5.1 provides frontier intelligence for ambitious tasks across coding, scientific research, and enterprise workflows. It is built for long-running, high-stakes work that spans hours and multiple applications, allowing it to handle features across an entire codebase, code review, and performance work over extended sessions. If it encounters an issue, it reports it instead of claiming success, and it avoids shortcuts like disabling failing tests. Fable 5.1 is designated by Anthropic as a Covered Model, a category with additional data retention, safety review, and access policies. Enterprise Frontier Safeguards (EFS), developed jointly by AWS and Anthropic, enable eligible customers to use Covered Models while keeping their data in a cloud environment they control.

Why it matters

AWS GovCloud (US) is designed for regulated industries, and this new model is particularly useful for advanced AI processing in highly regulated environments

Amazon MSK Connect supports restarting newly created connectors and their tasks, enabling quick recovery of streaming data pipelines. As a fully managed service, it deploys, monitors, and scales Apache Kafka Connect connectors. Previously, recovery required deleting and recreating connectors, causing downtime and operational overhead. This feature allows selective restart of connectors with all tasks or just failed tasks, ensuring seamless recovery. It can also restart connectors without failed tasks to reflect changes in external systems or dependencies. The restart capability is available across all AWS regions via the Amazon MSK console, AWS CLI, AWS SDK, and AWS CDK at no additional cost.

Why it matters

This update is useful for developers and deployment managers who manage Apache Kafka Connect connectors. It makes recovery from failures easier and reduces operational burden.

Amazon DocumentDB (MongoDB-compatible) supports direct major version upgrades (MVU) from engine versions 3.6 and 4.0 to version 8.0, eliminating the need for intermediate upgrades while preserving existing data, configurations, and cluster settings. Upgrading to version 8.0 provides the latest security patches, performance improvements, and new developer features, available in all currently supported AWS regions for these versions.

Why it matters

Amazon DocumentDB is a managed database service compatible with MongoDB, and this upgrade capability allows users to easily access newer features and security updates

Amazon CloudWatch now allows configuring a warm-up period for metric and log alarms. This setting delays evaluation after alarm creation, reducing noise when metrics are not yet published, such as during new resource or service startup. For example, attaching a warm-up period to new microservices and alarms provisioned in a CI/CD pipeline prevents page notifications to on-call engineers while services are starting up or metrics are still being emitted. Previously, if underlying metrics had not started reporting data before an alarm was created, CloudWatch would immediately evaluate using the missing data handling setting, potentially triggering unnecessary notifications as newly deployed applications or services transitioned into alarm state during startup. The warm-up period addresses this issue by offering two options: waiting a set period before starting alarm evaluation, or automatically starting evaluation only after metrics meet the evaluation window. The warm-up period is set during alarm creation or update using the WarmUpConfiguration parameter and can be specified from 1 to 2,880 minutes (2 days). By default, alarms end warm-up early and start evaluation once sufficient data accumulates in the evaluation window. Alternatively, you can require alarms to wait the full duration before starting evaluation. The warm-up period is available at no additional cost in all AWS regions where Amazon CloudWatch is provided, beyond standard CloudWatch alarm charges. For details, see the Amazon CloudWatch User Guide sections on alarm warm-up periods and creating alarms that use warm-up periods.

Why it matters

This update is useful for developers and operations teams who want to prevent unnecessary alarm notifications when deploying new resources or services in the cloud environment.

AWS has expanded Amazon WorkSpaces Applications to three new Regions: Europe (Zurich), Asia Pacific (Osaka), and Canada West (Calgary). This expansion allows customers in these areas to deploy applications and desktops in closer proximity, enhancing performance. The service is a fully managed, secure application streaming solution that provides instant access to desktop applications from any device, eliminating the need for local software downloads or management. It automatically scales resources and delivers on-demand user access. Users can start using the service by selecting their preferred Region in the WorkSpaces Applications management console. Pricing is pay-as-you-go.

Why it matters

Amazon WorkSpaces Applications is a fully managed service that allows users to stream desktop applications from any location. This update makes the service available in additional Regions, primarily benefiting users in Europe, Asia Pacific, and Canada.

Amazon OpenSearch Service has expanded Cluster Insights with 17 new insights that detect root causes behind red and yellow cluster statuses and offer actionable recommendations. These insights address resource exhaustion scenarios such as JVM out-of-memory errors, sustained CPU saturation, and configuration issues like zone imbalance and misconfigured replica counts. Previously, diagnosing unassigned shards required manual correlation of metrics across nodes and zones. Now, OpenSearch Service automatically identifies specific constraints or misconfigurations and suggests tailored actions, such as scaling up instance types, increasing disk capacity, or correcting shard allocation settings, to restore cluster stability faster. These insights are available at no extra cost for domains running OpenSearch 1.0 or later and Elasticsearch 6.8 or later.

