AWS News - 2026-10-10

Starting today, you can upload brand templates in Amazon Quick, allowing you to create presentations and documents that match your approved visual identity. Brand managers set up a template once and everyone gets on-brand output, without hunting for the right file in each chat.

Brand managers upload PowerPoint or Word templates, or pull them from a connected file store such as SharePoint. Quick extracts the colors, fonts, logos, layouts and brand rules from each file. A brand manager reviews and edits what Quick found before publishing it to the whole organization.

Quick also follows a template's rules as it creates new assets. If a request breaks a rule, Quick explains why and suggests an on-brand alternative. For each task, Quick picks the best-fit template based on guidance the brand manager writes. Users can still choose a different template.

Administrators decide who can create and publish brand templates using custom permissions, ensuring that only the proper members of brand, marketing, or other approved teams can set visual standards. 

Brand assets are generally available today in the Amazon Quick desktop app. To learn more, see the Amazon Quick documentation, or create an account for free and start using Quick in minutes.

AWS Lambda now supports OAuth authentication for self-managed Apache Kafka event source mappings (ESM), including Kafka clusters that customers run themselves and managed offerings such as Confluent Cloud, Aiven, and Redpanda. With this launch, customers can authenticate their Lambda Kafka consumers through their enterprise identity provider, helping them meet the security and compliance requirements for their Kafka applications.

Customers building event-driven Kafka workloads for use cases such as payment processing, fraud detection, and real-time data pipelines use Kafka ESM to build serverless Kafka consumers. Kafka ESM provides automatic scaling, error handling, batching, and event filtering. Previously, Kafka ESM supported only SASL/PLAIN, SASL/SCRAM, and mutual TLS (mTLS) as authentication methods, so customers in regulated industries that require OAuth could not use Kafka ESM with their clusters. With OAuth support, customers can use their enterprise identity provider, such as Amazon Cognito or Okta, to authenticate their Kafka ESM and apply the same identity governance and access policies across their Kafka clusters and Lambda consumers.

This capability is available in all AWS commercial Regions where self-managed Kafka ESM is available. To use OAuth authentication, create a new Kafka ESM with your authentication configuration through the AWS Management Console, Lambda API, AWS CLI, AWS CloudFormation, or AWS SAM. To learn more, see the AWS Lambda developer guide and AWS Lambda pricing.    

Amazon Connect Customer now suggests changes to performance evaluation forms that improve the accuracy of evaluations automatically filled by AI. While setting up an evaluation form, managers can run an automated check that compares the form against best practices with a single click. Managers then receive a list of evaluation questions that are missing context for AI to score reliably, along with suggestions to make them more specific. For example, the check might flag "Did the agent provide a sales disclosure?" and prompt the manager to define exactly what the agent must disclose before a sale. This helps managers automatically score human and AI agents fairly and accurately, while spending less time refining their evaluation forms.

This feature is available in the following AWS Regions: US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (London), Asia Pacific (Singapore), Asia Pacific (Sydney), and Asia Pacific (Tokyo). To learn more, please visit our documentation and our webpage. For information about Amazon Connect Customer pricing, please visit our pricing page.

Two new Anthropic models are now available in the Kiro IDE and CLI for the AWS GovCloud (US) Regions.

Claude Opus 5.5 is Anthropic's most capable Opus model yet and a step up from Opus 5 on long-running agentic coding work. Opus 5.5 thinks adaptively on every request, deciding how much effort each task needs, and completes tasks with roughly 40% fewer tool calls and about half the tokens of Opus 5 in Kiro's internal benchmarking. Available with a 1M context window and 2.0x credit multiplier, down from Opus 5's 2.2x.

Claude Sonnet 5.5 is Anthropic's fastest Sonnet model to date and a natural upgrade for teams already building on Sonnet 5. Output is more than 30% faster, real-world coding and knowledge work approaches Opus 5.5 performance, and clearer writing makes it a stronger collaborator, giving developers a cost-performance dial between maximum capability and higher throughput. Available with a 1M context window and 1.3x credit multiplier.

