AWS Updates: Oct 2026

Amazon Connect Customer now supports flow and flow module versioning and alias features, simplifying the building, testing, and deployment of customer experience flows while minimizing impact on live end-customers. Versioning creates immutable versions of flows with attachable friendly names (aliases). Resources like queues, quick connects, and phone numbers point to aliases instead of specific versions. New versions can be rolled out in a single update without republisher or relinking resources. For example, publish an updated customer experience flow as a new version and validate it in a test environment while live traffic remains on the current version, then repoint the production alias to move all phone numbers to the new version in one update. This feature is available in all AWS regions where Amazon Connect Customer is offered. For more information, see the Amazon Connect Customer website.

Why it matters

This update is relevant for enterprises that need to streamline the management and deployment of customer experience flows

Regions: Same as Amazon Connect Customer

AWS WAF now offers automatic SDK integration for Amazon CloudFront distributions. When enabled, CloudFront automatically adds the AWS WAF JavaScript SDK script tag to HTML, requiring no changes to application code, build processes, or deployments. The SDK provides client-side signals for three AWS WAF managed rule groups: Bot Control (target inspection level), Fraud Control account takeover prevention (ATP), and Fraud Control account creation fraud prevention (ACFP). Previously, teams had to manually add script tags to every page for protection, a repetitive task that often led to configuration errors, especially for teams running many applications or serving pages on systems they don't control. Enabling automatic SDK integration on a CloudFront-protecting web ACL eliminates per-application work. This feature is available for web ACLs with at least one managed rule group and can be configured via the AWS Management Console, CLI, SDK, CDK, or CloudFormation. It appears in the AWS WAF console alongside managed rule group settings and is enabled by default for new web ACLs using one of these rule groups. Programmatically created web ACLs default to disabled. Existing web ACLs remain unchanged. The automatic SDK integration incurs no additional cost. For requirements, limitations, and content security policy guidance, see the AWS WAF developer guide's section on automatic SDK integration for CloudFront distributions.

Why it matters

This update is relevant for developers and security teams looking to enhance bot and fraud detection/prevention by integrating AWS WAF with CloudFront.

Amazon RDS for Oracle now allows users to disable automatic minor version upgrades for new and existing DB instances using the JVM, Spatial, Locator, or OLAP options. Previously, these options had automatic minor version upgrades enabled by default; this change lets users choose when to upgrade. While disabling automatic minor version upgrades, we recommend regularly applying new minor versions to incorporate the latest Oracle security fixes. For controlled upgrade sequencing while keeping automatic minor version upgrades enabled, use AWS Organizations' upgrade rollout policy. This change is available in all commercial AWS regions and AWS GovCloud (US). For details on available options, see Amazon RDS user guide: Adding Options to an Oracle DB Instance.

Why it matters

This change affects users managing Oracle databases on Amazon RDS, especially those using the JVM, Spatial, Locator, or OLAP options, by allowing them to control the timing of minor version upgrades.

Regions: All Regions

Amazon MSK now supports TLS version 1.3 for provisioned clusters, enhancing speed and security for encrypted streaming data and meeting evolving compliance and corporate security standards. It also serves as a prerequisite for post-quantum encryption to protect data against quantum computer attacks. Customers can enable TLS 1.3 by selecting a named security policy in their MSK cluster settings. Existing clusters will not change until the policy is applied. Named security policies define the TLS versions and cipher suites the cluster accepts, allowing customers to control security and compliance. Policies supporting both TLS 1.2 and TLS 1.3 let clients negotiate the highest supported version, enabling TLS 1.3-capable clients to connect immediately while TLS 1.2 clients continue using TLS 1.2, allowing customers to upgrade clients before enforcing stricter policies. Customers can also choose a policy that restricts connections to TLS 1.3 only, aligning with compliance requirements. This feature is available at no additional cost in all AWS regions where Amazon MSK provisioning is offered. For more information, see the Amazon MSK documentation.

Why it matters

Amazon MSK is a managed Kafka service. This update enhances security for data in transit, making it particularly useful for enterprises with high compliance and security requirements.

Regions: Same as Amazon MSK Provisioned

Amazon CloudFront can optionally forward two new headers to the origin. The CloudFront-Viewer-ISP header indicates the requesting internet service provider's name, helping identify the network origin. The CloudFront-Viewer-TLS-Details header describes the encryption method used for each viewer's TLS connection, including whether post-quantum cryptography (PQC) was applied. Using CloudFront-Viewer-ISP allows analysis of traffic and performance per network, and isolation of anomalous traffic from specific providers. CloudFront-Viewer-TLS-Details includes key exchange, signature scheme, and signature public key type for each connection, enabling measurement of the proportion of viewers using PQC and identification of unsupported clients. To forward either header to the origin, add it to an origin request policy and attach it to the distribution.

Why it matters

This update is relevant for developers and security professionals who need to analyze web traffic or enhance security. It allows detailed monitoring of request origins and encryption technologies using CloudFront features.

OpenAI's Daybreak Red is now available on Amazon Bedrock in AWS GovCloud (US-East) for authenticated customers. Built for permitted vulnerability research, attack simulation, and mitigation development, Daybreak Red: GPT-5.6 Cyber enhances complex security investigation capabilities, reduces task denials, and provides stronger identity verification, monitoring, and access control. It runs on Bedrock's next-generation inference engine with chip-level zero-operator access enforcement. Inference data isn't used for model training, and Daybreak Red data need not be shared with OpenAI. The model is available in US East (Ohio) and AWS GovCloud (US-East), requiring Daybreak access registration from OpenAI. To begin, contact your OpenAI or AWS account team about Daybreak eligibility, then work with your AWS account team to enable access after approval.

Why it matters

Daybreak Red is now available in AWS GovCloud (US-East) on Amazon Bedrock, providing security teams with advanced AI tools for authorized vulnerability research, exploit reproduction, and defense development

Regions: AWS GovCloud (US-East), Ohio

Amazon Connect Customer automatically saves in-progress emails as drafts, allowing agents to resume without losing progress even if disconnected or the browser refreshes. Saved drafts can be restored, including message body, recipients, subject, and attached files, and accessed via Amazon S3 for integration with other applications.

Why it matters

A feature that ensures customer service agents can complete email processing even when interrupted during email correspondence

Kiro's web search lets agents access real-time internet updates, using the latest results and page content for responses. It automatically uses web search for topics beyond recent changes or model data, and includes citations in responses using web results. Enterprise admins can disable web search and fetch in the Kiro console, and teams can remove web tools or block them with feature-based permissions. For details, see AWS GovCloud (US) docs or contact your AWS account team. Learn more at the Kiro product page.

Why it matters

Kiro is an AI agent service on AWS, and the web search capability enables agents to leverage the latest information, allowing organizations to align with their information security requirements.

Amazon Bedrock extends API support in AWS GovCloud (US) for the OpenAI GPT-5.6 models (Terra and Luna), now supporting Responses, Converse, and Chat Completions APIs through the bedrock-runtime endpoint. It also supports cross-region inference within the AWS GovCloud (US) region, enabling customers to improve throughput without managing multi-region capacity automatically. Cross-region inference routes requests between both regions in AWS GovCloud (US), ensuring US data sovereignty while scaling to provide maximum throughput and Bedrock processing power during peak demand. This release also extends API support for OpenAI GPT models via the bedrock-runtime endpoint. These native OpenAI APIs operate with the same account-level controls as other Bedrock models, and usage is itemized in Bedrock model call logs (deliverable to Amazon S3 or Amazon CloudWatch Logs), Amazon CloudWatch metrics (invocations, tokens, latency, throttling, errors), AWS Cost Explorer, and AWS cost and usage reports, enabling per-model spend attribution. Cross-region inference for OpenAI models is available in all AWS regions where Amazon Bedrock offers OpenAI models. To get started, see the GPT-5.6 (Terra and Luna) model card in the Amazon Bedrock user guide.

Why it matters

This update affects users operating AI models in AWS GovCloud (US). Cross-Region Inference improves processing capacity and redundancy.

Amazon Quick has introduced Quick Essentials for enterprises. This plan enables organizations to easily access all features including AI-powered chat, research, flow, and apps. Users can view and interact with Quick Sight dashboards and reports, adopting at their own pace. Quick Sight readers upgrade to Quick Essentials at no additional per-user cost, allowing natural language queries such as "what caused the sales drop in March?" Responses can be converted into documents, presentations, or spreadsheets. The research function gathers information from data, files, and the web to generate detailed reports, while flow automates routine updates. Apps build tools without coding when needed. Existing dashboards, favorites, and recent items remain unchanged. Row and column-level security applies to all responses, ensuring data is not shared between customers or used to train shared models. Administrators can manage features by applying custom permission profiles to users or roles. Quick Essentials is being rolled out gradually in AWS regions where Quick AI features are available.

Why it matters

Amazon Quick is a business intelligence and AI assistant tool for enterprises. Quick Essentials simplifies access to AI features, streamlining data analysis and reporting.

The managed Prometheus collector now supports Amazon MSK consumer group metrics, enabling collection of Kafka export and consumer group lag metrics from Amazon MSK clusters. It automatically detects and collects Prometheus metrics from workloads without user-managed agents. These metrics are ingested into Amazon Managed Service for Prometheus workspaces or Amazon CloudWatch for querying and analysis, allowing monitoring of Kafka stream health and consumer performance to identify streaming application bottlenecks. This feature is available in all AWS regions where the managed Prometheus collector is generally available.

Why it matters

This update is useful for users who want to automate monitoring of Amazon MSK clusters, enabling easy monitoring of Kafka stream health and consumer performance.

Amazon MSK Connect is a fully managed service for deploying, monitoring, and scaling Apache Kafka Connect connectors on Amazon MSK. Previously, updating connector plugins or worker configurations required deleting and recreating the connector, increasing operational burden and risk. This new feature allows in-place updates, preserving committed offsets and resuming tasks after updates complete. The feature is available at no additional cost in all AWS regions supported by Amazon MSK Connect.

Why it matters

A new feature for Amazon MSK Connect, a fully managed service for Apache Kafka Connect, that enables safer and more efficient connector updates

Regions: Same as Amazon MSK Connect

Today, AWS announced a feature allowing partners with multiple entities to list products at the parent level for subsidiaries to sell as direct private offers, eliminating duplicate listings. The main user retains list ownership and can specify countries where each subsidiary may sell products and private offers. Each subsidiary transacts under its own tax ID, selecting supported currencies, payment settings, and bank accounts. The main user's AWS Marketplace analytics report shows an integrated view of offers, contracts, and renewals across all connected subsidiary accounts. Partners can revoke subsidiary permissions or connections at any time, preventing new offers while leaving existing customer contracts unchanged. This feature is available in all AWS regions where AWS Marketplace operates, at no additional cost.

Why it matters

This change is particularly useful for AWS partners operating multiple legal entities, helping to streamline management and optimize global sales strategies.

Regions: Same as AWS Marketplace

Amazon SageMaker AI inference now supports GPU partitioning, enabling multiple model execution on a single GPU. Using NVIDIA Multi-Instance GPU technology, a GPU can be divided into up to seven isolated partitions, each with dedicated memory and compute. Customers running small to medium models such as fine-tuned variants, embedding models, rankers, and classifiers no longer need to allocate a full accelerator per model, avoiding payment for unused GPU capacity. With GPU partitioning, users select how to split the GPU behind an endpoint and place each model in a suitably sized partition. Multiple models can share one accelerator, with hardware-enforced isolation ensuring that busy models do not affect the memory or throughput of neighboring models. This capability also allows access to new instance generations with capacities better matched to workload requirements. When creating an endpoint to host inference components, GPU partitioning can be configured while keeping application code unchanged by continuing to call each model by name. GPU partitioning is available for P4d, P5, G7, and G7e instances in US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Tokyo), Europe (Frankfurt), and Europe (Ireland).

Why it matters

Beneficial for customers hosting small to mid-size models, improving cost efficiency and resource optimization

Regions: N. Virginia, Ohio and 5 more

Amazon Aurora PostgreSQL-compatible edition now supports post-quantum TLS key exchange for encrypted data in transit. Versions 18 and above allow selecting crypto groups from the Amazon Aurora PostgreSQL allow list to meet organizational security standards. Amazon Aurora delivers high performance and availability globally with full PostgreSQL compatibility, featuring serverless compute, Aurora Global Database for multi-region, Aurora I/O-Optimized for I/O-intensive workloads, and built-in security with continuous backups. For details, see the launch page.

Why it matters

This update is relevant for organizations needing to enhance security for data in transit. Amazon Aurora users can now use post-quantum cryptography to future-proof their data against emerging security threats.

Amazon RDS for SQL Server and Amazon RDS for Oracle now support RDS storage autoscaling on additional volumes. This feature automatically scales storage capacity as database workloads grow, eliminating downtime. You can add up to three volumes to increase storage up to 256 TiB. Previously, storage capacity had to be pre-provisioned for additional volumes, leading to application downtime if capacity was insufficient or wasted resources and higher costs if over-provisioned. With RDS storage autoscaling, simply set the maximum storage limit for each additional volume, and autoscaling handles the rest. It continuously monitors actual storage consumption and automatically scales up when usage approaches provisioned capacity. Autoscaling works for both new and existing database instances, incurs no additional charges, and you only pay for provisioned storage resources. It can be enabled via the AWS Management Console, AWS CLI, or Amazon RDS API, and is available in all commercial AWS regions and AWS GovCloud (US).

Why it matters

This update benefits Amazon RDS users who need to dynamically adjust database storage capacity, especially for applications where storage capacity is difficult to predict or users aiming to improve cost efficiency of storage resources.

Regions: All Regions

Amazon SageMaker Unified Studio now supports custom specifications, allowing admins to define permission sets for project roles. Admins can create up to ten custom specs in the management portal, selecting grouped permissions for catalogs, subscriptions, connections, notebooks, and data agents. For example, a "data admin" spec may include approving subscription requests and publishing assets, while an "analyst" spec is limited to querying data and running notebooks. Each spec is defined at the domain level and can be assigned to any project within that domain. When a member performs an action, SageMaker Unified Studio evaluates the assigned spec to allow or deny the request. This enables data engineers, admins, analysts, and automation pipelines to work on the same project with different access rights, eliminating the need for separate projects for permission separation. Each domain includes two managed specs (owner and contributor), and admins can create up to ten additional specs. This feature is available in all AWS regions where Amazon SageMaker Unified Studio is offered.

Why it matters

This update is useful for organizations managing data science and machine learning projects that require finer-grained control over project member permissions.

Regions: Same as Amazon SageMaker Unified Studio

Amazon Redshift has introduced automated cross-Region snapshot copying, enabling automatic backups of provisioned clusters or serverless workgroups to selected target AWS Regions. This feature continuously and incrementally copies the latest snapshots without manual intervention, offering an additional business continuity option. Enabling the feature eliminates the need to manually start cross-Region snapshot copies during unplanned failures, as the system copies the most recent available snapshot to the target independently of the local cluster's schedule. To configure cross-Region snapshot copying, enable the automated feature for each cluster, set the target Region for copying snapshots, and specify how long to retain automatic snapshots in the target Region. User snapshots are retained until explicitly deleted. To restore snapshots in the target Region, use the restore functionality for a new provisioned cluster or serverless workgroup. Snapshots copied via automated cross-Region copying are prefixed with "copy" in the target Region. This feature is available in all AWS commercial and GovCloud (US) Regions. For configuration details, see the Amazon Redshift documentation section on cross-Region snapshot copying. For cluster restoration procedures, refer to the documentation on restoring clusters from snapshots. For pricing, review the Amazon Redshift pricing page sections on backups and storage and data transfer.

Why it matters

This update is useful for database administrators and enterprises that need to enhance business continuity and disaster recovery strategies, and seek high availability and data protection for their clusters

Regions: All Regions

Amazon Managed Grafana now supports in-place upgrades from Grafana version 12.4 to 13.2. This enables features introduced in open-source Grafana versions 13.0 to 13.2, including dashboard Git sync, dynamic dashboards, and PromQL query support in the Amazon CloudWatch data source plugin. Git sync lets you link workspaces to Git repositories for version-controlled dashboard changes. Dynamic dashboards adjust layouts and panels based on data or variables. The CloudWatch plugin allows querying metrics collected via OpenTelemetry (OTLP) endpoints using PromQL, in addition to previously supported metric search and metrics insights query types. In-place upgrades are available in all AWS regions where Amazon Managed Grafana is offered, via the AWS console, SDK, or CLI. For details on new features and upgrade procedures, see the Amazon Managed Grafana User Guide sections on Grafana version differences and updating workspaces. Features and pricing are available on the product and pricing pages.

Why it matters

Amazon Managed Grafana is a managed service that makes it easier for users to manage Grafana dashboards and monitoring. This update allows users to easily access the latest Grafana features.

Regions: Same as Amazon Managed Grafana

Amazon ECS Managed Instances introduced two infrastructure optimization updates: cross-instance and Spot consolidation. Cross-instance consolidation evaluates tasks running across multiple underutilized instances, packing them into fewer instances to increase utilization and reduce costs. Spot consolidation extends this capability to Spot capacity, consolidating underutilized Spot instances after confirming alternative capacity is available. These features are available at no additional cost in all AWS regions and automatically apply to existing and new ECS Managed Instances capacity providers.

Why it matters

Amazon ECS Managed Instances provisions, configures, and operates appropriately sized Amazon EC2 instances for workloads, balancing availability and cost. This update enhances infrastructure optimization, improving cost efficiency.

Regions: All Regions

Today we announced support for time series collections in the next version of Amazon OpenSearch Serverless. These collections allow ingesting, storing, and analyzing logs, metrics, traces, and event data without provisioning or managing clusters. They automatically absorb ingest peaks, enable fast querying of recent data, and provide low-cost search for monthly or yearly history. In addition to the existing hot storage tier, a new low-cost warm storage tier has been added, eliminating the need to store infrequently accessed data at hot storage prices. Customers can choose the duration for data to transition from hot to warm storage. With up to 100 TB of hot storage per collection, time series collections can handle high-volume observability workloads such as application monitoring, security analytics, and IoT telemetry. Alerts and anomaly detection are now available, enabling detection of issues or anomalous patterns in logs and event data without additional tools. Time series collections are available in all AWS regions where OpenSearch Serverless is offered.

Why it matters

This update benefits developers and data engineers who want to analyze logs and metrics efficiently without cluster management

AWS Lambda now supports deferred loading of Seekable OCI on Lambda managed instances, reducing startup time by up to 70% by fetching only required files at runtime. This resolves delays in compute-intensive applications like data processing pipelines and high-throughput API backends that previously waited for image downloads and preparation. Push a SOCI index to Amazon ECR and tag function versions with the SOCI-indexed tag to enable automatic deferred loading. For coding assistants such as Kiro, Claude Code, and Codex, install the Lambda managed instances skill from the AWS agent toolkit. This feature is available in all AWS commercial regions where Lambda managed instances are offered.

Why it matters

Useful for users building compute-intensive applications such as data processing pipelines and high-throughput API backends. Reduces startup times for Lambda Managed Instances and improves performance at scale.

Amazon ElastiCache Serverless for Valkey now supports public endpoints in AWS GovCloud (US), enabling connections from serverless functions or applications outside VPCs without VPC, VPN, bastion hosts, or SSH tunnels. ElastiCache Serverless requires no VPC configuration or infrastructure provisioning and can be created in under one minute. All connections use IAM authentication over TLS 1.3, eliminating the need for password management or rotation. Connections are possible with Valkey clients using Valkey GLIDE 2.2 or later or the developer toolkit. Public endpoints are available in all commercial AWS regions, AWS GovCloud (US), and China regions at no additional cost beyond standard ElastiCache Serverless pricing. Serverless caches using Valkey 9.0 or later can be created and accessed via the AWS Management Console, AWS SDK, or AWS CLI.

Why it matters

Amazon ElastiCache Serverless is a fully managed cache service that requires no VPC or infrastructure management. This update adds public endpoint support in AWS GovCloud (US) Regions, simplifying connections from applications outside a VPC.

Regions: All Regions

AWS Backup now supports cross-account management, cross-account backup, and delegated administrators in the AWS European Sovereign Cloud (Germany) region. This enables centralized management, monitoring, and copying of backups across an organization using AWS Organizations. Cross-account management allows deployment of backup policies from the management or delegated administrator account, while cross-account backup enables copying recovery points to backup vaults in other accounts, adding protection against accidental or malicious deletion in the source account. Members can also be registered as delegated administrators, letting teams manage organization-wide backups without accessing the management account. These features incur no additional charges, and standard AWS Backup pricing applies. For details, see the AWS Backup documentation and access the AWS Backup console to get started.

Why it matters

AWS Backup is a service that strengthens organizational backup strategies, enabling centralized management and enhanced security across organization-wide backups

Regions: AWS European Sovereign Cloud (Germany)

AWS Certificate Manager (ACM) provides a fully managed ACME server endpoint in AWS GovCloud (US-East) and AWS GovCloud (US-West), supporting ACMEv2-compatible clients like Certbot and cert-manager for automated public TLS certificate issuance from Amazon Trust Services, addressing the CA/Browser Forum's 2029 mandate for 47-day certificate lifetimes.

Why it matters

By supporting the ACME protocol in AWS GovCloud (US), AWS Certificate Manager enables developers to fully automate the issuance and renewal of public TLS certificates, addressing the CA/Browser Forum's requirement for 47-day certificate lifetimes by 2029.

Regions: AWS GovCloud (US-East), AWS GovCloud (US-West)

Amazon DynamoDB Accelerator (DAX) is now available in two new AWS regions: Canada (Central) and Africa (Cape Town). DAX is a fully managed, highly available in-memory cache for Amazon DynamoDB, delivering performance improvements from milliseconds to microseconds. It is API compatible with DynamoDB, allowing applications to add microsecond-latency caching. Customers can retain cache data within the region and benefit from the fully managed service.

Why it matters

A caching service that improves read performance for Amazon DynamoDB. The region expansion allows more customers to access low-latency caching capabilities.

Regions: Canada (Central), Cape Town

AWS Step Functions workflows can now be used as AI agent tools through the Amazon Bedrock AgentCore Gateway. The agent decides when and with what input to run the workflow, and Step Functions executes each step as defined. Existing standard and express workflows can be used as tools. The AgentCore Gateway connects AI agents and tools via the model context protocol (MCP). This allows agents to execute multi-step business processes in the same sequence each time. For example, when a customer support agent initiates a refund workflow, Step Functions performs eligibility checks, manager approval, and credit steps, ensuring all refunds are processed according to policy. Agents can check workflow execution status, enabling operations agents to quickly inform on-call engineers where nightly order executions fail. This feature is available in all AWS regions where Amazon Bedrock AgentCore Gateway is offered. Standard pricing for Step Functions and AgentCore Gateway applies. For details, see the Step Functions developer guide tutorial. For supported operations and setup options, refer to the Step Functions connector target in the AgentCore Gateway documentation. When using AI coding assistants like Kiro, the Agent Toolkit for AWS provides skills and guidance for builds on AWS.

Why it matters

This update is useful for developers and enterprises that need to integrate AI agents with business processes. Using AWS Step Functions workflows as AI agent tools allows agents to automate complex multi-step processes.

