AWS News - 2026-07-17

You can now transition objects to S3 Standard-Infrequent Access (S3 Standard-IA) and S3 One Zone-Infrequent Access (S3 One Zone-IA) as soon as the day they are created, without the previous 30-day minimum retention in S3 Standard. These storage classes offer up to 40% lower storage costs than S3 Standard while still providing millisecond access when needed, making them ideal for backups, log analytics, and compliance workloads where data becomes cold within hours or days.

To get started, create new S3 Lifecycle rules to transition objects to S3 Standard-IA and S3 One Zone-IA as soon as 0 days after creation. You can configure these rules using the S3 console, AWS CLI, or SDKs. This update is available in all AWS Regions where S3 Standard-IA and S3 One Zone-IA are available. For pricing details, visit the Amazon S3 pricing page. To learn more, visit the overview page and documentation.

Amazon EC2 High Memory U7in-24TB instances (u7in-24tb.224xlarge) are now available in AWS Europe (Paris) region. U7i instances are part of the AWS 7th generation and are powered by custom fourth-generation Intel Xeon Scalable processors (Sapphire Rapids). U7in-24TB instances offer 24 TiB of DDR5 memory, enabling customers to scale transaction processing throughput in a fast-growing data environment. U7i instances offer up to 45% better price performance over existing U-1 instances.

U7in-24TB instances deliver 896 vCPUs and support up to 100 Gbps of Amazon EBS bandwidth for faster data loading and backups, 200 Gbps of network bandwidth, and ENA Express. U7i instances are ideal for customers running mission-critical in-memory databases like SAP HANA, Oracle, and SQL Server.

To learn more about U7i instances, visit the High Memory instances page.

Customers can now view annual water withdrawals data associated with their AWS workloads in AWS Sustainability, alongside existing carbon emissions data. This enhancement helps organizations gain comprehensive visibility into their environmental impact across carbon and water.

Water withdrawals data is available by AWS Region, service, and AWS account on an annual basis through the AWS Sustainability console and API. The data represents the total volume of water withdrawn for data center operations, with efficiency improvements reflected as lower withdrawal volumes.

AWS Sustainability water withdrawals data is available at no additional charge in all AWS Regions where the service is available.

To get started visit the AWS Sustainability user guide. For more information, see the AWS Sustainability console page.

Amazon S3 Event Notifications now include system-generated tags in events delivered to all destinations including Amazon EventBridge, Amazon SQS, Amazon SNS, and AWS Lambda. System-generated tags are metadata labels attached to your bucket by AWS services. You can use these tags to filter events from thousands of buckets with a single EventBridge rule, instead of listing each bucket name individually.

To get started, enable S3 Event Notifications on your general purpose buckets through the AWS Management Console, AWS SDK, or AWS CLI. If AWS services like AWS CloudFormation have already applied system-generated tags to your buckets, S3 automatically includes them in new event notifications. System-generated tags in S3 Event Notifications are available at no additional cost in all AWS Regions and require no changes to existing configurations. To learn more, visit the S3 Event Notifications documentation.

Amazon EC2 now surfaces the AWS Systems Manager (SSM) Parameter Store parameters associated with public AMIs directly in the AMI metadata. When you describe a public AMI, the response includes the associated public SSM parameter, making it easy to discover and reference in your configurations.

Previously, finding the SSM parameter associated with a public AMI required searching through SSM parameter namespaces manually. Now, when you describe a public AMI, the response includes the public SSM parameter it is associated with. This allows you to discover the SSM parameter for a public AMI easily and use it as an alias that always resolves to the latest version, simplifying AMI updates across your infrastructure.

This capability is available to all customers at no additional cost in all AWS regions including AWS China (Beijing) Region, operated by Sinnet, and AWS China (Ningxia) Region, operated by NWCD, and AWS GovCloud (US) Regions. To learn more, please visit the documentation.

Amazon EC2 now surfaces the AWS Systems Manager (SSM) Parameter Store parameters associated with public AMIs directly in the AMI metadata. When you describe a public AMI, the response includes the associated public SSM parameter, making it easy to discover and reference in your configurations.

Previously, finding the SSM parameter associated with a public AMI required searching through SSM parameter namespaces manually. Now, when you describe a public AMI, the response includes the public SSM parameter it is associated with. This allows you to discover the SSM parameter for a public AMI easily and use it as an alias that always resolves to the latest version, simplifying AMI updates across your infrastructure.

This capability is available to all customers at no additional cost in all AWS regions including AWS China (Beijing) Region, operated by Sinnet, and AWS China (Ningxia) Region, operated by NWCD, and AWS GovCloud (US) Regions. To learn more, please visit the documentation.

