この日は生成 AI とデータ分析、開発者向け機能が幅広く更新されました。AWS Weekly Roundup では AWS Transform の 1 周年、Claude Platform on AWS、EC2 M3 Ultra Mac インスタンスなどが振り返られています。機械学習では Amazon Bedrock AgentCore のカスタムコード評価機能、Amazon Nova 2 によるコンテンツモデレーション、Amazon Quick と Confluence 連携が紹介されました。日本語ブログでは AWS Security Agent のフルリポジトリコードスキャンのプレビュー、Aurora DSQL の CDC 入門を解説。What's New では SAM CLI の CloudFormation Language Extensions 対応、SageMaker Studio の GPU 予約、Amazon EVS の 32 ホスト対応、Redshift の Iceberg ALTER TABLE 対応などが発表されました。セキュリティ速報では redshift-python-driver の RCE 脆弱性 CVE-2026-8838 が告知されました。
生成 AI: Bedrock AgentCore カスタム評価、Nova 2 コンテンツモデレーション
GPU/ML: SageMaker Studio の GPU 予約、ML 向け Capacity Blocks 共有
開発: SAM CLI の CloudFormation Language Extensions 対応
データ: Redshift の Iceberg ALTER TABLE、Aurora DSQL CDC
セキュリティ: Security Agent コードスキャン、CVE-2026-8838 (RCE)
Amazon SageMaker Studio IDEs, including JupyterLab and Code Editor, now support GPU capacity reservations through SageMaker Flexible Training Plans (FTP), giving you predictable access to high-demand, high-performance computational resources within your budget. By leveraging FTP, you can achieve up to 65% cost savings compared to On-Demand instances while running ML workflows in JupyterLab or Code Editor.
FTP provides a fully self-serve procurement experience. To get started, navigate to the SageMaker FTP console and select your preferred instance type, reservation length, and start date for your Studio IDE workload. Review your order, complete the purchase, and wait for the plan to become active. When creating a Studio app from the SageMaker Studio UI, select your purchased plan from the Instance dropdown. SageMaker provisions the instance automatically with no infrastructure management required on your part. As your plan nears expiration, the IDE proactively notifies you, giving you time to save your work before the reservation ends.
To learn more about using FTP capacity reservation capability with Studio IDEs, see Using Training Plans with Studio IDEs.
To learn about launching JupyterLab and Code Editor applications in SageMaker Studio, see Studio Spaces documentation.
Amazon Elastic Container Service (Amazon ECS) now integrates with Amazon Elastic Block Store (Amazon EBS) volumes in AWS GovCloud Regions. This capability makes it easier for you to deploy storage and data-intensive applications such as ETL jobs, media transcoding, and ML inference workloads using ECS.
To use EBS volumes with your Amazon ECS tasks, simply configure the path you want the EBS volume to be mounted on in your task definition, and pass desired EBS volume attributes (e.g., size, type, IOPS, throughput), AWS Key Management Service (AWS KMS) key, and a snapshot ID (if you want the volume to be initialized from an existing EBS snapshot) in the RunTask, CreateService, or UpdateService API request. When you configure EBS volumes for your Amazon ECS tasks or services, Amazon ECS provisions an equal number of EBS volumes as the number of tasks and mounts one EBS volume to each task. By default, Amazon ECS automatically deletes the attached Amazon EBS volume when a task exits. This integration gives you access to all EBS features including configurable volume types and performance, snapshots, Amazon Data Lifecycle Manager, and encryption for your applications deployed with Amazon ECS.
Amazon ECS support for Amazon EBS volumes is available in the AWS GovCloud Regions for Amazon EC2, AWS Fargate, and ECS Managed Instances. To get started, view our documentation and blog.
Amazon Redshift now supports writing directly to Apache Iceberg tables via the AWS Glue Data Catalog (awsdatacatalog) mount and ALTER TABLE DDL statements to modify the schema, partitioning, and properties of Apache Iceberg tables. With write access through the auto-mounted awsdatacatalog, you can land Redshift transformations in your data lake for any engine to query without creating external schemas—particularly useful for Iceberg tables federated with AWS Lake Formation. Supported ALTER TABLE operations include ADD/DROP/ALTER columns, RENAME COLUMN, SET TABLE PROPERTIES to overwrite the default compression type, and ADD/DROP/REPLACE PARTITION FIELD to adapt partitioning strategies as data volumes grow. Previously, updating the structure of Iceberg tables required deleting the table and its data, adding complexity and latency to data pipelines. Tables modified by Redshift remain compatible with other Iceberg-compatible engines, including Amazon EMR and Amazon Athena, preserving cross-engine interoperability. AWS Lake Formation permissions are supported for Iceberg write operations.
