AWS News - 2026-10-31

Amazon Connect Customer now supports versioning and aliasing for flows and flow modules, simplifying how you build, test, and deploy customer experience flows while minimizing impact to live end-customer traffic. With this launch, you can now create immutable versions of a flow and attach one or more friendly names (i.e., aliases) to a version, then point resources such as queues, quick connects, and phone numbers at an alias instead of a specific version.

Rolling out a new version takes a single update, with no need to republish or relink each resource. For example, you can publish an updated customer experience flow as a new version and validate it in a test environment while live traffic stays on the current version, then repoint the production alias to move every phone number to the new version in a single update.

This feature is available in all AWS Regions where Amazon Connect Customer is offered. To learn more, see Flow versioning and aliasing in the Amazon Connect Customer Administrator Guide. To learn more about Amazon Connect Customer, an agentic AI solution that helps enterprises deliver exceptional customer experiences, visit the Amazon Connect Customer website.

AWS WAF announces automatic SDK integration for Amazon CloudFront distributions. When you enable it, CloudFront adds the script tag for the AWS WAF JavaScript SDK to the HTML it serves, with no change to your application code, build process, or deployment. The SDK supplies the client-side signals used by three AWS WAF managed rule groups: Bot Control at the targeted inspection level, Fraud Control account takeover prevention (ATP), and Fraud Control account creation fraud prevention (ACFP).

Previously, supplying those signals required you to add a script tag to every page of every application you wanted to protect, and to maintain that tag across releases. For teams running many applications, or serving pages produced by systems they do not control, this created recurring work and a common source of misconfiguration, where a protection was enabled in AWS WAF but the client-side integration was missing. Enabling automatic SDK integration on the web ACL protecting your CloudFront distribution removes that per-application work.

Automatic SDK integration is available for web ACLs that are used with Amazon CloudFront and contain at least one of those managed rule groups. You can configure it using the AWS Management Console, CLI, SDK, CDK, or CloudFormation. In the AWS WAF console, the setting appears with the managed rule group settings and is on by default for new web ACLs that you create with one of those rule group. When you create a web ACL programmatically, the setting is off by default. Web ACLs created before this release are unchanged.

There is no additional charge for automatic SDK integration. For requirements, limitations, and Content Security Policy guidance, see Automatic SDK integration for CloudFront distributions in the AWS WAF Developer Guide.

Amazon MSK now supports version 1.3 of Transport Layer Security (TLS) protocol for MSK Provisioned clusters through encryption policies. TLS 1.3 delivers faster, more secure encryption for streaming data and is increasingly required by compliance frameworks and enterprise security standards. It is also one of the prerequisites for post-quantum cryptography for protecting data against attacks that collect encrypted traffic now with the intent to decrypt it later.

Customers can opt in to TLS 1.3 by selecting a named security policy in their MSK cluster configuration, with no change to existing clusters until a policy is applied. A named security policy defines which TLS version and cipher suites a cluster can accept. With this launch, Amazon MSK provides a set of policies customers can select and any connection that does not meet the selected policy requirements is rejected. This allows customers to stay in control of their security and compliance posture. Policies that support both TLS 1.2 and TLS 1.3 allow connections to negotiate the highest version the client supports allowing clients that support TLS 1.3 to connect on it immediately while clients on TLS 1.2 continue to connect on TLS 1.2. This lets customers upgrade their clients at their pace before applying a stricter policy. Customers can also select stricter policies that align closer with their compliance requirements to restrict connections to TLS 1.3 only.

This capability is available at no additional cost in all AWS Regions where Amazon MSK Provisioned is available. To learn more, see the Amazon MSK documentation.

Amazon Relational Database Service (Amazon RDS) for Oracle now lets you turn off automatic minor version upgrades on new and existing DB instances that use the JVM, Spatial, Locator, or OLAP option. Previously, these options required automatic minor version upgrades to be enabled.

With this change, you decide when to apply minor version upgrades to DB instances using these options. If you turn off automatic minor version upgrades, we recommend that you apply new minor versions regularly so your DB instances keep the latest Oracle security fixes. To keep automatic minor version upgrades turned on and still control the order in which your environments are upgraded, you can use AWS Organizations upgrade rollout policy.

This change is available in all commercial AWS Regions and the AWS GovCloud (US) Regions where Amazon RDS for Oracle is available. To learn more about options available in Amazon RDS for Oracle, see Adding options to Oracle DB instances in the Amazon RDS User Guide.

Amazon CloudFront can now forward two new optional headers to your origin. The CloudFront-Viewer-ISP header contains the name of the viewer's internet service provider (ISP), so you can see which network a request came from. The CloudFront-Viewer-TLS-Details header describes the cryptography used on each viewer's TLS connection, so you can see whether a connection used post-quantum cryptography (PQC).

With CloudFront-Viewer-ISP, you can break down traffic and performance by network. You can also isolate unusual traffic from a single provider. CloudFront-Viewer-TLS-Details includes the key exchange, signature scheme, and signature public key type for each connection. You can use it to measure the share of viewers that actually connect with PQC and identify clients that do not yet do so. To forward either header to your origin, add it to an origin request policy and attach the policy to your distribution.

