AWS News - 2026-10-15

Today, AWS HealthOmics introduces the resource fallback directive for tasks in your Nextflow workflows, enabling you to define an ordered list of preferred accelerator types, including an option to fallback to CPU instances. Researchers and bioinformaticians can use this directive to reduce time spent diagnosing and resubmitting runs due to accelerator constraints and keep production workflows running. AWS HealthOmics is a HIPAA-eligible service that helps healthcare and life sciences customers accelerate scientific breakthroughs at scale with fully managed bioinformatics workflows. 

With resource fallback for Nextflow workflows, you can prioritize your preferred accelerator for your task. When your preferred accelerator is unavailable, HealthOmics automatically moves through your specified alternatives in the fallback without resubmission. Each accelerator profile has a configurable timeout, giving you control over how long HealthOmics searches for that accelerator before moving to the next. Shorter timeouts help you move quickly through the fallback order, while longer timeouts increase the probability of reserving your preferred accelerator. You can also include a CPU profile as a final fallback to increase the likelihood of your task reserving an instance. 

You can now use resource fallback for Nextflow workflows in all AWS HealthOmics Regions: US East (N. Virginia, Ohio), US West (Oregon), Europe (Frankfurt, Ireland, London), Israel (Tel Aviv), and Asia Pacific (Seoul, Singapore, Tokyo). To learn more, visit the advanced resource configuration and Nextflow specifics documentation. 

AWS License Manager  now supports in-place upgrades for EC2 Ubuntu LTS (Long Term Support) instances to Ubuntu Pro available on AWS Marketplace. This allows customers to strengthen their security posture and meet compliance requirements without rebuilding their fleet or migrating workloads to a new instance or AMI. With an Ubuntu Pro subscription, customers receive security patches for up to 10 years — extendable to 15 years with the Legacy add-on. This coverage extends beyond the base OS to thousands of additional packages, including widely used open-source applications such as NGINX, PostgreSQL, MongoDB, and Redis. Ubuntu Pro also supports Kernel Livepatch, which applies critical kernel security fixes without rebooting to minimize downtime.

With this launch, customers, who have an existing Canonical Ubuntu Pro subscription through AWS Marketplace, can upgrade directly during the conversion workflow. Customers who do not yet have a subscription can subscribe to Canonical Ubuntu Pro from within the AWS License Manager console. The new feature is available in  all commercial regions  where AWS License Manager is available.

To get started, navigate to the  AWS License Manager console  and the  AWS License Manager User Guide . 

AWS Lambda recursive loop detection now automatically detects and stops recursive loops between Lambda Event Functions and Amazon EventBridge Custom event buses, helping protect you against unintended usage and unexpected charges from runaway workloads. Lambda recursive loop detection, enabled by default on your AWS account, automatically identifies when a Lambda Event Function is invoked recursively by a supported AWS service and stops the loop.

You can use EventBridge Custom event buses to invoke Lambda Event Functions, building automation workflows and scheduling recurring tasks without managing any infrastructure. However, a misconfiguration or code defect can cause EventBridge rules to trigger your Event Functions recursively, resulting in runaway usage. Now, recursive loop detection supports EventBridge Custom buses, automatically stopping such loops and sending you an AWS Health Dashboard notification with troubleshooting instructions.

EventBridge Custom event buses now support recursive loop detection in every commercial AWS Region where they are available. This feature is enabled by default on your account and requires no configuration. If your Event Function uses recursive loops intentionally, you can use the PutFunctionRecursionConfig API to turn off recursive loop detection for that function.

To learn more about recursive loop detection, visit Lambda documentation.

You can now use container images from registries such as Seqera (Wave), NVIDIA NGC, and Google Artifact Registry with AWS HealthOmics expanded support for third-party container registries. You can use the containerized tools your workflows already rely on, without manually migrating images into Amazon ECR or editing your workflow definitions. AWS HealthOmics is a HIPAA-eligible service that helps healthcare and life sciences customers accelerate scientific breakthroughs at scale with fully managed bioinformatics workflows.

With expanded container registry support, you can now instruct HealthOmics to copy container images, on your behalf, from newly supported registries into your Amazon ECR when running your private workflows. Previously, AWS HealthOmics could pull images only from registries supported through Amazon ECR pull-through cache (PTC). Your private workflows can now access Amazon ECR pull-through cache registries and the newly supported third party container registries, so you do not need to pull, re-push, or rewrite image URIs yourself.

Expanded container registry support is now available in all AWS Regions where HealthOmics is available: US East (N. Virginia, Ohio), US West (Oregon), Europe (Frankfurt, Ireland, London), Israel (Tel Aviv), and Asia Pacific (Singapore, Seoul, Tokyo). To learn more, visit the third-party container image support documentation. 

