AWS News - 2026-10-20

Amazon GuardDuty now supports optional detection rules for Runtime Monitoring. You can enable more than 50 Runtime Monitoring rules that help detect process, file, and network activity that might be routine in one environment but a sign of compromise in another, such as modifying sudoers files or disabling audit logging.

The new rules provide detections for Amazon EC2 instances, Amazon EKS, and Amazon ECS on both EC2 and AWS Fargate, and span 13 finding types mapped to MITRE ATT&CK® tactics including persistence, privilege escalation, execution, defense evasion, discovery, exfiltration, and command and control. This release introduces four new finding types: CommandAndControl:Runtime/SuspiciousCommand, CredentialAccess:Runtime/SensitiveFileRead, Discovery:Runtime/SensitiveFileRead, and Exfiltration:Runtime/SuspiciousCommand.

To get started, visit the GuardDuty console. You can enable rules in dry-run mode to evaluate detection efficacy before enabling live detection.

Custom Detection Rules for Runtime Monitoring is available in all AWS commercial Regions and the AWS GovCloud (US) Regions. To learn more, see Amazon GuardDuty Custom Detection Rules. To receive programmatic updates on new Amazon GuardDuty features and threat detections, subscribe to the Amazon GuardDuty SNS topic.

EC2 Image Builder now supports using existing instances from an Auto Scaling Group (ASG) for building images, enabling faster builds by eliminating the time spent in launching and bootstrapping new instances and reusing already running EC2 instances.

With this feature, you can provide an ASG in your Image Builder infrastructure configuration. Instead of launching a new instance at the build time, Image Builder selects an already-running instance from this ASG, applies your build components, and creates the image. The ASG continuously replenishes the pool as instances are used for builds, ensuring instances are always available for subsequent pipeline runs.

This feature is fully opt-in and does not affect existing pipelines. Pipelines without an ASG configured continue to use the default launch path with no behavior change.

This feature is available in all AWS Regions at no additional cost. To configure ASG integration in your Image Builder pipelines, see the EC2 Image Builder documentation.

Amazon Connect Customer Global Resiliency now provides a Global Resiliency page in the admin website, giving administrators a single place to review their Region switch readiness. The page shows an overall readiness status and lists the resources that Global Resiliency natively replicates, including which resource types are in sync, which are still pending synchronization, and which need action. For example, if a phone number or user is not associated with a traffic distribution group, the page flags it and lets the administrator associate the affected resources directly from the page. With this readiness overview, administrators can review their resiliency posture at any time and verify that their instance is ready for a Region switch.

This feature is available in all AWS Regions where Amazon Connect Customer Global Resiliency is supported. To learn more, see Amazon Connect Customer admin guide.

AWS IAM Identity Center now retains your workforce identities and their assignments when you change your identity source from Active Directory to an external identity provider (IdP), such as Okta or Microsoft Entra ID, or to the Identity Center directory. Specifically, it preserves your users, groups, group memberships, permission set assignments, and application assignments. Previously, this change required you to recreate them in IAM Identity Center.

IAM Identity Center helps you connect your workforce identities to AWS once and manage their access centrally across AWS applications and accounts. When you change your identity source from Active Directory, your existing identity store remains in place, so your users and groups keep the same IDs. As a result, users retain their access to AWS accounts and applications, and policies that reference your user IDs, group IDs, or identity store ID continue to work.

To make this change, configure your new identity source with the standard setup required for users to sign in. After the change, your workforce signs in through your dual-stack AWS access portal URL. Changing your identity source in the other direction, to Active Directory, works as before. This feature is available for organization instances of IAM Identity Center in all AWS Regions where IAM Identity Center is available. IAM Identity Center is provided at no additional cost.

To get started, navigate to the IAM Identity Center console. For more information, see Change your identity source in the IAM Identity Center User Guide. To learn more about IAM Identity Center, visit the product detail page.

AWS Partner Central now features Program Navigator, a unified experience that lets partners discover, apply for, and track AWS Specialization program applications in one place. Partners can browse specialization designations, view requirements and benefits, and submit applications through a guided, step-by-step workflow.

The new Case Study Generator in AWS Partner Central gives partners a redesigned creation experience with three starting paths: build a case study directly with AI assistance, import from an existing customer success story URL, or auto-populate from an opportunity. Case studies created for go-to-market purposes now follow a streamlined review path, a lightweight policy validation that lets partners publish directly to AWS domains without a specialization review. The deeper specialization-level review applies only to case studies associated with Program Navigator applications.

Additionally, AWS has streamlined the specialization application review process through Program Navigator. Partners submitting applications can expect faster review times and more detailed, requirement-level feedback throughout the process. Partners applying for non-specialization programs continue to access those programs through the existing experience.

Program Navigator and Case Study Generator are available to all AWS Partners in AWS Partner Central. To get started, navigate to Program Navigator and Case Studies under the Go to Market section in the left navigation panel.

AWS Transform now supports more types of existing AWS environments when building landing zones for your migration, including AWS Control Tower landing zones and landing zones built with AWS Organizations. AWS Transform runs a foundation gap analysis of your current environment against AWS best practices and expands your landing zone on top of what's already in your target accounts, so your team can start migrating sooner.

