AWS News - 2026-10-26

AWS Glue Data Catalog now supports OAuth 2.0 bearer token authentication for Apache Iceberg REST Catalog (IRC) APIs using AWS Sign-In. The Apache Iceberg REST Catalog specification defines OAuth 2.0 as its standard authentication mechanism, and query engines such as Apache Spark, Trino, and Apache Flink implement it natively. These engines and external integration partners can now authenticate to the Glue Data Catalog Iceberg endpoint using standard OAuth 2.0 bearer tokens, in addition to AWS Signature Version 4 (SigV4).

You can now grant partners federated access to your Iceberg tables without distributing AWS credentials. Using OAuth 2.0 Token Exchange (RFC 8693), you exchange an OpenID Connect (OIDC) identity token for a short-lived, Glue-scoped bearer token and include it in IRC requests following the same standards-based pattern used across the Iceberg ecosystem. Access remains governed by AWS IAM and AWS Lake Formation permissions. Common use cases include enabling third-party analytics and data cloud platforms to query tables in the Glue Data Catalog through a single, consistent authentication path.

This capability is available in all AWS Regions where AWS Glue and Lake Formation are available. To learn more, see the AWS Glue User Guide and AWS Sign-In User Guide.

Amazon Relational Database Service (Amazon RDS) for SQL Server now supports the latest Cumulative Updates (CU) and General Distribution Release (GDR) updates for Microsoft SQL Server. This release includes support for Microsoft SQL Server 2017 CU31+GDR KB5122774 (RDS version 14.00.3550.4.v1), SQL Server 2019 CU32+GDR KB5122772 (RDS version 15.00.4490.9.v1), SQL Server 2022 CU27 KB5104824 (RDS version 16.00.4295.3.v1) and SQL Server 2025 CU9 KB5122048 (RDS version 17.00.5005.3.v1).

For additional information on the improvements and fixes included in these updates, see Microsoft documentation for KB5122774, KB5122772, KB5104824 and KB5122048. We recommend that you upgrade your Amazon RDS for SQL Server instances to apply these updates using Amazon RDS Management Console, or by using the AWS SDK or CLI. You can learn more about upgrading your database instance in the Amazon RDS SQL Server User Guide for upgrading your RDS Microsoft SQL Server DB engine.

AWS EC2 Auto Scaling now lets you enable Launch Before Terminate as the default replacement behavior across all Auto Scaling groups in your account. When enabled, Auto Scaling launches a replacement instance and waits for it to pass health checks before terminating the instance it replaces, helping your applications maintain full capacity and availability during instance replacement events. This applies to replacement events such as instance refreshes, rebalancing, health checks, and maximum-instance-lifetime replacements.

You can enable Launch Before Terminate through AWS EC2 Auto Scaling account settings, which let you configure the behavior once at the account level instead of on each Auto Scaling group individually. You can manage the setting with the new `PutAccountSetting` and `DescribeAccountSettings` APIs, available through the AWS Management Console, AWS CLI, or AWS SDKs.

Launch Before Terminate is available in all AWS Regions at no additional cost.

To learn more, see Launch Before Terminate in the AWS EC2 Auto Scaling User Guide and AWS EC2 Auto Scaling API Reference Guide.

AWS Key Management Service (KMS) now supports Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), a post-quantum cryptography standard under NIST FIPS 203, which enables two parties to establish a shared secret. NIST designed ML-KEM to replace the classical key-establishment schemes, like DH/ECDH key agreement, and RSA-based key transport, in their strategic cryptographic roadmap (see NIST IR 8547). ML-KEM addresses the "harvest now, decrypt later" threat to those classical schemes, where an adversary records the key-establishment exchange today and recovers the shared secret once sufficiently powerful quantum computers become available.

KMS supports all three ML-KEM key specs defined in NIST FIPS 203: ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The Encapsulate API uses the public key to produce a random 32-byte shared secret and its ciphertext form. The Decapsulate API recovers the shared secret from ciphertext using the corresponding private key. KMS protects the private key of an ML-KEM key pair in FIPS 140-3 Level 3 validated hardware security modules (HSMs). You can use the GetPublicKey API to export the public key and distribute it to partners, client applications, or external systems for performing the encapsulate operation locally using cryptographic libraries like AWS-LC, OpenSSL, or Bouncy Castle.