Today, AWS Billing and Cost Management (BCM) announces support for Cost Efficiency widget in BCM Dashboards. You can now view cost efficiency trends alongside Cost Explorer, Budgets, and reports for Savings Plans and Reserved Instance coverage and utilization reports. This provides a unified view of your spending, commitments, and optimization performance in a single, tailored dashboard.

The Cost Efficiency widget displays your efficiency score over time, showing how your efficiency across your AWS environment changes over time. You can view efficiency by AWS account, region, or overall, and adjust granularity to analyze trends at the level that matters most to your team. By adding one or more Cost Efficiency widget to a BCM Dashboard, you can monitor your optimization performance from your existing cost management workflows. The widget links directly to the Cost Optimization Hub console so you can easily take actions when you have recommendations for savings opportunities.

With the Cost Efficiency widget, you can create a unified view of your spending, commitments, budgets, and optimization performance. The widget is fully integrated with dashboard exports and can be included in scheduled email reports or downloaded as a CSV or PDF for offline analysis. They are also included with cross-account dashboard sharing.

The Cost Efficiency widget for BCM Dashboards is available in all AWS commercial Regions at no additional charge. To learn more, visit our User Guide.

Amazon Managed Grafana is now a FedRAMP High authorized service in the AWS GovCloud (US-East) and AWS GovCloud (US-West) regions. Federal agencies, public sector organizations, and other enterprises with FedRAMP High compliance requirements can now use Amazon Managed Grafana to visualize, query, and alert on operational metrics across their AWS and hybrid environments while meeting their strict security and compliance requirements.

Amazon Managed Grafana is a fully managed service based on open-source Grafana that makes it easier for you to visualize and analyze your operational data at scale. The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program that delivers a standard approach to the security assessment, authorization, and continuous monitoring for cloud products and services. 

For more details about Amazon Managed Grafana in AWS GovCloud (US), visit the Amazon Managed Grafana GovCloud documentation or contact your AWS account team for more information. To learn more, visit the Amazon Managed Grafana product page.

Amazon CloudWatch Synthetics now supports customer managed AWS Key Management Service (KMS) keys for encrypting canary environment variables, giving you full control over the encryption of sensitive configuration data such as API keys, credentials, and tokens. Previously, environment variables were encrypted at rest using only an AWS owned key. Now, in addition to the default AWS owned key, you can specify your own symmetric KMS key for encryption at rest, and you can also encrypt individual values client-side before they are stored.

With encryption at rest, you specify a customer managed KMS key when creating or updating a canary, and CloudWatch Synthetics uses a grant on the key to handle encryption and decryption transparently. With client-side encryption, you encrypt values before storage, and your canary script decrypts them at runtime using the AWS KMS Decrypt API. This benefits teams in regulated industries that require organizational key management policies, auditability, or key rotation controls across all services.

Amazon CloudWatch Synthetics customer managed key encryption is available in all commercial AWS Regions. Multi-location canaries can use a different KMS key per replica Region.

To learn more, see Encrypting environment variables in the Amazon CloudWatch User Guide.

2006 年 7 月 13 日、Amazon EC2 および Amazon S3 と共にお客様向けに提供される […]

本ブログは、株式会社アドバンスト・メディア様と Amazon Web Services Japan が共同で執 […]

Oracle Data Masking and Subsetting Pack を Amazon RDS for Oracle で使用する方法を説明します。Oracle Enterprise Manager (OEM) でのデータマスキングのセットアップから、マスキングスクリプトの生成と実行、EventBridge と Step Functions による自動化まで、非本番環境を本番相当のデータで安全にリフレッシュする手順を紹介します。

本記事では、Amazon RDS for Oracle のクロスリージョンレプリカにおけるレプリケーションラグを REDO 圧縮機能で最適化する方法を説明します。REDO 圧縮の仕組み、有効化手順、実際の負荷テストによる効果を SLOB ツールを用いて検証し、圧縮有効時にラグが大幅に削減されることを示します。

AWS Summit Japan 2026 の流通小売・消費財・飲食ブースにて、私たちは「バーチャル AI エ […]

本記事は Amazon RDS for Oracle リードレプリカのレプリケーション遅延を減らす 2 回シリーズの後編です。CloudWatch メトリクスとデータベースビューによる遅延の監視、待機イベント分析による根本原因の特定、そして遅延を解消するための段階的なトラブルシューティング手法を、プライマリ側とリードレプリカ側の 2 つの実践シナリオを通じて紹介します。

