Back to Archive

AWS News - 2026-10-17

2026-10-17
最終更新: 2026-10-28 06:46:04 JST

AI による概要

11 記事

この日は 11 件で、FreeRTOS に関するセキュリティ速報 2 件 (計 4 件の CVE) と、オープンウェイトモデルの追加が中心でした。セキュリティ速報の 1 件目は FreeRTOS-Plus-TCP の問題です (Bulletin ID 2026-139-AWS、Important、2026 年 10 月 16 日 10:15 PDT 公開)。FreeRTOS-Plus-TCP は組み込みや IoT 機器向けに Amazon が配布している、スレッドセーフな TCP/IP スタックで、複数バージョンが影響を受けます。CVE-2026-102551 は IPv6 の Router Advertisement ハンドラーにおける通信チャネルの送信元検証の不備で、受信した Router Advertisement がオンリンクの送信元から来たものかを十分に検証していません。あわせて CVE-2026-102552 も公開されています。2 件目は FreeRTOS-Kernel の問題です (Bulletin ID 2026-138-AWS、Important、同日 10:00 PDT 公開)。マイクロコントローラーや小型マイクロプロセッサー向けのリアルタイム OS カーネルで、Arm Cortex-R82 (Armv8-R AArch64) の MPU ポートに 2 件の問題があり、複数バージョンが影響を受けます。CVE-2026-109587 は同 MPU ポートにおける不適切な認可で、MPU を有効にしたビルドで非特権タスクに割り当てたメモリ領域の境界を正しく強制しません。あわせて CVE-2026-109588 も公開されています。モデルでは、Reflection AI のオープンウェイトモデル Beam が Amazon SageMaker JumpStart と AWS Trainium で利用可能になりました。米国の Reflection が初めて公開したオープンウェイトモデルで、同クラスのオープンウェイトモデルの最前線にあり、推論・コーディング・エージェント系のベンチマークで高い性能を示すとしています。データとインフラを自分の管理下に置いたまま、高度なコーディングエージェントや自動化ワークフローを構築できる点が強調されています。機械学習ブログでは Beam を AWS にデプロイする手順も公開され、Amazon SageMaker JumpStart のリアルタイムエンドポイントから始める方法と、Kubernetes ネイティブに分散 GPU インフラを制御したい場合に JumpStart、SGLang、vLLM と組み合わせて Amazon SageMaker HyperPod Inference を使う方法が示されています。もう 1 つのモデル追加は NVIDIA の Nemotron 3.5 Super VL で、画像・動画・テキストを入力してテキストを生成するビジョン言語モデルとして SageMaker JumpStart に加わりました。文書理解、GUI の把握、動画への質問応答、マルチモーダルなエージェント用途を想定し、総パラメーター 120B・活性 12B のハイブリッド Mixture-of-Experts の言語バックボーンにビジョンエンコーダーを組み合わせています。エージェントの評価では、Amazon Bedrock AgentCore 上に構築した 9 段階の評価フレームワークが紹介されました。自律型エージェントの障害は静かに進むため、レイテンシーは変わらないまま回答品質だけが徐々に劣化するという問題意識から、最初のコミットから本番稼働までのライフサイクル全体で品質の退行を捉えます。サービス更新は 2 件で、AWS Lambda の durable functions が AWS GovCloud (US-West) と AWS GovCloud (US-East) で利用可能になり、Amazon CloudWatch のログ集約が AWS GovCloud (US) と追加 13 の商用リージョンで使えるようになりました。このほか、Amazon EMR Serverless が IPv6 とデュアルスタックの接続に対応し、デュアルスタックまたは IPv6 専用のサブネットを指定して VPC 内で Apache Spark や Apache Hive のジョブを IPv6 上で実行できるようになりました (既存の IPv4 ワークロードとの後方互換性は維持されます)。また AWS Partner Central の Partner Analytics に Solution Matching Engine (SME) のパフォーマンスを見るセクションが追加され、パートナーは推奨、SME に帰属する商談、AWS 起点の商談に占める割合、停滞率、SME 由来のパイプラインを確認できるようになりました。あわせて Amazon Connect Customer が、agentic CX designer でフローモジュールをデータリクエストとして使えるようになりました。再利用できるロジックを顧客体験のフロー全体に適用できるもので、会話の決まった段階で Data request ノードからフローモジュールを実行することも、Generative journey に渡して会話の必要に応じて呼ばせることもできます。顧客プロファイルやケースの更新、タスクの作成、データテーブルの参照、SMS での確認送信、人のエージェントへ引き継ぐ前の営業時間や要員の確認といった用途に使えるほか、コアバンキング・保険契約・請求といったプライベートネットワーク内のシステムにあるデータも取得できます。たとえばフローモジュールから VPC 内の AWS Lambda 関数を呼び出して、口座残高や請求の状況を返すといった構成が可能です。

