AWS News - 2026-10-14

Amazon Bedrock AgentCore Memory now lets you set a time-to-live (TTL) on long-term memory records, so they are automatically deleted after a retention period you define. By default, long-term memory records do not expire. With this launch, you can configure a TTL to meet data-retention requirements, control storage growth, and ensure that stale insights age out of a memory over time.

You can configure retention on the resource or specific records. Configuring or removing a TTL requires the new bedrock-agentcore:UpdateMemoryRecordExpirySpecification permission, giving you independent control over who can set record retention.

To learn more, see Set a time-to-live for long-term memory records in the Amazon Bedrock AgentCore Developer Guide. This feature is available in all AWS Regions where Amazon Bedrock AgentCore Memory is supported.

Amazon Location Service now offers a complete, interactive API Playground that lets developers explore and test every Places, Routes, and Maps API visually without writing code. With this release, all 14 Amazon Location Service Places, Maps and Routes APIs are available in an interactive API Playground, where developers can make real API calls, see results rendered on an interactive map, adjust parameters, and copy ready-to-use request snippets directly into their applications.

The API Playground covers Amazon Location Service's Places, Routes, and Maps APIs: search and geocoding (Geocode, ReverseGeocode, Autocomplete, Suggest, SearchText, SearchNearby, and GetPlace), route planning and optimization (CalculateRoutes, CalculateRouteMatrix, CalculateIsolines, OptimizeWaypoints, and SnapToRoads), and mapping (Dynamic Map and GetStaticMap). Customers can simulate validating delivery addresses, planning truck-safe multi-stop routes, visualizing drive-time service areas, or embedding maps into their apps — with no SDK setup or test scripts required.

The API Playground is available in the following AWS Regions: US East (Ohio), US East (N. Virginia), US West (Oregon), Asia Pacific (Mumbai), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Malaysia), Asia Pacific (Tokyo), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Spain), Europe (Stockholm), and South America (São Paulo).

To get started, visit the Amazon Location Service API Playground in the AWS Console, or learn more in the Developer Guide.

AWS Deadline Cloud now lets users who have access to specific queues, fleets, or jobs, rather than an entire farm, find the resources they can reach directly from the Deadline Cloud monitor. Deadline Cloud is a fully managed service that helps teams run compute-intensive workloads for visual effects, animation, product design, simulation, and gaming.

Previously, a user with access to only one queue had to get the farm ID from an administrator before they could reach their work. With this launch, the Deadline Cloud monitor displays to users queues they have access to, the parent IDs needed to reach them, and their level of access, covering both direct and group-inherited permissions. Teams now can share a single monitor entry point (URL) across different permission levels without additional coordination.

Resource discovery is available in all AWS Regions where Deadline Cloud is available. To learn more, visit the AWS Deadline Cloud user guide.

Amazon DCV 2026.0 is now available, adding support for RHEL 10, Rocky Linux 10, CentOS 10, and Ubuntu 26.04 along with a new macOS client and updated Windows and Linux clients. Amazon DCV is a high-performance remote display protocol that enables customers to securely access remote desktops and application sessions across Windows, Linux, and macOS.

Amazon DCV 2026.0 includes the following key features and improvements:

• Support for RHEL 10, Rocky Linux 10, CentOS 10, and Ubuntu 26.04, with Linux hosts and sessions running on the modern Wayland display server

• A new macOS client with gamepad support, and updated Windows and Linux clients

• URL redirection on Windows hosts, so configured links opened in a remote session launch in the local browser on the client device

• Printer preferences redirection on Windows, giving remote sessions access to client-side printer settings

• Performance improvements, including H.264 frame slice support and slice-based multithreaded decoding on the Linux and macOS clients for lower latency

• Support for new macOS server versions on Amazon EC2

For more information about the new features and enhancements in Amazon DCV 2026.0, see the release notes or visit the Amazon DCV webpage to learn more and get started.