Regions: Same as Amazon Bedrock AgentCore Gateway

AWS Lambda now offers the Durable Execution Telemetry Exporter plugin for Lambda durable functions. This monitoring plugin captures step-by-step history of durable executions and sends it to one or more selected destinations. The exported data enables operational and business insights with historical retention beyond standard periods. Thirteen built-in destinations include Amazon CloudWatch Logs, Amazon S3 (for Amazon Athena), Amazon DynamoDB, Amazon Aurora, and Amazon OpenSearch Service. Users can mask sensitive fields before export and control data volume by setting sampling rates. When used with an MCP server, on-call engineers can query lists of recent failed executions or identify failure causes, while business analysts can search all transactions for specific customers. The exporter is available in TypeScript, Python, Java, and Go. Implementation requires installing the exporter, registering the plugin in the function handler, and adding it to MCP server agents. The Durable Execution Telemetry Exporter is available at no additional cost in all AWS regions that support Lambda durable functions.

Why it matters

Useful for building resilient multi-step applications and AI workflows with Lambda durable functions that run for up to one year. Simplifies monitoring and analyzing execution status.

Regions: All Regions

Amazon EKS Dashboard now offers integrated CA rotation status for entire clusters. The existing dashboard enables centralized management across multiple regions and accounts, allowing teams to identify clusters with expiring CAs or upcoming automated rotation events without checking each cluster individually. CA rotation support is available in all commercial AWS regions, and management teams can access this dashboard free of charge from the US East region (us-east-1).

Why it matters

Helps platform teams managing many clusters prioritize CA rotation actions across their fleet

Amazon Quick supports smart approvals, reducing unnecessary prompts while maintaining human oversight for critical actions. As agents perform more tasks on behalf of users-such as sending emails, updating records, or creating tickets-requiring approval for every step causes approval fatigue and weakens oversight. Smart approvals use a separate review model called a classifier to evaluate each action for user requests, automatically approving routine actions and presenting significant ones to the user for review. Existing policies always take precedence. Smart approvals only review actions set to "ask every time"; rejected actions remain rejected, and smart approvals do not grant new permissions. The classifier presents actions with greater impact-such as sending content outside the organization, changing permissions, deleting content, making payments, or actions beyond the user's requested scope-to the user for review. Each auto-approval applies only to the exact action reviewed. If a review fails or times out, the action is forwarded to the user. Smart approvals are enabled for all users by default, with administrators able to control usage via custom permissions, and users can disable it for conversations or scheduled executions via chat options. AWS CloudTrail logs each action taken through smart approvals and any changes to user smart approval settings. Smart approvals are available in all AWS regions where the Amazon Quick agent feature is supported.

Why it matters

Amazon Quick is a service that provides agent capabilities, and this update adds a feature to streamline the approval process for actions performed by agents.

Regions: Same as Amazon Quick agentic capabilities

Amazon RDS for Oracle now supports the September 2026 monthly recommended patch (MRP) for Oracle Database versions 19c and 26ai. The September 2026 MRP incorporates Oracle's critical security patch update (CSPU) and additional Oracle recommended fixes from the July 2026 release update (RU). It includes the updated Oracle timezone file (DST version 46) reflecting daylight saving time rule changes effective November 1, 2026 in British Columbia and Alberta, Canada, and September 20, 2026 in Morocco and Western Sahara. We recommend upgrading to the September 2026 MRP to apply the latest security updates. The MRP can be applied to new database instances or existing instances using the Amazon RDS Management Console, AWS SDK, or CLI to engine version 19.0.0.0.ru-2026-07.mrp-2026-09.r2 or 26.0.0.0.ru-2026-07.mrp-2026-09.r2. For more details on supported Oracle MRPs in Amazon RDS, see the Amazon RDS for Oracle release notes.

Why it matters

This update affects users running Oracle databases on Amazon RDS, providing the latest security patches and time zone information updates

AWS Agent Registry is a fully managed discovery service for organizing, managing, and discovering resources across an organization. It exposes MCP servers, tools, agents, agent skills, and custom resources in a searchable registry with approval workflows for access control, enabling both human users and AI agents to discover suitable tools and agents through hybrid search, catalog browsing, and native MCP endpoints. It is currently available in nine AWS regions; see the AWS region service list for availability per region. For more information, visit the AWS Agent Registry documentation.

Why it matters

AWS Agent Registry is a fully managed discovery service for organizing and discovering resources across an organization, enabling both human users and AI agents to find the right tools and agents.

Regions: London, Frankfurt, Ohio, Canada (Central)

Amazon ElastiCache for Valkey data tiering is now available in the Europe (Spain) region on Graviton4-based r8gd nodes and in the Asia Pacific (Hyderabad) and Europe (Spain) regions on Graviton3-based r7gd nodes. Data tiering scales Valkey clusters to hundreds of terabytes cost-effectively by using solid-state drives alongside memory, automatically moving less-used items to SSD when memory fills and returning them to memory on access. It suits workloads accessing up to 20% of their dataset regularly and applications tolerant of extra latency from SSD reads. R8gd nodes deliver up to 47% higher throughput, 43% lower p99 latency and 31% better price performance versus Graviton3-based nodes of the same size. R7gd nodes offer up to 28% more throughput (reads and writes per second), 21% lower p99 latency and 25% higher network bandwidth than Graviton2-based nodes. Actual performance varies by node size and workload. Data tiering requires Valkey 7.2 or later and can be enabled by creating a new cluster or upgrading an existing one via the AWS Management Console, AWS CLI or AWS SDK. For pricing, see the Amazon ElastiCache pricing page. See the ElastiCache documentation for more details on data tiering and supported node types.

Why it matters

Amazon ElastiCache combines memory and SSDs to enable low-cost operation of large-scale Valkey clusters. This update adds support for new node types in Europe and Asia Pacific regions, improving performance and cost efficiency.

Regions: Spain, Hyderabad

AWS IAM Identity Center's Identity Store now delivers events to Amazon EventBridge in real time when creating, updating, or deleting users, groups, or group memberships. Acting as the identity source for AWS IAM Identity Center, the Identity Store centrally manages identities across AWS accounts and applications. This feature enables automated responses to identity lifecycle events, supporting security and compliance processes. By creating EventBridge rules, users can automate workflows such as auditing user provisioning activities, sending alerts to SIEM systems, and updating access in downstream applications. For large organizations, it also automates onboarding and offboarding when users are added to or removed from specific groups. Change notifications are available in all AWS regions where IAM Identity Center is offered, with events sent per enabled region. The change notifications are free except for standard Amazon EventBridge charges.

Why it matters

This change is useful for security teams and large organizations that need automated responses to identity changes

Regions: Same as AWS IAM Identity Center

AWS Backup now supports restore testing for Amazon Redshift. Restore testing automatically verifies backup recovery success and time. Amazon Redshift can be added to restore test plans with other AWS resources. The plan automatically selects recovery points, runs restores on schedule, and compares restore job completion times to recovery time objectives (RTO), helping assess disaster recovery and business continuity compliance readiness. When creating a restore test plan, specify Amazon Redshift resources by ARN or tag. You can choose to restore the latest recovery point or a qualified random one for each test. Optionally, use restore test validation to confirm the restored resource before AWS Backup deletes the test resource. This support is available in all AWS regions where both restore testing and Amazon Redshift are supported through the AWS Backup console, AWS CLI, or AWS SDK. For a full list of supported regions and features, see AWS Backup documentation. For more details on restore testing, visit the product and pricing pages.

Why it matters

This update is useful for users who need to automatically verify that their backups restore successfully and measure restore times. It helps evaluate recovery readiness for disaster recovery and business continuity requirements using AWS Backup's restore testing capabilities.

Amazon SageMaker AI MLflow Apps now supports MLflow 3.16, enhancing debugging and analysis for generative AI applications and agents. The redesigned trace explorer is used by default, allowing row height adjustments, column reordering, and custom column creation from trace tags or metadata fields. Metric charts for experiments with large metric histories are also accelerated. New MLflow Apps are created with MLflow 3.16 by default, and existing apps will be upgraded during future maintenance windows without user action. MLflow 3.16 is available in all AWS regions where MLflow Apps are offered.

Why it matters

This update impacts developers and data scientists who want to improve debugging and analysis in their generative AI and machine learning workflows

Amazon Bedrock offers Anthropic's Claude Haiku 5.5 cross-region inference (CRIS) for Canada, ensuring inference processing stays entirely within Canada. Canada CRIS routes requests only between ca-central-1 and ca-west-1, helping financial services, healthcare, public sectors, and other regulated industries meet federal and provincial data residency requirements. Offered as a limited-model-selection inference profile, it may not include future models or versions. It is recommended for workloads requiring inference processing to remain within Canada. For details, see Amazon Bedrock user guide: Limited-model-selection inference profile.

Why it matters

A feature for organizations in Canada with strict data residency requirements, such as financial services, healthcare, and the public sector

Regions: Listed in the official documentation

On October 26, 2026, Amazon announced patch updates for Amazon Corretto LTS and feature release versions. Corretto 27.0.1.0.11, 25.0.5.0.10, 21.0.13.0.11, 17.0.21.0.11, 11.0.33.0.10, and 8u512 are now available for download. Amazon Corretto is a free, multi-platform OpenJDK distribution for production environments. Downloads are available on the Corretto homepage, and Linux systems can configure Apt, Yum, or Apk repositories for updates. Feedback is welcome.

Why it matters

Amazon Corretto offers a no-cost, reliable OpenJDK distribution for developers and enterprises. Patch updates help improve security and performance.

Amazon Interactive Video Service (Amazon IVS) Low-Latency Streaming displays a fallback slate to viewers when a broadcaster's stream interrupts unexpectedly. Viewers see the slate instead of buffering icons or frozen frames, and can wait until the broadcaster reconnects. Live playback resumes automatically without requiring viewers to refresh the player. Fallback slate helps retain viewers during temporary disruptions and is ideal for broadcasters streaming from mobile devices or unstable connections. You can enable fallback slate on new or existing channels and monitor slate activity with Amazon EventBridge events and Amazon CloudWatch metrics. Amazon IVS is a managed streaming solution that delivers low-latency or real-time video to global audiences.

Why it matters

Amazon IVS is a managed live streaming solution designed to deliver low-latency or real-time video to viewers worldwide. This update is particularly useful for broadcasters streaming from mobile devices or locations with unreliable connectivity.

Regions: Listed in the official documentation

Amazon ECR now supports replication backfill, allowing existing images in a private registry to be replicated to configured destinations in a single API call. This enables full image catalog replication across regions for expansion, disaster recovery validation, rule updates, or compliance, with up to 10 jobs running concurrently. Progress and per-image results can be monitored via the new API, and jobs can be stopped at any time without deleting already replicated images. The feature is available in all AWS regions where Amazon ECR is offered.

Why it matters

Amazon ECR is an AWS service for managing and distributing container images. This update simplifies bulk replication of existing images across regions, aiding disaster recovery and compliance efforts.

Regions: Same as Amazon ECR

Amazon Connect Customer lets you verify action outcomes during testing and simulation, including Lambda function responses, resolved intents from Amazon Lex, and variables set in Agentic CX blocks. This enables quicker issue resolution and more confident flow releases by identifying the exact action that returns unexpected results, rather than tracing downstream steps.

Why it matters

This update benefits developers and deployment teams by enabling more reliable verification that customer experience flow actions are functioning as expected.

AWS now offers light mode support for Identity Center-based domains in Amazon SageMaker Unified Studio. Customers can choose between dark and light themes to customize their visual interface. This update enables visual settings for both IAM and Identity Center domains, improving readability in bright environments and providing a familiar experience for users who prefer light interfaces. Combined with the existing dark mode, it allows full control over the development environment's appearance, enhances accessibility, and reduces eye strain under various lighting conditions. The setting can be selected under profile preferences as dark mode, light mode, or device settings, and is retained across browsers and devices. This feature is available in all AWS regions where SageMaker Unified Studio is offered. For more information, see the SageMaker Unified Studio user guide.

Why it matters

This update helps Amazon SageMaker users with IDC-based domains customize their development environment.

Regions: Same as Amazon SageMaker Unified Studio

AWS Glue Data Catalog now supports OAuth 2.0 bearer token authentication via AWS Sign-In for Apache Iceberg REST Catalog (IRC) API. The Iceberg REST Catalog spec defines OAuth 2.0 as the standard, natively implemented in engines like Apache Spark, Trino, and Apache Flink. These engines and external partners can now authenticate to the Glue Data Catalog Iceberg endpoint using standard OAuth 2.0 bearer tokens in addition to AWS Signature Version 4 (SigV4). Using OAuth 2.0 token exchange (RFC 8693), OpenID Connect (OIDC) identity tokens can be exchanged for short-lived Glue-scoped bearer tokens to include in IRC requests, following the same standard pattern used across the Iceberg ecosystem. Access is governed by AWS IAM and Lake Formation permissions. Common use cases include third-party analytics and data cloud platforms querying Glue Data Catalog tables through a single, consistent authentication path. This feature is available in all AWS regions where AWS Glue and Lake Formation are offered.

Why it matters

This update is useful for data engineers and data analysts, providing a more secure and standardized way to access Iceberg tables stored in AWS Glue Data Catalog.

Regions: Same as AWS Glue and Lake Formation

AWS KMS supports the NIST FIPS 203 compliant module lattice-based key encapsulation mechanism (ML-KEM), a post-quantum cryptographic standard specified by NIST for replacing classical key establishment methods like DH/ECDH key agreement and RSA key transport. This addresses the harvest-now-decrypt-later threat from quantum computers. KMS supports three key sizes: ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The Encapsulate API generates a random 32-byte shared secret and its ciphertext using a public key, while the Decapsulate API recovers the shared secret from the ciphertext using the corresponding private key. KMS protects ML-KEM private keys in FIPS 140-3 level 3 validated HSMs. The GetPublicKey API allows exporting the public key for distribution to partners, client applications, or external systems to perform Encapsulate operations locally using libraries like AWS-LC, OpenSSL, or Bouncy Castle. ML-KEM is available in all AWS regions except Middle East (UAE), Middle East (Bahrain), and China regions.

Why it matters

AWS KMS is a service for managing cryptographic keys, and this update enhances protection against quantum computing threats by supporting ML-KEM

Regions: Same as AWS KMS

AWS EC2 Auto Scaling now enables Launch Before Terminate at the account level. When activated, Auto Scaling starts replacement instances and waits for them to pass health checks before terminating the targeted instances, ensuring full application capacity and availability during replacement events such as instance refreshes, rebalancing, health checks, and maximum instance lifetime replacements. This feature is managed via new PutAccountSetting and DescribeAccountSettings APIs in the AWS Management Console, AWS CLI, or AWS SDKs, is available in all AWS regions, and incurs no additional cost.

Why it matters

This change affects users who need to ensure application availability during instance replacement events in Auto Scaling groups.

Regions: All Regions

Trusted identity propagation assigns user identity to requests, allowing AWS services to grant permissions based on user and group membership, and logs this information. Cross-region support extends this identity context to AWS services running in different regions, increasing flexibility for cross-region architectures and deployments. Customers distribute workloads across AWS regions for reasons such as isolating compute and query data, running workloads where capacity exists, disaster recovery, and global scale. Previously, trusted identity propagation required all AWS services accessing user identity to be in the same region. To access services in another region, permissions had to be granted through broad IAM roles that could not distinguish individual users, or all services had to be centralized into a single region. With cross-region trusted identity propagation, user identity automatically propagates across AWS regions with each request, enabling fine-grained access control based on user and group membership while auditing which resources were accessed. Cross-region trusted identity propagation is available in all AWS regions where IAM Identity Center is offered, at no additional cost. For a list of regions where IAM Identity Center is available, see AWS Capabilities by Region. For more details, see Trusted identity propagation in the IAM Identity Center user guide.

Why it matters

IAM Identity Center is a service for managing access to AWS resources. This update allows users to maintain fine-grained access control for individual users when distributing workloads across AWS Regions

Regions: Same as AWS IAM Identity Center

Amazon Connect Customer now scores customer interaction results, showing whether customers are satisfied, at risk of churn, made a purchase, or resolved their needs via self-service. Each metric has a default definition that can be adjusted to align with business success criteria. It is available through both the analytics dashboard and API.

Why it matters

Useful for businesses needing to measure the effectiveness of customer interactions to improve engagement and retention

Amazon Connect Customer now enables metrics display split by lifetime value and repeat callers, allowing you to identify at-risk groups before they appear in aggregated results and take actions such as routing high-LTV customers to the most effective agents, adjusting knowledge bases or self-service flows for repeat callers, or refining agent guidance for segments with declining satisfaction.

Why it matters

Amazon Connect Customer helps analyze and optimize customer service. This update allows users to view metrics segmented by customer lifetime value and repeat-caller status, enabling early identification of issues and appropriate actions.

Amazon Bedrock's Web Search now supports two new controls to improve model response accuracy: domain filtering and user location control. Domain filtering lets you specify up to 100 allowed domains to limit results to trusted sources, or up to 100 blocked domains to exclude unwanted sources. User location control optionally enables location parameters for region-specific results, useful for local services or availability queries. These features are available in all supported AWS regions: US East (N. Virginia), US East (Ohio), US West (Oregon), and AWS GovCloud (US-West). For details, see the Web Search section in the Amazon Bedrock user guide. Visit the Amazon Bedrock pricing page for cost information.

Why it matters

This update is useful for developers and organizations that need to control the precision of AI model responses, especially when relying on trusted sources or requiring location-specific information.

AWS Transit Gateway and AWS Cloud WAN integrate with regional private NAT gateways to provide 1:1 NAT, enabling connections for networks with overlapping classless inter-domain routing (CIDR) blocks. Customers define address translation rules on their AWS Transit Gateway or AWS Cloud WAN attachments, specifying which source CIDR from Amazon VPC, AWS Site-to-Site VPN, AWS Direct Connect, and Transit Gateway Connect via SD-WAN appliances maps to which private IP range. Both services automatically perform bidirectional translation, eliminating the need for separate return traffic rules or NAT appliance deployments. AWS operates, scales, and manages NAT functionality as part of the attachment. Customers can configure this in minutes using the AWS Management Console, AWS CLI, AWS SDK, or AWS CloudFormation, and monitor translated traffic with Amazon CloudWatch metrics and Amazon EventBridge events. AWS Transit Gateway and AWS Cloud WAN provide 1:1 NAT via regional private NAT gateways in all active AWS commercial regions. For detailed pricing, see the Amazon VPC pricing page.

Why it matters

This feature is useful for connecting private networks with overlapping IP address ranges on AWS, such as during corporate mergers and acquisitions, partner network connections, and interconnection of independently provisioned VPCs.

Amazon Connect Customer Global Resiliency now offers persistent chat experiences across linked AWS regions. End users retain full context, metadata, and transcripts between regions, eliminating repetitive information. Agents access complete conversation histories across regions for personalized service. For example, a user can start a chat in US-East (N. Virginia) and resume in US-West (Oregon). Enable global routing to use this feature, available in all supported AWS regions. See the Amazon Connect Customer administration guide for details.

Why it matters

This update is relevant for customers using Amazon Connect Customer Global Resiliency, particularly those needing to maintain chat continuity across AWS Regions.

Regions: Same as Amazon Connect Customer Global Resiliency

Amazon MSK Connect is a fully managed service for deploying, monitoring, and scaling Apache Kafka Connect connectors on Amazon MSK. This update adds the ability to pause and resume connectors, allowing safe stoppage during source database or sink target maintenance or while investigating upstream/downstream issues. Connectors no longer need to be deleted and recreated, and their configurations, capacity, and offsets are preserved upon resumption. The feature is available across all AWS regions where Amazon MSK Connect is offered via the Amazon MSK console, AWS CLI, AWS SDK, and AWS CDK at no additional cost.

Why it matters

Amazon MSK Connect is a managed service for deploying, monitoring, and scaling Apache Kafka Connect connectors. This update enables pausing and resuming connectors, improving operational safety and efficiency

Regions: Same as Amazon MSK Connect

AWS CloudFormation simplifies stack update rollback, making it easier to return to a previous deployment. If automatic rollback cannot proceed due to certain resources, using force rollback completes the rollback in one operation. This works across all CloudFormation workflows, including the AWS CLI, SDK, AWS CDK, and AI agents. Force rollback lets CloudFormation finish the update rollback and restore the stack to a deployable state. Resources modified outside CloudFormation are recorded for review and resolution before the next deployment. To begin, continue the update rollback with the force rollback option and create a drift detection change set to verify configuration differences before the next deployment. For more information, see Continuing to Roll Back Updates in the AWS CloudFormation User Guide. Force rollback is available in all regions at no additional cost. For service availability, refer to the AWS Region Table.

Why it matters

AWS CloudFormation is a service for managing and deploying cloud resources. This update makes update rollbacks more efficient, streamlining the deployment process.

Regions: All Regions

Amazon Connect Customer Profiles lets administrators customize customer data displayed to agents in the workspace using layouts created in Profile Explorer. It integrates data from multiple sources for real-time agent access. Layouts customize widgets such as contact history, customer details, and lifetime value; showing flight and baggage ticket info to airline baggage claim agents, and loyalty status and preferences to loyalty agents. AI-generated profile summaries can highlight key customer information. Profile Explorer is available in US East (N. Virginia), US West (Oregon), Africa (Cape Town), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Canada (Central), Europe (Frankfurt), and Europe (London).

Why it matters

Enables customer service agents to handle interactions more efficiently by customizing the information displayed

Amazon MWAA now offers provisioned environments in the Mexico (Central) region (mx-central-1). While the server-less Amazon MWAA was already available, customers can now use provisioned environments for Apache Airflow workflows. Amazon MWAA is a managed orchestration service for Apache Airflow that simplifies large-scale data pipeline setup and operation in the cloud. Customers can create provisioned environments using the AWS Management Console, AWS CLI, AWS SDK, or AWS CloudFormation. This allows Mexico (Central) customers to run workflows closer to data sources and end users, reducing latency and meeting data residency requirements. For more information, see the Amazon MWAA product page and documentation on supported regions.

Why it matters

Amazon MWAA is a managed service for orchestrating Apache Airflow workflows in the cloud. This update makes Provisioned environments available in the Mexico (Central) Region, enabling customers to run workflows closer to their data and users.

Regions: Mexico (Central)

Amazon EMR announced a 30 percent price reduction for running EMR on EKS, applicable per vCPU-hour and per GB-hour, with no change to EKS base fees. All EMR workloads on EKS deployment options are covered, allowing Apache Spark workloads to run on Amazon Elastic Kubernetes Service (EKS) at lower costs. The new pricing applies automatically to EMR on EKS workloads with no user action required, and is available in all AWS regions where EMR on EKS is offered. More details can be found in the Amazon EMR on EKS documentation and Amazon EMR pricing page.

Why it matters

This update affects users running EMR workloads on Amazon EKS, offering cost savings.

Regions: Same as Amazon EMR on EKS

As of today, Amazon OpenSearch Serverless has reduced the default refresh interval for search and vector collections from 10 seconds to 5 seconds. This change controls how quickly newly indexed documents become searchable, enabling applications to achieve earlier read-write visibility automatically without any configuration or user action. The improvement applies to next-gen Amazon OpenSearch Serverless and is enabled by default for both search and vector collections. Faster refreshes benefit workloads requiring continuous indexing and near real-time retrieval, such as full-text search over frequently updated content, RAG, semantic search, and recommendation systems. This 5-second default refresh interval is now available across all 24 regions where Amazon OpenSearch Serverless is offered. For more details, see the Amazon OpenSearch Serverless documentation.