主要トピック

  • セキュリティ速報: CVE-2026-102551 と CVE-2026-102552 (Bulletin 2026-139-AWS、Important) — 組み込み・IoT 向け TCP/IP スタック FreeRTOS-Plus-TCP の問題。IPv6 Router Advertisement ハンドラーが送信元がオンリンクかを十分に検証しない。複数バージョンが影響

  • セキュリティ速報: CVE-2026-109587 と CVE-2026-109588 (Bulletin 2026-138-AWS、Important) — FreeRTOS-Kernel の Arm Cortex-R82 (Armv8-R AArch64) MPU ポートの問題。MPU 有効ビルドで非特権タスクのメモリ領域境界を正しく強制しない。複数バージョンが影響

  • 生成 AI: Reflection のオープンウェイトモデル Beam が Amazon SageMaker JumpStart と AWS Trainium で利用可能に。推論・コーディング・エージェント系ベンチマークで高い性能とされ、データとインフラを自分の管理下に置いたまま利用できる

  • 生成 AI: Beam を AWS にデプロイする手順。SageMaker JumpStart のリアルタイムエンドポイントから始めるか、JumpStart・SGLang・vLLM と組み合わせて SageMaker HyperPod Inference で Kubernetes ネイティブに分散 GPU を制御

  • 生成 AI: NVIDIA の Nemotron 3.5 Super VL が SageMaker JumpStart で利用可能に。画像・動画・テキストを入力するビジョン言語モデルで、総 120B・活性 12B のハイブリッド MoE バックボーン。文書理解や GUI 把握、動画 QA 向け

  • エージェント評価: Amazon Bedrock AgentCore 上の 9 段階の評価フレームワーク。レイテンシーが変わらないまま回答品質だけが劣化する「静かな障害」を、最初のコミットから本番までのライフサイクル全体で捉える

  • リージョン拡大: AWS Lambda durable functions が AWS GovCloud (US-West・US-East) で、Amazon CloudWatch のログ集約が AWS GovCloud (US) と追加 13 の商用リージョンで利用可能に

  • データ処理: Amazon EMR Serverless が IPv6 とデュアルスタック接続に対応。デュアルスタックまたは IPv6 専用サブネットで Spark・Hive ジョブを実行でき、IPv4 との後方互換性も維持

  • パートナー: AWS Partner Central の Partner Analytics に Solution Matching Engine のパフォーマンス分析を追加。SME 帰属の商談や停滞率、パイプラインを可視化

  • コンタクトセンター: Connect Customer の agentic CX designer でフローモジュールをデータリクエストとして利用可能に。Data request ノードでの固定実行と Generative journey からのツール呼び出しに対応し、VPC 内の Lambda 経由で社内システムのデータも取得できる

AI (Claude Opus 5) が生成 · 2026-10-28 08:09:43 JST

AWS What's New

Beam model by Reflection is now available on Amazon SageMaker JumpStart and AWS Trainium

詳細を表示

Beam, the first open weight model offered by US-based Reflection, is now available in Amazon SageMaker JumpStart, the model hub in Amazon SageMaker AI. According to Beam, they operate at the frontier of open weight models in its class, with strong performance across reasoning, coding, and agentic benchmarks. With it, customers can now build advanced coding agents and automated workflows on a frontier open weight model while keeping control of their data and infrastructure and adapting the model to their business. Beam runs alongside other models that customers already use in SageMaker AI and scales to meet production demand with the same controls, audit trails, and monitoring built into every SageMaker AI deployment. Additionally, Beam was ported and optimized for AWS Trainium3, giving customers a high-performance, cost-efficient option for deploying and scaling the model from day one. “Reflection is delivering frontier AI that developers can actually control, not just rent through an API. Bringing Beam to SageMaker AI puts that capability in front of millions of developers on infrastructure they already trust, running in their own AWS account, on their own data, fully in their control," said Misha Laskin, co-founder and CEO, Reflection.