Amazon CloudWatch now supports conditional log routing and chained parsers via pipelines, giving you more control over how log data is transformed and which CloudWatch log group it's sent to. CloudWatch pipelines is a fully managed service that ingests, transforms, and routes telemetry to CloudWatch without managing infrastructure.

Log pipelines often carry a mix of event types that belong in different places, and individual events can nest one log format inside another. With conditional log routing, you define routes that send each event to a different CloudWatch log group based on conditions evaluated against processed fields, so you can separate events by severity, source, or type and apply the right retention and access controls to each. With chained parsers, you can apply multiple parser processors in sequence, where later parsers consume fields produced by earlier ones. For example, you can parse a JSON envelope first, then apply a Grok parser to a field it extracts. Together, these capabilities let you structure diverse log formats and route them to the right log groups in a single pipeline.

Conditional routing and chained parsers are available in all commercial AWS Regions where CloudWatch pipelines is generally available. You can configure these capabilities using the AWS Management Console, AWS CLI, or AWS SDKs. To get started, see the Amazon CloudWatch pipelines documentation.

AWS Security Hub CSPM now supports automated security checks that align with the Cyber Risk Institute (CRI) profile. The CRI Profile is a cybersecurity framework developed by the Cyber Risk Institute, a non-profit coalition of financial institutions and trade associations. The framework harmonizes cybersecurity and regulatory expectations that apply to the financial services sector into a common set of requirements, so that an organization can assess itself once and report against multiple regulations. AWS Security Hub CSPM provides 404 controls that support a subset of CRI Profile v2.2 requirements; the controls don't support requirements that require manual checks.

The new standard is now available in all AWS Regions where Security Hub CSPM is currently available, including the AWS GovCloud (US) and the China Regions. To quickly enable the standard across your AWS environment, we recommend that you use Security Hub central configuration. With this approach, you can enable the standard in all or only some of your organization's accounts and across all AWS Regions that are linked to Security Hub with a single action.

To learn more, see CRI Profile v2.2 in the AWS Security Hub CSPM user guide. To receive notifications about new Security Hub CSPM features and controls subscribe to the Security Hub SNS topic. You can also try Security Hub CSPM at no cost for 30 days with the AWS Free Tier offering.

Amazon Managed Service for Prometheus collector, a fully-managed agentless collector for Prometheus metrics, is now available in Asia Pacific (New Zealand). Customers in New Zealand can now run their Prometheus-compatible monitoring workloads in-region, with lower latency for local workloads and the ability to keep their data in-country.

Amazon Managed Service for Prometheus collector discovers and collects Prometheus metrics from your container workloads without the need to run and operate collection agents yourself. Customers ingest the collected metrics into an Amazon Managed Service for Prometheus workspace, where they query and analyze the metrics. This fully-managed approach simplifies operational overhead by eliminating the need to maintain and scale collection infrastructure.

To learn more about Amazon Managed Service for Prometheus collector, visit the user guide or product page.

Amazon Managed Workflows for Apache Airflow (MWAA) now integrates with the Agent Toolkit for AWS to provide built-in AI agent skills that let you author, debug, and test MWAA workflows and upgrade MWAA environments using any AI coding assistant that supports agent skills.

The four skills are authoring-mwaa-workflow, debugging-mwaa-workflow, testing-mwaa-workflow, and upgrading-mwaa-environments. Together they let your AI assistant interact directly with MWAA using natural language, reducing the manual effort of building and maintaining data pipelines. For example, you can describe an ETL pipeline in plain language and the authoring skill generates a working DAG complete with task dependencies and error handling.

The Amazon MWAA AI agent skills work with both Amazon MWAA Provisioned and Amazon MWAA Serverless environments, and are available in all AWS Regions where Amazon MWAA is available.

To get started, install the aws-data-analytics plugin and configure your AI coding assistant to use the MWAA agent skills. To learn more, see Using agent skills with Amazon MWAA in the Amazon MWAA User Guide and the Agent Toolkit for AWS documentation.

Oracle Database@AWS (ODB) now supports advertising aggregate routes and a default route (0.0.0.0/0) when configuring ODB peering between applications in an Amazon VPC and databases in an ODB network. This simplifies network operations as customers extend new VPCs or on-premises networks to reach their databases, without updating the advertised CIDRs for each network that needs connectivity to the ODB network.

Previously, customers had to advertise each network reaching the ODB network as a separate CIDR, and could not advertise a broad aggregate range or a default route. With this launch, customers can advertise any CIDR range, so a single aggregate or default route can cover all networks reachable through the peered VPC, such as those connected through an AWS Transit Gateway, without a separate entry for each one.

