AWS News - 2026-10-09

AWS Network Firewall now supports wildcard matching in container attribute-based inspection filters for Amazon Elastic Kubernetes Service (Amazon EKS) and Amazon Elastic Container Service (Amazon ECS). This enhancement allows you to define attribute filters using wildcard patterns to match multiple container workloads in a single rule, eliminating the need to create individual container associations for each variant.

With wildcard support, you can use patterns like app=payments-* to automatically cover all variants of an application, such as payments-api, payments-worker, and payments-cron. This simplifies firewall rule management for dynamic container environments where new application variants are frequently deployed, reducing operational overhead and ensuring consistent security coverage across your containerized workloads. 

Wildcard support for container attribute filters is available in all AWS Regions where AWS Network Firewall container attribute-based inspection is supported. For a full list of supported Regions, see the AWS Region Table.

To get started, visit AWS Network Firewall product page and service documentation. 

AWS Cost Explorer, AWS Budgets, and AWS Cost Management Dashboards now let you analyze Amazon Bedrock costs by product attributes, a new dimension that breaks down Bedrock cost by model, model provider, inference type, and feature. In Cost Explorer and Dashboards, you can group and filter costs by these attributes. In Budgets, you can filter budgets by the same attributes.

With this launch, finance and platform teams get a direct view of which models and workloads drive their Bedrock spend, and can act on it in the billing tools they already use. The attributes include model (such as Claude Sonnet 5 or Claude Haiku 4.5), model provider (such as Anthropic or Cohere), inference type (such as input tokens or output tokens), and feature (such as on-demand inference or reranker). You can combine product attributes with cost allocation tags on application inference profiles, projects, or workspaces to see which applications drive spend on each model, and with IAM principal tags to see which users or roles drive it. Group a month of Bedrock spend by model in Cost Explorer to find your most expensive models, build a dashboard widget that tracks cost per provider, or set a budget that alerts on spend for a single model.

The Amazon Bedrock product attribute dimension is available today at no additional charge in all AWS Regions, excluding the AWS GovCloud (US) Regions and the China (Beijing) and China (Ningxia) Regions. To learn more, see the user guides for Cost Explorer, Budgets, and Dashboards.

Today, AWS announces the availability of Ultrafast mode for GPT-6.1 Sol from OpenAI on Amazon Bedrock. Ultrafast mode provides faster inference for workloads where speed matters most. The Amazon Bedrock inference engine delivers the performance, security, and reliability required for production workloads.

Use GPT-6.1 Sol Ultrafast for latency-sensitive applications such as real-time coding assistants, interactive agents, and customer-facing experiences that require fast, high-quality responses. GPT-6.1 Sol helps developers build features, debug issues, investigate complex codebases, and complete multistep workflows. Established AWS controls help you secure workloads, govern access, and audit model invocation activity.

You can get started in the Amazon Bedrock console or programmatically through supported Amazon Bedrock APIs. For information about supported AWS Regions, endpoints, APIs, features, inference profiles, and pricing, see the Amazon Bedrock documentation.

Amazon Bedrock now supports TwelveLabs Pegasus 1.5, a video-to-text model that generates structured, time-coded metadata from video. Until now, finding a moment in a large video library meant knowing where to look before you could ask about it. Pegasus 1.5 reads an entire video and labels what happens and when, turning footage into data your applications can query.

You define what matters to your business, such as editorial segments, speaker changes, sports plays, or brand appearances, and Pegasus 1.5 finds those moments across the video and returns them with timestamps. It analyzes what it sees, hears, and reads on screen in a single pass, with no pre-indexing or ingestion pipeline to build first.

Pegasus 1.5 is accessible through the US and Global cross-Region inference profiles. To get started, visit the Amazon Bedrock product page, access the model in the Amazon Bedrock console, or see the Amazon Bedrock documentation for supported Regions, APIs, features, and pricing.

Amazon SageMaker Unified Studio now supports custom Tooling blueprints, giving domain administrators the ability to define the foundation of every project by using their own AWS CloudFormation templates. Administrators can tailor project environments to meet organization-specific requirements, such as IAM role names that comply with company naming standards or custom permissions boundaries instead of AWS managed policies.

Amazon SageMaker Unified Studio administrators start by authoring a CloudFormation template that describes the project environment they need, then register it as a custom Tooling blueprint. The service validates the template at registration and again after each project deployment, confirming that the required resources exist before any team member uses the project. Templates can include any CloudFormation-supported resource, such as AWS Lake Formation grants, Amazon Athena workgroups, or VPC security groups, and work across multiple AWS accounts and Regions without per-project edits. At deployment time, the service automatically populates reserved template parameters, such as the project ID and domain ID, so administrators define the template once and apply it everywhere.

This feature is available in all AWS Regions where Amazon SageMaker Unified Studio is available. To learn more, visit the Custom blueprints as Tooling documentation.

