AWS News - 2026-09-28

AWS Backup logically air-gapped vault now supports Amazon FSx for NetApp ONTAP. Logically air-gapped vaults are a type of AWS Backup vault that allows secure sharing of backups across accounts and AWS Organizations, supporting direct restore to reduce recovery time from a data loss event.

You can now protect your Amazon FSx for NetApp ONTAP volumes in logically air-gapped vaults. A logically air-gapped vault stores immutable backups that are locked by default, and isolated with encryption using AWS owned keys or customer-managed keys. You can store your FSx for NetApp ONTAP backups in a logically air-gapped vault in the same account or across other accounts and Regions. This helps reduce the risk of downtime, ensure business continuity, and meet compliance and disaster recovery requirements.

You can get started using the AWS Backup console, AWS Command Line Interface (CLI), or AWS SDKs. Target FSx for NetApp ONTAP backups to a logically air-gapped vault by specifying it as the primary target or copy destination in your backup plan. Share the vault for recovery or restore testing with other accounts using AWS Resource Access Manager (RAM), or safeguard vault access during account compromise using Multi-party approval. Once available, you can initiate direct restore jobs from that account, eliminating the overhead of copying backups first.

This support is available in all AWS Regions where both logically air-gapped vault and Amazon FSx for NetApp ONTAP are available. For more information and detailed regional availability, visit the AWS Backup documentation. To learn more about logically air-gapped vaults, visit the feature documentation and pricing page.

Amazon SageMaker Unified Studio now supports two new connection capabilities: (1) Iceberg REST Catalog (IRC) connections for external Apache Iceberg catalogs, and (2) IAM authentication for Amazon DocumentDB. Together, they let data teams connect to a broader set of governed data sources and use credential-less authentication across projects.

Iceberg REST Catalog connections. SageMaker Unified Studio now supports Iceberg REST Catalog (IRC) connections, letting customers connect to external Apache Iceberg catalogs that follow the Iceberg REST specification. Supported catalog types include Snowflake Open Catalog (Polaris), Databricks Unity Catalog, and a Generic IRC type for any other spec-compliant catalog. Once connected, customers can browse the catalog in Data Explorer (list catalog/schema/table, view columns, sample data), read and write it in Visual ETL as a source or append/overwrite sink, and query it from data notebooks. Authentication uses OAuth2 or bearer token, and data access uses vended, short-lived Amazon S3 credentials. The connection lifecycle is fully supported - create, edit, delete, and test connection.

IAM authentication for Amazon DocumentDB. SageMaker Unified Studio now supports IAM authentication for Amazon DocumentDB connections, so customers can connect to DocumentDB without storing a database username or password in the connection or notebook. The connection authenticates using its own IAM role, which DocumentDB validates via AWS Security Token Service (AWS STS). This requires Amazon DocumentDB 5.0 or later instance-based clusters with TLS enabled. The connection can be used from data notebooks, Data Explorer, Test Connection, and Visual ETL data preview.

These connection capabilities are available today in all AWS Regions where Amazon SageMaker Unified Studio is available, at no additional cost.

To learn more about Amazon SageMaker Unified Studio, refer to the Amazon SageMaker Unified Studio User Guide.