AWS Transform also now supports an Infrastructure as Code (IaC)-only mode for building landing zones for your migration. In this mode, AWS Transform analyzes your organization, generates recommendations, and produces IaC tailored to your migration plan in AWS CDK, Terraform, or Landing Zone Accelerator (LZA) format. IaC-only mode is designed for organizations that prefer not to grant AWS Transform direct access to their management account. AWS Transform can now connect through a delegated administrator (DA) account instead. It also benefits customers who manage their own deployment pipeline and don't need the agent to deploy automatically.

The AWS Transform for migrations landing zone agent automates landing zone design end to end, including foundation setup, organizational unit (OU) and account structure, service control policies (SCPs), and workload accounts aligned to your migration planning and waves. You can deploy directly or generate IaC for your own pipeline.

These new capabilities are available in all target AWS Regions supported by AWS Transform for migrations.

To learn more, please visit the AWS Transform User Guide.

Amazon Bedrock Advanced Prompt Optimization now supports prompt shortening, an optional setting that reduces the length of your prompt while maintaining or improving your evaluation scores. Advanced Prompt Optimization optimizes prompts for any model on Amazon Bedrock against your own evaluation criteria. Until now, optimization focused on quality alone. Optimized prompts were often longer than the original. Longer prompts raise input token costs and can increase time to first token, which matters at scale and in latency-sensitive applications.

When you turn on prompt shortening for a prompt template in your input dataset, the optimizer reduces the prompt's length. The optimized prompt is returned only when it is shorter than your original prompt and scores at least as high on your evaluation. Otherwise your original prompt is returned, so the setting never leaves you with a longer or lower-scoring prompt. Results include a compression ratio and the original and optimized token counts, in the output file and on the console results page. For example, a compression ratio of 0.7 means the optimized prompt uses 30% fewer tokens. Prompt shortening works with any evaluation method, including steering criteria, LLM-as-a-judge rubrics, and custom Lambda evaluators.    

Prompt shortening is available in all AWS Regions where Advanced Prompt Optimization is available. To get started, enable prompt shortening for a prompt template in your input dataset and create an optimization job as usual. To learn more, see Shorten prompts in the Amazon Bedrock User Guide, the Amazon Bedrock pricing page, and the Amazon Bedrock product page.

Today, Amazon CloudWatch announces support for including alarm tags in action payloads and Amazon EventBridge events, enabling customers to route and filter alarm notifications by tag without additional lookups. When enabled on an alarm, CloudWatch adds the alarm tags to the messages it sends to Amazon SNS, AWS Lambda, and Amazon EventBridge each time the alarm changes state. This option is designed for customers who route many alarms through a shared notification pipeline and need to identify the owning team, environment, or service directly from the message.

With tags in actions payloads, customers can avoid the extra work of correlating tag metadata with alarm events after the fact. For example, a team that routes hundreds of alarms through a single SNS topic to a Lambda function previously had to call ListTagsForResource for each event to find the owning team before paging. With this feature, the tags arrive in the notification, so the function can route directly from the message. The setting is off by default and configurable per alarm, and customers can include all tags, only selected tag keys, or all tags except selected keys. It is supported for metric, composite, and log alarms.

Tags in actions and events for CloudWatch Alarms are available in all AWS Regions where Amazon CloudWatch is available except Middle East (UAE), and Middle East (Bahrain).

To get started, see  Alarm tags in action payloads  in the Amazon CloudWatch User Guide. To learn more about Amazon CloudWatch Alarms, visit the  Amazon CloudWatch  product page.

AWS Clean Rooms now supports Databricks as a data source, so collaboration members and their partners can securely analyze data managed in Databricks without moving or revealing the source data. Members query a Databricks table shared through Delta Sharing directly in a collaboration. Databricks joins AWS Glue, Snowflake, and Amazon Athena as supported data sources in AWS Clean Rooms.

Previously, members with data in Databricks had to export or replicate it into Amazon S3 to use it as a table in a collaboration, which added pipeline work and an extra copy of the data to govern. Now members can register a Databricks table directly by providing the workspace URL, schema, and table along with a Delta Sharing share, and make it available to a collaboration. For example, a retailer that manages its customer data in Databricks can collaborate with a media partner on campaign measurement in AWS Clean Rooms, running approved analyses against its Databricks data without first building and maintaining an export to S3.

AWS Clean Rooms helps companies and their partners easily analyze and collaborate on their collective datasets without revealing or copying one another’s underlying data. For more information about the AWS Regions where AWS Clean Rooms is available, see the AWS Regions table. To learn more about collaborating with AWS Clean Rooms, visit AWS Clean Rooms.

Amazon Bedrock now supports structured outputs for all Anthropic Claude models across both the bedrock-runtime and the bedrock-mantle endpoint. Whether you call Claude through boto3 and the bedrock-runtime APIs or through the Messages API and the bedrock-mantle endpoint, you can now receive schema-compliant JSON responses that conform to a defined structure, without custom parsing, retry logic, or post-processing.