These capabilities are available in all AWS Regions where Amazon Redshift is available. To get started, visit the Referencing Iceberg tables in Amazon Redshift and Altering table definitions sections in the Amazon Redshift Database Developer Guide.
AWS SAM CLI now supports AWS CloudFormation Language Extensions, enabling you to reduce duplication in your infrastructure as code (IaC) templates while retaining the full local development workflow. This accelerates your serverless development by letting you define resources once and iterate locally without waiting for cloud deployments.
Developers frequently need to define multiple similar resources, such as Lambda functions, DynamoDB tables, or SNS topics, from a single template definition. However, developers who use SAM CLI to build, test, and deploy their serverless applications previously could not process templates that use CloudFormation Language Extensions. This required choosing between reducing template duplication and using SAM CLI for local development. Now, SAM CLI processes Language Extensions in memory for local operations while preserving your original template for CloudFormation deployment. You can define your resources once and test them locally across all SAM CLI commands, catching errors like invalid syntax or missing dependencies before deploying. This shortens your iteration cycles and reduces time spent debugging failed deployments in the cloud.
To get started, download or update SAM CLI to the latest version. Add the AWS::LanguageExtensions transform to your SAM template and use Fn::ForEach to generate multiple resources from a single definition. SAM CLI commands including sam build, sam local invoke, sam sync, sam local start-api, and sam validate will automatically expand your loops and process each generated resource. You can invoke expanded functions by name, for example sam local invoke AlphaFunction. SAM CLI also supports Fn::Length, Fn::ToJsonString, Fn::FindInMap with DefaultValue, and conditional DeletionPolicy and UpdateReplacePolicy attributes.
To learn more, visit the SAM CLI developer guide and launch blog post.
Today, we are announcing that Amazon Elastic VMware Service (Amazon EVS) now supports up to 32 ESXi hosts per environment, double the previous limit of 16 hosts.
Amazon EVS gives you flexibility in how you configure VMware Cloud Foundation (VCF) domains and clusters within an environment. You can put all your hosts into a single large cluster, spread them across several smaller clusters, or any combination that fits your needs. With this release, you can now submit a service quota increase to scale up to a total of 32 hosts and reduce the operational overhead of managing multiple environments.
This latest release is available in all regions where Amazon EVS is offered.
For more details on the steps and procedure, visit the Amazon EVS product detail page and user guide.
Amazon Lightsail content delivery network (CDN) distributions now support IPv6-only instances as origins. This feature enables customers to use IPv6-only instances to deliver content through the Lightsail CDN distributions with low latency and high transfer speeds worldwide. With this launch, customers can run their websites and applications on cost-effective IPv6-only instances while seamlessly serving content to all end users, including those on networks that don't yet support IPv6 connectivity.
Previously, only IPv4 and dual-stack instances were supported as origins for Lightsail CDN distributions. With this launch, customers can also use IPv6-only instances as origins for their Lightsail CDN distributions, making applications running on those instances accessible to all end users, regardless of whether end users have IPv6 connectivity. Lightsail CDN distributions support multiple origin types including instances, containers, buckets, and load balancers.
Amazon Lightsail is available in 16 AWS Regions including US East (N. Virginia), US West (Oregon), Europe (Frankfurt), Europe (London), Asia Pacific (Tokyo), and Asia Pacific (Malaysia). To get started, visit the Lightsail console. For pricing and other details, visit the Amazon Lightsail pricing.
AWS Glue zero-ETL integrations are now available in the Asia Pacific (Mumbai) region. With this expansion, customers in the Asia Pacific (Mumbai) region can now use zero-ETL integrations to simplify their data pipelines, reduce data movement latency, and accelerate time-to-insight for analytics and machine learning workloads.