Why it matters

Amazon OpenSearch Serverless is a service for search and vector collections that minimizes the delay between data indexing and search. This update improves performance for applications requiring real-time capabilities.

AWS has launched the general availability of AWS Continuum for code vulnerabilities. The service builds a context graph from AWS environments, including resource topology, identity relationships, and network reachability. It ingests existing vulnerability findings, scans code, and validates in isolated sandboxes to identify actually exploitable vulnerabilities. It prioritizes based on business impact, delivering fix patches as pull requests directly into development workflows with proof of exploitability and impact scope assessment attached. Continuum offers learning and enforcement modes: in learning mode, it suggests fix patches for user approval and operates autonomously within set constraints when sufficient confidence is achieved. It also integrates with existing AWS security services such as Amazon GuardDuty and AWS Security Hub.

Why it matters

Useful for developers and security teams who need to efficiently manage and address code vulnerabilities.

Amazon Bedrock AgentCore Gateway supports the InvokeModel and InvokeModelWithResponseStream APIs for Amazon Bedrock at inference endpoints, also offering model fallback routing. This allows access to any model provider through a single managed endpoint without changing existing Amazon Bedrock SDK integrations. Fallback routing automatically redirects requests to alternate models or providers when the primary is throttled, lacks capacity, or is unreachable, keeping agents available. Gateway rules define alternates in order, switching on conditions like throttling, server errors, or response timeouts. Built-in circuit breakers skip currently failing targets, avoiding delays until the request reaches a healthy target. Handled internally, fallback routing requires only one request and one response per call, with no per-request trial and error. These features are available in all AWS regions where Amazon Bedrock AgentCore Gateway is offered, except China.

Why it matters

Developers can access multiple model providers without modifying existing Amazon Bedrock SDK, improving agent availability and simplifying retry logic implementation

Regions: Same as Amazon Bedrock AgentCore Gateway

AWS has extended programmatic service reference information to automate IAM policy management and align policies with service updates. The reference includes global condition keys under the aws: prefix in a single machine-readable file, a ServiceName field mapping service identifiers to readable names, and an IsDataPlane property identifying data plane operations. This enables automatic retrieval and integration into existing policy management tools and processes, available at no additional cost. For details, see the programmatic service reference documentation.

Why it matters

This update helps automate IAM policy management and align policies with the latest service updates, useful for users managing security and access control.

Amazon Quick is now available in the AWS Asia Pacific (Singapore) region (ap-southeast-1), allowing Singapore customers to access all features while meeting data residency requirements. It provides AI-powered assistance for business users to quickly answer questions and take actions, with features like AI chat, research, Spaces, and QuickSight dashboards, all storing and processing data within the AWS Singapore region. For region-specific availability and more details, see the Quick region availability page and Amazon Quick documentation or product detail page.

Why it matters

Amazon Quick is an AI assistant for business users that enables quick answers and action execution. This update allows customers in Singapore to use Amazon Quick while meeting data sovereignty requirements.

Regions: Singapore

AWS Lambda MicroVMs are now available in four new regions: Asia Pacific (Hong Kong, Malaysia, Thailand) and Europe (Spain), bringing the total to 14 regions. These server-less compute primitives offer VM-level isolation, near-instant startup and resume speeds, and state retention for user and AI-generated code execution. Developers can provide each user or job with its own isolated compute environment without managing virtualization infrastructure or balancing trade-offs between isolation, speed, and state retention. MicroVMs enable secure, stateful, and responsive code execution for applications such as AI coding assistants, interactive development environments, and vulnerability scanners. With this expansion, developers can run Lambda MicroVMs in four regions closer to end users, meeting latency and data residency requirements. MicroVM images can be built from Dockerfiles, and each MicroVM can be launched with a dedicated HTTPS URL supporting common connection protocols like HTTP/2, gRPC, and WebSockets. MicroVMs can be used via the AWS Lambda console, AWS CloudFormation, AWS Cloud Development Kit, or Agentic development tools using the Agent Toolkit for AWS.

Why it matters

Lambda MicroVMs is a serverless compute primitive that provides VM-level isolation for executing user or AI-generated code, useful for applications like AI coding assistants and interactive development environments.

Regions: Hong Kong, Malaysia, Thailand, Spain

AWS Neuron 2.33 is released, providing TorchNeuron, a native PyTorch backend for Trainium, in public beta. It enables standard PyTorch APIs to run models on Amazon EC2 Trn2 and Trn3 instances in eager mode or via torch.compile. Neuron Observer also enters public beta to detect Trainium health issues in under one second and identify affected nodes or devices. The vLLM Neuron plugin upgrades to vLLM 0.29.0 and integrates the vLLM Omni Neuron plugin for Wan2.2 video generation, both supporting native PyTorch compilation through TorchNeuron. New Neuron Deep Learning AMI and containers are available for PyTorch training, including TorchNeuron, PyTorch 2.14, and TorchTitan. Neuron Explorer opens profiles captured with torch.profiler and attributes allocations from PyTorch memory snapshots to Python source lines for off-memory error debugging. Kernels written in Neuron Kernel Interface (NKI) can use full Python language for metaprogramming, with the NKI library adding 25 new experimental kernels such as DeepSeek-V3.2, Qwen3.5, and Kimi Delta Attention.

Why it matters

This update impacts developers and data scientists using Trainium-based AI training and deployment with PyTorch, offering more seamless workflows and debugging capabilities.

The Beam model from Reflection is now available on Amazon SageMaker JumpStart. Beam is an open-weight model that delivers strong performance in inference, coding, and agent benchmarks, offered through the SageMaker AI model hub. Users can fine-tune the model to their specific domain, inspect and modify the weights, and deeply integrate it into agents or workflows while maintaining full control over data and infrastructure. Optimized for AWS Trainium3, Beam enables high-performance, cost-effective deployment and scaling. Currently available in the US East (N. Virginia) and US East (Ohio) regions, it offers BF16, FP8, and NVFP4 checkpoint variants. The model can be deployed fully managed through the SageMaker JumpStart endpoint.

Why it matters

For AI developers and enterprises seeking flexibility with open-weight models combined with managed infrastructure.

Regions: N. Virginia, Ohio

Amazon Cognito now supports multi-region replication in AWS GovCloud (US), extending its resiliency benefits to more workloads. MRR synchronizes user and machine identity data in near real-time to a secondary user pool in a standby region, allowing traffic redirection to maintain authentication during primary region failures. Previously available in 16 commercial regions, MRR will soon support replication across additional AWS regions, helping meet business resilience, data residency, and compliance needs. It is offered as an add-on for essential or plus tier user pools and requires multi-region AWS KMS customer-managed keys.

Why it matters

Amazon Cognito provides user authentication and identity management. Expanding MRR support helps ensure resilience even in highly regulated government environments.

Regions: Listed in the official documentation

From today, you can reserve on-demand capacity reservations for Amazon Aurora and Amazon RDS DB instances. These reservations ensure specific DB instance capacity for business-critical events such as migrations, product launches, seasonal peaks, high-availability deployments, and disaster recovery. Users select DB instance class, engine, Availability Zone, and per-zone reserved capacity, and RDS holds this capacity. Reservations can also support multi-AZ deployments by reserving capacity in two or more Availability Zones. To use reserved capacity, reference the reservation when creating, restoring, modifying, or launching a DB instance. Capacity can be reserved immediately with no commitment and cancelled anytime, or scheduled to start in 5 to 120 days with a minimum commitment. While active, reservations are billed at on-demand rates, and discounts from existing Reserved DB Instances or Database Savings Plans are automatically applied regardless of whether the reserved DB instance is running. On-demand capacity reservations are available for Amazon Aurora and Amazon RDS in all AWS commercial regions.

Why it matters

This update benefits users who need to pre-reserve database instance capacity, especially for scenarios like migrations, peak loads, and disaster recovery where capacity shortages could cause disruptions.

Regions: All Regions

Today, AWS announced the extension of existing AWS Direct Connect locations at Equinix MA3 data center near Manchester, England, to include 10 Gbps and 100 Gbps dedicated connections with MACsec encryption. This location provides private, direct network access to all public AWS regions (excluding China), AWS GovCloud regions, and AWS Local Zones, making it the third 100 Gbps connection with MACsec encryption in England. Direct Connect establishes private physical network connections between AWS and data centers, offices, or colocation facilities, offering a more consistent network experience than connections over the public internet. More than 150 Direct Connect locations worldwide are detailed in the locations section of the Direct Connect product page, with purchasing and deployment information available on the getting started page.

Why it matters

AWS Direct Connect provides a private, physical network connection between AWS and a customer’s data center, office, or colocation environment. This expansion enables faster and more secure connectivity from Manchester.

AWS Transform now assesses on-premises storage for migration to AWS, mapping workloads to optimal services like Amazon S3, EBS, EFS, and FSx after uploading storage inventory. It calculates recommended service sizes and costs, presents total cost of ownership business cases, and supports single or multi-AZ deployments with cost versus performance scenario comparisons. Available across all AWS regions via imports from NetApp Digital Advisor, RVTools, and other sources.

Why it matters

AWS Transform is a service for planning storage migrations, and the addition of migration assessments streamlines the process and enables cost forecasting

Regions: Same as AWS Transform

AWS Transform for migrations offers three methods: modernizing existing networks, building new networks from scratch, or converting on-premises access rules into optimized security groups for deployment to existing VPCs. This prevents carrying over legacy definitions from on-premises environments and ensures new networks follow AWS best practices. When importing access rules, they are transformed into security groups, with recommendations to identify and optimize outdated rules, enabling deployment to existing VPCs without redeploying the network stack. These capabilities support migrations to AWS commercial or GovCloud regions.

Why it matters

For customers considering AWS migration solutions, especially those looking to solve challenges in migrating existing networks to AWS

Amazon SageMaker AI now allows configuring sequence lengths for serverless model customization jobs. This update enables fine-tuning popular model families like gpt-oss, Gemma, Llama, Nemotron, and Qwen. Previously fixed, sequence lengths can now be set via the dataset_max_len hyperparameter for SFT and DPO jobs, and max_prompt_length and max_response_length for RFT jobs, supporting everything from short Q&A pairs to multi-page documents. Most models support up to a maximum of 16K tokens. Serverless model customization is available in US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), and Europe (Ireland). See SageMaker AI documentation for details.

Why it matters

This change impacts users fine-tuning LLMs, especially those working with long text data or document processing requirements.

Regions: N. Virginia, Oregon, Tokyo, Ireland

Amazon WorkSpaces for AI agents now handles authentication and desktop connections as a managed Model Context Protocol (MCP) service, enabling AI agents to connect to governed cloud desktops without custom code. This eliminates pre-session requirements, manual generation and rotation of streaming URLs, and complexity each time sessions expire. It uses existing AWS credentials to create OAuth 2.0 sessions while the service manages the connection lifecycle. After configuring a desktop stack once, agents reach the correct desktop without viewing or handling the underlying streaming connection. Session status queries show which desktop stack, fleet, or session an agent is connected to, and generate real-time monitoring links for visibility and auditability. Agents can now discover and launch applications through the application catalog MCP tool, listing available applications at runtime, launching one or more, and switching between them, providing a programmatic and deterministic path instead of Start menu or taskbar navigation to improve accuracy and reduce token cost. WorkSpaces for AI agents runs within the same network isolation and compliance boundaries that govern human workforces, inheriting VPC controls, data loss prevention policies, and session-level security posts already configured by the enterprise. The service is now available in four AWS regions: Brazil, Europe (Milan), Europe (Spain), and Asia Pacific (Malaysia).

Why it matters

Amazon WorkSpaces is an enterprise cloud desktop service, and this update simplifies AI agent access to desktops while reducing management overhead

Regions: São Paulo, Milan, Spain, Malaysia

Amazon S3 server access logs can now be delivered to CloudWatch Logs in AWS GovCloud (US), AWS European Sovereign Cloud, and AWS China regions. This allows querying, setting alarms, and encrypting logs with AWS KMS keys upon arrival. It enables flexible monitoring and analysis of data access alongside existing S3 general bucket logging. Features include error rate alarms, traffic pattern monitoring, access incident investigation, and correlation with other operational data. Delivery to CloudWatch Logs is available in all AWS regions, with vendor-provided logging charges applying; see Amazon CloudWatch pricing for details.

Why it matters

For organizations prioritizing data security and compliance, this enables more efficient monitoring and analysis of S3 access through CloudWatch Logs.

Regions: All Regions

Today, AWS launched the public beta of TorchNeuron, an open-source native PyTorch backend for AWS Trainium. TorchNeuron lets AI scientists build and experiment models natively on Trainium using PyTorch. Developers can use eager execution, torch.compile, and standard PyTorch APIs while maintaining full PyTorch compatibility. It integrates with the Neuron Kernel Interface (NKI) for custom operators and performance optimizations on Trainium hardware. TorchNeuron is available open-source on GitHub for Amazon EC2 Trainium2 and Trainium3 instances.

Why it matters

AI developers and researchers can now use PyTorch natively on Trainium chips, making model development and experimentation easier.

Amazon ElastiCache Serverless for Valkey supports seamless migration from self-managed Valkey and Redis OSS on EC2 without downtime, measured the same way as ElastiCache's SLA. Applications continue reading and writing during migration, eliminating the need for third-party replication tools. The online migration process has three stages: preparation, data sync start, and cutover completion. ElastiCache provides a migration endpoint; after preparation, data continuously replicates from the source. The timing for moving writes to the serverless cache can be chosen between manual cutover or automatic cutover after data sync. ElastiCache logs each step in the cache's events tab and records reasons for any step failures. The online migration connects to the source using in-transit encryption (TLS) and authentication, maintaining existing security controls by reading credentials from AWS Secrets Manager. It supports self-managed caches running Redis OSS 4.0 to 7.2 or Valkey 7.2 to 8.1 on Amazon EC2 in cluster mode, with direct migration to Valkey 9.0. The migration is free for the first 180 days after an AWS account's first migration preparation; afterward, charges apply per node hour for migration nodes active during migration. ElastiCache Serverless caches are billed separately at standard data storage and ECPU rates, including during the free period. For pricing details, see Amazon ElastiCache pricing. Online migration is available in all commercial AWS regions, China regions, and AWS GovCloud (US) regions. To get started, create or select an empty ElastiCache Serverless cache and initiate migration from the ElastiCache console or AWS CLI. For more information, see the documentation.

Why it matters

This update benefits users who need to migrate self-managed Valkey and Redis OSS on Amazon EC2 to ElastiCache Serverless for Valkey. Zero-downtime migration maintains application availability and eliminates the need for third-party replication tools.

Regions: All Regions

Today, Amazon CloudWatch announced support for including alarm tags in action payloads and Amazon EventBridge events. This lets customers route and filter alarm notifications by tags without extra lookups. When enabled, CloudWatch adds alarm tags to messages sent to Amazon SNS, AWS Lambda and Amazon EventBridge each time an alarm state changes. Designed for customers who route many alarms through shared notification pipelines and need to identify the owning team or environment directly from messages, this removes extra work for correlating tag metadata with alarm events after the fact. For example, teams routing hundreds of alarms through a single SNS topic to a Lambda function no longer need to call ListTagsForResource for each event before paging; the function can route directly from the message because the tags arrive with the notification. The setting is off by default, configurable per alarm, and supports including all tags, selected tag keys only, or all tags except selected keys. It is supported for metrics, alarms, composite alarms and log alarms. Actions and events with tags are supported in all AWS regions where Amazon CloudWatch is available, except Middle East (UAE) and Middle East (Bahrain).

Why it matters

This update is particularly useful for customers who route multiple alarms through a shared notification pipeline.

Regions: Same as Amazon CloudWatch

Amazon Bedrock now supports structured outputs for all Anthropic Claude models via bedrock-runtime and bedrock-mantle endpoints, enabling schema-compliant JSON responses through boto3 and bedrock-runtime API or Messages API without custom parsing, retry logic, or post-processing. This automates reliable schema tasks like extracting fields from financial reports, parsing clinical notes into EHRs, enriching product catalogs, analyzing contracts, and routing support tickets intelligently. For details, see Amazon Bedrock documentation. Structured outputs are available where Claude models are offered; check regional availability for more information.

Why it matters

This update benefits developers and organizations that need to automate data extraction and document processing with AI models, as structured outputs enable reliable and consistent data formats.

Regions: Listed in the official documentation

Amazon GuardDuty now supports optional detection rules for runtime monitoring. Enabling over 50 rules detects non-standard processes, files, and network activities such as changes to sudoers files or audit log disabling. These rules run on Amazon EC2 instances, Amazon EKS, and Amazon ECS (on EC2 and AWS Fargate), covering 13 finding types mapped to MITRE ATT&CK tactics including persistence, privilege escalation, and defense evasion. This release introduces four new finding types: CommandAndControl:Runtime/SuspiciousCommand, CredentialAccess:Runtime/SensitiveFileRead, Discovery:Runtime/SensitiveFileRead, and Exfiltration:Runtime/SuspiciousCommand. To get started, enable rules in dry-run mode via the GuardDuty console before activating live detection. Custom detection rules are available in all AWS commercial regions and AWS GovCloud (US). For details, see Amazon GuardDuty custom detection rules. Subscribe to the Amazon GuardDuty SNS topic for programmatic updates on new features and threat detections.

Why it matters

Amazon GuardDuty automates security event monitoring and threat detection in cloud environments. This update adds customized detection rules for Runtime Monitoring, enabling security teams to more precisely identify threats.

Regions: All Regions

EC2 Image Builder can use existing instances from an Auto Scaling Group (ASG) to speed up image builds by skipping instance launch and initialization. You can specify the ASG in the image builder's infrastructure settings. Instead of launching new instances for each build, the service selects running instances from the ASG, applies build components, and creates the image. The ASG continuously replenishes instances used in builds, ensuring they are always available for the next pipeline run. This feature is opt-in only, leaving existing pipelines unaffected. Pipelines without an ASG configured continue using the default launch path unchanged. The functionality is available in all AWS regions at no additional cost. See the EC2 Image Builder documentation to configure ASG integration into your pipelines.

Why it matters

EC2 Image Builder automates the creation of EC2 images. This integration improves build efficiency, particularly beneficial for large environments or frequent builds

Regions: All Regions

Amazon Bedrock Advanced Prompt Optimization now supports prompt shortening. This optional feature reduces prompt length while maintaining or improving evaluation scores. It optimizes prompts for any Amazon Bedrock model based on user-defined criteria. Previously, optimization focused solely on quality, often resulting in longer prompts that increase input token costs and initial token latency-problematic for large or latency-sensitive applications. Enabling prompt shortening directs the optimizer to shorten prompts, returning only optimized prompts that are shorter than the original and achieve equal or higher scores. Results include a compression ratio and token counts for both original and optimized prompts. For example, a compression ratio of 0.7 means the optimized prompt uses 30% fewer tokens. Prompt shortening works with any evaluation method, including steering criteria, LLM-as-a-judge rubrics, and custom Lambda evaluators, and is available in all AWS regions where Advanced Prompt Optimization is provided. To get started, enable prompt shortening in your input dataset's prompt template and create optimization jobs as usual.

Why it matters

Amazon Bedrock is a service for invoking AI models, and prompt optimization is a key feature for improving model performance. This update reduces prompt costs and latency.

AWS Transform for migrations now supports more existing AWS environments, including those built with AWS Control Tower or AWS Organizations. It performs gap analysis against AWS best practices and extends landing zones over existing target accounts, enabling teams to start migrations faster. AWS Transform also supports an infrastructure as code-only mode, generating AWS CDK, Terraform, or Landing Zone Accelerator templates aligned with migration plans after analyzing the organization. This mode benefits organizations that prefer connecting via delegated administrator accounts rather than granting direct access to the management account, and customers who want to manage their own deployment pipelines without agent-based automation. The AWS Transform for migrations landing zone agent automates end-to-end landing zone design, including foundational setup, organizational unit and account structure, service control policies, and workload accounts aligned with migration plans and waves. These new features are available in all target AWS regions supported by AWS Transform for migrations.

Why it matters

AWS Transform for migrations is a tool for organizations planning cloud migrations, and by supporting more existing environments, it streamlines the migration process.

AWS Partner Central now includes Program Navigator, allowing partners to centrally manage AWS specialization program applications and progress in one view. Partners can verify specialization targets, requirements, and benefits, and submit applications through guided workflows. The Case Study Generator has been redesigned with three methods: creating AI-powered case studies, importing existing customer success stories, and auto-filling from opportunities. Marketing-focused case studies can be published directly after a minor policy check, separate from specialization program applications. Program Navigator streamlines specialization applications with faster reviews and detailed feedback at the requirement level. Non-specialization applications remain available through traditional methods. Both Program Navigator and Case Study Generator are provided to all AWS partners. Access them via the "Marketing" section in the left navigation panel.

Why it matters

New tools for AWS partners streamline the process of applying for AWS Specializations and creating case studies, helping partners enhance their market presence and achieve AWS Specializations

AWS IAM Identity Center now retains employee identities and assignments when changing the identity source from Active Directory to an external identity provider or Identity Center directory. This includes users, groups, group memberships, permission set assignments, and application assignments, eliminating the need to recreate them in IAM Identity Center and keeping existing identity store IDs consistent. As a result, users retain access to AWS accounts and applications, and policies referencing user, group, or identity store IDs continue to function. To make the change, configure the new identity source with standard sign-in settings. After the change, employees sign in through the dual-stack AWS access portal URL. Reverting to Active Directory remains possible using the traditional method. This capability is available for organization instances of IAM Identity Center in all AWS regions where IAM Identity Center is offered, at no additional cost.

Why it matters

IAM Identity Center connects workforce identities to AWS and centrally manages access across AWS applications and accounts. This update reduces effort when changing identity sources and makes access management more flexible.

Regions: Same as AWS IAM Identity Center

AWS Clean Rooms now supports Databricks as a data source, enabling members and partners to securely analyze data managed in Databricks without moving or exposing source data. Members can directly query Databricks tables shared via Delta Sharing within the collaboration. Databricks joins AWS Glue, Snowflake, and Amazon Athena as supported data sources in AWS Clean Rooms. Previously, members storing data in Databricks had to export or replicate it to Amazon S3, requiring pipeline work and additional data copies. Now, by specifying the workspace URL, schema, table, and Delta Sharing share, Databricks tables can be directly registered and used in collaborations. For example, a retailer managing customer data in Databricks can collaborate with media partners on campaign measurement in AWS Clean Rooms, running authorized analytics on Databricks data without building and maintaining exports to S3.

Why it matters

AWS Clean Rooms enables companies and their partners to analyze and collaborate on their collective datasets without revealing or copying each other's underlying data. This update allows the use of Databricks as a data source, reducing pipeline work and data copying.