Amazon Bedrock の自動推論チェック (Automated Reasoning checks) では、AI の回答を形式論理で検証し、説明可能な判定を得られます。この記事では、Agent Skills を使って自動推論ポリシー (Automated Reasoning policy) のライフサイクルをコーディングエージェントからコードで実行する方法を説明します。builder や validator など 6 つのスキルの役割と構成を紹介し、育児休暇ポリシーを例に構築からデプロイ、検証までを順に解説します。あわせて、SATISFIABLE という判定の解釈など、スイートを実行して得られた教訓も紹介します。

みなさん、こんにちは。ソリューションアーキテクトの梅田です。 AWS Japan パブリックセクターチームでは […]

脆弱性スキャナーの検出結果は、手動のトリアージでは処理しきれないほど増え続けています。この記事では、AI を活用した脆弱性検出ハーネスを紹介します。複数スキャナー間の一致、AST による構造検証、IaC テンプレートを用いたデプロイコンテキストの 3 層で検出結果をフィルタリングし、悪用可能性の証拠を備えた優先順位付きの少数の検出結果に絞り込みます。パイプラインの構築から得られた 4 つの原則と、段階的な導入手順も解説します。

AI モデルに経験豊富なセキュリティアナリストと同等の一貫性で脆弱性トリアージを実行させる、ステアリングファイルの設計と使い方を紹介します。重要な 5 つのセクションとして、構造的検証によるハルシネーションの抑制、証拠ベースの信頼度スコアリング、AWS WAF などの補完的コントロールを考慮したインフラストラクチャの評価、CISA KEV や EPSS を活用した脅威インテリジェンスの統合、P0～P3 の優先度分類を解説します。検証結果に加え、Kiro や Claude Code での導入方法も説明します。

「自治体のためのクラウドコスト最適化」シリーズについて 自治体がガバメントクラウド上で業務システムを運用する場 […]

Bulletin ID: 2026-129-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/08/2026 10:30 PM PDT

Description:

AWS Toolkit for Visual Studio Code is an open source extension that lets developers work with AWS services, including Amazon CodeCatalyst, from within Visual Studio Code. We identified CVE-2026-107332, an issue in the CodeCatalyst connection handler. When a user connected to a CodeCatalyst Dev Environment, the extension cached the user's CodeCatalyst bearer token to a file with world-readable permissions and did not remove the file after the session ended. A local user or process on the same machine with access to the file system was able to read this file and obtain the bearer token.

Impacted versions: < 4.10.0

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Bulletin ID: 2026-130-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/08/2026 11:30 AM PDT

Description:

Amazon Agent Plugins for AWS is an open source collection of plugins that extends supported AI coding agents with AWS-focused workflows and tool integrations. The databases-on-aws plugin provides database design, development, migration, and operational guidance, including Aurora DSQL helper scripts.

We identified CVE-2026-107322, where an incomplete list of disallowed inputs in databases-on-aws versions before 1.7.1 could allow a remote unauthenticated actor to supply crafted content that an agent ingests. The affected code is not a listening network service; operating-system command execution on the host is possible only if the agent subsequently invokes the local helper with the crafted database command value. Any resulting command runs with the permissions of the process running the helper. This issue does not affect the Aurora DSQL service or bypass database privileges.

Impacted versions: databases-on-aws versions 1.0.0 through 1.7.0

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Bulletin ID: 2026-131-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/08/2026 12:30 PM PDT

Description:

AWS CDK is an open source framework that allows customers to build cloud infrastructure using their favorite programming language (Python, Typescript, C#, Go). That infrastructure is then able to be deployed with AWS CDK command line commands to AWS CloudFormation. We identified CVE-2026-107608, which is an issue where Docker files could be configured to insert symlinked files into the output of the AWS CDK asset bundling process when it was invoked with a Docker file. When bundling an asset using AWS CDK with a docker file, prior to 2.267.0, it was possible for a docker file to insert a symlinked file or directory into the output of asset bundling without the symlink having been provided as input to the bundling process.

Impacted versions: All aws-cdk-lib versions before 2.267.0

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

A reference architecture for securely sharing one Amazon SageMaker HyperPod EKS cluster across multiple teams, using AWS IAM Identity Center for authentication, per-team SageMaker Domains and Kubernetes namespaces for isolation, HyperPod Task Governance for fairness, and namespace-level cost allocation for chargeback.

Amazon Bedrock AgentCore payments gives AI agents a managed way to pay for services on demand, with spending limits enforced by the infrastructure. See how Incarna's agents pay BlockRun for model inference one request at a time over x402, cutting the work of adding x402 payment support from months to days.

Reinforcement learning at scale runs thousands of isolated rollout sandboxes in parallel, and packing more of them onto each host lowers your cost per training step. This post shows how to tune Firecracker microVM density on Amazon EC2 metal, and introduces labsweep, a harness for mapping your own latency and density curve.