Why it matters

This update helps users of Amazon OpenSearch Service quickly identify and resolve abnormal cluster states

Amazon Connect Global Resiliency now enables cross-region routing of contacts to agents across two linked AWS regions. For example, a contact arriving in US East (N. Virginia) is routed to the longest-available matching agent, whether located in US East (N. Virginia) or US West (Oregon). Managers can view analytics and search contacts across both regions as a single contact center. Both regions carry live traffic at all times, ensuring neither remains idle as an untested standby. Full configuration and integrations are exercised continuously in both regions, providing confidence that either environment can handle the full workload when needed. Users retain full control over traffic distribution and can shift new contacts and agents to a single region at any time. This feature is supported for all AWS regional pairings where Amazon Connect Global Resiliency is available.

Why it matters

This update is relevant for small and medium businesses and enterprises that need to optimize contact center operations across multiple AWS regions.

AWS Elemental MediaTailor introduces an analytics dashboard built into the AWS Management Console, allowing publishers to view ad monetization and streaming performance globally across multiple regions. The dashboard displays key business metrics such as fill rate, ad impression rate, video completion rate, and impression recovery data, showing how many billable impressions are recovered through MediaTailor's server-side beacon retry logic. Available in all AWS regions where MediaTailor is offered, the dashboard uses Amazon CloudWatch, which includes a free tier. Some components use ListMetrics API calls and incur charges beyond the free tier. Additional streaming metrics, reporting dimensions, and visualizations will be added in future releases.

Why it matters

This update benefits publishers and content providers who rely on video streaming platforms and ad revenue. AWS Elemental MediaTailor automates ad insertion and streaming optimization, and this analytics dashboard enables more detailed performance monitoring and revenue maximization.

Amazon RDS Custom for SQL Server now includes the most recent cumulative updates (CU) and general distribution releases (GDR) from Microsoft SQL Server. This support covers SQL Server 2019 CU32+GDR (KB5102335, RDS version 15.00.4480.2.v1) and SQL Server 2022 CU25+GDR (KB5101347, RDS version 16.00.4262.2.v1). The GDR updates fix vulnerabilities such as CVE-2026-47295 and CVE-2026-47296. Users can apply these updates via the RDS Management Console, AWS SDK, or CLI.

Why it matters

This update affects users running SQL Server databases on Amazon RDS Custom. It includes the latest security fixes and feature updates, so database upgrades should be considered.

Claude Fable 5.1 is now generally available on AWS, providing Anthropic's most capable frontier model for customers. Fable 5.1 offers frontier intelligence for demanding tasks in coding, scientific research, and enterprise workflows. It represents a clear improvement over Claude Fable 5, especially in complex reasoning tasks, delivering better judgment on ambiguous work and fewer confidently wrong answers. The model is designed for long-running, high-stakes work spanning hours and multiple applications, capable of handling entire codebases, code reviews, and performance optimization autonomously. Designated as a Covered Model, Fable 5.1 includes enhanced data retention, safety review, and access policies. Eligible customers can use Covered Models while keeping their data in a cloud environment they control, thanks to Enterprise Frontier Safeguards developed jointly by AWS and Anthropic. Access is available through Amazon Bedrock and the Claude Platform on AWS.

Why it matters

This update impacts developers and enterprises needing advanced AI models for complex workflow automation

AWS has announced the preview of AWS Interconnect for multicloud connectivity with Microsoft Azure. Previously, connecting workloads across multiple cloud providers required complex DIY approaches. AWS Interconnect provides a managed, consistent experience for connections between AWS and Azure, along with OCI and Google Cloud. The preview is available in US East (N. Virginia), US West (N. California), Asia Pacific (Sydney), and Europe (Frankfurt) regions.

Why it matters

A new service simplifying connections between AWS and other cloud providers, aimed at users needing efficient network management in multicloud environments.

AWS Agent Registry is now generally available, providing a private, governed catalog for discovering agents, tools, skills, MCP servers, and custom resources within an organization. Teams gain full visibility into their AI landscape, enabling them to discover existing capabilities instead of rebuilding from scratch. Accessible through the AWS console, CLI, or SDK, it integrates with Amazon Bedrock AgentCore and Kiro IDE for resource discovery without switching contexts. The console features semantic and keyword search alongside dedicated browsing. New enterprise features include provisioning and managing registries as code using AWS CloudFormation, Terraform, and AWS CDK, applying tags for organization and access control, and sharing registries across accounts with AWS Resource Access Manager. It auto-detects agents on AgentCore runtimes and gateways organization-wide, and integrates with Amazon Quick for discovering custom connectors directly in the Quick Connectors page. The service is available in five AWS Regions.