AWS announced Amazon CloudWatch Omni is now available in eight additional regions. CloudWatch Omni combines OpenTelemetry interoperability with CloudWatch scalability and reliability for an AI-powered observability experience, enabling centralized telemetry management across AWS accounts, regions, and other clouds from a single account. It offers automatic service discovery, dependency mapping, golden metrics, and root cause analysis through chat, point-and-click, and the Agent Toolkit. Agent observability experiences have been added for frameworks such as LangGraph, CrewAI, OpenAI Agents SDK, Vercel AI SDK, and Strands. To get started, create an Omni space in the CloudWatch console and sign in via SSO. Agent developers can install the free CloudWatch Omni extension for VS Code, Cursor, and Kiro. For details, visit the Amazon CloudWatch Omni product page and documentation. Pricing information is available on the CloudWatch Omni pricing page.

Why it matters

CloudWatch Omni is an AI-powered observability service that enables centralized monitoring and troubleshooting centered around development teams and applications. The expansion to additional Regions broadens its availability in global environments.

Regions: Canada (Central), Mumbai and 9 more

Amazon Connect Customer Global Resiliency adds a Global Resiliency page to the console, centralizing cross-region readiness status and listing resources natively replicated for Global Resiliency. It shows each resource type as synced, unsynced, or requiring action, allowing direct association of resources like phone numbers and users not linked to traffic distribution groups. This overview lets administrators verify their resiliency position and confirm instance readiness for cross-region failover, available in all supported AWS regions.

Why it matters

This feature is for administrators using Amazon Connect Customer Global Resiliency, helping them verify and resolve Region switch readiness issues

Regions: Same as Amazon Connect Customer Global Resiliency

AWS Elemental MediaConnect Router now supports high-bitrate mode at 250 Mbps and 500 Mbps, enabling professional broadcasters to transfer high-value content without compromising quality or reliability. This enhancement supports up to two redundant sources for reliability and includes data plane optimizations to reduce jitter for improved performance, facilitating industry-standard workflows such as broadcasting, content distribution, and remote production.

Why it matters

This update is relevant for professional broadcasters and media delivery businesses that require high bitrates. The high bitrate mode enables more reliable transport of high-quality content.

Amazon RDS for SQL Server now allows direct DB snapshot creation on read replica instances, previously limited to standalone or primary instances. This flexibility enhances backup and disaster recovery workflows by enabling snapshots without promoting the read replica first. Previously, enabling Multi-AZ on a promoted read replica required waiting for the initial full snapshot to complete, which was time-consuming for large storage configurations like 64 TiB io2 volumes and made predicting DR timelines difficult. The service now retains snapshot data throughout the read replica lifecycle, accelerating post-promotion snapshot completion and shortening Multi-AZ activation. While manual snapshots, automatic backups with a retention period greater than zero, and retained backups during read replica deletion are supported, point-in-time recovery from read replicas is not. This feature works for both intra-region and cross-region read replicas, and is available for all SQL Server versions that support read replicas in every AWS region where Amazon RDS for SQL Server read replicas are offered, including AWS GovCloud (US).

Why it matters

This update affects users who need to optimize backup and disaster recovery strategies for SQL Server databases. The ability to create snapshots directly from read replicas makes DR planning more flexible and predictable.

Regions: Same as Amazon RDS for SQL Server read replicas

IAM Identity Center is a service that enables employees to access AWS accounts and applications with single sign-on. It supports optimistic locking for user and group identity stores, ensuring updates or deletions succeed only if the user or group has not changed since last read. This prevents silent overwrites when multiple administrators or automated workflows attempt to modify the same user or group simultaneously. Each user and group is assigned a revision value that updates whenever their attributes change, via SCIM provisioning, Active Directory sync, or the IAM Identity Center console. Current revision values are returned in create, describe, update, and list operations and can be passed in subsequent UpdateUser, UpdateGroup, DeleteUser, or DeleteGroup requests. Requests succeed only if the provided revision matches the current value; otherwise, a ConflictException is returned, allowing workflows to reload the user or group and retry with updated values. Specifying a revision is optional; omitting it behaves as before without affecting existing integrations. Conditional requests are supported through the Identity Store API but not SCIM endpoints. Group membership operations do not accept revision values, and adding or removing members does not change user or group revision values. This feature is available in all AWS regions where IAM Identity Center is offered, at no additional cost.

Why it matters

IAM Identity Center enables single sign-on access for employees to AWS accounts and applications. This update prevents conflicts when multiple administrators or automated workflows modify users or groups concurrently.

Regions: Same as AWS IAM Identity Center

Amazon Connect Customer now allows flow modules to be used as data requests in agent-based CX designers, enabling reusable logic across customer experience flows. Data request nodes execute flow modules at specific conversation steps or invoke them as generative journeys when needed. This supports updating customer profiles and cases, creating tasks, referencing data tables, sending SMS confirmations, checking operating hours and staff availability, and accessing data within private networks such as core banking, policy, and claims systems. For example, flow modules can call AWS Lambda functions within a VPC to return account balances or claim statuses during interactions. The feature is available in AWS regions including US East (N. Virginia), US West (Oregon), Canada (Central), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Europe (Frankfurt), and Europe (London).

Why it matters

Amazon Connect Customer is an agentic AI solution that helps enterprises deliver exceptional customer experiences. This update allows developers to build more flexible and reusable customer interaction logic.

Regions: N. Virginia, Oregon and 7 more

Amazon EMR Serverless now supports IPv6 and dual-stack connectivity, extending traditional IPv4-only connections. Jobs for Apache Spark and Apache Hive can run within Amazon VPC using IPv6, dual-stack (IPv4 and IPv6), or IPv6-only subnets. This increases flexibility for connecting to data stores and services while maintaining full backward compatibility with existing IPv4 workloads. As Spark and Hive workloads scale to many workers, organizations face constraints on VPC and subnet IPv4 address space and compliance requirements mandating IPv6 adoption. Dual-stack connectivity allows EMR Serverless applications to support both IPv4 and IPv6, maintaining backward compatibility with existing IPv4 workloads while gradually adopting IPv6. Using IPv6-only subnets avoids IPv4 address exhaustion and enables job access to IPv6 endpoints and services inside and outside the VPC. IPv6 and dual-stack connectivity for Amazon EMR Serverless are available in all AWS regions where EMR Serverless is offered, at no additional cost, and are supported in all EMR Serverless release versions. For more information, see "Configuring IPv6 Subnets for EMR Serverless Applications" and "Configuring VPC Access for EMR Serverless Applications".

Why it matters

This change affects users who need to run Apache Spark and Apache Hive workloads over IPv6. It addresses IPv4 address space constraints and compliance requirements within VPCs.

Regions: Same as Amazon EMR Serverless

AWS Partner Central helps partners understand the impact of the solution matching engine (SME) on co-selling pipelines. In the partner analytics section for solution matching engine performance, partners can review SME performance and its effect on AWS Marketplace listings. They can view recommendations, opportunities, participation rates in AWS-originated opportunities, opportunity stagnation rates, and SME-generated pipelines. Partners can filter by recommendation type and AWS Marketplace listings, and analyze key customer profiles by region, industry, and segment. These analytics help partners identify areas to improve visibility and listing and opportunity information. All APN customer engagement (ACE)-eligible partners can access this section on the opportunity pipeline analysis page in partner analytics within AWS Partner Central.

Why it matters

This update helps AWS Partners measure the impact of their co-sell pipeline and optimize their marketplace listings and opportunity information.

AWS Lambda Durable Functions are now available in the AWS GovCloud (US-West) and AWS GovCloud (US-East) regions. They enable building reliable, multi-step applications and AI workflows within the Lambda development environment, adding new primitives like steps and waits. They support checkpointing, automatic recovery from failures, and pausing execution without compute charges. The features can be activated for Python (versions 3.13, 3.14), Node.js (versions 22, 24), Go (version 1.24+), .NET (version 2.2), and Java (17+) functions using the AWS Lambda API, AWS Management Console, or AWS SDK. Infrastructure-as-code tools like AWS CloudFormation, AWS SAM, and AWS CDK are also supported.

Why it matters

Available in AWS GovCloud (US) Regions, Lambda durable functions allow government customers and regulated industries to orchestrate complex processes such as order workflows, user onboarding, and AI-assisted tasks.

Regions: AWS GovCloud (US-West), AWS GovCloud (US-East)

Amazon Redshift now offers extended system table storage beyond the 7-day limit in additional AWS regions, integrating natively with Amazon S3 Tables. This allows storing system table data for compliance, auditing, and observability needs. AWS automatically writes, partitions, compacts, and manages retention of system table data in Apache Iceberg format on S3 Tables. The data is replicated automatically, avoiding resource contention with custom ETL pipelines or production workloads. For multiple data warehouses, system table data can be aggregated into one location for cross-warehouse observability and analysis. The data is stored in open Apache Iceberg format, queryable by Redshift, Amazon Athena, DuckDB, or any Iceberg-compatible engine, enabling observability dashboards with AWS services or third-party tools. The AWS agent toolkit provides skills to query system table data for performance insights and optimization recommendations. This feature is available for Amazon Redshift Provisioned RA3 and Serverless in the following additional regions: Asia Pacific (New Zealand), Canada West (Calgary), AWS GovCloud (US-East) and AWS GovCloud (US-West). See documentation or blog for details.

Why it matters

This update benefits users who need to retain system table data for extended periods to meet data warehouse performance monitoring and compliance requirements.

Regions: New Zealand, Calgary, AWS GovCloud (US-East), AWS GovCloud (US-West)

AWS Transform for migrations is now available in the Asia Pacific (Singapore) region, enabling customers to optimize data residency and reduce latency to local source infrastructure. This agentless AI service accelerates cloud migration, application modernization, and technical debt reduction, automating the entire migration lifecycle from discovery and wave planning to network transformation and test and cutover instance launch. It supports infrastructure migration of workloads from nearly any source, including VMware, Hyper-V, KVM, bare metal, and hybrid environments, integrating teams, tools, and workflows into a single collaboration workspace. For more information, see the AWS Transform documentation or visit the AWS Transform product page.

Why it matters

AWS Transform for migrations is a service that helps enterprise IT teams streamline cloud migrations and application modernization. Its availability in the Singapore Region enables data residency and reduced latency during migrations.

Regions: Singapore

AWS End User Messaging now includes a guided wizard that automates the video capture required for RCS agent registration. Previously, registering RCS required screen recordings in multiple countries, including the US, and users had to manually script message sequences, which was error-prone. This wizard records a compliant video on the first attempt by sending messages in the correct order, speeding up agent approval. The wizard is available for all RCS registration forms requiring video submission. For more information and instructions, see the AWS End User Messaging user guide.

Why it matters

This update is particularly useful for developers and businesses that require video submissions for RCS agent registration, as it automates the process and reduces errors, accelerating approval times.

Today, AWS End User Messaging launched end-to-end managed OTP verification in Notify. This allows building a working OTP solution with AWS phone numbers and code verification in under five minutes, eliminating the need to manage phone number setup, carrier registration, and message delivery. Previously, developers had to generate passcodes themselves, pass them to Notify for sending, and build and maintain the logic for creating, storing, and expiring passcodes. Now, Notify generates and delivers codes and verifies recipient input, handling the entire verification flow. Codes can be delivered via text, voice, or WhatsApp. Notification code settings configure rules once-code type, length, expiration, recipient attempts, and templates per channel. Then, one call sends the code to the chosen channel, and another verifies the recipient's input. Notify is available in all commercial AWS regions where AWS End User Messaging is offered.

Why it matters

This update is relevant for application developers who need to enhance authentication and security or simplify user verification processes. AWS End User Messaging is a service for managing communication with customers or users, and this update makes OTP verification management even easier.

Regions: Same as AWS End User Messaging

AWS End User Messaging has introduced brand profiles, allowing brands or company details to be saved once and reused across SMS, RCS, and WhatsApp registrations. Previously, business information and contact details had to be manually entered per channel or country, causing delays. With brand profiles, entering information once applies it to new registrations, enabling faster setup and consistent information management. Brand profiles are useful for sending under a unique brand or managing multiple brands within a single AWS account. They automatically populate fields from saved information and provide confirmation drafts. Standard fields like company name and address are supported by default, with AI-powered smart matching handling variations in field names. Brand profiles can also be created from existing registrations. This feature is available in all commercial AWS regions where AWS End User Messaging is offered.

Why it matters

This update benefits organizations that want to streamline messaging registrations across SMS, RCS, and WhatsApp, or manage multiple brands within a single AWS account.

Regions: Same as AWS End User Messaging

AWS End User Messaging improves registration with clearer guidance, explicit field requirements, and support to avoid common rejections. It now includes mockups of opt-ins and sample messages for US 10DLC, US short codes, US toll-free numbers, and RCS to meet compliance before submission. The registration API response shows conditional logic, eliminating the need for AI agents to guess required fields, and adds recording instructions for RCS compliance videos. These enhancements are available in all regions where AWS End User Messaging is offered. See the End User Messaging user guide for details and getting started.

Why it matters

This update improves the registration process for messaging services, enabling users to complete registrations more accurately and quickly. It is intended for users of AWS End User Messaging.

Regions: Same as AWS End User Messaging registrations

The second-generation AWS Outposts rack is now supported in the AWS Mexico (central) Region. Outposts racks extend AWS infrastructure, services, APIs, and tools to virtually any on-premises data center or colocation space, providing a truly consistent hybrid experience. This regional expansion increases the number of AWS Regions customers can connect their Outposts to, optimizing latency and data residency requirements. For details on the second-generation Outposts rack, see the blog post and user guide. For the latest list of countries and regions where the second-generation Outposts rack is supported, and AWS Regions, see the Outposts rack FAQ page.

Why it matters

AWS Outposts integrates on-premises environments with the AWS cloud. This update increases flexibility for hybrid environments, particularly for customers in the Mexico region.

Regions: Mexico (Central)

AWS Transform now generally available for migrating Microsoft Azure cloud-native .NET applications to AWS, converting Azure service code to AWS service code. It supports Azure Functions to AWS Lambda, Azure Blob Storage to Amazon S3, and Azure Queue Storage to Amazon SQS, with Azure Cosmos DB to Amazon DynamoDB in preview. AWS Transform detects Azure SDKs in submitted source code, evaluates conversion options, and presents reports and modernization plans for user approval or adjustment. Post-conversion, changes are validated within the transformed code. The feature is available in eight AWS regions: US East (N. Virginia), Asia Pacific (Mumbai, Tokyo, Seoul, Sydney), Canada (Central), and Europe (Frankfurt, London).

Why it matters

This update benefits developers and enterprises planning to migrate from Microsoft Azure to AWS, offering automated conversion of cloud-native application code to streamline the migration process.

Regions: N. Virginia, Mumbai and 6 more

Amazon RDS for PostgreSQL 19 release candidate 1 (RC1) is now available in the Amazon RDS database preview environment, allowing evaluation of the PostgreSQL 19 pre-release. Focused on stability, PostgreSQL 19 RC1 includes bug fixes and improvements from the beta 4 testing period, enhancing error handling for complex text search expressions, improving parallel autovacuum, and increasing reliability of GIN index management. For details, see the PostgreSQL community announcement. Database instances in the Amazon RDS database preview environment are retained for up to 60 days and are automatically deleted afterward. Snapshots created in the preview environment can only be used to create or restore database instances within that environment. The preview environment supports importing and exporting databases using PostgreSQL dump and restore capabilities. Database instances in the Amazon RDS database preview environment are billed according to US East (Ohio) region pricing.

Why it matters

Database administrators and developers can evaluate pre-release versions of PostgreSQL on Amazon RDS, allowing them to verify performance and compatibility before upgrading

Amazon CloudFront now offers dual-stack VPC origins, supporting end-to-end IPv6 delivery to origins within Amazon VPC. This allows customers to place Application Load Balancers, Network Load Balancers, and EC2 instances in private subnets, accessible only by CloudFront distributions. Dual-stack support enables IPv6 traffic to private origins, meeting IPv6 architecture and compliance requirements without exposing origins to the internet. Previously, CloudFront supported dual-stack for public origins but only IPv4 for VPC origins, forcing customers to choose between moving origins to public subnets or compromising security. This announcement lets customers configure VPC origins as dual-stack, enabling end-to-end IPv6 without sacrificing security. Dual-stack VPC origins are available in all AWS commercial regions where VPC origins are supported, at no additional cost.

Why it matters

This update affects users who need to send IPv6 traffic to private origins within their VPC. It helps meet IPv6 architecture and regulatory requirements while maintaining security.

Amazon MSK Connect and AWS Glue Schema Registry are now available in the AWS European Sovereign Cloud (Germany) region, offering customers a comprehensive toolset to build, connect, and manage Apache Kafka applications for streaming workloads alongside existing Amazon MSK Standard brokers. MSK Connect enables fully managed Kafka Connect clusters with automatic scaling, pay-per-use pricing, and no infrastructure provisioning, allowing deployment, monitoring, and scaling of connectors for data movement between Apache Kafka and external systems. AWS Glue Schema Registry, a serverless and free feature of AWS Glue, controls validation and evolution of streaming data using Avro, JSON, and Protobuf schemas, centrally managing data formats across isolated applications to reduce downstream failures and integrate with C# and Java applications built for Amazon MSK, Amazon Kinesis Data Streams, Amazon Managed Service for Apache Flink, and AWS Lambda. For details, see the Amazon MSK Developer Guide and AWS Glue Schema Registry documentation.

Why it matters

This update impacts users building and managing streaming data processing and Kafka applications in the AWS European Sovereign Cloud (Germany) region. The availability of MSK Connect and Glue Schema Registry improves infrastructure management and data format consistency.

Regions: AWS European Sovereign Cloud (Germany)

AWS Transform's full-stack Windows modernization now supports cross-region deployment of transformed Amazon Aurora PostgreSQL databases and is available in seven additional AWS regions. Customers can upload SQL Server DDL files, set the target AWS region in the transformation plan, and deploy the resulting Aurora PostgreSQL cluster to another region. The same workflow also modernizes dependent .NET applications to be PostgreSQL-compatible, updating connection strings and data access calls for ADO.NET and Entity Framework. This expansion makes the feature available in the following regions: US East (N. Virginia), Europe (Frankfurt), Europe (London), Asia Pacific (Mumbai), Asia Pacific (Seoul), Asia Pacific (Tokyo), Asia Pacific (Sydney), and Canada (Montreal).

Why it matters

AWS Transform is a service that helps migrate Windows applications to AWS by assisting in the modernization of databases and applications.

Amazon Time Sync Service now supports microsecond-accurate timing on 135 additional EC2 instance types across 12 families and is available in all commercial regions. This allows customers to directly use the reference clock in the Nitro system to easily order application events, measure one-way network delays, and speed up distributed application transactions. The new supported families include eight Gen8 families (C8a, C8i, C8i-flex, C8id, M8i, M8i-flex, R8a, X8i) and four Gen9 families (C9g, C9gd, M9g, M9gd). From today, customers can create a Precision Time Placement Group (PTPG) to access microsecond-accurate timing on these instance types. Customers requiring both low network latency and precise timing can associate the PTPG with a Cluster Placement Group (CPG) to also enjoy the benefits of microsecond-accurate timing for low-latency workloads.

Why it matters

This update impacts developers and deployments of distributed systems and real-time processing applications that require high-precision timing

Regions: All Regions

AWS HealthOmics supports shared VPC using AWS resource access manager (RAM) to access Amazon VPC resources managed in other AWS accounts, allowing customers to centralize network management by sharing subnets and security groups across multiple accounts from a single VPC. It deploys each account's workflows directly into these shared subnets, enabling multiple accounts to run within one centrally managed VPC without replicating endpoints per VPC. Participating accounts can privately access data without separate VPC peering connections or duplicated VPC endpoints. Previously, customers with centralized networks needed to create individual AWS PrivateLink VPC endpoints in each VPC and maintain separate route tables using VPC peering. Cross-account VPC sharing reduces infrastructure overhead and simplifies network management for organizations with centralized networks, while allowing researchers and developers to run bioinformatics workflows in their own accounts. The shared VPC is available in all regions where AWS HealthOmics is offered: US East (N. Virginia, Ohio), US West (Oregon), Europe (Frankfurt, Ireland, London), Israel (Tel Aviv), Asia Pacific (Singapore, Seoul, Tokyo).

Why it matters

AWS HealthOmics is a HIPAA-eligible service that helps healthcare and life sciences customers accelerate scientific breakthroughs at scale with fully managed bioinformatics workflows. This update is particularly useful for organizations that need to centralize network management and reduce infrastructure overhead across multiple accounts.

Regions: Same as AWS HealthOmics

Meta's Muse Spark Open is now available on Amazon SageMaker JumpStart, expanding the portfolio of foundation models for AWS customers. Optimized for agent-based coding workflows, Muse Spark Open is an open-weight model designed for long-running coding agents and multimodal engineering workflows. It uses a Mixture-of-Experts architecture with 816B total parameters and 42B active parameters per token, maintaining large-model capabilities while reducing compute per token. With a 1M token context window, it can process entire projects (including dependencies, legacy code, and thousands of files) at once. Accepting text, images, documents, audio, and audiovisual inputs, it outputs text. SageMaker JumpStart offers two variants: BF16 (Muse-Spark-Open-816B-A42B) and NVFP4 quantized (Muse-Spark-Open-816B-A42B-NVFP4), where the NVFP4 variant reduces memory usage by about 1/4 for cost-effective deployment. Using SageMaker JumpStart, customers can deploy Muse Spark Open in a few clicks, with the endpoint running in their AWS account for full control over source code and prompts. To use this model, access the SageMaker JumpStart model catalog in the SageMaker console or deploy the model to an AWS account using the SageMaker Python SDK. For details on deploying and using foundation models with SageMaker JumpStart, see the Amazon SageMaker JumpStart documentation.

Why it matters

Available for developers and software engineering teams to implement agentic coding workflows on AWS infrastructure.

Amazon DynamoDB Streams now supports timestamp-based stream processing, allowing reads to start from a specific time using the AT_TIMESTAMP shard iterator type. This enables processing from the first record written at that time, avoiding full retention reprocessing or record loss on resumption. The feature works with the DynamoDB Streams Kinesis adapter via the Amazon Kinesis Client Library (KCL), supporting common use cases like post-interruption recovery, debugging, auditing, and skipping backlogs. It is available in all commercial AWS regions, AWS GovCloud (US), and China regions at no additional cost beyond standard GetRecords API request charges. For details, see the DynamoDB developer guide's Amazon DynamoDB Streams timestamp documentation.

Why it matters

This change increases the flexibility of stream processing by allowing you to start reading stream records from a specific point in time. It helps avoid reprocessing entire retained streams or missing records when resuming stream consumption, making it useful for data replay, recovery, auditing, and other use cases.

Regions: All Regions

Amazon SageMaker Studio now allows new users to sign up with Google, GitHub, or Apple credentials and access a fully configured environment directly. Previously, customers finding models on Hugging Face or AWS product pages needed to create an AWS account, enter a credit card, locate SageMaker AI in the AWS console, configure the environment, and set IAM permissions. This new feature enables quick sign-up with existing identity, receipt of AWS free tier credits without a credit card, and direct access to SageMaker Studio. Team members can be invited via email, and collaborators access the shared environment using their email verification. If a project exceeds free credit limits, users can upgrade to a paid plan to stay within budget. Verified customers receive GPU access to G5, G6, G6e, and G4dn instances by default.

Why it matters

Simplifies initial setup for AI/ML model development, making it easier for developers and data scientists to get started with SageMaker Studio.

