AWS News - 2026-09-02

Amazon Managed Workflows for Apache Airflow (MWAA) now supports Apache Airflow version 3.3.1, the latest release of the popular open-source workflow orchestration framework. Amazon MWAA is a managed orchestration service for Apache Airflow that makes it easier to set up and operate end-to-end data pipelines in the cloud.

Apache Airflow 3.3 introduces stateful tasks and multi-language support. With the new Task and Asset State Store, tasks can now persist durable state across retries and reruns, enabling cursor tracking and crash-safe reconnection to long-running jobs. The Language Task SDK (experimental) lets teams write task logic in Java or Go while keeping orchestration in Python. Additional improvements include expanded asset partitioning, pluggable retry policies, and bulk actions for DAG runs and task instances. Apache Airflow 3.3.1 also delivers stability, security, and UI improvements on top of these capabilities.

You can launch a new Apache Airflow 3.3.1 environment on Amazon MWAA, or upgrade from 3.2 or later, with a few clicks in the AWS Management Console in all currently supported Amazon MWAA regions. To learn more about Apache Airflow 3.3.1, visit the Amazon MWAA documentation and the Apache Airflow 3.3.1 change log in the Apache Airflow documentation.

Apache, Apache Airflow, and Airflow are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries.

Amazon Connect Customer now offers compact mode on the analytics dashboards, increasing data density so supervisors can see more of their operational data without scrolling. Compact mode reduces widget size, font, and minimizes filters to maximize screen space. For example, a supervisor on a 13-inch laptop toggles compact mode, which reduces row height, enabling them to view all team agents on the widget without scrolling and spot non-adherent agents faster.

Compact mode on dashboards is available in all AWS regions where Amazon Connect Customer is offered. To learn more about Amazon Connect Customer analytics dashboards, see the Amazon Connect Customer Administrator Guide.  To learn more about Amazon Connect Customer, visit the Amazon Connect Customer website.

AWS Backup now supports backup and restore of more than 1,000 Amazon S3 buckets per account, matching the Amazon S3 bucket quota configured for your account.

Previously, AWS Backup for Amazon S3 supported up to 1,000 buckets per account. With this launch, AWS Backup supports backing up all general purpose buckets in your account. Existing backup plans and configurations continue to work with no changes required if you are using default AWS Backup managed policies. For details on the required permissions for custom policies, see the AWS Backup documentation.

This capability is available in all AWS commercial and AWS GovCloud (US) Regions. To get started, visit the AWS Backup console.

AWS Marketplace now offers a 0% listing fee for professional services purchased as part of a qualifying multi-product solution. This builds on the recent reduction of professional services listing fee to 0.5%. It further lowers the cost for any Partner that transacts services through AWS Marketplace, while retaining the billing benefits that come with it.

Over the past year, AWS Marketplace has built a set of capabilities purpose-built for discovering and purchasing services. Customers can find the right Partner through AI-powered discovery in Agent Mode, combine software and services in a single transaction through multi-product solutions, and pay through variable payment models like time-and-materials. The 0% fee for professional services within a multi-product solution complements these capabilities and further reduces the cost for Partners to sell solutions through AWS Marketplace.

A multi-product solution qualifies for the 0% fee when its professional services are combined with at least one other valid, paid subscription. The fee applies to new subscriptions, while existing subscriptions continue at their original terms. This applies to all commercial AWS Regions where AWS Marketplace operates. 

To get started, Partners can review seller documentation and list multi-product solutions through AWS Partner Central . Customers can explore multi-product solutions directly on AWS Marketplace.

Today, AWS announces support for self-managed PostgreSQL databases in Amazon CloudWatch Database Insights. Using CloudWatch Database Insights, you can now monitor your self-managed PostgreSQL instances running on Amazon EC2, alongside Amazon RDS and Amazon Aurora, to give you a complete view of your database fleet in a single console. 

Amazon CloudWatch Database Insights is a database observability solution that provides a curated experience to help you monitor database fleet health, diagnose issues, and resolve performance bottlenecks. With support for self-managed databases, you use the Amazon CloudWatch agent to collect health and performance data from your self-managed PostgreSQL instances. Your database appears in the Database Insights fleet view with live performance data, including database load, wait event analysis, query-level statistics, and host metrics. Monitor and troubleshoot your self-managed PostgreSQL instances using the same familiar Database Insights console and workflows you already use for your AWS-managed databases.

Amazon CloudWatch Database Insights support for self-managed PostgreSQL is available in all AWS Commercial Regions. To get started, see Monitoring Self-Managed Databases in the Amazon CloudWatch User Guide. For pricing details, see the Amazon CloudWatch pricing page.

Amazon Kinesis Data Streams now supports a dry run feature to check whether an API request would succeed without executing the operation. Customers can now set the new optional parameter ‘DryRun’ to true in their API requests to validate permissions before interacting with a stream in production.