IBM Db2 ワークロードを運用しているお客様向けに、Amazon RDS for Db2 を再現性が高く監査可能な方法でプロビジョニングするモジュール式の Terraform テンプレートを紹介します。空の AWS アカウントから、AWS License Manager で追跡される稼働中の RDS for Db2 インスタンスまでを 1 時間以内で構築できます。ネットワーク、IAM、暗号化、パラメータグループ、インスタンス、ライセンスまでを 7 つのモジュールでカバーします。

IBM Db2 ワークロードを Amazon RDS for Db2 へ移行する際、既存のアプリケーション接続文字列を書き換えずに済ませたいという要望はよくあります。本記事では、SNI ベースの TLS プロキシをデプロイするモジュール化された Terraform テンプレートを紹介します。エンドツーエンドの TLS 暗号化を維持しながら、既存のカスタムドメイン名とポートをそのまま利用できます。

はじめに こんにちは、IoT Specialist ソリューションアーキテクトの新澤です。2026 年 6 月 […]

Amazon RDS for Db2 は、お客様自身の Active Directory を利用した Kerberos 認証をサポートしており、データベースユーザーの認証を一元化してシングルサインオンを実現できます。本記事では、専用の OU とサービスアカウントの作成、必要な AD 権限の委任、KMS で暗号化したシークレットへの認証情報の保存、そしてドメイン参加済みクライアントからの接続検証まで、セルフマネージド AD による Kerberos 認証の設定手順を順を追って説明します。

AWS Database Migration Service (AWS DMS) を使い、Amazon RDS for Db2 からオンプレミスの AIX Db2 インスタンスへ CDC のみのリバースレプリケーションを構成する方法を説明します。プライベートのみのネットワーク上で検証済みのフェイルバック経路を用意し、移行カットオーバー後の検証期間に問題が発生してもデータの整合性を保ったまま迅速にロールバックできるようにします。

    株式会社エブリーは、「前向きなきっかけを、ひとりひとりの日常にとどける。」というミッションのもと、デリ […]

Amazon RDS for Db2 のアーカイブログを Amazon S3 にコピーし、セルフマネージドの Db2 インスタンスへ継続的に適用することで、両者を同期させ続けるハイブリッドアーキテクチャを紹介します。これにより、マネージドサービスの利点を活かしつつ、緊急バックアップサーバーや切り戻しの選択肢を確保できます。IAM 権限の設定からロールフォワードの運用、トラブルシューティングまでの手順を解説します。

みなさん、こんにちは。ソリューションアーキテクトの 寺山です。 AutoGluon-Cloud v0.5.0 […]

AWS で実現する新しい E-Commerce の形 〜 Future of Agentic Commerce […]

Bulletin ID: 2026-058-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 07/16/2026 10:15 AM PDT

Description:

Bedrock AgentCore Python SDK (bedrock-agentcore) is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. We identified CVE-2026-15737 in the OpenTelemetry instrumentation of the SDK. Affected versions wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, where a local authenticated user with CloudWatch Logs read access could access the potentially sensitive content.

Impacted versions: 1.4.8, 1.5.0

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Bulletin ID: 2026-057-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 07/15/2026 12:00 PM PDT

Description:

jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. We identified CVE-2026-15895, an issue where specially formatted command line arguments can be used to execute shell commands via this tool.

Impacted versions: < 1.131.0

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

In this post, we show you how to build a voice ordering system that answers a phone number and takes the order from greeting to confirmation. The system uses Amazon Bedrock AgentCore to host and run the agent and Amazon Nova 2 Sonic for real-time speech, connected to a restaurant backend through the Model Context Protocol (MCP). The walkthrough covers deploying the full stack with AWS Cloud Development Kit (AWS CDK) and bridging a phone call into the agent through a Session Initiation Protocol (SIP) gateway on Amazon Elastic Container Service (Amazon ECS) and AWS Fargate. It also warms the agent session while the phone is still ringing, so the caller never hears dead air.

This post covers what makes Grok 4.3 a great fit for agentic and enterprise workloads, how you access it through Amazon Bedrock, and how to use the capabilities most teams reach for first: a basic chat request, configurable reasoning effort, tool calling, structured output, image input, and stateful multi-turn conversations.

In this post, we walk through the three pillars that make this possible: simplified setup, smarter retrieval, and production readiness. We also show you code examples for setting up a knowledge base and retrieving from it.

If you manage Lambda functions at scale, you’ve likely hit the 75 GB code storage limit or explained to your security team why deployment artifacts live in an S3 bucket you don’t control. Today, we’re announcing self-managed Amazon S3 buckets for AWS Lambda deployment packages. Lambda reads your code directly from your bucket, eliminating quota […]