Regions: Same as Amazon SageMaker Studio

AWS Lambda's recursion detection automatically identifies and stops recursion loops between Lambda event functions and Amazon EventBridge custom event buses, protecting against runaway usage and unexpected charges. This feature is enabled by default and supported in all commercial regions where EventBridge custom event buses are available. Users can disable detection using the PutFunctionRecursionConfig API if they intentionally use recursion loops.

Why it matters

This feature helps protect against runaway usage and unexpected charges by automatically detecting and stopping recursive loops between Lambda Event Functions and EventBridge Custom event buses.

AWS HealthOmics now supports using container images from third-party registries such as Seqera (Wave), NVIDIA NGC, and Google Artifact Registry. This allows HealthOmics to copy these registry container images to Amazon ECR for private workflows, eliminating the need to retrieve images solely through Amazon ECR pull-through cache (PTC). Private workflows can now access both the Amazon ECR pull-through cache registry and the newly supported third-party container registries.

Why it matters

AWS HealthOmics helps healthcare and life sciences customers accelerate scientific breakthroughs at scale with fully managed bioinformatics workflows. This update provides more flexibility for using container images in private workflows.

Amazon CloudWatch now supports conditional log routing and chained parsers in pipelines, allowing finer control over log data transformation and destination log groups. CloudWatch pipelines are a fully managed service for collecting, transforming, and routing telemetry without managing infrastructure. Conditional log routing lets you define routes based on processed fields, sending each event to different CloudWatch log groups by severity, source, or type, with appropriate retention and access controls. Chained parsers apply multiple parser processors sequentially, enabling later parsers to consume fields generated by earlier ones, such as parsing a JSON envelope followed by applying a Grok parser to extracted fields. These features are available in all commercial AWS regions where CloudWatch pipelines are generally offered and can be configured via the AWS Management Console, AWS CLI, or AWS SDK. For more information, see the Amazon CloudWatch Pipelines documentation.

Why it matters

This update is useful for developers and deployment teams struggling with log data processing and management. The enhanced capabilities of CloudWatch pipelines make it easier to handle complex log formats and route them to appropriate log groups.

The next-generation version of AWS Resilience Hub integrates with AWS DevOps Agent, enabling users to review failure mode assessment findings and apply mitigations. When running resilience tests, Resilience Hub initiates an investigation with AWS DevOps Agent, returning structured details on symptoms, root causes, impact, and recovery actions. Users can also launch AWS DevOps Agent directly from failure mode assessment results to ask investigative questions and plan mitigations. AWS Resilience Hub serves as a central hub within the AWS Management Console for evaluating and enhancing workload resilience, offering automated dependency detection, AI-powered failure mode analysis, modular resilience policies, resilience testing, and organization-wide resilience posture reports.

Why it matters

Useful for platform engineering and site reliability teams assessing and strengthening resilience of workloads running on AWS.

Regions: N. Virginia, Ohio and 13 more

Amazon Managed Workflows for Apache Airflow (MWAA) integrates with Agent Toolkit for AWS to provide AI agent skills, allowing direct interaction with an AI coding assistant in natural language for creating, debugging, testing, and upgrading MWAA workflows. These skills reduce manual effort in building and maintaining data pipelines; for example, describing an ETL pipeline in natural language generates a functional DAG with task dependencies and error handling. Available for both Amazon MWAA Provisioned and Serverless environments across all AWS regions where Amazon MWAA is offered, getting started requires installing the aws-data-analytics plugin and configuring the AI coding assistant for MWAA agent skills. See the Amazon MWAA user guide and Agent Toolkit for AWS documentation for details.

Why it matters

Data engineers and data scientists can streamline the development and management of MWAA workflows.

Regions: Same as Amazon MWAA

Amazon Managed Service for Prometheus Collector, a fully managed, agentless collector for Prometheus metrics, is now available in the Asia Pacific (New Zealand) region. This allows New Zealand customers to run Prometheus-compatible monitoring workloads locally, reducing latency and enabling data residency. The service discovers and collects Prometheus metrics from container workloads, which customers can then ingest into Amazon Managed Service for Prometheus workspaces for querying and analysis. This fully managed approach eliminates the need to maintain or scale collection infrastructure, reducing operational overhead. For more information, see the user guide or product page.

Why it matters

This update impacts users who need to collect and analyze Prometheus metrics in a managed way within the New Zealand Region.

Regions: New Zealand

Amazon S3 Metadata is now generally available in six regions: Asia Pacific (Hyderabad, Malaysia, New Zealand, Taipei, Thailand) and Mexico Central. It enables instant discovery and understanding of S3 data through automated metadata, automatically updating metadata for both new and existing objects. This facilitates business analytics and real-time inference applications. The annotation feature allows attaching up to 1 GB of business context directly to objects in JSON, XML, or YAML format, which can be queried through S3 Metadata annotation tables in these regions. S3 Metadata is currently generally available in 38 AWS regions.

Why it matters

S3 Metadata enables automated metadata collection and querying for S3 data, useful for analytics and real-time processing. Region expansion makes it accessible to more customers.

Regions: Hyderabad, Malaysia and 4 more

AWS HealthOmics now supports resource fallback directives for Nextflow workflow tasks, allowing researchers to define a prioritized list of accelerator types with an optional CPU instance fallback. This reduces diagnosis and resubmission time due to accelerator constraints, keeping production workflows running. AWS HealthOmics is a HIPAA-compliant service that accelerates scientific breakthroughs at scale for healthcare and life sciences customers with fully managed bioinformatics workflows. The resource fallback enables priority acceleration, automatically moving to specified alternatives without resubmission if the preferred accelerator is unavailable. Each accelerator profile has a configurable timeout, controlling search duration, where shorter timeouts speed fallback progression and longer timeouts increase the chance of securing the preferred accelerator. Including a CPU profile as the final fallback can also improve the likelihood of instance allocation. This feature is available in all AWS HealthOmics regions, including US East, US West, Europe, Israel, and Asia Pacific. For more information, see the detailed documentation on advanced resource configuration and Nextflow.

Why it matters

AWS HealthOmics is a HIPAA-eligible service that helps healthcare and life sciences customers accelerate scientific breakthroughs at scale with fully managed bioinformatics workflows. This update allows researchers and bioinformaticians to reduce time spent diagnosing and resubmitting runs due to accelerator constraints and keep production workflows running.

AWS License Manager now enables direct upgrades of EC2 Ubuntu LTS instances to Ubuntu Pro from AWS Marketplace. This allows customers to enhance security and meet compliance without rebuilding infrastructure or migrating workloads. Ubuntu Pro subscriptions provide security patches for up to 10 years, extendable to 15, and cover open-source applications like NGINX, PostgreSQL, MongoDB, and Redis beyond the base OS. It also supports kernel live patches for critical updates without reboots, minimizing downtime. Customers with existing Canonical Ubuntu Pro subscriptions can upgrade directly during the conversion workflow, while others can subscribe via the AWS License Manager console. This feature is available in all commercial regions where AWS License Manager is offered.

Why it matters

This update benefits users who utilize Ubuntu Pro on AWS or aim to achieve security enhancements and compliance more easily.

Regions: Same as AWS License Manager

Amazon Application Recovery Controller (ARC) region switching helps manage failover for multiregion applications and limits recovery time during region outages. It now adds four features: a run block for AWS Systems Manager Run Command to execute commands on managed instances or virtual machines during failover, a payload capability for custom action Lambdas to reuse Lambda functions across recovery plans, a service quota check to verify quota consistency between primary and standby regions and automatically request quota increases to reduce the risk of service quota shortages during recovery, and a target group health wait feature for compute scaling actions to confirm provisioned compute capacity is ready to handle traffic. For details, see the documentation for the run block for AWS Systems Manager Run Command, the run block for custom action Lambdas, service quota checks, and the target group health wait feature for Amazon ECS service scaling run blocks and Amazon EC2 Auto Scaling group run blocks.

Why it matters

This update affects users managing multi-region application failover with ARC Region switch, improving automation and reliability during failover events

Amazon Bedrock AgentCore Memory now allows setting a TTL for long-term memory records. While these records do not expire by default, this feature enables TTL configuration to meet data retention requirements or control storage growth. Retention periods can be set per resource or specific records. The new bedrock-agentcore:UpdateMemoryRecordExpirySpecification permission is required for TTL configuration or deletion, allowing independent control over retention settings. This functionality is available in all AWS regions supporting Amazon Bedrock AgentCore Memory.

Why it matters

Amazon Bedrock AgentCore Memory enables AI agents to retain and manage long-term knowledge. This update allows control over the retention period of memory records.

Regions: Same as Amazon Bedrock AgentCore Memory

Amazon Location Service provides a full interactive API playground, allowing developers to visually explore and test APIs without writing code. This release makes 14 Places, Maps, and Routes APIs available interactively, enabling real API calls, parameter adjustments, result display on maps, and ready-to-use request snippets for applications. The playground covers search and geocoding, route planning and optimization, and mapping. It is available in 14 AWS regions, and users can start by accessing the API playground in the AWS console or checking the developer guide for details.

Why it matters

Amazon Location Service is an AWS service that provides location-based search, routing, and mapping capabilities. This update allows developers to visually test APIs without writing code, improving development efficiency.

Regions: Ohio, N. Virginia and 13 more

As of today, AWS Lambda Durable Functions increases the sustainable operations per execution from 3,000 to 30,000 and the checkpoint payload size from 256 KB to 1 MB. The higher operation limit allows more work per execution, enabling extended loops, long polling, and complex rollback paths when steps fail. The 1 MB checkpoint payload matches the maximum payload size of integrated services like asynchronous Lambda invocations, Amazon SQS, and Amazon EventBridge, allowing full events from these sources to be stored in a single operation. AWS Lambda Durable Functions helps build resilient multi-step applications and AI workflows with up to one year of execution, built-in checkpoints, automatic retries, and compute-free wait times. Sustainable operations include each step attempt, each conditional wait polling, and each branch in parallel or map operations. With 30,000 operations, single executions can orchestrate more complex multi-step workflows, iterate over thousands of items, or poll external systems for weeks. Agent applications can reason over thousands of model and tool calls, storing larger conversation histories, model responses, and tool outputs directly in checkpoints with the 1 MB limit. For state exceeding 1 MB, the JavaScript and Python SDKs include a FileSystem serializer that writes payloads to Amazon EFS or Amazon S3 file mounts and checkpoints pointers. The new limits apply in all AWS regions where AWS Lambda Durable Functions is available. For details on these service limits, see the AWS Lambda developer guide.

Why it matters

AWS Lambda Durable Functions helps build resilient multi-step applications and AI workflows that execute for up to one year, with built-in checkpointing, automatic retries, and waits. This update enables more complex workflows and longer polling periods.

Regions: Same as AWS Lambda durable functions

Amazon S3, including S3 Tables and S3 Vectors, is now available on Vercel Marketplace and v0 by Vercel. Developers can create and connect S3 resources in seconds without leaving their development environment, gaining S3's durability, scalability, and performance through Vercel's simplified provisioning workflow. S3's general-purpose buckets suit nearly all use cases, S3 Tables offer fully managed Apache Iceberg tables optimized for analytics workloads, and S3 Vectors enable native storage and querying of vectors at scale. New AWS accounts created through Vercel include a $100 credit valid for six months for Amazon S3, Amazon OpenSearch Serverless, and AWS database services. Existing AWS customers can link their accounts to use S3 with Vercel projects. Amazon S3 on Vercel is available in all AWS regions where Vercel is offered. For more details, see the AWS News Blog, visit AWS on Vercel Marketplace, or launch v0 by Vercel.

Why it matters

This change simplifies the development workflow by allowing Amazon S3 resources to be provisioned directly from the Vercel development environment.

AWS Transfer Family now allows storing SFTP server host keys in AWS Secrets Manager within your account, improving server identification control and simplifying migration or failover. Previously, Transfer Family stored host keys internally, preventing access to associated private key material. The update lets you choose Secrets Manager as the storage type when creating a server or importing host keys, enabling retrieval and reuse of private key material across servers or AWS regions, such as for standby or migration purposes. Clients no longer need to trust new host keys, and IAM policies control access to stored keys. Existing host keys can be migrated to Secrets Manager, though additional steps may be required; see the AWS Transfer Family user guide for details.

Why it matters

AWS Transfer Family is a service that helps you securely and efficiently transfer files using AWS managed services. This update makes host key management easier, allowing server migrations and failover to be safer and more efficient.

Regions: Same as AWS Transfer Family

AWS has launched blockchain snapshots for Ethereum and Solana chain nodes, hosting pre-synchronized chain data on Amazon S3 to bootstrap nodes from snapshots instead of peer-to-peer sync. These snapshots, optimized for parallel extraction across multiple cores, reduce setup times for Amazon EC2 instances and are available for free in US East (N. Virginia), Europe (Ireland), and Asia Pacific (Tokyo), requiring same-region Amazon EC2 instances and Amazon S3 gateway VPC endpoints. They can be used for adding capacity to RPC fleets, recovering failed nodes, and resynchronizing corrupted databases.

Why it matters

Targeted at blockchain developers and node operators running Ethereum or Solana. It significantly reduces node setup time.

AWS Agent Registry is a catalog for centrally managing agents, MCP servers, agent skills, gateways, and custom resources in an organization. With hundreds of resources, names and descriptions alone make governance and discovery challenging. Custom metadata allows adding organization-specific structured fields to each registry record, enabling consistent resource search and management for both humans and automated systems. Publishers can record fields like team ownership and data classification. A common attribute schema is defined once per registry and can be extended with type-specific fields, such as model families for agent records. Each field supports free-form text, URLs, booleans, or a list of allowed values. The registry validates required fields and values on record creation or update. Search results can be filtered by custom metadata fields. It is accessible via the AWS Management Console, AWS CLI, AWS SDK, or the registry's MCP endpoint and is available in all AWS regions where AWS Agent Registry is offered: US East (N. Virginia), US West (Oregon), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Europe (Ireland). For more information, see the AWS Agent Registry documentation.

Why it matters

AWS Agent Registry is a centralized catalog for managing agents and resources within an organization. This update allows adding custom metadata to registry records, improving resource management and discovery.

Regions: Same as AWS Agent Registry

Today, Amazon Elastic Container Service (Amazon ECS) introduced a new service metric, LiveTaskCount, reporting the number of actively running tasks. This metric is provided at no additional cost to all customers. Additionally, the existing RunningTaskCount metric from Amazon CloudWatch Container Insights is now free. LiveTaskCount reports tasks in ACTIVATING, RUNNING, and DEACTIVATING desired states, including those transitioning to stopped during connection draining, making it suitable for autoscaling policies and capacity planning. It is offered free as part of ECS service usage metrics and does not require opting into CloudWatch Container Insights. The existing RunningTaskCount metric continues to track tasks where both current and desired states are RUNNING, serving as a health and stability signal. With today's update, RunningTaskCount is now available at no cost to all CloudWatch Container Insights users. These updates are available in all AWS regions where Amazon ECS is offered. No action is required, and the change to RunningTaskCount pricing will take effect on October 1, 2026, applying automatically. For more information, see the ECS CloudWatch metrics and ECS Container Insights metrics pages. For pricing examples, refer to the Amazon CloudWatch pricing page.

Why it matters

Amazon ECS is an AWS service for managing and deploying containerized applications. This update helps users monitor task status more accurately and optimize autoscaling and capacity planning.

Regions: Same as Amazon ECS

AWS Security Hub now adds resource criticality to prioritization, helping security teams focus on vulnerabilities affecting the most important business resources. Criticality can be set via automated rules and applies to both existing and new resources. It automatically estimates criticality from resource tags or names, requiring no configuration and logging which source determined the value. Criticality appears as a column on resource pages for sorting, filtering, and grouping, and also shows in vulnerability findings on the impact assessment tab. Included with Security Hub Essentials at no extra cost, it is always enabled for all customers.

Why it matters

Helps security teams prioritize vulnerabilities based on resource criticality

Regions: Listed in the official documentation

AWS Backup now supports Amazon FSx for Lustre, Amazon FSx for NetApp ONTAP, Amazon FSx for OpenZFS, and Amazon FSx for Windows File Server in the Asia Pacific (New Zealand) region. This enables centralized, automated management of data protection for Amazon FSx file systems alongside other supported AWS resources. Users can create policy-based backup plans, schedule backups, apply retention rules, store backups in encrypted vaults, and restore file systems as needed, fulfilling business continuity, disaster recovery, and compliance requirements through a single service. Get started via the AWS Backup console, AWS CLI, or AWS SDK. For a full list of supported regions and features, see AWS Backup documentation.

Why it matters

AWS Backup is a service that automates and manages data protection for AWS resources. This update enables protection of Amazon FSx file systems in the Asia Pacific (New Zealand) Region.

Regions: New Zealand

AWS Deadline Cloud lets users search for resources accessible directly from the Deadline Cloud monitor for specific queues, fleets, or jobs. The monitor shows queues users can access, required parent IDs, and access levels via direct and group inheritance, eliminating the need to obtain farm IDs from administrators. Teams can share a single monitor entry point (URL) across different access levels without additional adjustments. Resource discovery is available in all AWS regions where Deadline Cloud is provided.

Why it matters

AWS Deadline Cloud is a fully managed service that helps teams run compute-intensive workloads for visual effects, animation, product design, simulation, and gaming. This update allows users with restricted permissions to efficiently manage resources.

Regions: Same as AWS Deadline Cloud

Amazon DCV 2026.0 is now available, adding support for RHEL 10, Rocky Linux 10, CentOS 10, and Ubuntu 26.04, enabling Linux hosts and sessions to run on the modern Wayland display server. A new macOS client introduces gamepad support, while Windows and Linux clients have also been updated. Windows hosts now feature URL redirection, launching configured links in the client's local browser during remote sessions, and printer preference redirection allows remote sessions to access client-side printer settings. Performance improvements include H.264 frame slice support and slice-based multithreaded decoding on Linux and macOS clients, reducing latency. New macOS server versions on Amazon EC2 are also supported. Details are available in the release notes or on the Amazon DCV webpage.

Why it matters

Amazon DCV is a high-performance remote display protocol that enables secure access to remote desktops and application sessions across Windows, Linux, and macOS

Amazon RDS for SQL Server now supports the latest Microsoft SQL Server cumulative update (CU). This release includes Microsoft SQL Server 2025 CU8 KB5104822 (RDS version 17.00.4075.5.v1). For details on improvements and fixes in these updates, see Microsoft's KB5104822 documentation. We recommend upgrading your Amazon RDS for SQL Server instances using the Amazon RDS Management Console, AWS SDK, or CLI. For guidance on upgrading the RDS Microsoft SQL Server DB engine, refer to the Amazon RDS SQL Server User Guide.

Why it matters

Database administrators and developers using SQL Server should consider upgrading to apply the latest security patches and functional improvements

Amazon Connect Customer lets agents pre-fill step-by-step guides using extracted call details like reservation IDs and summaries. Managers configure which extracted data populates each form field. Agents review, edit if needed, and submit the guide, saving post-call work time and reducing data entry errors. Available in US East, US West, Asia Pacific regions, and Europe. Call summaries are also available in Africa (Cape Town). For details, see the Amazon Connect Customer user guide.

Why it matters

This update is useful for contact center managers and agents, improving workflow efficiency and data accuracy.

Regions: Cape Town

Amazon Elastic Compute Cloud (Amazon EC2) G7 instances are now available in the Europe (Frankfurt) and Europe (Stockholm) regions. These instances feature NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs, delivering up to 4.6x higher AI inference and 2.1x faster graphics performance compared to G6 instances. They also accelerate GPU-based data analytics. G7 instances can deploy AI models for language translation, video and image analysis, speech recognition, and recommendation systems, and support graphics workloads like real-time cinematic rendering and game streaming. They also support video transcoding, spatial computing, and data analytics. Each G7 instance includes up to eight NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs, each with 32 GB of memory, and custom Intel Xeon 6 processors. They support up to 192 vCPUs, 700 Gbps Elastic Fabric Adapter (EFA) network bandwidth, up to 768 GiB of system memory, and up to 7.6 TB of local NVMe SSD storage. G7 instances are available in the US West (Oregon), US East (Ohio), and Europe (Spain, Frankfurt, Stockholm) regions, and can be purchased as On-Demand, Spot, or as part of a Savings Plan.

Why it matters

Amazon EC2 G7 instances are high-performance computing instances equipped with powerful GPUs, ideal for AI inference, graphics processing, and data analytics workloads.

Regions: Frankfurt, Stockholm

AWS DataSync Enhanced mode now supports Amazon FSx for OpenZFS as a source or destination and NFS version 4.2 on on-premises NFS servers and FSx for OpenZFS file systems. It adds a new ObjectMetadata option for object storage transfers, enabling user metadata copy control. This allows transfers where destination metadata must remain intact, such as with AWS Storage Gateway buckets, or when source metadata keys are incompatible with the destination, like Azure Blob Storage. Existing tasks remain unaffected and continue on schedule. These features are available in all AWS regions where AWS DataSync Enhanced mode is supported. For details, see AWS DataSync documentation.

Why it matters

AWS DataSync is a high-speed, secure data transfer solution, and this update adds support for new protocols like FSx for OpenZFS and NFS 4.2, along with object metadata controls, making data migration and backup workflows more flexible.

Regions: Same as AWS DataSync Enhanced mode

The Agent Toolkit for AWS now integrates new AWS AI/ML skills, allowing coding agents to select, train, optimize, and deploy models on Amazon SageMaker AI through a single natural language workflow. It replaces previous AWS Labs skills and plugins with a unified installation and update path, pre-installed in SageMaker Studio JupyterLab for use with Kiro or your preferred coding agent. The skill extends SageMaker AI support to include inference optimization, end-to-end fine-tuning workflows, serverless training, MLflow, experiment tracking, model lifecycle management, and JumpStart model deployment and recommendations. The AWS AI/ML skill is available at no additional cost, billing only for AWS resources used. To get started, install the skill from GitHub’s Agent Toolkit for AWS or use the pre-installed version in SageMaker Studio JupyterLab.

Why it matters

This update benefits developers and data scientists who want to leverage SageMaker AI's advanced capabilities through their coding agents. Integrating natural language processing into SageMaker workflows improves development efficiency and model deployment speed.

Amazon Bedrock AgentCore's short-term memory (STM) pricing now uses data consumption instead of a per-event fee: $1 per GB for ingest, $0.20 per GB for retrieval, and $0.10 per GB-month for storage. Ingest and retrieval are billed per event from 12 KB to 64 KB, while storage is charged at actual size. Small payloads see the greatest cost savings, and storage costs can be managed by setting shorter TTLs for memory resources. Long-term memory pricing remains unchanged. The consumption-based rates are available in all AWS regions where AgentCore Memory is offered.

Why it matters

Developers building AI agents will benefit from better cost management for short-term memory.