Engineering teams can use Beam to resolve software issues, generate and review code, and automate routine operations work. Businesses can also use it for complex workflows that span many steps and tools, and for advanced math and science reasoning. Because Beam is released under the Apache 2.0 license, customers can inspect and customize the model, while also running it in their own AWS accounts, so data stays private and under their control, protected by the same AWS security and compliance capabilities they already rely on.  “Advanced AI models like Beam, now available on Amazon SageMaker, let us run open weight frontier AI entirely inside our own secure environments, with full visibility into the weights, the data, and the pipeline. In the age of multi-model AI, the pairing of openness and managed infrastructure is an essential addition to the AI ecosystem. The freedom to deploy and adapt advanced AI, tailored to mission problems with client-specific security and controls, gives more agencies greater flexibility to deploy advanced AI across their enterprise." said Garrett Berntsen, Chief AI Officer, Accenture Federal Services.

Beam is initially available in Amazon SageMaker JumpStart in US East (N. Virginia) and US East (Ohio). To start, search for "Beam" in SageMaker JumpStart within Amazon SageMaker Studio, or deploy it directly on SageMaker AI.  To learn more, read the AWS/Beam launch blog, SageMaker AI documentation and SageMaker JumpStart documentation.

Amazon Connect Customer now enables you to use flow modules in agentic CX designer

Amazon Connect Customer now enables you to use flow modules as data requests in agentic CX designer, so you can build and apply reusable logic across your customer experience flows. You can run a flow module at a fixed step in a conversation with a Data request node, or give it to a Generative journey as a tool to call when the conversation needs it.

With this launch, you can use flow modules to update customer profiles and cases, create tasks, look up data tables, send an SMS confirmation, or check hours of operation and staffing before escalating to a human agent. You can also retrieve data that sits inside a private network, such as core banking, policy, or claims systems. For example, a flow module can invoke an AWS Lambda function in your VPC to return an account balance or claim status in the middle of an interaction.

This feature is available in the following AWS Regions: US East (N. Virginia), US West (Oregon), Canada (Central), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Europe (Frankfurt), and Europe (London). To learn more, refer to Data requests and Flow modules in the Connect Customer documentation. To learn more about Amazon Connect Customer, an agentic AI solution that helps enterprises deliver exceptional customer experiences, visit the Amazon Connect Customer website.

Nemotron 3.5 Super VL model now available on Amazon SageMaker JumpStart

詳細を表示

NVIDIA's Nemotron 3.5 Super VL is now available on Amazon SageMaker JumpStart, expanding the portfolio of foundation models available to AWS customers. This vision-language model from the Nemotron 3.5 family accepts images, video, and text as input and generates text, enabling customers to deploy multimodal AI solutions on AWS infrastructure.

Nemotron 3.5 Super VL is designed for document intelligence, GUI understanding, video question answering, and multimodal agentic applications. It pairs a 120B-parameter hybrid Mixture-of-Experts (MoE) language backbone with 12B active parameters and a vision encoder, supporting context lengths of up to 1 million tokens. The model includes a built-in Multi-Token Prediction (MTP) head for speculative decoding to accelerate text generation, with reasoning configurable per request. It supports ten languages including English, French, Spanish, German, Japanese, Hindi, Korean, and Chinese. Post-trained with multimodal supervised fine-tuning on image, video, document, chart, and GUI data followed by GRPO reinforcement learning, it delivers structured JSON output, tool calling, and configurable reasoning for enterprise agent workflows. SageMaker JumpStart offers two variants: NVFP4 for optimized inference on G7 instances with NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs, and BF16 reference weights on ml.p5en.48xlarge for customization including SFT, RL, distillation, and domain adaptation.

With SageMaker JumpStart, customers can deploy Nemotron 3.5 Super VL with just a few clicks to address their specific AI use cases.

To get started with these models, navigate to the SageMaker JumpStart model catalog in the SageMaker console or use the SageMaker Python SDK to deploy the models to your AWS account. For more information about deploying and using foundation models in SageMaker JumpStart, see the Amazon SageMaker JumpStart documentation.