 

AWS Agent Registry is the centralized, governed catalog for agents, MCP servers, agent skills, gateways, and custom resources within your organization. As organizations scale to hundreds of such resources, a name and description alone are insufficient for effective governance and discovery. Custom metadata lets you extend every registry record with your organization's own structured fields, so both people and automated systems can find and govern resources consistently.

With custom metadata, publishers can record fields like team ownership, data classification, or review status directly on each registry record. You define a schema once per registry with common attributes, then extend it with type-specific fields — such as a model family for agent records. Each field supports free text, a URL, a Boolean, or a choice from a list of allowed values, and the registry validates required fields and values on every record creation or update. You can then filter search results on any custom metadata field from the AWS Management Console, the AWS CLI, the AWS SDKs, or the registry's MCP endpoint.

Custom metadata is available in all AWS Regions where AWS Agent Registry is available: US East (N. Virginia), US West (Oregon), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Europe (Ireland).

To learn more, visit the AWS Agent Registry documentation. For detailed setup guidance, see Define a custom metadata schema and Set custom metadata values on a record.

Today, Amazon Elastic Container Service (Amazon ECS) announces LiveTaskCount, a new ECS service metric that reports how many tasks are actively running in your service, available to all customers at no additional charge. Additionally, the existing RunningTaskCount metric in Amazon CloudWatch Container Insights no longer incurs a charge.

LiveTaskCount reports the number of actively running ECS tasks across all desired states (ACTIVATING, RUNNING, and DEACTIVATING), including tasks still running while transitioning to a stopped state, for example, tasks undergoing connection draining during a scale-in event. This comprehensive state coverage makes LiveTaskCount well suited for autoscaling policies and capacity planning where a complete view of active, metric-generating tasks is required. It is available at no charge as part of ECS service utilization metrics and does not require opting in to CloudWatch Container Insights. The existing CloudWatch Container Insights RunningTaskCount metric tracks tasks where both the current and desired state are RUNNING, and continues to serve as a health and stability signal for customers who depend on it. With today's update, RunningTaskCount is now available at no additional charge for all CloudWatch Container Insights users.

These updates are available in all AWS Regions where Amazon ECS is available. No action is required, and the pricing change for RunningTaskCount takes effect beginning October 1, 2026, and applies automatically. To learn more, see ECS CloudWatch metrics and ECS Container Insights metrics. For a pricing example, see Amazon CloudWatch pricing.

Today, AWS Security Hub adds resource criticality to exposure prioritization, helping central security teams focus on the exposures that threaten their most business-critical resources.

You can set criticality with an automation rule, for example marking every compute resource in a specific account as Very High. The rule applies to resources already in your inventory and to new resources as Security Hub discovers them. Security Hub also infers criticality from resource tags and resource names, with no configuration required, and records which source determined the value. Criticality appears as a column on the Resources page for sorting, filtering, and grouping, and on the Impact assessment tab of an exposure finding. Resource criticality is included with Security Hub Essentials at no additional cost and is always on for all customers.

Resource criticality is included with Security Hub Essentials at no additional cost and requires no new enablement. To learn more, see  AWS Security Hub User Guide and the AWS Security Hub product page. For a list of AWS Regions where Security Hub is available, see the AWS Region table.

Amazon S3, including S3 Tables and S3 Vectors, is now available on the Vercel Marketplace and v0 by Vercel. Developers can create and connect S3 resources in seconds without leaving their development environment, getting the durability, scalability, and performance of S3 through Vercel's streamlined provisioning workflow.

Millions of customers rely on S3 for low-cost, high-performance storage to power web and AI applications, but until now provisioning it from Vercel required navigating to the AWS Management Console. Now, S3 integrates directly into the Vercel developer experience, automatically handling resource provisioning and connection configuration. You can choose from S3 general purpose buckets for virtually any use case, S3 Tables for fully managed Apache Iceberg tables optimized for analytics workloads, or S3 Vectors to natively store and query vectors at scale.

New AWS accounts created through Vercel include $100 in credits valid for up to six months, usable across Amazon S3, Amazon OpenSearch Serverless, and AWS Database services. Existing AWS customers can link their account to use S3 with their Vercel projects.