Amazon EMR provides native data quality validation within Apache Spark jobs, allowing data engineering teams to catch bad data inline before it reaches downstream systems without building or maintaining separate validation infrastructure. Based on AWS Glue and available at no extra cost, it offers a consistent experience across both engines using the same declarative rule language and APIs, and integrates with Apache Iceberg, Apache Hudi, and Delta Lake in EC2, EKS, and serverless deployment modes. Users can create validation rules in Spark scripts or reference rules stored in the AWS Glue Data Catalog, applying them post-load, during transformation, or post-processing. With over 30 rule types-including dynamic rules and ML-based anomaly detection for tracking drift over time without fixed thresholds-users can choose actions such as pipeline failure, filtering invalid records, or routing them to quarantine. Results are generated at the dataset, rule, and row levels, making it easy to identify records or rules causing quality issues. Amazon EMR Data Quality is available on all AWS commercial, AWS GovCloud (US), and AWS China regions via AWS Runtime for Apache Spark (emr-spark-8.1.0). To get started, access the Amazon EMR Data Quality documentation and add DQDL rules to your EMR workload Spark scripts.

Why it matters

This update benefits data engineering teams that need to effectively manage data quality. Amazon EMR's data quality capabilities simplify in-pipeline validation, helping ensure data quality without requiring separate infrastructure

Amazon S3 Express One Zone storage class is now available in four additional regions: Europe (London), Asia Pacific (Jakarta), Asia Pacific (Hong Kong), and Africa (Cape Town). It delivers consistent single-digit millisecond data access for highly accessed data and latency-sensitive applications, with up to 10x faster data access and 80% lower request costs than S3 Standard. Suitable for workloads like machine learning training, interactive analytics, and caching for AI search engines, it offers high durability and availability. This expansion brings S3 Express One Zone to 19 AWS regions. For pricing details and more information, see the S3 pricing page and product documentation.

Why it matters

Amazon S3 Express One Zone is a high-performance, low-latency storage class ideal for workloads such as machine learning and interactive analytics.

Regions: London, Jakarta, Hong Kong, Cape Town

Amazon OpenSearch Service supports index-level encryption, allowing each index to be encrypted with its own AWS KMS customer-managed key. This enables different keys for different ownership or sensitive data within the same domain, such as encrypting each tenant's data with a unique key in multi-tenant applications. The feature builds on existing Amazon OpenSearch Service encryption and can be enabled by setting the encryption mode to Native and specifying a customer-managed AWS KMS key when creating a new domain via the AWS Management Console or AWS CLI. Additional keys can also be registered to the domain for use with individual indexes. It is available for domains running OpenSearch version 3.3 or later in 14 AWS regions, at no extra cost beyond standard AWS KMS and OpenSearch Service charges.

Why it matters

Amazon OpenSearch Service is a cloud-based search and analytics service. This update allows different encryption keys for each tenant or data owner, simplifying security and compliance management

Regions: N. Virginia, Ohio and 12 more

Amazon ElastiCache for Valkey has introduced ElastiCache Insights for node-based clusters. This feature provides a pre-built dashboard in Amazon CloudWatch, aggregating cluster health, memory, compute, network, command throughput, latency, key space, and errors into a single view. It automatically collects data from OpenTelemetry metrics, allowing users to quickly assess regional cache workload health, detect nodes nearing memory, network, or connection limits, and filter views by cluster, shard, node, or availability zone. The dashboard can also be copied as a starting point for custom dashboards. Detailed monitoring publishes metrics every 15 seconds for viewing in the Metrics tab or custom dashboards. CloudWatch charges for OpenTelemetry metrics apply to ElastiCache detailed monitoring. To use it, open the Metrics tab in the Amazon ElastiCache console and select View in ElastiCache Insights, or choose ElastiCache Insights under infrastructure monitoring in the Amazon CloudWatch console. ElastiCache Insights is available for node-based Valkey clusters in all AWS regions where Amazon CloudWatch supports OpenTelemetry metrics.

Why it matters

ElastiCache Insights provides a streamlined way to monitor and analyze Valkey cluster performance, helping developers and operators manage cache environments more effectively

Regions: Same as Amazon CloudWatch

AWS Secrets Manager now supports managed external secrets for Databricks and Twilio, enabling automatic rotation of credentials used by data pipelines or messaging applications when calling these services. Rotation can be configured via the AWS Management Console or API without needing to write or maintain custom Lambda functions. For Databricks, personal access tokens used in jobs or CI/CD pipelines can be rotated. For Twilio, API keys and auth tokens used to send messages or make calls can be rotated. In both cases, credentials are stored as Secrets Manager managed external secrets with a rotation schedule set. Secrets Manager always returns current credentials, allowing applications to retrieve rotated values without code changes. These integrations join existing managed external secret support for BigID, Cisco Security Platform, Confluent Cloud, Datadog, GitLab, Jenkins, MongoDB Atlas, Netskope, Paddle, Salesforce, Snowflake, and SonarQube. Managed external secrets for Databricks and Twilio are available in all AWS regions where AWS Secrets Manager managed external secrets are supported.

Why it matters

AWS Secrets Manager is a service that helps secure and manage the secrets a user stores in the cloud, such as API keys, database credentials, or tokens. This update enhances credential management for Databricks and Twilio, improving security and operational efficiency.

Regions: Same as AWS Secrets Manager managed external secrets

AWS Transfer Family now allows configuring custom ports and selecting communication modes for each port on public SFTP servers. This enables a single server to support clients requiring different ports or specific SFTP connection initiation methods. Previously, only port 22 with server-initiated connections was supported, but now up to three ports (22 or any between 2000 and 65535) can be set. Since some clients initiate connections from their side, where server-initiated ports may stop connections, each port can be set for client or server initiation, allowing redirection based on client behavior. Using ports other than 22 also reduces unwanted connection attempts from scanners targeting port 22. This feature is available in all AWS regions where Transfer Family public SFTP servers are offered. For details, see the AWS Transfer Family console, AWS CLI, AWS SDK, or the user guide's 'Creating SFTP-enabled servers' section.

Why it matters

AWS Transfer Family is a service that securely transfers files using protocols such as SFTP and FTPS. This update allows custom ports on public SFTP servers and supports client-specific connection settings.

AWS now allows US customers to sign up and pay AWS service invoices via ACH direct debit. Customers can securely link personal or business bank accounts to manage AWS invoices directly from USD bank accounts. This feature eliminates the need for credit or debit cards during sign-up. During sign-up, customers select 'bank account' on the AWS sign-up page, choose their bank, and authenticate using their bank's mobile app or online banking credentials. This securely verifies ownership and links the bank account to the AWS account. By default, this account is used for future AWS invoices. Existing customers can add a bank account via the AWS Billing and Cost Management console's payment settings page. After selecting 'Add payment method' and choosing 'Link bank account,' they complete the same bank selection and authentication flow. Once verified, the bank account becomes an available payment method for future AWS invoices. ACH direct debit is available at no additional cost to AWS users with USD bank accounts.

Why it matters

This update benefits AWS new and existing users seeking more flexible payment options, especially those who prefer not to use credit or debit cards.

Starting today, Amazon EC2 C9g and C9gd instances are available in Asia Pacific (Malaysia, Seoul, Singapore) regions, and M9g and M9gd instances in Asia Pacific (Malaysia) and Europe (Spain) regions. These instances feature AWS Graviton5 processors, AWS's custom-designed 5th generation CPU, delivering the best price performance for a wide range of workloads on Amazon EC2. They offer up to 25% higher compute performance than AWS Graviton4-based C8g, C8gd, M8g, and M8gd instances, with up to 30% faster databases, up to 35% faster web applications, and up to 35% faster machine learning. Built on the 6th generation AWS Nitro System, they include the Nitro Isolation Engine for mathematically proven isolation of customer workloads from each other and from AWS operators. C9g instances are ideal for compute-intensive workloads such as high-performance computing (HPC), batch processing, gaming, video encoding, scientific modeling, distributed analytics, CPU-based machine learning (ML) inference, real-time analytics, and ad serving. M9g instances suit a broad range of general-purpose workloads including application servers, microservices, gaming, caching, and containers, and also provide the performance needed for agent-based AI use cases like real-time inference, code generation, and multi-step orchestration. C9gd and M9gd instances add local NVMe-based SSD block-level storage for scratch space, temporary files, and caching. These instances can be purchased through Savings Plans, On-Demand, Spot Instances, Dedicated Instances, or Dedicated Hosts in these regions. Elevate your compute with AWS Graviton and get started with C9g and M9g today.

Why it matters

New Amazon EC2 instance types are now available in additional regions, allowing users to access high-performance compute resources in more locations.

Regions: Malaysia, Seoul, Singapore, Spain

Amazon Elastic Compute Cloud (Amazon EC2) M8id instances are now available in the Asia Pacific (Malaysia) and Asia Pacific (Sydney) regions. Designed for workloads needing balanced compute and memory resources with fast, low-latency local NVMe-based SSD storage up to 22.8 TB, they suit data logging, media processing, and mid-sized datastores. Compared to previous sixth-gen instances, M8id offers triple the vCPUs, memory, and local storage, up to 43% higher compute performance, and 3.3x memory bandwidth. I/O-intensive database workloads see up to 46% performance gains, and real-time analytics queries run up to 30% faster. Customers can adjust network and Amazon EBS bandwidth by 25% using EC2 instance bandwidth weighting to better optimize resource allocation. These instances provide Elastic Fabric Adapter (EFA) networking in 24xlarge, 48xlarge, metal-24xl, and metal-48xl sizes and are available through Savings Plans, On-Demand, and Spot Instances. For more information, visit the Amazon EC2 M8id page.

Why it matters

Amazon EC2 M8id instances are a new instance type designed for workloads requiring a balance of compute and memory resources along with high-speed, low-latency local block storage, enabling more efficient execution of tasks such as data logging, media processing, and medium-sized data stores.

Regions: Malaysia, Sydney

Anthropic's new models, claude sonnet 5.5 and claude opus 5.5, are now available in the AWS GovCloud (US) region via Kiro IDE and CLI. Opus 5.5, anthropic's most capable opus model to date, advances agent-based coding for long tasks, completing tasks in about 40% fewer tool calls and half the context of opus 5. It offers a 1M context window and a 2.0x credit multiplier (down from opus 5's 2.2x). Sonnet 5.5, anthropic's fastest sonnet model, provides a natural upgrade for existing sonnet 5 users, with outputs over 30% faster and real-world coding and knowledge work approaching opus 5.5 performance. It features a 1M context window and a 1.3x credit multiplier. Update and restart your IDE or CLI to access the new models from the model selector. For details, see GovCloud docs, monitoring and tracking guides, or contact your AWS account team. Learn more about Kiro at the Kiro product page.

Why it matters

This update impacts developers and organizations using AI models in AWS GovCloud (US), especially those engaged in long-running coding tasks or high-throughput knowledge work.

AWS Security Hub now allows exporting findings to Amazon S3 as CSV or JSON (OCSF). Security teams can export findings on-demand from any Security Hub console page (threats, exposures, vulnerabilities, posture management, sensitive data, all findings, etc.) to their account's S3 bucket without maintaining export pipelines. Users may choose CSV for spreadsheet review or sharing, or JSON in Open Cybersecurity Schema Framework (OCSF) format when needed. This feature is available in all AWS regions where AWS Security Hub is offered. For details, see the AWS Security Hub user guide.

Why it matters

This feature helps security teams utilize findings for compliance reporting and audit evidence.

Regions: Same as AWS Security Hub

Starting today, Amazon Quick allows uploading brand templates. Brand managers can upload PowerPoint or Word templates or retrieve them from connected file stores like SharePoint. Quick extracts colors, fonts, logos, layouts and brand rules from each file for review and editing by brand managers before organization-wide publishing. When creating new assets, Quick enforces template rules, explains violations and suggests brand-compliant alternatives. The best template is chosen based on guidance written by brand managers for each task, though users may select different templates. Admins set custom permissions to control who can create and publish brand templates, limiting visual standards setting to approved teams like brand and marketing. Brand assets are now generally available in the Amazon Quick desktop app. For details, see Amazon Quick documentation or sign up for a free account to start using Quick in minutes.

Why it matters

Useful for brand and marketing teams to ensure consistency across presentations and documents organization-wide.

AWS Lambda now supports OAuth authentication for customer-managed Apache Kafka event source mappings (ESM). This allows customers to authenticate Kafka ESM through corporate identity providers such as Amazon Cognito or Okta, meeting security and compliance requirements for Kafka applications. Kafka ESM is used to build event-driven workloads like payment processing, fraud detection, and real-time data pipelines, offering auto-scaling, error handling, batch processing, and event filtering. Previously limited to SASL/PLAIN, SASL/SCRAM, and mutual TLS (mTLS), Kafka ESM was unavailable to regulated industry customers requiring OAuth. With OAuth support, customers can authenticate Kafka ESM using their corporate identity provider, applying consistent identity governance and access policies across Kafka clusters and Lambda consumers. This feature is available in all AWS commercial regions where customer-managed Kafka ESM is offered. To use OAuth authentication, create a new Kafka ESM via the AWS Management Console, Lambda API, AWS CLI, AWS CloudFormation, or AWS SAM with the authentication settings configured.

Why it matters

Affects customers building event-driven Kafka workloads using Kafka ESM, especially those in regulated industries

Amazon Connect Customer offers an automatic performance review form checker, improving AI-generated evaluation accuracy. Managers can run the check with one click to compare forms against best practices, flagging vague questions and suggesting more specific ones, such as refining 'Did the agent provide sales disclosures?' to specify required disclosures. This enables fair and accurate evaluations of human and AI agents, reducing form revision time. The feature is available in US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (London), Asia Pacific (Singapore), Asia Pacific (Sydney), and Asia Pacific (Tokyo) regions. For details and pricing, see the documentation and web page.

Why it matters

This update is useful for managers who want to improve the accuracy of AI-driven customer service evaluations and for those responsible for managing performance evaluation forms

Regions: N. Virginia, Oregon and 6 more

Amazon Bedrock supports the reasoning.summary parameter with OpenAI models via the Responses API, allowing developers to retrieve human-readable summaries alongside model responses for understanding complex tasks like code generation, analysis, and multi-step problem solving. Summaries are returned in the summary array of inference output items. This feature is available in all AWS regions where OpenAI GPT models are offered, supporting intra-region, cross-region (geographic), and global cross-region inference.

Why it matters

Developers can use this feature to evaluate model responses, debug applications, and show users how a model approached a request

Amazon EC2 R8g instances are now available in the Europe (Germany) region, powered by AWS Graviton4 processors for up to 30% better performance than Graviton3-based instances. Ideal for memory-intensive workloads like databases, in-memory caching, and real-time big data analytics, they use the AWS Nitro system to offload CPU virtualization, storage, and networking to dedicated hardware and software, enhancing performance and security. Offering larger instance sizes than R7g instances, R8g instances provide up to 48xlarge vCPU and 1.5TB of memory, delivering up to 30% better performance for web applications, 40% for databases, and 45% for large Java applications. Available in 12 sizes, including two bare metal options, they support up to 50 Gbps enhanced networking bandwidth and 40 Gbps to Amazon EBS. For details, see the Amazon EC2 R8g instance page. For guidance on migrating workloads to Graviton-based instances, refer to the AWS Graviton Fast Start program and the porting advisor. To get started, visit the AWS Management Console.

Why it matters

Amazon EC2 R8g instances are high-performance instances for memory-intensive workloads, powered by AWS Graviton4 processors, offering superior performance and energy efficiency.

Regions: AWS European Sovereign Cloud (Germany)

Amazon EC2 R8gd instances are now available in the AWS European Sovereign Cloud (Germany) region. They feature up to 11.4 TB of NVMe-based SSD block storage and AWS Graviton4 processors, delivering up to 30% performance gains over Graviton3-based instances. Built on the AWS Nitro System, these instances are ideal for applications requiring fast, low-latency local storage access. Offered in 12 sizes, they provide up to 50 Gbps network bandwidth and 40 Gbps Amazon EBS bandwidth, with an additional 25% adjustable bandwidth via EC2 instance weight settings for optimized resource allocation. Elastic Fabric Adapter (EFA) networking is supported for 24xlarge, 48xlarge, metal-24xl, and metal-48xl sizes.

Why it matters

Amazon EC2 R8gd instances are high-performance computing instances powered by AWS Graviton4 processors, ideal for applications requiring high-speed, low-latency local storage. These instances offer flexibility in adjusting network and EBS bandwidth, aiding in workload optimization.

Regions: AWS European Sovereign Cloud (Germany)

Amazon Bedrock now supports the TwelveLabs Pegasus 1.5 model to generate structured, time-coded metadata from videos. Pegasus 1.5 reads entire videos, labeling events and their timing, converting footage into queryable data. Users define business-critical elements like editorial segments or speaker changes; Pegasus 1.5 detects these moments and returns them with timestamps, without requiring pre-indexing or ingest pipelines. It is accessible via US and global cross-region inference profiles. To get started, visit the Amazon Bedrock product page, access the model in the Amazon Bedrock console, or refer to Amazon Bedrock documentation for supported regions, APIs, features, and pricing.

Why it matters

This update benefits users who need to efficiently search for specific moments in video libraries or developers looking to convert video content into structured data for application use.

Regions: Listed in the official documentation

AWS today announced that Amazon Bedrock now offers OpenAI's GPT-6.1 Sol in Ultrafast mode for speed-critical workloads, delivering high inference performance, security, and reliability for production use, ideal for low-latency applications such as real-time coding assistants, interactive agents, and customer experiences requiring fast, high-quality responses, with existing AWS controls to protect workloads, manage access, and audit model calls, accessible via the Amazon Bedrock console or supported API.

Why it matters

Amazon Bedrock is a platform that allows developers to securely and efficiently utilize AI models, enabling the easy integration of advanced AI capabilities into production environments.

Regions: Listed in the official documentation

Amazon GameLift Servers now supports CPU burst for container fleets, allowing developers to allocate and consume compute resources more flexibly at runtime. Previously, container fleets relied on fixed CPU values that simultaneously controlled container density and runtime limits, forcing developers to choose between efficient resource use and performance headroom for game server workloads. Game server workloads are inherently bursty: CPU demand is low during matches but spikes sharply during physics calculations, AI processing, and collision detection. With CPU burst, developers can pack containers based on typical CPU needs while releasing idle instance CPU to game server processes during peak demand. This optional feature is configured per container group definition, supporting high-density deployments without sacrificing peak performance and is included at no extra cost in the standard container fleet pricing. Amazon GameLift Servers container fleet CPU burst is available in all AWS regions except China regions.

Why it matters

Game developers need to efficiently manage CPU resources due to the bursty nature of game server workloads. This update provides functionality to maintain performance during peak demand moments while increasing container packing density.

Amazon EC2 C8gb instances are now generally available in US East (Ohio), US West (N. California), EU (Frankfurt, Ireland, Paris, Stockholm), and Africa (Cape Town) regions. These instances feature the latest AWS Graviton4 processors, delivering up to 30% higher compute performance than AWS Graviton3-based EC2 instances. They offer up to 300 Gbps EBS bandwidth and 1600 K IOPS, achieving higher EBS performance than similarly sized Graviton4-based instances. These instances support up to 48xlarge sizes, up to 384 GiB of memory, up to 300 Gbps EBS bandwidth, and up to 400 Gbps network bandwidth. The 16xlarge, 24xlarge, and 48xlarge sizes support Elastic Fabric Adapter (EFA) networking for improved inter-cluster low latency and cluster performance.

Why it matters

Amazon EC2 C8gb instances, powered by AWS Graviton4 processors, deliver higher compute performance and EBS bandwidth for workloads requiring high-performance file systems and large-scale data processing

Regions: Ohio, N. California and 7 more

AWS Config adds 77 new resource types for key services such as Amazon EC2, Amazon S3 Files, and Amazon Q Business. This expansion enables broader coverage of AWS environments, improving the effectiveness of resource discovery, assessment, auditing, and remediation. When recording is enabled for all resource types, AWS Config automatically tracks these new additions. The new resource types are also available for Config rules and Config aggregators, allowing monitoring of these types across all available AWS regions.

Why it matters

AWS Config monitors the configuration state of AWS resources and evaluates compliance. This update expands the range of supported resources, enabling more detailed visibility and management of the environment.

Today, AWS launched feature-level notifications and advanced filtering for AWS Builder Center across AWS Regions. Users can set notifications for service or specific feature availability in regions of interest, with in-app alerts and weekly email digests showing features enabled after notification activation. Notification settings apply to all features within a service, and the all-Regions option includes future additions. API actions and CloudFormation resources can be filtered by availability status, allowing display of all inter-region features, only applicable ones, or just differences. This enables quick extraction of precise differences among over 19,000 API actions and 5,000 CloudFormation resource types. Feature comparisons require no account, but setting notifications needs a free Builder ID. For details, see the AWS Builder Center FAQ.

Why it matters

AWS Capabilities by Region helps developers check which AWS services and features are available in specific regions. This update enables real-time tracking of regional availability and easy comparison of feature differences across regions.

AWS GovCloud (US) now offers Claude Haiku 5.5, the fastest and most efficient model in the Claude 5.5 family, built for sub-agents and high-volume, cost-sensitive tasks. According to Anthropic, it reduces costs by about 75% compared to Haiku 4.5 for most tasks, with significant performance gains in coding, tool use, computer operations, and agent capabilities. It features effort control to balance cost and intelligence per task, making it ideal for real-time experiences like voice agents and live support, as well as heavy tasks such as classification, summarization, and extracting key fields from documents. Haiku 5.5 can also serve as a high-performance sub-agent. Amazon Bedrock provides Haiku's capabilities while keeping data within AWS infrastructure, offering region-specific data residency and access to managed features like Guardrails and Knowledge Bases. For details and regional availability, see Amazon Bedrock documentation.

Why it matters

This update impacts enterprises using AWS GovCloud (US), particularly developers and organizations focused on agent technologies and high-volume processing. Claude Haiku 5.5 offers a balance of cost-efficiency and performance, making it suitable for subagents and real-time processing.

Regions: Listed in the official documentation

AWS now offers Claude Haiku 5.5, the fastest and most efficient model in the Anthropic Claude 5.5 family. Built for sub-agents and high-volume, cost-sensitive tasks, it reduces costs by about 75% compared to Claude Haiku 4.5. It features effort control to balance cost and intelligence per task. Haiku 5.5 is ideal for real-time experiences like voice agents and live support, as well as high-volume tasks such as classification, summarization, and extracting key fields from documents. It can also serve as a fast, cost-effective sub-agent. Customers can access Haiku 5.5 through Amazon Bedrock or the Claude Platform on AWS, which provides Anthropic's native platform experience integrated with AWS billing and authentication.

Why it matters

Claude Haiku 5.5 is an AI model designed for real-time agent responses and high-volume processing, making it ideal for users prioritizing cost efficiency.

Regions: Listed in the official documentation

AWS Batch publishes job metrics to Amazon CloudWatch, providing native visibility into batch workloads. It generates metrics throughout the job lifecycle, showing queue health, failure rates, and job execution times. Job state transitions and execution time metrics are automatically published to the AWS/Batch namespace with the JobQueueName dimension. These metrics, accessible via the AWS Batch console, CloudWatch console, AWS CLI, or SDKs, track job counts per state (submitted, running, succeeded, failed) and times (time to runnable, total execution time).