To get started, see adding CloudFront headers and controlling origin requests with a policy in the Amazon CloudFront Developer Guide

Security teams need powerful tools to find vulnerabilities, test exploits, and build defenses. Daybreak Red from OpenAI is now available to eligible customers on Amazon Bedrock in AWS GovCloud (US-East), bringing advanced AI to this work.

 

Part of OpenAI’s Daybreak cyber defense initiative, Daybreak Red: GPT-5.6 Cyber is built for authorized vulnerability research, exploit reproduction, and mitigation development. It gives verified defenders more room to investigate complex security problems, with fewer refusals for this work and stronger identity verification, monitoring, and access controls.

Daybreak Red runs on Bedrock’s next-generation inference engine, with zero-operator access enforced at the chip. Your inference data is not used to train models, and you do not need to share your Daybreak Red data with OpenAI.

 

The model is available in US East (Ohio) and AWS GovCloud (US-East). Access to the model requires enrollment in Daybreak access from OpenAI. To get started, contact OpenAI or your AWS account team about Daybreak eligibility. Once approved, work with your AWS account team to enable access. Learn more in the blog.

Amazon Connect Customer automatically saves in-progress emails as drafts, helping agents resume work without losing progress when connectivity is interrupted or when their browser is accidentally closed or refreshed. When agents return, their drafts are restored with the message body, recipients, subject line, and attachment references intact. Customers can also access saved draft data in their Amazon S3 buckets to build integrations with other applications.

Kiro web search gives the agent real-time access to current information on the internet, so its answers draw on up-to-date search results and page content. The agent uses web search automatically when a question involves recent changes or topics beyond the model's training data. Answers that use web results include citations.

Kiro enterprise administrators can turn off web search and web fetch for their organization from the Kiro console under Settings. Teams can also remove web tools from individual custom agents, or block them with capability-based permission rules.

For more details, visit the AWS GovCloud (US) documentation, the monitoring and tracking guide, or contact your AWS account team. To learn more about Kiro, visit the Kiro product page.

Amazon Bedrock now supports the OpenAI GPT-5.6 models (Terra and Luna) on the bedrock-runtime endpoint, with support for the Responses, Converse, and Chat Completions APIs in AWS GovCloud (US). It also adds support for cross-Region inference, allowing customers to use cross-Region inference within AWS GovCloud (US) regions to access higher throughput and increased redundancy.  

Cross-Region inference automatically routes inference requests across both AWS GovCloud (US) Regions to give you higher throughput, without you needing to manage capacity across multiple Regions. Cross region inference within AWS GovCloud (US) routes requests across both regions so you can scale while maintaining US data sovereighnty, giving you the broadest access to Bedrock capacity and the highest throughput during demand spikes. This launch also expands API support; you can use OpenAI GPT models with the Responses API, Chat Completions API, and the Converse API on the bedrock-runtime endpoint. Because these native OpenAI APIs now run on bedrock-runtime, the models work with the same account-level controls you already use for other models on Bedrock: usage appears in Bedrock model invocation logging (deliverable to Amazon S3 or Amazon CloudWatch Logs) and in Amazon CloudWatch metrics covering invocation counts, token counts, latency, throttles, and errors, and it is itemized in AWS Cost Explorer and the AWS Cost and Usage Report so you can attribute spend by model.

Cross-Region inference for OpenAI models is available in all AWS Regions where OpenAI models on Amazon Bedrock are offered. To get started, review the model cards for GPT 5.6 (Terra and Luna) in the Amazon Bedrock User Guide.

Amazon Bedrock now supports the OpenAI GPT-5.6 models (Terra and Luna) on the bedrock-runtime endpoint, with support for the Responses, Converse, and Chat Completions APIs in AWS GovCloud (US). It also adds support for Cross-Region Inference, allowing customers to use Cross-Region Inference within AWS GovCloud (US) regions to access higher throughput and increased redundancy.  

Cross-Region Inference automatically routes inference requests across both AWS GovCloud (US) Regions to give you higher throughput, without you needing to manage capacity across multiple Regions. Cross-Region Inference within AWS GovCloud (US) routes requests across both regions so you can scale while maintaining US data sovereignty, giving you the broadest access to Bedrock capacity and the highest throughput during demand spikes. This launch also expands API support; you can use OpenAI GPT models with the Responses API, Chat Completions API, and the Converse API on the bedrock-runtime endpoint. Because these native OpenAI APIs now run on bedrock-runtime, the models work with the same account-level controls you already use for other models on Bedrock: usage appears in Bedrock model invocation logging (deliverable to Amazon S3 or Amazon CloudWatch Logs) and in Amazon CloudWatch metrics covering invocation counts, token counts, latency, throttles, and errors, and it is itemized in AWS Cost Explorer and the AWS Cost and Usage Report so you can attribute spend by model.