Amazon S3 on Vercel is now available in all AWS Regions where Vercel is available. To get started, read the AWS News Blog, visit AWS on Vercel Marketplace, or launch v0 by Vercel.

Amazon RDS Proxy, a fully managed, highly available database proxy for Amazon Relational Database Service (RDS), now supports Amazon RDS for SQL Server instances running major version 2022.

Amazon RDS Proxy sits between your application and the database to pool and share established database connections, improving database efficiency and application scalability. For Amazon RDS for SQL Server Multi-AZ databases, RDS Proxy automatically connects to the standby database instance during a failure, preserves application connections, and helps reduce failover times by up to 83%. RDS Proxy supports standard IAM authentication for SQL Server, where your applications authenticate to the proxy using AWS Identity and Access Management (IAM) and RDS Proxy manages database connections using credentials stored in AWS Secrets Manager.

You can enable Amazon RDS Proxy for your SQL Server 2022 database in a few steps on the Amazon RDS console, then connect by pointing your application to the RDS Proxy endpoint. To get started, see our documentation.

AWS Backup now supports Amazon FSx for Lustre, Amazon FSx for NetApp ONTAP, Amazon FSx for OpenZFS, and Amazon FSx for Windows File Server in the Asia Pacific (New Zealand) Region.

With this launch, you can use AWS Backup to centrally automate and manage data protection for your Amazon FSx file systems in the Asia Pacific (New Zealand) Region, alongside your other supported AWS resources. You can create policy-based backup plans to schedule backups and apply retention rules, store backups in encrypted vaults, and restore file systems when needed. This helps you meet business continuity, disaster recovery, and regulatory compliance requirements from a single, centralized service.

To get started, visit the AWS Backup console, AWS Command Line Interface (CLI), or AWS SDKs. For a complete list of supported Regions and features, visit the AWS Backup documentation. To learn more about AWS Backup, visit the product page and pricing page.

For blockchain node operators running Ethereum or Solana, AWS is announcing Blockchain Snapshots on AWS, an initiative that publishes pre-synced public blockchain node chain data in Amazon Simple Storage Service (Amazon S3) so you can bootstrap a node from a snapshot instead of peer-to-peer syncing from the network. These snapshots are hosted on Amazon S3 within AWS infrastructure, enabling customers running nodes on AWS benefit from reduced latency and optimized data transfer. Blockchain Snapshots on AWS republishes each network's authoritative snapshot in a format optimized for parallel extraction across multiple cores, reducing setup time, that an Amazon Elastic Compute Cloud (Amazon EC2) instance can use.

Snapshots cover Ethereum and Solana, are available at no charge, and refresh on the same cadence as the upstream provider. Use them to add capacity to a remote procedure call (RPC) fleet, recover a failed node, or re-sync a corrupted database.

You can use Blockchain Snapshots on AWS in the following AWS Regions: US East (N. Virginia), Europe (Ireland), and Asia Pacific (Tokyo). Access requires an Amazon EC2 instance in the same Region with an Amazon S3 gateway VPC endpoint.

To get started, visit the Blockchain Snapshots on AWS documentation to access setup instructions and download the latest snapshots.

AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. This gives you greater control over your server identity and helps simplify server migrations and failover.

Previously, Transfer Family stored host keys within the service, so you could not retrieve the associated private key material. With this launch, you can choose Secrets Manager as the storage type when creating a server, importing a host key, or updating an existing one. You can then retrieve the private key material and reuse the same host key across servers and AWS Regions. For example, you can use it on a standby server for failover or on a replacement server during migration, without requiring clients to trust a new host key. AWS Identity and Access Management (IAM) policies let you control who can retrieve the stored keys.

This capability is available in all AWS Regions where AWS Transfer Family is available. To learn more, see Managing host keys in the AWS Transfer Family User Guide. To get started, go to the AWS Transfer Family console

The AWS Transfer Family console now supports SVG files for logos and ICO files for favicons in web apps, with upload limits increased to 2 MB. This gives you more flexibility to use existing branding assets when customizing your web app.