Why it matters

AWS Batch provides job management and scheduling for batch processing workloads. This update enables users to monitor job status and execution times in more detail through CloudWatch

Regions: Same as AWS Batch

Amazon EC2 Hpc8a instances are now available in the Asia Pacific (Singapore) region, featuring 5th-gen AMD EPYC processors (code-named Turin) with speeds up to 4.5GHz, delivering up to 40% better performance and 25% improved price performance over Hpc7a instances. They also offer up to 42% higher memory bandwidth, boosting performance for memory-intensive simulations and scientific computing workloads. Built on the latest 6th-gen AWS Nitro Cards, Hpc8a instances are designed for compute-intensive, latency-sensitive HPC workloads such as computational fluid dynamics (CFD), weather forecasting, explicit finite element analysis (FEA), and multiphysics simulations that require fast, consistent high-performance inter-node communication. To get started, sign in to the AWS Management Console. For more details, see the Amazon EC2 Hpc8a instance page or the AWS News Blog.

Why it matters

Amazon EC2 Hpc8a instances are designed for compute-intensive, latency-sensitive HPC workloads, particularly beneficial for fields such as computational fluid dynamics, weather forecasting, finite element analysis, and multiphysics simulations

Regions: Singapore

AWS Client VPN now supports device posture assessment, ensuring user devices meet security and compliance requirements before connecting. It integrates with existing providers like CrowdStrike, Jamf, and JumpCloud to automatically evaluate compliance scores, encryption status, and risk levels. These requirements are defined in Cedar policies for granular control over connectable devices. Client VPN provides a Test Policy tool to help create and validate Cedar policies. The feature continuously re-evaluates device compliance during active sessions, automatically terminating sessions if risk scores or security settings change. It also offers monitoring-only mode to assess policy impact before enforcement. Device posture assessment works with existing allow rules for defense-in-depth. The feature is available in all AWS regions where AWS Client VPN is offered, at no additional cost, and requires AWS VPN client version 6.2.0 or later.

Why it matters

This update is useful for organizations that need to ensure security and compliance in remote and hybrid work environments. Device posture assessment allows verification of device status before granting access.

Regions: Same as AWS Client VPN

Amazon EC2 now supports AMI tag sharing, allowing AMI owners to make selected tags visible to all AWS accounts sharing the AMI. Shared tags are automatically included with the AMI, whether shared across accounts, organizations, or made public, eliminating the need to build and maintain custom tag replication workflows. Owners simply add the "ec2:SharedTag/" prefix to tag keys for immediate visibility in all recipient accounts. These tags are read-only for recipients, with only the owner able to create, modify, or delete them. Tags count toward the owner's per-resource 50-tag limit only, and recipients can still add their own private tags. The feature is available in all AWS regions at no additional cost. See documentation and blog for details.

Why it matters

This change improves tag management efficiency when sharing Amazon Machine Images across multiple AWS accounts. AMI owners can set tags once, and they are automatically reflected for all shared accounts, reducing operational burden

Regions: All Regions

AWS Control Tower Account Factory for Terraform (AFT) now supports plan-only customization runs, allowing administrators to preview Terraform changes before applying them. Previously, customization calls always triggered a full Terraform apply, making it difficult to verify expected outcomes or detect unintended configuration drift before broad deployments. Plan-only execution enables administrators to trigger Terraform plans for global and account customizations without applying changes, supporting pre-deployment validation, drift detection, and integration with CI/CD review workflows. This feature is compatible with all Terraform distributions supported by AFT, including open-source, Terraform Cloud, and Terraform Enterprise, and is available in all AWS regions where AFT is supported. For more information, see the AFT documentation and AFT 1.22.0 release notes, as well as the AWS Control Tower user guide.

Why it matters

AWS Control Tower AFT is an open-source Terraform module that automates account provisioning and customization in AWS Control Tower environments. This update allows administrators to preview changes before applying them, making pre-deployment validation and detection of unintended configuration drift easier

Regions: Same as AWS Control Tower Account Factory for Terraform

Amazon Bedrock now supports Z.ai's GLM 5.3, a powerful option for agent-based coding and long-term software engineering. With 753b total parameters and about 40b active parameters per token, GLM 5.3 is a professional mixture architecture built on the same base model as GLM 5.2 through scaled post-training improvements. It offers a 1 million token context window and up to 128k output tokens, enabling always-on inference with adjustable trade-offs between latency, token usage, and task performance. GLM 5.3 includes prompt caching to explicitly cache system prompts and message cache points, reducing latency and input costs when reusing context between model calls. Available to eligible enterprise customers, GLM 5.3 can be accessed via the Amazon Bedrock console or supported Amazon Bedrock APIs in US and global cross-region inference profiles. For details on supported AWS regions, endpoints, APIs, features, inference profiles, and pricing, see Amazon Bedrock documentation.

Why it matters

Amazon Bedrock is a platform for invoking AI models, allowing developers to access and use various AI models. The general availability of GLM 5.3 provides a new option for agentic coding and long-horizon software engineering tasks.

Regions: Listed in the official documentation

Amazon Redshift now supports creating and updating Apache Iceberg materialized views. These views precompute complex joins and aggregations, storing results in Amazon S3 or S3 table buckets. The results are registered in the AWS Glue Data Catalog, enabling immediate querying with Amazon Athena, Apache Spark on Amazon EMR, AWS Glue, and other Iceberg-compatible engines. Redshift keeps results up-to-date with manual incremental updates, managing them as Iceberg tables in the Glue Data Catalog, detectable and manageable like other catalog tables. This reduces pipeline orchestration overhead for data cleaning and transformation across different engines, allowing all downstream consumers to share the same open results. The results are provided as open Iceberg tables, readable by any engine without copying or transformation. These tables can also be loaded into Redshift Managed Storage (RMS) for use as native RMS materialized views in performance-critical dashboards. Iceberg materialized views can be created in all regions supporting Redshift Serverless and provisioned Graviton instances.

Why it matters

This update benefits data teams aiming to streamline and ensure consistency in data analytics pipelines by reducing overhead from multiple engine conversions and orchestration, providing consistent results.

AWS Certificate Manager (ACM) now supports AWS PrivateLink for ACME public certificate issuance, enabling public TLS certificate requests and renewals over private networks within the AWS network. Create a VPC interface endpoint from ACMEv2-compatible clients to route issuance traffic inside the VPC. No changes to existing ACME client configurations are required; simply create an ACM-managed ACME endpoint and a standard VPC interface endpoint using the VPC console, AWS CLI, or AWS CloudFormation. Private DNS automatically resolves existing ACME directory URLs to the interface endpoint within the VPC, allowing the same client configurations and directory URLs to continue working without reconfiguration. Issuance operations (account creation, order creation, domain validation, finalization, certificate retrieval) are executed via PrivateLink, with all activities visible in the ACM console and auditable through AWS CloudTrail logs and Amazon CloudWatch metrics. This support for ACME certificate issuance via AWS PrivateLink is available in all commercial AWS regions. Standard AWS PrivateLink charges apply to interface endpoints. For details on ACM pricing, see the ACM pricing page.

Why it matters

This change affects users who issue TLS certificates using ACME. It enables certificate issuance over a private network path, improving security and control

Regions: All Regions

AWS Batch now supports access entries for authentication to Amazon EKS compute environments. Access entries provide an API-driven approach to grant IAM principals access to Kubernetes clusters, complementing the existing aws-auth ConfigMap. This simplifies cluster configuration and authentication lifecycle management. To enable, set accessEntry.desiredState to ENABLED for the target cluster's compute environment using the CreateComputeEnvironment or UpdateComputeEnvironment API. AWS Batch creates one access entry per cluster and associates the AWSBatchClusterPolicy. Access entries can be configured via AWS CLI, SDK, or Management Console.

Why it matters

This change affects users who combine AWS Batch with Amazon EKS, making it easier to manage access to EKS clusters for AWS Batch compute environments

AWS advanced Ruby driver wrappers are now generally available for Amazon RDS and Aurora PostgreSQL and MySQL-compatible databases. This advanced database driver shortens RDS blue/green deployments, Aurora global database switches, and database failovers, improving application availability. It supports multiple authentication mechanisms, including AWS Secrets Manager and AWS IAM token-based authentication. Built on community pg and mysql2 drivers, it offers capabilities beyond standard database connections. The wrapper natively integrates with Aurora and RDS databases, monitoring cluster status and quickly connecting to a new writer after an unexpected failure. It seamlessly integrates with ActiveRecord through the provided aws_postgresql and aws_mysql2 adapters, enabling use without application code changes. The driver is provided as an open-source project under the Apache 2.0 license. See the GitHub repository description to get started.

Why it matters

This update is relevant for developers and application builders using Amazon RDS and Aurora PostgreSQL and MySQL-compatible databases. It introduces a new driver that accelerates database failovers and improves application availability.

AWS Continuum for Penetration Testing now integrates continuous penetration testing directly into existing CI/CD systems for on-deploy security checks. Developers often release code daily, but on-demand pen tests usually sit outside deployment workflows. This integration closes the gap, delivering pipeline feedback with severity, affected endpoints, and remediation guidance. Non-security changes proceed without delay, and after remediation, the pipeline auto-retests to verify fixes-no manual re-triggering needed. No security expertise is required; simply paste the auto-generated pipeline snippet into your existing setup and complete setup in under five minutes. Application context bootsraps automatically on first run, so no full pen test is required upfront. Continuous penetration testing is available today; see documentation for details.

Why it matters

Useful for development teams wanting to automate and streamline security testing during code deployment

AWS IAM Identity Center is a service that enables employees to access AWS accounts and applications via single sign-on. It now supports network access control for the Identity Store, allowing restrictions on Identity Store API and SCIM API access based on the originating network. Custom applications and user provisioning workflows can manage and search users and groups using the Identity Store API, while external identity providers synchronize users and groups using the SCIM API. For the Identity Store API, you can require requests only from allowed VPC endpoints or specific source VPCs in an account or organization; both APIs can be restricted to specific IP ranges. Different limits can be applied to each API within the same settings-for example, requiring Identity Store API requests only from VPC endpoints while allowing SCIM requests from external identity provider public IP ranges. Network access control is optional and disabled by default. Requests made by AWS services on your behalf are exempt. This feature can be configured via the Identity Store API using the AWS SDK and AWS CLI, and is available in all AWS regions where IAM Identity Center is offered.

Why it matters

IAM Identity Center manages single sign-on for employees to AWS accounts and applications. This update enhances security by allowing access only from permitted networks.

Regions: Same as AWS IAM Identity Center

We are now generally available Amazon Nova 2.5 Sonic, the latest speech recognition model for natural real-time speech agents, improving inference, instruction understanding, and tool call accuracy while reducing latency. This enables developers to build more advanced speech agents that can perform tasks like order confirmation and return initiation within conversations. Built on existing features such as robust speech understanding, expressive voice in seven languages, controllable turn-taking, mixed speech and text sessions, asynchronous tool calls, and a 256K context window, Nova 2.5 Sonic can be combined with Strands Bidi Agents to build production-ready speech agents in just a few lines of code. It is available on Amazon Bedrock in US East (N. Virginia), US West (Oregon), Europe (Stockholm), and Asia Pacific (Tokyo) regions at the same price as Nova 2 Sonic.

Why it matters

This update is relevant for developers building voice agents for customer service, personal AI assistants, and real-time conversational applications.

AWS Private CA provides detailed certificate issuance logs, recording full certificate contents, issuing CA information, requester IDs, and signing status for each issuance. These events aid compliance audits, certificate inventory, algorithm transition tracking, and issuance failure monitoring. Unlike legacy IssueCertificate API CloudTrail management events, which only provided a certificate ARN upon successful API calls, the new IssueCertificateDetails event captures all X.509 fields and extensions of the certificate to be signed (TBS), along with convenience fields for subject, issuer, serial number, validity, template, and signing algorithm. It logs both successful and failed issuance events, including pre-signing failures like name constraint violations, with failure descriptions. Each event identifies the requester-either the account and IAM principal for direct API calls, or the service principal for certificates issued via AWS Private CA connectors or integrated AWS services. In cross-account setups, events are delivered to the CA owner account. This event is automatically delivered as a CloudTrail management event with no configuration or opt-in required and no additional cost beyond standard AWS CloudTrail charges. CloudTrail can then process these events in real time via Amazon EventBridge or run batch queries with Amazon Athena for certificate auditing, inventory, tracking, and monitoring. This feature is available in all AWS regions where AWS Private CA is offered.

Why it matters

AWS Private CA is a service for managing private certificates. This update enables more detailed tracking of certificate issuance, improving compliance and security management.

Amazon Elastic Container Service (Amazon ECS) now natively supports blue/green, linear, and canary deployment strategies using Amazon VPC Lattice. Applications communicating between services across VPCs or AWS accounts can manage and migrate traffic during updates. This allows customers to control traffic during deployment, choosing to shift all traffic at once with blue/green, in equal increments with linear, or starting with a small percentage using canary. Teams can validate new versions with test traffic and run custom verification steps or manual approvals via deployment lifecycle hooks, including Lambda and pause hooks. These services can automatically roll back deployments upon issues using Amazon CloudWatch alarms or Amazon ECS deployment circuit breakers, with the option for immediate rollback to the previous version during bake time.

Why it matters

This update is useful for users developing applications that communicate across VPCs and AWS accounts. Users of Amazon ECS and Amazon VPC Lattice can control deployment strategies to improve the reliability and safety of releases.

AWS Brazil provides an automated workflow through the AWS Brazil 2P Distribution Program, enabling non-Brazilian independent software vendors (ISVs) to distribute SaaS product licenses in Brazil. Eligible ISVs grant Brazil distribution rights for their SaaS product licenses to AWS Brazil via AWS Partner Central or public APIs. AWS Brazil acts as the record seller, creating private offers for Brazil customers, setting customer prices, automatically generating invoices with tax calculations, and allocating payments. ISVs can track transactions and payment status via the Seller Insights dashboard. Brazil purchasers receive private offers in USD from AWS Brazil and are invoiced in BRL, with payment options including credit cards (Visa, Mastercard, American Express) or Pay by Invoice (PBI). Purchase order numbers can be added, and invoices accessed via the AWS Billing Console.

Why it matters

This update impacts non-Brazilian software vendors targeting the Brazilian market and companies looking to offer SaaS products to Brazilian customers. By acting as the seller of record, AWS Brazil automates local currency invoicing and tax calculations, simplifying the sales process.

Kubernetes version 1.37 introduces new features including general availability of the Metrics API and Dynamic Resource Allocation device plugins and relationships, and beta support for Horizontal Pod Autoscaler scale-to-zero. AWS now enables Kubernetes version 1.37 for Amazon EKS and Amazon EKS Distro. From today, you can create new EKS clusters or upgrade existing clusters to version 1.37 using the EKS console, eksctl command line interface, or infrastructure-as-code tools. EKS supports Kubernetes version 1.37 in all available AWS regions, including AWS GovCloud (US). For details on available Kubernetes versions in EKS and instructions to update clusters to version 1.37, see EKS documentation. Use EKS cluster insights to check for any issues affecting Kubernetes cluster upgrades. Builds of EKS Distro Kubernetes version 1.37 are available in the ECR public gallery and GitHub. For details on the EKS version lifecycle policy, see the documentation.

Why it matters

Amazon EKS is a service for managing Kubernetes clusters on AWS. This update enables support for Kubernetes version 1.37, allowing cluster upgrades and access to new features.

Amazon Aurora DSQL now allows indexing specific subsets of a table, storing only relevant rows to improve query performance and reduce index storage costs. By adding a WHERE clause to CREATE INDEX, you can index only the working set, keeping the index small as the table grows and reducing data reads for relevant queries. Aurora DSQL uses partial indexes for queries whose filters match the index condition, available in all AWS regions where Aurora DSQL is offered. For details, see CREATE INDEX in the Aurora DSQL user guide.

Why it matters

This update benefits database administrators and developers seeking to optimize query performance and reduce storage costs

Today, AWS Health introduced the version catalog to centralize software version lifecycle information across all AWS services. Available via the AWS Health dashboard, customers using Business Support Plus, Enterprise Support, or Unified Operations can integrate lifecycle data into operational workflows through the AWS Health API. The version catalog enables customers to shift from reactive to proactive management, helping control upgrade and end-of-support risks. Initially targeting services such as Amazon RDS, Amazon EKS, and AWS Lambda, it will expand to more services over time. The catalog is available in all AWS commercial regions; for details, see the version catalog in the AWS Health dashboard or read the documentation.

Why it matters

AWS Health emphasizes the importance of version management for maintaining security and operational posture of applications running on AWS. This version catalog helps customers build upgrade schedules and governance controls, enabling them to move to newer supported versions before receiving account-specific planned lifecycle events.

Amazon OpenSearch Service now offers a validation advisory for domain configuration changes, enabling informed decisions even for risky modifications. Each validation is classified as either critical or warning; critical changes are blocked, while warnings require confirmation before proceeding. Previously, results were only pass or block, with no way to flag risky changes. The validation advisory helps identify potential issues without blocking deployment, such as undersized dedicated master nodes or exceeding recommended cluster shard limits. Warnings can be checked when submitting changes, via dry-run results, AWS CloudFormation templates, API responses, or Amazon EventBridge notifications. This feature is supported for all Amazon OpenSearch Service domains running OpenSearch or Elasticsearch, and is available in every AWS region where the service is offered.

Why it matters

Amazon OpenSearch Service is a managed service for search and analytics. This update helps users better understand risks in configuration changes and deploy more safely.

Today, AWS announced expanded visualizations for Amazon Q Developer within the AWS Management Console. Amazon Q answers across hundreds of AWS APIs, providing full account-wide responses for all regions and services. Beyond previously introduced resource tables and cost charts, Amazon Q now renders a health dashboard with status indicators, time-series charts with trends and anomaly detection, troubleshooting diagnostics, and resource detail views. It now orchestrates calls across multiple services to gather health data and render dashboards with status indicators, giving customers a complete picture at a glance. Queries like "graph my EC2 instance network usage for the past 12 hours" now generate interactive time-series charts with trend lines and anomaly highlights, enabling quick issue identification and response. These responses are also significantly faster, delivering complete answers in seconds instead of requiring multi-step text replies. To use Amazon Q Developer in the AWS Management Console, sign in and click the Q icon in the top-left corner. The enhanced visualization features are available in all AWS regions where Amazon Q Developer is offered. For more information, see the Amazon Q Developer documentation.

Why it matters

Amazon Q Developer is an AI-powered tool that enhances developer support within the AWS Management Console, making AWS resource management and monitoring more intuitive and efficient

AWS has introduced AWS Well-Architected Agent, an AI-powered service evolving from AWS Trusted Advisor and AWS Well-Architected Tool. The agent analyzes AWS infrastructure for cost, security, performance, and reliability, prioritizing recommendations aligned with business goals. It automatically compares key metrics and application topologies against Well-Architected best practices, examining Terraform, CDK, and CloudFormation templates to suggest automatable fixes. Teams can define business objectives and receive prioritized recommendations at resource, application, and architecture levels. For example, reliability-focused teams may receive suggestions to add multi-AZ failover to critical databases, automating configuration changes via SSM runbooks while previewing impacts on cost and performance. Recommendations, where appropriate, include SSM runbooks, CLI scripts, or console-guided walkthroughs to accelerate implementation. The agent also automatically reviews IaC templates, including Terraform, CloudFormation, and CDK, identifying gaps and returning IaC code changes aligned with Well-Architected best practices. Access to AWS Well-Architected Agent and its recommendations is available in US East (N. Virginia), US East (Ohio), and US West (Oregon), provided by AWS Support for AWS customers with a support plan.

Why it matters

AWS Well-Architected Agent is an AI-powered service that analyzes and optimizes AWS infrastructure across cost, security, performance, and reliability, helping teams align their cloud environment with business goals through automated recommendations.

Amazon ElastiCache for Valkey now publishes OpenTelemetry metrics to Amazon CloudWatch for node-based clusters. These metrics include properties filterable and aggregatable with PromQL. ElastiCache offers standard and detailed monitoring modes. Standard monitoring, existing functionality, publishes CloudWatch metrics (classic) and a basic set of OpenTelemetry metrics every 60 seconds at no extra cost. Detailed monitoring is a new mode allowing selection of a full set of OpenTelemetry metrics published every 15 seconds. OpenTelemetry metrics enable detection of nodes approaching connection limits, classification of errors by type during incidents, and prediction of memory exhaustion. These queries can be run in CloudWatch and Grafana, leveraging existing PromQL skills. Detailed monitoring allows detection of short-term events like latency spikes with 15-second metrics, balancing diagnostic depth and cost. The basic set of OpenTelemetry metrics also powers ElastiCache Insights, a pre-built CloudWatch dashboard. To enable detailed monitoring, open the Metrics tab for a cluster in the Amazon ElastiCache console, select 'Detailed', and configure detailed metrics. OpenTelemetry metrics and detailed monitoring are available for node-based Valkey clusters in all AWS regions where CloudWatch supports OpenTelemetry metrics. There is no additional charge for detailed monitoring from ElastiCache; charges apply to selected detailed monitoring metrics, created alarms, and executed PromQL API queries under CloudWatch's OpenTelemetry metrics pricing.

Why it matters

Amazon ElastiCache is a managed caching service supporting Valkey implementations. This update enhances performance monitoring and issue diagnosis with OpenTelemetry metrics and detailed monitoring.

Amazon DynamoDB now supports filtered exports for tables, allowing you to export table data to Amazon S3 either as a full export or incremental export over a time window. Using key condition expressions on key attributes and filter expressions on any attributes, you can select items to export and choose which attributes to include with projection expressions, creating datasets containing only the data needed for your case. This subset data enables detailed data recovery, moving data slices between accounts, and performing analysis while meeting compliance rules. Filtered exports are available for both full and incremental exports in all AWS regions except AWS GovCloud (US).

Why it matters

Useful for developers and data engineers who need to export DynamoDB table data for analytics or offline use

Amazon Redshift now supports querying Amazon S3 data lake tables in different AWS regions without copying or replicating data, enabling global analytics and cross-region report consolidation. It also allows residency-compliant queries where data must remain in a specific region. Standard data transfer fees apply for cross-region queries. Using extended VPC routing ensures all data movement between Amazon S3 and Amazon Redshift stays within the VPC, bypassing the public network. This capability helps regulated industries like financial services, healthcare, and government meet compliance requirements for querying data lakes within defined network boundaries. Both features operate on the unified data lake query engine available in all regions where RA provisioned and serverless clusters are offered.

Why it matters

This update benefits enterprises with globally distributed data and security-sensitive customers who need tight control over how their data travels.

Today, AWS announced that Amazon GuardDuty Runtime Monitoring is now included with AWS Security Hub Threat Analytics plan. Runtime Monitoring inspects operating system, network, and file activity on Amazon EC2 instances, Amazon EKS clusters, and Amazon ECS tasks running on AWS Fargate, detecting threats such as container escape, privilege escalation, and crypto mining. Security Hub now bills this coverage at a simplified rate. For accounts and regions with Security Hub enabled, separate charges for GuardDuty Runtime Monitoring no longer apply, and its usage appears under AWS Security Hub. Detection coverage, finding types, and the GuardDuty security agent remain unchanged and require no reconfiguration. The free trial for the Threat Analytics plan is separate from the Security Hub Essentials plan free trial, and this change does not add a new free trial for Runtime Monitoring. Users can verify the billing impact of this change in AWS Cost Explorer or on the Security Hub usage page.

Why it matters

This change affects users of AWS security services, particularly those using both Security Hub and GuardDuty, simplifying billing and management through a streamlined pricing model.