This capability is available on ODB networks that support multiple ODB peering connections, in all AWS Regions where Oracle Database@AWS is available. To learn more, visit Oracle Database@AWS and the Oracle Database@AWS User Guide. To get started, subscribe through AWS Marketplace.

Amazon S3 Metadata is now available in six additional AWS Regions: Asia Pacific (Hyderabad), Asia Pacific (Malaysia), Asia Pacific (New Zealand), Asia Pacific (Taipei), Asia Pacific (Thailand), and Mexico (Central).

S3 Metadata is a fast and easy way to instantly discover and understand your S3 data with automated, easily queried metadata that updates in near real time. This helps you curate, identify, and use your S3 data for business analytics, real-time inference applications, and more. S3 Metadata automatically populates metadata for both new and existing objects, providing you with a comprehensive, queryable view of your data. Annotations extend S3 Metadata, letting you attach rich business context directly to your objects in JSON, XML, or YAML, with up to 1 GB per object. To query annotations at scale, you can surface them in S3 Metadata annotation tables in these Regions.

With this launch, S3 Metadata is now generally available in 38 AWS Regions. For pricing details, visit the S3 pricing page. To learn more, visit the product page and documentation.

You can now migrate existing Apache Hive datasets in Amazon S3 to fully managed Apache Iceberg tables in Amazon S3 Tables, with no pipelines to build or compute to provision, while production workloads keep running.

AWS CloudTrail ログには、疑わしいアクティビティを調査するために必要な証拠が含まれています。このパート 1 では、AWS の Security Incident Response Team (SIRT) が実践する調査手法を、2 つの実際のシナリオに沿って紹介します。1 つは、設定ミスのあるクロスアカウントアクセスが悪用され、ランサムウェアとの関連が疑われる Amazon S3 データ削除に至った事例です。もう 1 つは、多要素認証 (MFA) のないコンソール認証情報が悪用され、AWS CloudFormation と AWS CloudShell で暗号通貨マイニングが行われた事例です。重要なフィールドの読み解き方、調査の優先順位、対応チェックリスト、予防策を解説します。

本ガイドのパート 2 では、ウェブアプリケーションの SSRF の脆弱性を起点に、IMDSv1 からの認証情報の窃取、リージョンホッピングを経て Amazon Bedrock が不正使用されたマルチステージ攻撃を、AWS CloudTrail のログから分析します。userIdentity、readOnly、awsRegion などの注目すべきフィールドとインシデント対応チェックリストを紹介し、IMDSv2 の強制、最小権限、モデル呼び出しのログ記録といった強化策と、脅威アクターの回避手法も解説します。

この記事では、Kiro と Amazon Q Developer を使用して AWS のセキュリティポスチャを強化する 5 つの方法を紹介します。ステアリングファイルとルールによる永続的なコンテキストでセキュリティ標準を組み込む方法をはじめ、MCP サーバーを活用した AWS Security Hub の検出結果のトリアージ、Infrastructure as Code (IaC) の修復、AWS Well-Architected フレームワークのセキュリティの柱に沿ったレビュー、サービスコントロールポリシー (SCP) の作成を迅速化する手法を説明します。あわせて、人間による検証の重要性と段階的な導入の進め方も解説します。

Kiro CLI を使用して、「AWS セキュリティインシデント対応ガイド」のフレームワークに沿ってセキュリティ調査を迅速化する方法を紹介します。自然言語のプロンプトで Amazon GuardDuty の検出結果をトリアージし、EC2 インスタンスや IAM 権限を分析します。さらに、隔離用セキュリティグループによる封じ込め、フォレンジックスナップショットによる証拠保全、AWS CloudTrail ログ分析を進めます。Amazon SNS と Amazon EventBridge による自動アラートの構築や、ステアリングファイルによる再利用可能な調査ワークフローの作成も解説します。

アマゾン ウェブ サービス ジャパン（AWS ジャパン）は、2026 年 9 月 24 日に Kiro のハンズオンイベント「手を動かして実感する、Kiro が変える開発体験」を開催しました。AWS Workshop Studio の教材から 4 つのラボを選び、Kiro の仕様駆動開発（Spec）、Steering、Agent Skills、MCP、そして Kiro Crew までを、講義とワークショップを交互に進めながら体験いただきました。本記事では当日の模様をレポートします。

アマゾン ウェブ サービス ジャパン（AWS ジャパン）は、2026 年 9 月 24 日に「Kiro Meetup #8」を開催しました。まず AWS から、前回の Kiro Meetup 以降の半年間のアップデートと、常駐型エージェント基盤 Kiro Crew の仕組みを紹介しました。続いて、三菱電機株式会社、東海旅客鉄道株式会社、株式会社オープンアップシステムの皆様に、Kiro を組織に広げる取り組みをライトニングトークでご紹介いただきました。本記事ではその模様をレポートします。