Previously, the console accepted only JPG and PNG files and limited logo uploads to 50 KB and favicon uploads to 20 KB. The console automatically resizes images and converts them to JPG or PNG before saving them. Existing API upload limits and format requirements remain unchanged.

These capabilities are available in all AWS Regions where Transfer Family web apps are offered. To learn more, see the Transfer Family web apps tutorial.

Some numbers are hard to picture until you sit with them for a moment. Last week we published the Prime Day 2026 metrics, and the one that stuck with me is 2.3 quadrillion: the daily requests Amazon ElastiCache peaked at during the event. Prime Day ran back in June, so this post always lands as […]

みなさまこんにちは。自動車・製造インダストリーソリューションアーキテクトの 小川 です。10月に入っても関東は […]

一時的実行攻撃「L1TF Reloaded」は、ハーフ Spectre ガジェットと L1TF を組み合わせてゲストデータを漏洩させます。しかし、AWS Nitro System と Nitro Hypervisor を使用するお客様のゲストデータは影響を受けず、追加の対応も不要です。本記事では、攻撃の仕組みを解説します。さらに、XPFO の概念に基づくシークレットハイディングやゲスト CPU コンテキストの保護など、Nitro Hypervisor の多層防御の設計も詳しく説明します。

この記事では、Amazon EC2 インスタンス構成証明、NitroTPM、Attestable AMI を使用して、セルフマネージド型データベースでゼロオペレーターアクセス (ZOA) を実現する方法を説明します。Nix Flakes で再現可能な AMI をビルドして PCR 測定値を算出し、AWS KMS キーポリシーの条件に設定します。これにより、LUKS で暗号化された EBS ボリュームを、正しい AMI で起動したインスタンスでのみ復号できるようにします。PostgreSQL を例に、dm-verity やセキュアブートを組み合わせたブート時の信頼チェーンも詳しく解説します。

私たち AWS Customer Incident Response Team (CIRT) は、AWS 責任共有モデルにおけるお客様の責任範囲で進行中のセキュリティイベントへの対応を支援する、24 時間 365 日体制のグローバルチームです。この記事では、AWS CIRT の支援範囲と支援の依頼方法をご紹介します。また、脅威アクターによる AWS 固有の戦術、手法、手順 (TTPs) をまとめた Threat Technique Catalog for AWS (TTC) や、インシデントレスポンスに役立つオープンソースツール、ワークショップなどの公開リソースも取り上げます。

AWS Builder Center の無料サンドボックス環境を使って、Amazon Connect Customer のワークショップが利用可能になりました。この記事では AWS アカウントやクレジットカードなしで、AI を活用したコンタクトセンターの構築をハンズオンで体験する方法を解説します。

本ブログ記事は、株式会社インフキュリオン 菊田 慎一郎 様、向後 宗一郎 様、石原 幸治 様、佐々木 明良 様 […]

本ブログは、株式会社エナリス 星野 友宏 氏、KDDI アジャイル開発センター株式会社 御田 稔 氏、同 山本 […]

AI エージェントをデモから本番運用へ進めるには、何が必要でしょうか。本記事では、自動車工場の部品在庫エージェントを例に、Build (構築)・Test (テスト)・Run (実行)・Secure (セキュリティ保護)・Observe (観測)・Govern (ガバナンス) の6つの柱を順に解説します。Amazon Bedrock AgentCore や Guardrails、Evaluations、Cedar ポリシーを使った実装方法を紹介します。

AWS STS のセッショントークンのサイズ制限が 4,096 バイトの単一の制限に簡素化され、セッションポリシーとセッションタグに使用できる容量が拡大しました。トークンサイズは API レスポンス、Amazon CloudWatch メトリクス、AWS CloudTrail イベントで報告されます。また、MinimumSessionTokenSize パラメータを使用して、インフラストラクチャが処理できるトークンの最大サイズを検証できます。この記事では、変更点と影響に加え、ロードバランサーやデータベースなどトークンを扱うシステムで推奨される対応を説明します。