Ensure your IDE or CLI is updated to the latest version, then restart it to access the new models from the model selector. For more details, visit the GovCloud documentation, the monitoring and tracking guide, or contact your AWS account team. To learn more about Kiro, visit the Kiro product page.

Amazon Bedrock now supports the reasoning.summary parameter for OpenAI models through the Responses API. This capability lets you request a human-readable summary of a model’s reasoning alongside its response, helping you understand its approach to complex tasks such as coding, analysis, and multi-step problem solving.

Reasoning summaries give developers additional context for evaluating responses, debugging applications, and showing users how a model approached a request. The summary is returned in the summary array of the reasoning output item, alongside the model’s answer.

This capability is available for all OpenAI models on Amazon Bedrock in all AWS Regions where OpenAI GPT models are available, including in-Region inference, geographic (GEO) cross-Region inference, and global cross-Region inference.

To learn more, see the OpenAI documentation on reasoning summaries. To get started with OpenAI GPT models on Amazon Bedrock, see documentation here.

Starting today, Amazon Elastic Compute Cloud (Amazon EC2) R8g instances are available in the AWS European Sovereign Cloud (Germany) region. These instances are powered by AWS Graviton4 processors and deliver up to 30% better performance compared to AWS Graviton3-based instances. Amazon EC2 R8g instances are ideal for memory-intensive workloads such as databases, in-memory caches, and real-time big data analytics. These instances are built on the AWS Nitro System, which offloads CPU virtualization, storage, and networking functions to dedicated hardware and software to enhance the performance and security of your workloads.

AWS Graviton4-based Amazon EC2 instances deliver the best performance and energy efficiency for a broad range of workloads running on Amazon EC2. AWS Graviton4-based R8g instances offer larger instance sizes with up to 3x more vCPU (up to 48xlarge) and memory (up to 1.5TB) than Graviton3-based R7g instances. These instances are up to 30% faster for web applications, 40% faster for databases, and 45% faster for large Java applications compared to AWS Graviton3-based R7g instances. R8g instances are available in 12 different instance sizes, including two bare metal sizes. They offer up to 50 Gbps enhanced networking bandwidth and up to 40 Gbps of bandwidth to the Amazon Elastic Block Store (Amazon EBS). 
 
To learn more, see Amazon EC2 R8g Instances. To explore how to migrate your workloads to Graviton-based instances, see AWS Graviton Fast Start program and Porting Advisor for Graviton. To get started, see the AWS Management Console.

Amazon Elastic Compute Cloud (Amazon EC2) R8gd instances are available in AWS European Sovereign Cloud (Germany) region. These instances feature up to 11.4 TB of local NVMe-based SSD block-level storage and are powered by AWS Graviton4 processors, delivering up to 30% better performance over Graviton3-based instances. These instances are built on the AWS Nitro System and are a great fit for applications that need access to high-speed, low latency local storage. 
 
R8gd instances are available in 12 different sizes. They provide up to 50 Gbps of network bandwidth and up to 40 Gbps of bandwidth to the Amazon Elastic Block Store (Amazon EBS). Additionally, customers can now adjust the network and Amazon EBS bandwidth on these instances by 25% using EC2 instance bandwidth weighting configuration, providing greater flexibility with the allocation of bandwidth resources to better optimize workloads. These instances offer Elastic Fabric Adapter (EFA) networking on 24xlarge, 48xlarge, metal-24xl, and metal-48xl sizes.

To learn more, see R8gd instances. To explore how to migrate your workloads to Graviton-based instances, see AWS Graviton Fast Start program. To get started, see the AWS Management Console.

Amazon Elastic Compute Cloud (Amazon EC2) M8id instances with up to 22.8 TB of local NVMe-based SSD block-level storage are now available in Asia Pacific (Malaysia) and Asia Pacific (Sydney). M8id instances are designed for workloads that require a balance of compute and memory resources along with high-speed, low-latency local block storage, including data logging, media processing, and medium-sized data stores.