Why it matters

Useful for development and security teams needing centralized management and visibility of AI components within an organization

Amazon Aurora serverless has been updated to platform version 4, offering up to 30% performance improvements and enhanced scaling capabilities. These enhancements efficiently manage workloads with competing tasks, making it ideal for busy web applications, API services, and agentic AI applications with traffic bursts and idle periods. The updates are available for both Aurora PostgreSQL and Aurora MySQL at no additional cost. Existing clusters can upgrade via pending maintenance actions, restarts, or blue/green deployments.

Why it matters

Amazon Aurora serverless is an auto-scaling database service that adjusts resources based on demand, optimizing cost efficiency.

AWS Lambda recursive loop detection is now available in all commercial regions. This default-enabled feature automatically detects and stops recursive invocations between Lambda functions and supported services, preventing runaway workloads. When using event sources like Amazon S3, SQS, and SNS to trigger Lambda functions, misconfigurations or code defects can cause events to return to the original source, leading to recursive loops, unintended usage, and unexpected billing. Upon detection, Lambda stops processing the event and sends an AWS Health Dashboard notification with troubleshooting steps. The feature works with supported SDK versions or later. Intentional recursive loops can be disabled using the PutFunctionRecursionConfig API.

Why it matters

This update is relevant for developers and operators who trigger Lambda functions using event sources, as it automatically prevents unexpected usage and billing from recursive loops.

Amazon Cognito now includes the GetClientToken API operation, enabling app clients to obtain access tokens for machine-to-machine authorization directly through AWS SDKs, CLI, or APIs-without configuring a user pool domain. This provides an additional method to authorize service-to-service communication for applications, microservices, and automated workloads. The GetClientToken API allows app clients to authenticate with their client ID and secret to receive access tokens authorized for custom scopes on resource servers. As a native AWS API, it integrates seamlessly with AWS SDKs and supports AWS WAF and VPC interface endpoints. The existing domain-based OAuth 2.0 client-credentials flow remains available. This feature is available in all AWS Regions where Amazon Cognito user pools are offered, with standard Amazon Cognito M2M pricing applying.

Why it matters

This update benefits developers needing automated service-to-service communication and those wanting to avoid complex user pool configurations.

Amazon EC2 has launched R9g and R9gd instances powered by AWS Graviton5 processors. These instances are ideal for memory-intensive workloads such as databases, in-memory caches, real-time big data analytics, and containerized applications, offering up to 25% better compute performance compared to previous generation R8g/R8gd instances. R9gd instances provide local NVMe-based SSD storage, making them suitable for open-source databases and distributed real-time analytics. Built on the sixth generation AWS Nitro System, these instances feature the Nitro Isolation Engine for mathematically proven workload isolation.

Why it matters

New version of memory-optimized instances launched, providing high-performance options for database and big data analytics workloads

Amazon Timestream for InfluxDB is now available in eight additional AWS Regions: Africa (Cape Town), Asia Pacific (Bangkok), Asia Pacific (Hong Kong), Asia Pacific (Hyderabad), Asia Pacific (Melbourne), Asia Pacific (Seoul), Europe (Zurich), and Israel (Tel Aviv). This service allows developers and DevOps teams to run fully managed InfluxDB databases on AWS for real-time time-series applications using open-source APIs. It provides multi-AZ high availability, read replicas, enhanced durability, and multi-node scaling, offering flexible deployment options to match evolving workloads. Infrastructure can be right-sized without re-architecting, from single-node setups to 15-node enterprise clusters. InfluxDB databases can be created using the Amazon Timestream for InfluxDB console, AWS CLI, or AWS SDKs.

Why it matters

This update benefits developers and DevOps teams needing real-time time-series data processing. Amazon Timestream for InfluxDB allows fully managed InfluxDB databases on AWS, with expanded availability in new regions.

Amazon Redshift now supports AWS IAM Identity Center authentication for provisioned clusters and serverless workgroups configured with enhanced VPC routing (EVR). This allows single sign-on using corporate credentials, with all traffic traversing Amazon VPC and remaining on the AWS network. With Redshift EVR, traffic between Redshift and other AWS services goes through the VPC, where it can be governed with security groups, network ACLs, and observed in VPC Flow Logs. Authentication and authorization also use AWS PrivateLink interface VPC endpoints within the VPC, following the same network path as other Redshift traffic. The feature also supports IAM Identity Center multi-Region replication for customers running Redshift in a different Region than their primary Identity Center instance.

Why it matters

This change benefits customers with data residency, regulatory, or network-isolation requirements that mandate no public internet egress for analytics, allowing Redshift to be used in environments that avoid public internet access