Amazon Aurora DSQL は外部キー制約をサポートしており、行レベルのロックを使わずに参照整合性をデータベース側で保証できます。本記事では、外部キー制約の定義、即時チェックと遅延チェック、ダウンタイムなしでの制約の追加、OCC による競合解決の仕組み、スケールを考慮した FK 設計とリトライロジックを説明します。

If you’ve ever looked at a list of cybersecurity jobs and felt like none of them fit you, you might just be looking at a short list. Most career guides cover the same few roles, like the analyst watching alerts or the pen tester (penetration tester, someone hired to legally break into systems to find […]

The next generation of AWS Resilience Hub adds three capabilities to keep workload scope and resilience requirements aligned with your running environment: Amazon EKS label support for service input sources, generative AI-powered Dependency Insights, and resilience policy sharing through AWS Organizations.

The University of Technology Sydney built a modern curriculum data services foundation on AWS that treats curriculum data as a governed, reusable product, available through APIs, graph traversal, semantic search, and event delivery, while leaving the source Curriculum Management System authoritative. One engineer now operates the domain.

Learn how to build multi-region disaster recovery for Amazon API Gateway WebSocket APIs. This design pattern combines Amazon Route 53 DNS failover, Amazon DynamoDB Global Tables, a canary health probe, and client-side reconnection logic to reconnect clients and restore session state automatically during a regional failover.

AWS engineers share kernel optimizations for fused Mixture-of-Experts (MoE) models on Amazon SageMaker AI: Swap-AB for WGMMA utilization, Triton backend routing for FP8 quantization, and eliminating Triton JIT recompilation. Together they deliver up to 10% higher throughput and up to 9% faster Time to First Token on H200 GPUs.

Grok 4.7 is now available on Amazon Bedrock. In this post, we build a tool-calling agent on Grok 4.7 and evaluate it on three reasoning tasks at four reasoning effort levels, measuring correctness and token cost per completed task. We show how to tune the trade-off per request and monitor it in production.

ShipStation Global's engineering team built Deckhand, an AI IT help desk agent for Slack on Amazon Bedrock AgentCore. It answers routine IT questions from a curated knowledge base, reads error-message screenshots, and files Jira tickets. In its first three months it resolved 97.5% of channel queries with a 96% positive feedback rating.

Orca Security built Discovery AI, a natural language query agent on Amazon Bedrock that converts plain-English questions into Sonar queries. The post shares the multi-stage architecture and the results: 90% lower query cost, 93% fewer input tokens, and 75% lower latency than the initial baseline.

Managing AI model access across dozens or hundreds of AWS accounts creates friction when each account must accept AWS Marketplace Private Pricing Offers individually. This post shows two ways to activate MPPO entitlements in AWS License Manager: a lightweight script for a one-time fix, and CDK automation for ongoing event-driven processing.

Learn how the AWS Generative AI Innovation Center Partner Agent Factory and Anchor Browser built AI agents that autonomously pay for x402-protected web resources and APIs. Amazon Bedrock AgentCore payments checks budgets, signs transactions, and retries requests without exposing wallet credentials to the agent runtime.

Learn how to deploy an available model from Amazon SageMaker JumpStart, run a lightweight and repeatable performance test using the SageMaker Python SDK, and delete the endpoint when testing is complete.

Learn how Tamnoon built Tami, an agentic cloud remediation orchestrator on Amazon Bedrock that autonomously investigates and safely remediates cloud security findings from CNAPP and cloud-native sources. The approach drove a 90%+ reduction in critical cloud exposure in 90 days with zero production issues.

This post walks you through building an AI agent system with Amazon Bedrock AgentCore that automates PowerPoint presentation creation from enterprise documents. A supervisor agent, Retrieval Augmented Generation, and Amazon Bedrock Guardrails generate grounded presentations in under 90 seconds.

Run a standard Node.js web server on AWS Lambda with Lambda Web Functions, a new type of Lambda function. Deploy it with one command or AWS CloudFormation and get a public HTTPS endpoint with no adapter layer and no servers to manage. See how one execution environment handles many concurrent requests and how active-CPU billing keeps the cost of waiting low.