ML-KEM is available in all AWS Regions where KMS is available, except the the Middle East (UAE), Middle East (Bahrain), and China Regions. For more information, see Key spec reference in the AWS KMS Developer Guide.

AWS Elemental MediaConnect Router now supports managing external connections through a new endpoint registry. The registry provides a centralized interface to register and manage both standard endpoints—devices or software outside the service, such as cameras, sources, monitors, and other destinations—and connections to other AWS accounts. You can share registered endpoints directly with other AWS accounts, streamlining cross-account live video workflows. 

Cross-account endpoint sharing lowers costs by reducing required compute instances and decreases latency through fewer network hops when sharing live content across AWS accounts.. It also eliminates the need to manually chain router inputs and outputs, coordinate IP addresses out of band, and manage connection security. The endpoint registry gives you a single interface to manage all external connections to MediaConnect for seamless integration with your existing infrastructure. You get cross-account sharing through AWS Resource Access Manager (AWS RAM), transparent verification of encryption and protocol controls, and built-in connection management with Connection Manager. Use cases include content distributors sharing live feeds with downstream partners, broadcasters collaborating across organizational boundaries, and media workflows that require secure cross-account video transport.

MediaConnect endpoint registry is available in all AWS Regions where AWS Elemental MediaConnect Router is available, at no additional cost. For more information, see the AWS Elemental MediaConnect User Guide.

Amazon Connect Customer now scores the outcome of your customer interactions. It shows whether the customer left satisfied, is at risk of churning, made a purchase, or resolved their need in self-service. You can now see whether an interaction worked, not just how efficiently it ran. Each metric comes with a default definition you can adjust to match how your business defines success and are available both through the analytics dashboards and APIs.
 

Now you can view your metrics across customer segments: customer lifetime value (LTV) and repeat callers. See how any metric differs for repeat callers versus the rest of your contacts, or how results hold up among your highest-LTV customers; so you can spot the groups trending the wrong way before it shows up in the aggregate. Where a segment is underperforming, you can act. Route high-LTV customers to your most effective people, adjust the knowledge bases and self-service flows that repeat callers are falling back from, or refine agent guidance for segments where satisfaction is slipping. The segment tells you where to look; the metrics tell you what to fix.

契約書、製品マニュアル、調査レポートなど、企業の価値ある知識は Amazon S3 に保存されたドキュメントに蓄積されています。本記事では、Amazon OpenSearch Serverless (NextGen) の新機能である Amazon OpenSearch intelligent ingestion を使い、こうしたドキュメントの解析、画像の説明生成、チャンク分割、ベクトル埋め込みの生成、インデックス化までを、取り込みパイプラインを運用せずに実行する方法を紹介します。

組織で Kiro を導入すると、誰がどれだけ使い、そのコストがどこで発生しているのかを継続的に把握する必要が出 […]

Kiro を組織全体に展開すると、利用状況とコストを定期的に、複数の AWS アカウントにまたがって確認する必 […]

継続的記録と定期的記録のどちらを選ぶべきか。AWS Config の記録頻度は運用上の可視性とコストの両方を左右します。本記事では、リソースの静的性、リソース間の関係、ベースラインの変更頻度という 3 つの要素と 4 つのユースケースから、環境に適した記録方法を選ぶ方法を解説します。

本記事は、2026年10月5日にNetworking & Content Delivery で公開され […]

Amazon GuardDuty が Runtime Monitoring 向けのオプション脅威検出ルールを追加、Amazon Bedrock 上の Claude モデルで Structured Outputs が利用可能に、AWS Transform が新規ネットワークの構築とセキュリティグループの最新化に対応、AWS Continuum for code vulnerabilities が一般提供開始 など

今週の「週刊生成 AI with AWS」は、NEC 様の Claude Code 全社展開（約 3 万人体制を目指す CoE・チャンピオン制度）と、コーテッグ様が Amazon Bedrock AgentCore で構築した AI 分析基盤「Dotta」の 2 つの国内事例や、Amazon Bedrock の API キー保護や最小権限、AI コーディングエージェント向けコントロールフレームワークなどセキュリティ関連のブログに加え、AWS Physical AI Toolchain、AWS DevOps Agent の調査コスト制御も取り上げています。 サービスアップデートでは、Amazon Bedrock での Claude 構造化出力、Amazon CloudWatch Omni の東京リージョン対応、Kiro IDE と CLI のメモリ機能など 25 件を紹介しています。