本ブログは 株式会社東京会計パートナーズ 様、株式会社ゼネット 様と Amazon Web Services […]

Kiro IDE と Kiro CLI で、ローカルサンドボックスが一般提供されました。エージェントが実行するコマンドを OS カーネルが強制するサンドボックスで動かし、書き込み先をプロジェクトに限定し、認証情報パスの読み取りを拒否し、ネットワークをドメイン単位で制限します。本記事では、エージェント自体をサンドボックスの外に置く設計の考え方と、sandbox.json と permissions.yaml による設定方法を紹介します。

2026 年 10 月 12 日、コードをイベントハンドラーに書き直さずに標準の HTTP ウェブアプリケーシ […]

従来は定期的な診断で行われていたペネトレーションテストを、CI/CD パイプラインのデプロイ後ゲートとして組み込む方法を紹介します。AWS Continuum for penetration testing は、直前にデプロイした変更にスコープを限定し、AI エージェントを使用して悪用可能な脆弱性を確認します。そのため、デプロイのたびに高速かつ低コストで実行できます。OIDC フェデレーションによる IAM ロールの設定、GitHub Actions のワークフロー例、レポート専用モードからブロック運用へ移行する際の注意点も説明します。

数字の中には、しばらく向き合ってみないと想像しにくいものもあります。2026 年 10 月 5 日週、プライム […]

AWS マネジメントコンソールプライベートアクセスが、インターネット接続のない VPC に対応し、一般提供を開始しました。認証フロー、静的アセット、コンソール専用 API を含むコンソールトラフィックを、AWS PrivateLink の VPC エンドポイント経由でルーティングできます。この記事では、VPC エンドポイントポリシーとサインイン用のリソースコントロールポリシー (RCP) を組み合わせてデータ境界を強化する方法を説明します。パイロット導入の手順と考慮事項も紹介します。

こんにちは。Amazon Web Services Japan のソリューションアーキテクトの福嶋です。 20 […]

Amazon Aurora DSQL の DPU 料金モデルと、CloudWatch メトリクスと請求額の対応関係を解説します。Aurora DSQL コンソールの Usage and cost パネルでコストを確認する方法、1 時間あたりの DPU 使用量を監視する CloudWatch アラームの設定方法、AWS CloudFormation でアラームをデプロイする方法を紹介します。

Session Manager のセッションで実行されたコマンドはトランスクリプトとして記録されますが、数百台のノードで毎日数千件になると、SOC チームが手作業で確認することはできません。このブログでは、Amazon Bedrock、AWS Lambda、Amazon S3、Amazon Bedrock AgentCore を使い、セッションの終了時にトランスクリプトを自動で分析して Normal・Suspicious・Critical に分類し、不審なセッションを SOC にメールで通知する仕組みを構築します。分類の基準、CloudFormation テンプレートでのデプロイ手順、セッションの履歴を自然言語で問い合わせる方法を説明し、多層的なセキュリティ戦略の中での位置付けにも触れます。

Most security tooling that fits into a CI/CD pipeline—static analysis (SAST), software composition analysis (SCA), and dynamic scanners (DAST)—flags potential issues from patterns and signatures. A flagged pattern shows you where to look; penetration testing is what confirms whether something is actually exploitable. That confirmation has traditionally come from a periodic, out-of-band engagement that runs […]

Bulletin ID: 2026-134-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/14/2026 11:30 AM PDT

Description:

Amazon SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker.

We identified CVE-2026-110248, an issue in the git_utils.py component of Amazon SageMaker Python SDK. When a Git clone operation fails, repository credentials in subprocess error output are written to CloudWatch Logs without redaction. An authenticated remote user with access to those logs is able to obtain the plaintext credentials.

Impacted versions:
- Amazon SageMaker Python SDK V2 versions before 2.257.3
- Amazon SageMaker Python SDK V3 versions before 3.10.0

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Bulletin ID: 2026-135-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/14/2026 12:30 PM PDT

Description:

We identified CVE-2026-110310, an issue in Amazon S3 encryption client for .NET that could allow a remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.

Impacted versions: >= 2.1.0; 3.0.0 to 3.2.1; 4.0.0 to 4.0.2

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Learn how to build an agentic intelligent document processing (IDP) system using Amazon Bedrock AgentCore that classifies, extracts, validates, and learns from business documents with minimal human intervention, automatically handling new document formats without manual template configuration.

AWS re:Invent 2026 offers an extensive selection of serverless and application integration content, including new AWS Lambda execution models, AI agents as a new kind of serverless consumer, and maturing event-driven patterns. This guide helps you navigate the serverless sessions and find the content most relevant to you.