Amazon EC2 M8id instances offer 3 times more vCPUs, memory and local storage compared to previous sixth-generation instances. These instances deliver up to 43% higher compute performance and 3.3 times more memory bandwidth compared to previous sixth-generation M6id instances. They also deliver up to 46% higher performance for I/O intensive database workloads, and up to 30% faster query results for I/O intensive real-time data analytics compared to previous sixth generation instances.

Additionally, customers can now adjust the network and Amazon EBS bandwidth on these instances by 25% using EC2 instance bandwidth weighting configuration, providing greater flexibility with the allocation of bandwidth resources to better optimize workloads. These instances offer Elastic Fabric Adapter (EFA) networking on 24xlarge, 48xlarge, metal-24xl, and metal-48xl sizes.

Customers can purchase these instances via Savings Plans, On-Demand instances, and Spot instances. For more information visit the Amazon EC2 M8id page.

Today, AWS Security Hub announces support for exporting findings to Amazon S3 in CSV or JSON (OCSF) format. Security teams that need findings outside the console for use cases such as compliance reporting and audit evidence can now export findings from every findings page in the Security Hub console, including Threats, Exposure, Vulnerabilities, Posture Management, Sensitive Data, and All Findings, without building and maintaining their own extraction pipelines.

With this launch, you can start an export on demand from the findings page you are viewing and have Security Hub deliver the results to an S3 bucket in your account. You can choose CSV when you want to review or share findings in a spreadsheet or export in JSON if you need these findings in Open Cybersecurity Schema Framework (OCSF) format.

Findings export is available in all AWS Regions where AWS Security Hub is available. To learn more, visit the AWS Security Hub User Guide at https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-v2-findings-export.html.

Kiro CLI V3 は、Kiro IDE と Kiro Web を動かしているものと同じエージェントハーネスをターミナルで使えるようにします。V3 では、計画・実装・レビューが必要なタスクを Kiro に渡し、workflow のエージェントがバックグラウンドで各ステップを進めている間も、ご自身は作業を続けられます。クラウドセッションを開始すれば、ノート PC を閉じても作業は止まりません。新しい spec モードでは、Kiro がコードを書き始める前に要件と設計を Kiro と一緒にレビューできます。新しい tangent モードを使うと、メインセッションのコンテキストに影響を与えずに、並行する会話へ分岐できます。

Bulletin ID: 2026-132-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/09/2026 08:30 AM PDT

Description:

AWS Tools for PowerShell V5 lets developers and administrators manage their AWS services from the PowerShell scripting environment. We identified CVE-2026-107783, where insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts.

Impacted versions: <= v5.0.305

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Bulletin ID: 2026-133-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/09/2026 11:00 AM PDT

Description:

AWS Amplify API Category is a CDK Construct library for defining GraphQL data models with authorization rules as AWS AppSync APIs. We identified CVE-2026-108096, where improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.

Impacted versions:
- @aws-amplify/graphql-index-transformer >=2.2.0, <3.1.2;
- @aws-amplify/graphql-api-construct >=1.4.0, <1.21.4;
- @aws-amplify/data-construct <1.17.4

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Building an AI agent that works in a demo is a different problem from running one for 40 million developers. Postman and AWS share the architectural patterns behind Agent Mode: controlling tool sprawl, exposing schema-based reads, and treating context as the real bottleneck, plus how it runs on Amazon Bedrock at scale.

A monthly recap of the latest Amazon Bedrock, Amazon Bedrock AgentCore, and Strands updates from September 2026: broader model choice, faster serverless agents with built-in evaluation, and automated knowledge base syncing with native enterprise connectors.

AWS Lambda now exposes Availability Zone metadata through an endpoint in the execution environment, so your function can discover its AZ ID with an HTTP request. Use it to prefer same-AZ endpoints for services like ElastiCache, Amazon RDS, and MemoryDB, reduce cross-AZ latency and data transfer costs, and build AZ-aware resilience patterns.