Previously, customers had no safe way to test whether their application had the correct permissions to access a stream. They would often send a request engineered to fail after checking permissions, such as a PutRecord request with a payload deliberately larger than the maximum supported size. This approach was fragile as it depended on current service limits, and if those limits ever changed, the request could unexpectedly succeed, writing unintended records into the production stream and into any downstream consumers. Now, customers can simply set the parameter ‘DryRun’ to true to indicate they only want to validate the API request. If all checks complete successfully, the API returns a ‘DryRunOperationException’, confirming the request would have succeeded without the ‘DryRun’ parameter.

The dry run feature is available for five APIs (PutRecord, PutRecords, GetRecords, GetShardIterator, and SubscribeToShard) in all AWS Regions where Amazon Kinesis Data Streams is available. For more information about dry run, see Test your permissions and request inputs with dry run in the Amazon Kinesis Data Streams Developer Guide. To get started with dry run, see the Amazon Kinesis Data Streams API Reference.

AWS Deadline Cloud now supports sharing job bundles, giving teams a simple way to distribute and reuse render job templates without manual file distribution. Deadline Cloud is a fully managed service that helps teams run compute-intensive workloads in the cloud for visual effects, animation, product design, simulation, and gaming. 

Job bundles define the jobs you submit to Deadline Cloud, including the job template, parameters, and asset references. Previously, sharing a bundle with teammates meant distributing files through shared drives or manual copying. Now, you can publish a bundle to your queue directly from the submitter or the command line, and it immediately becomes available to everyone with access to that queue. Shared bundles are packaged as portable archives and stored in the queue's existing job attachments bucket in Amazon S3, so there is no additional infrastructure or configuration to set up. This makes it easy for pipeline teams to publish standard, ready-to-submit job templates that artists can pick up and use.

You can browse bundles shared on your queue, on your local filesystem, or from your job submission history. You can preview each bundle's name, description, steps, and parameters before selecting it. New CLI commands let you manage shared bundles from the command line and integrate bundle sharing into pipeline scripts.

This feature is available in all AWS Regions where Deadline Cloud is available. To get started, visit the AWS Deadline Cloud documentation.

Amazon Bedrock AgentCore Identity now offers a managed consent portal that eliminates the need for custom OAuth callback infrastructure when connecting agents to third-party tools and services.

Developers using AgentCore Gateway to connect agents with services such as GitHub, Salesforce, and Slack previously had to build, host, and maintain custom OAuth callback infrastructure to complete OAuth 2.0 three-legged authorization (3LO) flows. The new managed consent portal eliminates this undifferentiated heavy lifting for agent developers and platform administrators.

Each AgentCore Gateway receives its own managed consent portal with a dedicated hosted web client and credential provider list. Platform admins can share a portal URL with their team before sessions begin, granting consent for agents to call external tools on their behalf. End users can view their connection status at any time through a self-service interface without contacting an administrator.

Developers using agent IDE-based clients, which cannot natively present OAuth consent URLs or handle post-consent session binding, can now use the managed consent portal as a dedicated authorization surface for these workflows.

This feature is available in all commercial regions where Bedrock AgentCore Identity is available.

To learn more, visit the Amazon Bedrock AgentCore Identity documentation.

Now generally available, Amazon Quick lets you build custom applications by simply describing them in natural language. Create project trackers, customer dashboards, and training portals in minutes instead of months. Whether you're a product manager, finance lead, HR partner, or ops analyst, you can now turn ideas into fully functional apps without writing any code. Tell Quick what you need, and it builds a live, connected application with real-time data from your existing business systems.

Quick connects directly to the tools and data your business already uses, including Salesforce, Jira, Asana, ServiceNow, Microsoft 365, Google Workspace, databases, and data warehouses. Your apps stay current automatically as underlying data changes, and every connection respects your organization's existing identity, authorization, and access control policies. Once built, you can publish and share apps instantly with specific users or your entire organization. Need to make a change like adding AI, updating the visual style, or connecting to another system? Just describe what you want and Quick handles it.

During preview, customers used Quick to replace spreadsheets and disconnected tools with purpose-built applications. New York Life built an e-learning portal for their Institutional Life team that consolidates onboarding, training, and compliance courses into a single experience. The Amazon Quick team tracks pipeline, customer requests, and adoption metrics in a weekly leadership review app that replaced manual data pulls from four different systems.

Building apps in Quick is available to Plus, Professional, and Enterprise customers starting September 1, 2026. To learn more, visit the Apps in Quick getting-started guide.

Amazon RDS for SQL Server supports 18 additional SQL trace flags that you can enable through database parameter groups. Trace flags are configuration switches that modify SQL Server engine behavior — such as query optimizer cardinality estimation, lock escalation, statistics management, and memory handling — to allow database administrators to fine-tune performance and address workload-specific challenges. With this expansion, you have greater flexibility to optimize and stabilize your SQL Server workloads directly within your managed RDS environment.