Amazon Bedrock AgentCore Gateway now supports TLS certificates signed by private CAs for MCP, OpenAPI, and HTTP proxy targets, enabling secure connections to gateways using certificates issued by your own private CA. It establishes native connections to private endpoints within a VPC without using an Application Load Balancer, and allows registering private CA certificates for gateway targets running on Amazon VPC Lattice. The gateway retrieves PEM-encoded CA certificates from Amazon S3 or AWS Secrets Manager for use as trust anchors in outbound TLS connections. This private CA support is available for MCP server, OpenAPI, and HTTP proxy (pass-through) targets in all regions where both AgentCore Gateway and Amazon VPC Lattice are offered. For more information, see the AgentCore developer guide.

Why it matters

This update is important for developers and security professionals who need to securely connect to private endpoints within their VPC.

The AWS MCP server, part of the Agent Toolkit for AWS, is a managed model context protocol server that lets AI coding agents access AWS APIs through a single interface. This enables agents to discover and call AWS services without maintaining per-service integrations. Customers in these regions can run the AWS MCP server closer to them to reduce developer latency and keep request data resident, meeting data residency requirements. The AWS MCP server is accessible in all commercial AWS regions and currently runs in US East (N. Virginia), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Frankfurt), Europe (Ireland), and Europe (London). To get started, see the resources for getting started with the AWS MCP server, AWS MCP server endpoints, and quotas.

Why it matters

The AWS MCP Server is a managed protocol server that enables AI coding agents to efficiently access AWS services. This update allows development teams to manage resources closer to their location, improving development workflows.

Amazon GuardDuty now supports declarative policies in AWS Organizations, enabling centralized threat detection across all accounts and regions in an organization. Organization policies let you apply centralized GuardDuty activation settings that automatically apply to existing accounts and new accounts as they join. This eliminates the need to configure GuardDuty activation individually per region in large multi-account, multi-region environments, ensuring settings remain consistent over time. You can define activation criteria for the entire organization from a delegated administrator account, at the organization root, OU, or individual account level. Policies apply default settings in all available GuardDuty regions and support region-specific overrides, but cannot be overridden via the GuardDuty console or API. Support for GuardDuty declarative policies is available in all AWS commercial regions and AWS GovCloud (US). Ensure the delegated administrator has permissions to manage GuardDuty policies, then sign in to the GuardDuty console and select Organization policies, or create policies programmatically using the AWS Organizations API.

Why it matters

This update is useful for organizations managing multiple AWS accounts and Regions, as it allows for centralized and consistent threat detection configuration.

Amazon Elastic Kubernetes Service (EKS) Auto Mode now allows direct tuning of kubelet settings, Linux kernel sysctls, and hugepages via the NodeClass Kubernetes resource. Users can configure user namespaces for rootless container builds, adjust recovery thresholds and container log rotation to prevent disk or memory pressure, increase network and ARP cache limits for large clusters, and pre-allocate 2Mi or 1Gi hugepages for HPC, database, and latency-sensitive workloads. These settings are applied declaratively using the Kubernetes API. EKS Auto Mode validates and enforces configurations at node launch and maintains them through scaling and upgrade events, managing the underlying infrastructure while delivering required workload tuning. Maintenance of EC2 launch templates, custom AMIs, and privileged DaemonSets is unnecessary. Advanced compute configurations for Amazon EKS Auto Mode are available in all supported AWS regions.

Why it matters

Amazon EKS Auto Mode automates node provisioning, scaling, patching, and upgrades for Amazon EKS. This update enables advanced node tuning, allowing workloads with specific requirements such as CI/CD pipelines and HPC to run effectively.

AWS Secrets Manager now integrates with the AWS recommended actions framework, showing customized recommendations in the console to improve secret security. These suggestions allow you to apply best practices without leaving the console, such as configuring secret rotation or using customer-managed keys for encryption. The feature is available in all AWS commercial regions at no additional cost. To get started, access the AWS Secrets Manager console.

Why it matters

AWS Secrets Manager is a service for managing secrets. This update allows users to view security improvement recommendations directly in the console.

Today, Amazon Quick added support for applications to use live data directly from datasets, ensuring KPIs, charts, tables, and insights are always up to date. These applications facilitate data-driven workflows, including handling requests, approvals, and triggering next steps. Users see only data allowed by their Quick permissions, applying existing row and column-level security. To build an application, specify the dataset name and describe desired features to the application builder's chat agent, enriching portals like request and approval teams. This feature is available in all supported Quick regions. For validation, see the blog post, and for details, refer to the Quick user guide on connecting to datasets.

Why it matters

This update is useful for business users who want to automate data-driven business operations and developers who want to integrate data analytics into applications.

AWS Continuum for Penetration Testing is a managed security service enabling penetration testing for web applications and APIs. It now expands to six regions: Asia Pacific (Seoul), Canada (Montreal), Europe (London), US East (Columbus), Europe (Paris), and Europe (Stockholm). This allows organizations to maintain robust security testing while meeting data residency requirements. Security and compliance teams can use the service for critical use cases such as vulnerability assessments, compliance validation for frameworks like PCI DSS and ISO 27001, and ongoing security post-assessments.

Why it matters

AWS Continuum for Penetration Testing is a managed security service that enables penetration testing against web applications and APIs. This regional expansion allows geographically dispersed organizations to meet data residency requirements while conducting security testing.

Starting today, Aurora PostgreSQL allows querying data stored in Apache Iceberg and Parquet formats in data lakes directly using existing PostgreSQL applications or tools, eliminating the need for ETL pipelines or data duplication. You can create PostgreSQL external tables that reference Iceberg or Parquet data stored in Amazon S3, Amazon S3 Tables, or the AWS Glue Data Catalog. When querying these external tables, Aurora uses the high-performance DuckDB query engine embedded in PostgreSQL to run queries against the underlying Iceberg and Parquet data. Existing applications and BI tools continue to use the same PostgreSQL interface. External Iceberg REST Catalog (IRC) compatible catalogs can be federated through AWS Glue Data Catalog for query access without data movement or duplication. For latency-sensitive workloads, standard SQL statements can materialize Iceberg or Parquet data into native Aurora PostgreSQL tables, removing the need for ETL pipelines. This feature is generally available in Aurora PostgreSQL versions 17.11 and later, 18.6 and above, across all AWS commercial and GovCloud (US) regions at no additional cost. To get started, use the Amazon RDS console or any PostgreSQL client. For more details, see the blog post or documentation.

Why it matters

This update is useful for application developers and data engineers who need to access data from data lakes. It eliminates the need for data copying or ETL pipelines from data lakes to Aurora, reducing costs and engineering effort.

Amazon Bedrock now supports in-region inference for Anthropic's Claude Opus 5.5 and Claude Sonnet 5 models in the London region, allowing UK customers, including those in finance, healthcare, and the public sector, to use these models at scale while keeping inference within the country. Amazon Bedrock processes inference requests and data only within the called region. For the latest model availability in each region, see the Amazon Bedrock User Guide under 'Model availability by region'. Access the Amazon Bedrock console to use Claude models with Amazon Bedrock.

Why it matters

Amazon Bedrock is a service for invoking AI models, providing a variety of AI models on a cloud computing platform. This update helps customers in the UK meet data privacy and compliance requirements by enabling in-country data processing.

AWS Parallel Computing Service (AWS PCS) now supports scaling logs that record compute node group scaling activities. Each log entry captures a single node state transition, such as instance launch, node registration, scale-down, or launch failures with reasons. These logs simplify troubleshooting scaling issues, allowing users to verify why a group didn't reach its target size, which instances failed due to capacity, and when specific nodes started or stopped. Scaling log delivery is opt-in, configurable via AWS PCS to output logs to Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose, and available in all AWS regions where AWS PCS is offered.

Why it matters

AWS Parallel Computing Service is a managed service that simplifies running and scaling HPC workloads on AWS using Slurm; this new scaling log feature makes it easier to monitor and troubleshoot cluster scaling behavior.

AWS now offers system-managed write protection for Apache Iceberg materialized views. Previously, results could be altered by users with write access. With system-managed views, AWS Glue permits only Glue to write view data and definitions, ensuring results stay accurately calculated. To get started, define the materialized view SQL and optionally set a refresh schedule. AWS Glue computes results, stores them as standard Apache Iceberg tables in Amazon S3 Tables, and keeps them up to date on schedule. The results appear as regular Iceberg tables in the AWS Glue Data Catalog, readable directly by Iceberg-compatible engines, with AWS guaranteeing no changes from other writers. This provides a managed, always-consistent dataset for secure sharing. You can refresh, reschedule, or drop views as needed. System-managed Apache Iceberg materialized views are available in all regions where Apache Iceberg materialized views are supported. For details, see System-managed materialized views in the AWS Glue Developer Guide.

Why it matters

Apache Iceberg is used for data management and query optimization in large data lakes. System-managed write protection for materialized views ensures result consistency while enabling safe sharing.

Amazon WorkSpaces Core Managed Instances now support Graphics G7 instances with NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs and Intel Xeon 6 processors. Compared to G6 instances, G7 delivers up to 2.1x higher performance for graphics-intensive workloads, enabling professional applications such as CAD/CAM, 3D rendering, scientific visualization, video editing, and AI-assisted design workflows at higher fidelity and frame rates. G7 instances feature 32 GB of GDDR7 memory per GPU and 2.67x faster memory bandwidth, supporting larger and more complex 3D scenes and models. Six instance sizes with 1 to 8 GPUs are available, offering 8 to 192 vCPUs and 32 GB to 768 GB of system memory, supporting both Linux and Windows with bring-your-own-license options. Graphics G7 instances are available in US East (N. Virginia), US East (Ohio), US West (Oregon), and Europe (Spain), with additional AWS regions to be added as availability expands.

Why it matters

Amazon WorkSpaces Core Managed Instances provides remote desktop environments, and the addition of new instance types for graphics-intensive workloads impacts users of advanced visual workflows

Amazon S3 Tables has increased the table bucket limit per AWS account and region from 10 to 100, allowing up to one million tables per region. This higher quota applies to all accounts by default at no extra cost, enabling separate bucket settings for each dataset, workload, or team. As the first cloud object store with built-in Apache Iceberg support, S3 Tables simplifies large table storage and performs ongoing maintenance to automatically optimize query efficiency and storage costs as data lakes grow. The increased default quota is available in all AWS regions where S3 Tables is offered, with additional increases requestable via AWS Support. For more information, see the S3 Tables overview, user guide, and quota documentation.

Why it matters

Amazon S3 Tables is a cloud object store for tabular data with built-in Apache Iceberg support. This update allows users to create more table buckets, improving data management and security.

IAM Identity Center streamlines access management for employee identities across AWS accounts and applications by connecting once to AWS. Multi-Region support was previously available only in default commercial AWS Regions, but is now extended to AWS GovCloud (US) and AWS China Regions. When enabled, IAM Identity Center automatically replicates identities, entitlements, and other data from the primary Region to additional Regions. This ensures users can continue accessing AWS accounts with already provisioned entitlements if the primary Region fails. Application administrators can deploy applications to additional Regions using standard workflows while IAM Identity Center remains managed in the primary Region. Multi-Region support is available for organization instances using either an external identity provider or IAM Identity Center directories as identity sources, requiring multi-Region customer-managed KMS keys (CMKs). New instances can enable multi-Region support in one click, which also creates a CMK. For existing instances, you must create a multi-Region CMK in AWS KMS and configure it in IAM Identity Center. Standard AWS KMS charges apply for CMK storage and usage, while IAM Identity Center is provided at no additional cost.

Why it matters

IAM Identity Center integrates employee identities into AWS and simplifies access management. This update enhances resilience and deployment flexibility, particularly for users in government and China markets.

Amazon EMR Serverless now raises the per-job shuffle limit from 200 GB to 1 TB, supporting terabyte-scale shuffle operations. This allows data engineers and scientists to run open-source big data analytics frameworks without configuring, managing, or scaling clusters or servers, benefiting enterprise customers performing complex shuffle-requiring operations like large-scale table joins across terabyte datasets and complex aggregations on high-cardinality data. Added spill support offloads memory-intensive operations to disk, improving job reliability and success rates for demanding analytics workloads. The feature is available in Amazon emr-7.14 and emr-spark-8.1 or later, across the 18 AWS regions where Amazon EMR Serverless is offered.

Why it matters

This update impacts data engineers and data scientists running big data analytics frameworks in production, especially those needing to process terabyte-scale datasets.

AWS Glue Data Catalog now supports table optimization, statistics, and crawlers for Apache Iceberg version 3 tables, enabling automatic management, query performance optimization, and discovery in Amazon S3. Optimization uses binpack, sort, and z-order strategies to compress V3 tables, improve query performance, and reduce storage costs by removing expired snapshots and orphaned files. These optimizations support V3 data types like variant, geospatial, and nanosecond-precision timestamps, and can generate NDV statistics for efficient query planning by analytics engines. Glue crawlers can detect V3 tables stored in Amazon S3 and register them in the Glue Data Catalog for querying with V3-enabled engines. These features are available in all AWS regions where Glue Data Catalog table optimization, statistics, and crawlers are provided.

Why it matters

Data engineers and data analysts can use this feature when they need to efficiently manage and optimize the performance of Apache Iceberg V3 tables

AWS Transfer Family now lets you select a custom CloudWatch log group for managed workflow execution logs. Previously, all workflows on a server sent logs to its CloudWatch log group. You can now choose a separate workflow-level log group when creating workflows via the AWS Transfer Family console or API. Transfer Family delivers workflow logs only to the selected group, removing the need for the server's logging role. Logs retain their existing structured JSON format and can be queried with Amazon CloudWatch Logs Insights. You can also send logs from multiple workflows to a shared log group to build consolidated metrics and dashboards. If you don't select a structured log destination, workflow logs continue to use the server's role-based logging configuration if set. Existing workflows retain their current logging setup. This feature is available in all AWS regions where Transfer Family managed workflows are offered.

Why it matters

AWS Transfer Family provides file transfer services. The managed workflow feature automates file transfer processes. This update offers greater flexibility in managing workflow logs.

Aws security hub provides remediation plans that group related vulnerability findings by root cause, allowing users to resolve or mitigate multiple vulnerabilities at once by fixing a single underlying resource, such as misconfigurations or overly permissive policies. Each plan includes a priority level (critical, high, medium, low), impact assessment, and detailed step-by-step instructions in multiple formats, including aws cli, terraform, cloudformation, python, and cdk. Security hub automatically prioritizes plans that reduce risk the most, enabling focus on critical remediation activities. Ai agents can programmatically consume remediation plans via api to automate security fixes across the entire environment. Remediation plans are available in all aws regions where aws security hub is offered, at no additional cost under the aws security hub essentials plan.

Why it matters

Security teams can now efficiently improve security by fixing root causes rather than addressing each vulnerability individually.

Variable retention and event hold for Amazon S3 Object Lock are now available in the AWS GovCloud (US-East) and AWS GovCloud (US-West) regions. Event hold sets a retention period on objects, with S3 protecting them while the hold is active. Releasing the hold retains the object for the specified duration. Unlike legal hold, event hold provides WORM compliance for the required retention period after a trigger event, without needing to keep data longer than policy dictates.

Why it matters

Available in AWS GovCloud (US) regions, this feature is useful for organizations needing event-based retention periods to meet financial regulations and compliance requirements.

On September 30, 2026, Amazon released a patch update for Amazon Corretto LTS version Corretto 8u504, including tzdata 2026d. Amazon Corretto is a free, production-ready OpenJDK distribution for multiple platforms. Downloads for Corretto 27, 25, 21, 17, 11, and 8 are available on the Corretto website, with updates accessible via Apt, Yum, and Apk repositories on Linux systems. Feedback is welcome.

Why it matters

Amazon Corretto provides a no-cost, multi-platform distribution of OpenJDK for developers and enterprises. This update includes critical time zone data updates, ensuring stability in production environments.

AWS CloudTrail introduces Event Coverage, a new console experience that verifies data event logging across account and organization levels. It helps users confirm if data events-like Amazon S3 GetObject and PutObject-are enabled for AWS services and resource types, allowing detection of unauthorized data access or leaks. Insufficient data event coverage can create blind spots in security monitoring. Event Coverage displays all supported data event sources in one place and enables direct subscription from the dashboard, simplifying gap closure especially for organizations managing multiple accounts. The feature is available in all commercial AWS regions supported by CloudTrail.

Why it matters

This update is important for organizations and security teams that need to enhance security monitoring of AWS data plane operations. It allows for efficient identification of gaps in data event logging.

Amazon RDS for MySQL now offers MySQL 26.7 in preview, the first version with a new year-month format. It includes bug fixes, security patches, and new features like the Change Stream Applier for improved throughput and backlog recovery in test workloads. Preview database instances last up to 60 days before automatic deletion, and snapshots created in preview are only usable within the preview environment. Pricing aligns with the US East (Ohio) region rates.

Why it matters

For developers and database administrators evaluating new MySQL versions in a preview environment.

Amazon RDS now supports M8a database instances with 5th-gen AMD EPYC processors for PostgreSQL, MySQL, and MariaDB, expanding database workload options. Each M8a vCPU maps to a physical core, ensuring consistent per-core performance. These instances deliver up to 75 Gbps network bandwidth and 60 Gbps Amazon EBS bandwidth for high I/O workloads. Built on AWS Nitro systems with 6th-gen Nitro cards, M8a instances are available in US East (N. Virginia, Ohio), US West (Oregon), Asia Pacific (Mumbai, Tokyo, Hyderabad), and Europe (Ireland, Frankfurt, Spain) regions. You can launch M8a instances via the Amazon RDS console or AWS CLI; see RDS documentation for supported engine versions and the Amazon RDS pricing page for pricing details.

Why it matters

Aimed at users prioritizing database performance and scalability

Amazon Aurora and Amazon RDS now support R8a database instances powered by 5th generation AMD EPYC processors, expanding options for database workloads. Each vCPU maps to a physical CPU core, ensuring consistent per-core performance. R8a instances deliver up to 75 Gbps network bandwidth and 60 Gbps Amazon EBS bandwidth for high I/O workloads. Built on the AWS Nitro system with 6th generation Nitro cards, R8a instances are available for Amazon Aurora PostgreSQL and MySQL compatible editions, and RDS for PostgreSQL, MySQL, and MariaDB in multiple regions, including US East, US West, Canada, Asia Pacific, and Europe. Launch them via the Amazon RDS management console or AWS CLI; see Aurora and RDS documentation for engine versions and pricing details.

Why it matters

This update impacts users seeking database performance and scalability, especially for workloads with high I/O requirements, by offering a new instance type.

Amazon Aurora serverless now scales up to 256 ACU, adding up to 16 ACU per second, allowing workloads to reach needed capacity faster. When workloads end, it automatically scales down to zero, charging only for resources used. This makes it ideal for bursty applications like agent-based AI with long idle times and unpredictable traffic. The feature is enabled by default for all Aurora serverless clusters running on platform versions 3 or 4, requiring no configuration. Existing clusters on platform versions 1 and 2 can upgrade directly to version 4 to use this improvement. Check cluster platform versions in the AWS Management Console instance configuration section or the RDS API's ServerlessV2PlatformVersion parameter. For pricing details and regional availability, see the Amazon Aurora pricing page. For more information, refer to Aurora serverless scaling documentation and create an Aurora serverless database in just a few steps using the AWS Management Console.

Why it matters

Amazon Aurora serverless is a service that enables automatic database scaling, making it ideal for bursty workloads and agentic AI applications

AWS today announced GPT-6 Astra on Amazon Bedrock in UltraFast mode, offering up to 6x faster API inference and 300 tokens per second for latency-sensitive workloads. This premium tier delivers the performance, security, and reliability needed for production environments, enabling real-time coding assistants, interactive agents, and high-quality customer experiences, all manageable through existing AWS controls via the Amazon Bedrock console or supported APIs. For details on supported regions, endpoints, APIs, features, inference profiles, and pricing, see Amazon Bedrock documentation.

Why it matters

This update impacts developers building latency-sensitive applications and organizations deploying AI models in production, offering faster inference speeds combined with existing AWS security features for high-quality user experiences.

Amazon Managed Grafana now supports creating new workspaces with Grafana version 13.2. This release includes features from open-source Grafana versions 13.0 to 13.2, such as dashboard Git Sync, dynamic dashboards, and PromQL query support in the Amazon CloudWatch data source plugin. Git Sync lets you link workspaces to Git repositories to version, review, and restore dashboard changes. Dynamic dashboards offer flexible layout and panel adjustments based on data or variables. The Amazon CloudWatch data source plugin enables querying metrics collected by CloudWatch via OpenTelemetry (OTLP) endpoints using the Prometheus query language (PromQL), complementing existing metric search and metric insights query types. Grafana 13.2 is available in all AWS regions where Amazon Managed Grafana is generally available.

Why it matters

Amazon Managed Grafana is a managed service that simplifies the setup and operation of Grafana workspaces. Access to newer Grafana versions enables easier dashboard management and metric querying

Amazon S3 Vectors supports metadata pre-filtering, evaluating metadata filters before similarity searches, which can increase matching vectors by up to five times for selective filters. This improves filtering completeness for RAG, agent-based, and semantic search applications. S3 Vectors natively stores and queries vectors on Amazon S3, offering purpose-built, cost-optimized vector storage and queries at petabyte scale. New vector bucket indexes use metadata pre-filtering by default, with no changes to writing vectors using PutVectors or running filtered queries using QueryVectors. To enable pre-filtering on existing indexes, update the index using the UpdateIndexMode API. QueryVectors provides per-query parameters to compare current and pre-filtering on the same index. Metadata pre-filtering is available at no extra cost in all commercial AWS regions and AWS China regions. The feature is currently being rolled out and will complete within days. You can get started using the AWS CLI, AWS SDK, or Amazon S3 console. For more information, see the Amazon S3 Vectors documentation and the AWS News Blog.

Why it matters

Amazon S3 Vectors provides native support for storing and querying vectors in Amazon S3, useful for RAG, agentic, and semantic-search applications. The addition of metadata pre-filtering improves the precision and efficiency of filtering operations.

Today, AWS expanded the Agent Toolkit for AWS commands in the AWS CLI, adding two new features. Customers can now run aws agent-toolkit check-skill-updates to compare installed skills against the latest versions available in the registry, and aws agent-toolkit update-skill --all to update all outdated skills with a single command. The Agent Toolkit for AWS includes the AWS MCP server (providing a secure, auditable agent interface to over 15,000 AWS APIs), agent skills (expert guidance on storage, networking, analytics and more), and plugins (bundling the MCP server and skillset into one installation). These CLI additions allow developers to quickly identify and update all available skills without managing them individually, which is especially useful for teams using many skills across serverless, storage, networking, analytics and other domains. The new commands extend existing AWS CLI capabilities for installing, searching and configuring the AWS MCP server and agent skills in popular coding agents like Kiro, Claude Code, Codex and Cursor. To get started, see the Agent Toolkit for AWS user guide for AWS CLI. Ensure you have AWS CLI version 2.37.0 or later installed. The AWS MCP server is available in the US East (N. Virginia) and Europe (Frankfurt) regions.

Why it matters

This update is useful for developers and teams who want to ensure their AWS coding agents operate with the latest guidance.