AWS Lambda durable functions are now available in AWS GovCloud (US) Regions

AWS Lambda durable functions are now available in the AWS GovCloud (US-West) and AWS GovCloud (US-East) Regions. Lambda durable functions enable developers to build reliable multi-step applications and AI workflows within the Lambda developer experience.

Lambda durable functions extend the Lambda programming model with new primitives in your event handler, such as "step" and "wait", allowing you to checkpoint progress, automatically recover from failures, and pause executions without incurring compute charges for on-demand functions. With availability in the AWS GovCloud (US) Regions, government customers and regulated industries can orchestrate complex processes such as order workflows, user onboarding, and AI-assisted tasks while meeting stringent compliance and security requirements.

You can activate durable functions for new Python (versions 3.13 and 3.14), Node.js (versions 22 and 24), Go (versions 1.24 or later), .Net (version 2.2), or Java (17+) based Lambda functions using the AWS Lambda API, AWS Management Console, or AWS SDK. You can also use infrastructure as code tools such as AWS CloudFormation, AWS Serverless Application Model (AWS SAM), and the AWS Cloud Development Kit (AWS CDK).

For more information on durable functions, visit the AWS Lambda durable functions product page or the AWS Lambda Developer Guide. To learn about pricing, visit AWS Lambda pricing. For region availability, visit the AWS Capabilities by Region page. 

Amazon EMR Serverless now supports IPv6 and dual-stack connectivity

Amazon EMR Serverless now supports IPv6 and dual-stack connectivity, expanding beyond the IPv4-only connectivity that was previously available. You can now run your Apache Spark and Apache Hive jobs over IPv6 in your Amazon Virtual Private Cloud (VPC) by supplying dual-stack (IPv4 and IPv6) or IPv6-only subnets. This gives you greater flexibility in how your applications connect to data stores and services, while maintaining full backward compatibility with your existing IPv4 workloads.

As Spark and Hive workloads scale to many workers, the IPv4 address space in your VPCs and subnets can become a constraint, and a growing number of organizations face compliance mandates that require IPv6 adoption. With dual-stack connectivity, your EMR Serverless applications accept both IPv4 and IPv6, making it easy to adopt IPv6 gradually while maintaining backward compatibility with your existing IPv4 workloads. With IPv6-only subnets, you can eliminate the need for IPv4 addresses entirely, overcoming IPv4 address exhaustion and meeting the networking standards and compliance requirements that call for IPv6, while your jobs reach IPv6 endpoints and services both inside and outside your VPC.

IPv6 and dual-stack connectivity for Amazon EMR Serverless is available at no additional cost in all AWS Regions where Amazon EMR Serverless is available. IPv6 and dual-stack subnets are supported on all EMR Serverless release versions. To get started, see Configure IPv6 subnets for EMR Serverless applications and Configuring VPC access for EMR Serverless applications.

Amazon CloudWatch log centralization now available in AWS GovCloud and additional commercial Regions

Amazon CloudWatch log centralization is now available in AWS GovCloud (US) and 13 additional commercial Regions. CloudWatch log centralization copies log data from multiple AWS accounts and Regions into a single destination account, integrating with AWS Organizations for efficient aggregation without the need for custom solutions.

With this launch, organizations in the AWS GovCloud (US) partition and commercial partition can each centralize logs across their accounts and Regions for centralized monitoring. You can scope centralization rules to your entire organization, specific organizational units, or selected accounts and copy logs into a single account while preserving source context through enriched system fields.

CloudWatch log centralization is now additionally available in Africa (Cape Town), Asia Pacific (Hong Kong), Asia Pacific (Hyderabad), Asia Pacific (Jakarta), Asia Pacific (Malaysia), Asia Pacific (Melbourne), Canada West (Calgary), Europe (Milan), Europe (Spain), Europe (Zurich), Israel (Tel Aviv), Middle East (Bahrain), Middle East (UAE), AWS GovCloud (US-East), and AWS GovCloud (US-West). For a complete list of supported Regions, see the AWS Region table.

To get started, create a centralization rule in the Amazon CloudWatch console, or by using the AWS CLI or AWS SDKs. To learn more, see Log centralization in the Amazon CloudWatch Logs User Guide. Customers can centralize one copy of logs for free; additional copies are charged at $0.05/GB. For details, see Amazon CloudWatch pricing.