Zero-ETL integrations offer a set of fully managed integrations by AWS that minimizes the need to build ETL data pipelines for common ingestion and replication use cases. You can use zero-ETL to replicate data from sources such as Amazon DynamoDB, Oracle Database@AWS, self-managed databases (Oracle, SQL Server, MySQL or PostgreSQL), and supported SaaS applications including Salesforce, SAP, Zendesk, and Zoho CRM directly into target analytics data stores without writing or maintaining ETL pipelines. It automatically handles schema mapping, change data capture, and incremental data replication, eliminating the need to build and manage complex data pipelines by yourself. This allows your data engineering teams to focus on deriving value from data rather than managing infrastructure, while replicating data in your target data stores in near real-time.
To learn more, visit the AWS Glue documentation.
Today, AWS announces the addition of AWS Local Zones to the Region selector in the AWS Management Console, providing a unified experience across AWS global infrastructure. AWS Local Zones now appear alongside AWS Regions in the Console's top navigation, making it easier for customers to quickly navigate to the Console page for managing their resources in AWS Local Zones.
Now, when customers select the Local Zones tab in the Region selector, they will see all opted-in AWS Local Zones in one place. Clicking on an AWS Local Zone takes customers directly to its parent Region's Console page to view and manage resources. This capability streamlines navigation for customers operating across multiple AWS Local Zones parented to different AWS Regions.
This capability is available across all AWS Local Zones in public AWS Regions. To get started, navigate to the Region selector in the AWS Management Console. For more information, see the AWS Local Zones documentation.
Just a year ago, we launched AWS Transform for .NET, Mainframe and VMware workloads, the first agentic AI service purpose-built for modernizing enterprise applications at scale. At re:Invent 2025, we introduced AWS Transform custom, which enables organizations to modernize and transform code at scale using AWS-managed and custom transformations. You can upgrade language versions, migrate […]
Amazon Aurora DSQL は、パブリックプレビューで Change Data Capture (CDC) を発表しました。これにより、データベースの変更をほぼリアルタイムで Amazon Kinesis Data Streams にストリーミングできます。本記事では、Aurora DSQL CDC の仕組み、ストリーミングパイプラインの構成方法、変更イベントの消費方法を、CDC ストリームと Kinesis ストリームの作成から実際のイベント解析までの手順とともに説明します。
AWS Security Agent の新機能であるフルリポジトリコードレビューのプレビューリリースを発表。コードベース全体に対してコンテキスト認識型のセキュリティ分析を実行し、人間のセキュリティ研究者のように信頼境界やデータフローを推論します。従来の SAST が見逃す不整合や設計レベルの脆弱性を、透明性のある証拠と具体的な修復方法とともに検出します。本記事では仕組みと開発ワークフローへの組み込み方を紹介します。
Bulletin ID: 2026-033-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 05/18/2026 13:45 PM PDT
Description:
amazon-redshift-python-driver is the official Python connector for Amazon Redshift. We identified a code injection issue in versions 2.1.13 and earlier that could allow a rogue server or man-in-the-middle to execute arbitrary code on the client.
Impacted versions: <=2.1.13
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
In this post, you will implement four Lambda-based custom code evaluators for a financial market-intelligence agent, register each with AgentCore, and run them in on-demand and online modes. You will also see how to combine custom code-based evaluators with built-in evaluators and how to call other AWS services for grounded fact-checking, PII detection, and real-time alerting.
In this post, you will learn how to set up the Confluence Cloud integration with Quick. This includes creating a knowledge base for semantic search, setting up Actions to query and manage Confluence pages, and organizing resources in Quick Spaces. Quick integrates with your current enterprise technology stack, from internal knowledge repositories and corporate intranets to business-critical applications and AWS data services.
In this post, we share how Aderant used the AI-powered capabilities of Amazon Quick to unify search across six vendor systems and automate documentation workflows, achieving 90 percent faster search times and 75 percent documentation acceleration, and how others can apply these approaches to their operations.
In this post, you learn how to prompt Amazon Nova 2 Lite for content moderation using structured and free-form approaches, grounded in the MLCommons AILuminate Assessment Standard. The prompting techniques use the AILuminate taxonomy as an example, but they work equally well with your own custom moderation policy. You can swap in your own category definitions and the prompt structure stays the same. We also benchmark the content moderation capabilities of Amazon Nova 2 Lite against several foundation models (FMs) on three public datasets.
When your data science team reserves GPU instances for a two-week training job but completes it in four days, that capacity has the potential to sit unused while your computer vision team waits another week to start their project. Now you can eliminate this GPU waste and scheduling conflict by sharing Capacity Blocks for ML […]