Cross-Region Inference for OpenAI models is available in all AWS Regions where OpenAI models on Amazon Bedrock are offered. To get started, review the model cards for GPT-5.6 (Terra and Luna) in the Amazon Bedrock User Guide.

AWS Compute Optimizer now provides rightsizing recommendations for 389 additional Amazon Elastic Compute Cloud (Amazon EC2) instance types in AWS GovCloud (US-West) and 276 in AWS GovCloud (US-East) Regions. Customers running regulated and government workloads can find the same cost and performance opportunities on current-generation instance types without manual analysis.

Compute Optimizer has expanded support to include the latest generation families in every workload category. The additions include Compute Optimized (C7i, C7i-flex, C8g, C8gn), General Purpose (M7i, M7i-flex, M8g, M8gd, M8i, M8i-flex), Memory Optimized (R7i, R8g, R8gd, R8i, R8i-flex), Memory Intensive (X2iedn, X8i), and Storage Optimized (I7i, I7ie, I8g, I8ge) instance types. With this expansion, Compute Optimizer supports 724 instance types across 102 families in AWS GovCloud (US-West) and 542 instance types across 69 families in AWS GovCloud (US-East), in both EC2 instance and EC2 Auto Scaling group recommendations.

This expanded coverage is available today at no additional cost in the AWS GovCloud (US-West) and AWS GovCloud (US-East) Regions. You can start using Compute Optimizer through the AWS Management Console, AWS CLI, or AWS SDK. To learn more, see the AWS Compute Optimizer product page and AWS Compute Optimizer in the AWS GovCloud (US) User Guide.

spec 駆動開発 (SDD) は、大規模なチームのソフトウェア開発のやり方を変えつつあります。プロンプトだけに頼るのではなく spec を書き、それに沿って AI コーディングエージェントに設計、タスク、実装を進めさせます。

Kiro が毎年ハロウィンの時期に開いているハッカソン Kiroween が、今年も始まりました。提出の締め切りは日本時間 2026 年 12 月 5 日（土）午前 7 時で、賞金の総額は 10 万ドルです。

Bulletin ID: 2026-157-AWS
Publication Date: 10/30/2026 09:00 AM PDT

Description:

We identified CVE-2026-119116, a use-after-free in the SetClient command handler of the kmstool-enclave example application, where an application that executes on the parent EC2 instance could send crafted messages over vsock to corrupt heap memory inside the enclave and execute arbitrary code within it. Only enclave images that include kmstool-enclave, or code derived from it, are affected.

We also identified CVE-2026-119148, an input validation issue in the SDK library where the AWS KMS server name is built from a caller-supplied region string. A third party could supply a crafted region to impersonate KMS to the enclave and inject forged responses, such as actor-chosen key material.

Impacted versions: aws-nitro-enclaves-sdk-c <= v0.4.5 (CVE-2026-119116 affects kmstool-enclave only; CVE-2026-119148 affects the library)

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read this article

Bulletin ID: 2026-158-AWS
Publication Date: 10/30/2026 10:30 AM PDT

Description:

FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Applications that are built without queue sets are not affected.

Impacted versions: >=V7.4.0 AND <=V11.3.2 (MPU-enabled ports with configUSE_QUEUE_SETS=1)

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read this article

Bulletin ID: 2026-159-AWS
Publication Date: 10/30/2026 11:00 AM PDT

Description:

We published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.

Impacted versions:
- com.amazonaws:amazon-kinesis-producer <= 0.15.12
- oftware.amazon.kinesis:amazon-kinesis-producer < 1.0.8

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read this article

Bulletin ID: 2026-160-AWS
Publication Date: 10/30/2026 22:15 PM PDT

Description:

AWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later that could result in remote code execution. Updated kernel packages are available for Amazon Linux 2 and Amazon Linux 2023, and we recommend customers running self-managed Linux instances update and reboot. AWS is applying updates to managed services and no customer action is required for those services. For full details and per-service guidance, see the complete bulletin at https://aws.amazon.com/security/security-bulletins/2026-160-aws/

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

The ChatGPT desktop app is now available on Amazon Bedrock in AWS GovCloud (US). This post walks through a controlled local deployment that routes model inference to Amazon Bedrock in AWS GovCloud (US-West) using API-mode sign-in, a managed device policy, a named AWS profile, and network restrictions, so a security team can validate it before broader use.

Worldwide Express automated its less-than-truckload freight billing-exception process with a multi-agent solution built on Amazon Bedrock. Six months after launch, the company cut active exceptions by 75%, improved time-to-cash by four weeks, and unlocked $10 million in free cash flow.

Amazon Bedrock AgentCore Session endpoints give each runtime session an authenticated URL that forwards any HTTP method, path, and WebSocket connection to the ports you allow. In this post, you deploy a coding agent that keeps a Vite website running in its session, then watch the live site update in your browser as the agent edits files.

This post presents a five-stage operating model for managing Amazon Bedrock cost: attribute every dollar to an owner, make every request observable, enforce budgets, optimize platform defaults, and operate a review cadence. Written for FinOps and platform engineering teams.