The newly supported trace flags include: 647, 652, 1448, 3654, 4138, 4139, 7745, 8285, 8780, 9432, 9481, 9492, 9592, 11024, 11042, 12502, 12618, and 12656. These trace flags address scenarios such as query plan optimization, DDL performance improvements, availability group replication, Query Store behavior, automatic plan correction, and known engine bug mitigations. Because trace flags modify core SQL Server engine behavior, you should test them in a non-production environment before applying them to production instances. Some trace flags can impact system performance, increase memory usage, or change query execution plans in unexpected ways.

Trace flags are available in all AWS Regions where Amazon RDS for SQL Server is supported. To get started, update your RDS parameter group to enable the desired trace flags and apply it to your DB instance. To learn more, see Amazon RDS for SQL Server User Guide.

AWS User Experience Customization (UXC) is now available in all commercial AWS Regions. UXC enables account administrators to set a custom account color and control which services and Regions appear in the AWS Management Console.

Previously, UXC was available only in US East (N. Virginia), requiring customers who manage these settings programmatically to direct API calls to that single Region. With today's expansion, customers can manage account customizations from any commercial AWS Region using the AWS CLI, AWS SDKs, or AWS CloudFormation — making it easier to configure the console experience alongside existing infrastructure automation.

UXC is available at no additional charge. To get started, see the AWS User Experience Customization documentation.

You can now use AWS PrivateLink to privately access Amazon MemoryDB from your Amazon Virtual Private Cloud (Amazon VPC) in the AWS GovCloud (US-West) and AWS GovCloud (US-East) Regions. AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises networks, without exposing traffic to the public internet and securing your network traffic.

To use AWS PrivateLink with Amazon MemoryDB, you create an interface VPC endpoint for Amazon MemoryDB in your VPC using the Amazon VPC console, AWS SDK, or AWS CLI. With an interface VPC endpoint, you can privately access the Amazon MemoryDB APIs from applications inside your Amazon VPC. You can also access the VPC endpoint from other VPCs using VPC Peering or your on-premises environments using AWS VPN or AWS Direct Connect. To learn more, read the documentation, or get started in the Amazon VPC Console.

こんにちは、AWSの嶺、篠原、鈴木です。2026年5月、DeNAのヘルスケア事業部門のDeSCヘルスケア株式会 […]

Bulletin ID: 2026-093-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 09/01/2026 11:00 AM PDT

Description:

SageMaker Python SDK's @step and @remote decorator pipeline component uses an HMAC key to protect the integrity of serialized function payloads stored in S3. We identified an issue where the HMAC secret key is stored in cleartext within pipeline definitions and accessible via the DescribePipeline API.

This allows an actor with a role in that account that has permissions to invoke DescribePipeline to extract the key, create cloud-pickled payloads with valid HMACs, and overwrite S3 objects, achieving code execution in another user's pipeline execution context within the same AWS account.

Impacted versions:
- HMAC Configuration in SageMaker Python SDK v3 < v3.11.0
- HMAC Configuration in SageMaker Python SDK v2 < v2.256.0

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Boomi Scribe is an AI-powered agent on AWS that automatically generates documentation for enterprise integration workflows. Learn how Boomi uses Amazon Bedrock, Amazon SageMaker AI, Amazon S3, Amazon DynamoDB, and AWS Lambda to parse integration DAGs, generate detailed documentation, and compare component versions at scale.

Learn how ZS built a security-hardened Amazon SageMaker platform that balances developer agility with healthcare-grade governance, serving 1,000+ daily active users across 200+ SageMaker domains.

t54 built x402-secure, a trust layer on Amazon Bedrock AgentCore payments that scores every endpoint before an autonomous agent pays it. See how session budgets, credential isolation, and a deterministic trust gate have governed more than 20 million agent-initiated transactions with no human in the loop.

Amazon Quick proof-of-concept projects often stall when security teams review the production plan. This post walks through designing dashboards, Spaces, knowledge bases, agents, and Flows with security controls that hold as you scale: dataset shaping, agent isolation, document classification, and approval gates.

As generative AI adoption scales, cost governance becomes a top challenge. Learn how Jamf built real-time, per-user spend enforcement for Amazon Bedrock using IAM Customer Managed Policies, an Amazon Athena cost view, and a serverless AWS Lambda loop that applies tiered model limits in near-real-time without disrupting active sessions.

When Atos set out to upskill 400 engineers in agentic AI, hands-on learning was the missing ingredient. Over three days, engineers built multi-agent systems on AWS through an AI League event. This post explains why Atos chose the format, what engineers built and learned, and what other enterprises should consider.

Claude Fable 5.1 is now available on Amazon Bedrock and Claude Platform on AWS. This post covers Claude Fable 5.1's improvements, the Enterprise Frontier Safeguards for keeping your data in a cloud environment you control, and how to start building with the model on Amazon Bedrock.