With structured outputs for Claude on Amazon Bedrock, you can automate reliable, schema-compliant tasks across industries. Examples include extracting every required field from financial earnings reports and compliance documents, parsing clinical notes into Electronic Health Records (EHR), and enriching product catalogs with consistent, validated results. You can also analyze contracts for key terms, parties, and obligations, or power intelligent support ticket routing where intents, sentiments, and entities always match your application's data model.

To learn more, see the Amazon Bedrock documentation . Structured outputs is available where claude models are available. For more information check the regional availability details page.

Nothing last week added a new kind of compute. What it did instead was shorten the distance between the code you already have and that code being live. AWS Lambda learned to run a plain HTTP server with no adapter in front of it, and Amazon S3 became something you can provision from inside the […]

生成 AI アプリケーションは、DDoS 攻撃、SQL インジェクション、悪意のあるボットなど、さまざまな外部脅威にさらされています。この記事では、AWS PrivateLink による Amazon Bedrock へのプライベート接続、AWS WAF と AWS Shield によるエッジでの保護、AWS Network Firewall による境界防御、Amazon GuardDuty による監視を組み合わせた多層防御について、リファレンスアーキテクチャを交えて解説します。

見落とされがちなアウトバウンドトラフィックを悪用したデータ流出を防ぐため、AWS のサービスを組み合わせた多層的なエグレス制御の実装方法を紹介します。ハブアンドスポーク型アーキテクチャを基盤に、AWS Network Firewall と Amazon Route 53 Resolver DNS Firewall による予防的コントロールを構成します。さらに、SCP、RCP、VPC エンドポイントポリシーによるデータ境界、Amazon GuardDuty や AWS Security Hub による発見的コントロールを組み合わせます。あわせて、段階的な導入アプローチと、これらの制御がエージェンティック AI のワークロードにも有効であることを解説します。

サイバー脅威は急速に進化しており、潜在的な問題を抱えるワークロードは 90 秒以内に脅威アクターに発見されます。この記事では、AWS Network Firewall のアクティブ脅威防御を紹介します。アクティブ脅威防御は、Amazon のハニーポットネットワーク MadPot の脅威インテリジェンスを活用し、30 分以内に保護ルールを自動でデプロイします。DNS、HTTP、TLS SNI、IP の各レイヤーでブロックするスイスチーズモデルの多層防御によって、攻撃キルチェーンの各段階を阻止します。また、Amazon GuardDuty との連携に加え、CVE-2025-48703 を悪用して Mythic C2 フレームワークをデプロイしようとした実際の攻撃を阻止した事例も解説します。

日本電気株式会社（以下、NEC）・Anthropic Japan 合同会社（以下、Anthropic）のご協力 […]

このブログ記事では、脅威アクターがダングリング DNS レコードを悪用し、トラフィックを攻撃者が管理するリソースにリダイレクトするサブドメイン乗っ取りの仕組みと対策を説明します。S3、CloudFront、Elastic Beanstalk など乗っ取りの対象になり得るリソースを整理し、具体的なシナリオを分析します。さらに、AWS Config カスタムルールによるプロアクティブな検出、DNS レコードを先に削除する標準作業手順、Security Hub や SNS による通知と修復の方法を紹介します。

Multi-turn agentic workloads reprocess growing conversation context each turn, driving up latency. See how bi-directional KV cache transfer lets prefill and decode nodes reuse previously computed context across turns, cutting time to first token by up to 1.6x for Qwen3-32B and 3.3x for GLM-5-FP8 on Amazon EC2 P5en instances with EFA.

vLLM's prefill-decode disaggregation splits LLM inference across engine instances but must transfer the KV cache between them. This post introduces a push-based NIXL connector that moves transfer coordination off the critical path, delivering up to 3x better TTFT and 30% better TPOT in benchmarks on Amazon EC2 P5en instances with AWS EFA.

Deepgram worked with the AWS Forward Deployed Engineering team to port its Nova-3 speech-to-text model to AWS Trainium2 for offline batch inference. This post covers porting to the AWS Neuron stack, kernel-level tuning, a data-parallel Rust runtime, and the throughput and cost results on batch transcription.

TwelveLabs Pegasus 1.5 is now available in Amazon Bedrock. The video language model turns long-form video into structured, timestamped metadata: define the moments that matter and get every matching segment back as JSON, with new video segmentation, multimodal prompting with reference images, and on-the-fly processing of up to two hours of video.

Amazon SageMaker JumpStart onboarded over 100 new models from 30 providers in the first three quarters of 2026. This recap covers the model-onboarding highlights and JumpStart enhancements, including the simplified Model Hub, pre-configured deployment options, and Hugging Face deep link integration.

New Amazon SageMaker AI customers can now land in a fully configured SageMaker Studio environment in only a few steps. Sign up with an identity you already have, such as Amazon, Apple, GitHub, or Google, with no advanced AWS account or credit card required for most customers, plus $100 in AWS Free Tier credits.

Amazon Bedrock now supports structured outputs for all Anthropic Claude models on both the bedrock-runtime and bedrock-mantle endpoints. Receive schema-compliant JSON that conforms to a defined structure, without custom parsing, retry logic, or post-processing, using JSON Schema output format and strict tool use.