AWS Partner Central adds Solution Matching Engine performance insights

AWS Partner Central now gives AWS Partners more visibility into how the Solution Matching Engine (SME) contributes to their co-sell pipeline. The Solution Matching Engine performance section in Partner Analytics helps partners understand how SME performs for their company and AWS Marketplace listings.

Partners can view recommendations, SME-attributed opportunities, their share of AWS-originated opportunities, stall rate, and pipeline attributed to SME. They can filter by recommendation type or AWS Marketplace listing and explore top customer profiles by Region, industry, and segment. These insights help partners assess their visibility and decide where to improve their listings and opportunity information.

All partners eligible for APN Customer Engagements (ACE) can find the section on the Opportunity pipeline analysis page under Partner Analytics in AWS Partner Central. To learn more about SME and how to strengthen your visibility with AWS sellers, read Solution Matching Engine: Your Gateway to AWS Sellers.

AWS Security Bulletins

CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP

Bulletin ID: 2026-139-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/16/2026 10:15 AM PDT

Description:

FreeRTOS-Plus-TCP is an open-source, thread-safe TCP/IP stack for the FreeRTOS kernel, distributed by Amazon for use on embedded and IoT devices. AWS identified two issues with FreeRTOS-Plus-TCP, affecting multiple versions.

CVE-2026-102551: improper verification of the source of a communication channel in the IPv6 Router Advertisement handler. The handler does not fully validate that a received Router Advertisement originates from an on-link source before acting on it. Under certain conditions, a remote third-party might influence an endpoint's IPv6 gateway, prefix, and address configuration, potentially enabling interception of the device's IPv6 traffic. This issue is reachable in the library's default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled.

CVE-2026-102552: improper verification of the source of a communication channel in the DNS resolver. The resolver does not fully validate that a DNS reply originates from the server that was queried before accepting it. Under certain conditions, a remote third-party might insert a chosen address into the device's DNS cache, potentially redirecting the device's subsequent connections for the affected name.

Impacted versions:

- CVE-2026-102551 (Router Advertisement): <= V4.4.1
- CVE-2026-102552 (DNS resolver): <= V4.4.1

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel

Bulletin ID: 2026-138-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/16/2026 10:00 AM PDT

Description:

FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. AWS identified two issues with the FreeRTOS-Kernel Arm Cortex-R82 (Armv8-R AArch64) MPU port, affecting multiple versions.

CVE-2026-109587: incorrect authorization in the Arm Cortex-R82 MPU port. On MPU-enabled builds, the port does not correctly enforce the memory-region boundaries assigned to an unprivileged task when it passes a buffer argument to an MPU system call. Under certain conditions, an unprivileged task might read and write privileged kernel memory outside the regions assigned to it. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected.

CVE-2026-109588: numeric truncation in the MPU buffer authorization check on the Arm Cortex-R82 MPU port. On MPU-enabled builds, the buffer-length validation does not correctly account for the full length of a buffer passed to a stream buffer system call. Under certain conditions, an unprivileged task might read or write privileged kernel memory beyond the validated buffer window. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected.

Impacted versions:

- CVE-2026-109587 (MPU region authorization): V11.3.0 and V11.3.1 (Arm Cortex-R82 builds with configENABLE_MPU=1)
- CVE-2026-109588 (MPU buffer length truncation): V11.3.0 and V11.3.1 (Arm Cortex-R82 builds with configENABLE_MPU=1)

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

AWS Machine Learning Blog

Introducing Reflection Beam: an open-weight model for agentic coding on AWS

Reflection AI's Beam is an open-weight model for agentic coding and long-horizon tasks. This post shows how to deploy Beam on AWS: start with an Amazon SageMaker JumpStart real-time endpoint, or use Amazon SageMaker HyperPod Inference with JumpStart, SGLang, or vLLM for Kubernetes-native control over distributed GPU infrastructure.

Building trust in AI agents: A production-ready evaluation framework with Amazon Bedrock AgentCore

Autonomous AI agents fail softly: latency stays flat while answer quality quietly erodes. This post shares a nine-stage evaluation framework, built on Amazon Bedrock AgentCore, that catches silent quality regressions across the full agent lifecycle, from first commit to live production.
前日
Archive
翌日