AWS News - 2026-11-03

Amazon Connect Customer now enables you to invoke Model Context Protocol (MCP) tools in customer experience flows through the new 'External Tool' block. With this launch, you can connect flows to third-party applications through Amazon Bedrock AgentCore Gateway and reuse the same tools used by your agentic experiences to retrieve data or trigger actions, without writing custom Lambda functions. For example, when a customer contacts a financial institution about a recent transaction, a flow can use the External Tool block to retrieve relevant context from a third-party application, such as case history from their CRM system, or transaction details from a banking platform.

This feature is available in the following AWS Regions: US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (London), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), and Asia Pacific (Tokyo). To learn more about this feature, refer to the administrator guide. To learn more about Amazon Connect Customer, an agentic AI solution that helps enterprises deliver exceptional customer experiences, visit the Amazon Connect Customer website.

Amazon Connect Customer now supports Cases and External Tool events in the Wait block, giving you more control over how your customer experience flows react to real-time data changes. In addition to waiting for a Lambda function to complete, you can now wait until a Connect Case field meets a specified condition or an External Tool invocation completes. This enables you to wait for critical information before advancing an interaction, reducing unnecessary transfers and saving time for both your end-customers and agents. For example, you can hold a flow until a refund status field is updated on a case, then automatically resume and route the interaction based on the outcome. 

To learn more about this feature, refer to the administrator guide and availability of Connect Customer features by Region. To learn more about Amazon Connect Customer, an agentic AI solution that helps enterprises deliver exceptional customer experiences, visit the Amazon Connect Customer website.

For organizations that use Amazon Quick, the desktop application now signs users in with the same sign-in method the organization already uses for Quick on the web. Administrators no longer need to register an OIDC application in their identity provider or set up separate desktop sign-in before users can get started. If a user can sign in to Quick on the web, that user can sign in to the desktop application.

To turn on desktop access, an administrator adds the desktop connector once in the Amazon Quick console. Users then enter their Quick account name, choose Sign In, and finish signing in through their browser. This works for accounts that use IAM Identity Center, IAM federation, or native Amazon Quick users. If your organization wants to manage desktop sign-in separately, you can still set up a dedicated identity provider configuration with providers such as Microsoft Entra ID, Google Workspace, Okta, or Ping Identity.

Amazon Quick on desktop is available in AWS Regions that support the full Amazon Quick feature set.

To get started, see Amazon Quick on desktop in the Amazon Quick User Guide.

Starting today, Amazon RDS supports per snapshot billing for Amazon RDS snapshots. Per snapshot billing allows you to get the cost of each individual snapshot.

Previously, RDS snapshot charges were aggregated at the database instance level on the Cost and Usage report as well as the Cost Explorer. This meant that while understanding the snapshot charges, you could only see the aggregate view at the database instance instead of drilling down to each individual snapshot. Now, you can use cost allocation tags on your snapshots to see exactly how much each snapshot costs, giving you a better understanding of your backups spend and budgets. Per snapshot billing is enabled by default on all RDS snapshots for no additional charge.

Per snapshot billing is available for all Amazon RDS engines in all commercial AWS Regions and the AWS GovCloud (US) Regions. To learn more, please visit our documentation.

A new Anthropic model is now available in the Kiro IDE and CLI for the AWS GovCloud (US) Regions. With Haiku 5.5, all three Claude 5.5 models are now available in Kiro in AWS GovCloud (US).

Claude Haiku 5.5 is the fastest model in the Claude 5.5 family. It's a clear step up from Claude Haiku 4.5, built for work that runs in large volumes and needs quick responses. Developers can use it to summarize and compact long context, classify and route requests, process text in bulk, and make small, targeted edits across many files. It also works well as a review subagent that runs in parallel, while Opus 5.5 and Sonnet 5.5 take on harder planning and coding work. Haiku 5.5 uses adaptive thinking across five effort levels from low to max, with medium as the default. It's available with a 1M context window and a 0.06x credit multiplier. Requests over 100K tokens are billed at a 0.3x multiplier.

Ensure your IDE or CLI is updated to the latest version, then restart it to access the new model from the model selector. For more details, visit the GovCloud documentation, the monitoring and tracking guide, or contact your AWS account team. To learn more about Kiro, visit the Kiro product page.

Amazon Relational Database Service (Amazon RDS) for Oracle now supports M8i and R8i instances in additional AWS Regions. Both M8i and R8i instances are now available in Asia Pacific (New Zealand) and Canada West (Calgary), and R8i instances are now available in Europe (Milan, Stockholm, and Zurich) and Israel (Tel Aviv).

These instances are powered by custom Intel Xeon 6 processors, available only on AWS, delivering the highest performance and fastest memory bandwidth among comparable Intel processors in the cloud. The M8i and R8i instances offer up to 15% better price-performance, and 2.5x more memory bandwidth compared to previous generation Intel-based instances.

M8i and R8i instances are available for Amazon RDS for Oracle in Bring Your Own License model for Oracle Database Enterprise Edition (EE) and Oracle Database Standard Edition 2 (SE2). For EE, instances are available in sizes from large to 48xlarge, as well as bare metal sizes metal-48xl and metal-96xl. For SE2, instances are available in sizes from large to 4xlarge and bare metal sizes metal-48xl and metal-96xl. Refer to Amazon RDS for Oracle Pricing for available instance configurations, pricing, and region availability.

The Amazon Elastic Kubernetes Service (Amazon EKS) Capability for Argo CD now supports Argo CD Notifications, providing notifications when your applications sync, fail, or change health. You define triggers and message templates in your cluster and subscribe individual Applications with an annotation, the same way you do in upstream Argo CD.

With this launch, you can deliver notifications to 16 notification services, including Slack, PagerDuty, Opsgenie, Amazon SQS, and Amazon EventBridge. The Amazon SQS and Amazon EventBridge services authenticate with your IAM Capability Role, so you can route deployment events into your own event-driven workflows without storing credentials in your cluster. For a service that requires third-party credentials such as a Slack token, you can specify an AWS Secrets Manager ARN in place of the secret and EKS will automatically use it on your behalf.

Notifications are available in all AWS Regions where the EKS Capability for Argo CD is available, at no additional charge. Standard charges apply for resources related to the services your notifications use, for example Amazon SQS or Amazon EventBridge. To learn more, visit Amazon EKS and refer to the Amazon EKS User Guide.

AWS Transform for mainframe now discovers business functions with field-level precision and generates a new requirements coverage report in the assess and reimagine workflow. Previously, business functions that used the same table or file were grouped together, and you had to build your own traceability reporting from AWS Transform artifacts. With this launch, you can start modernizing z/OS COBOL and PL/I workloads from a more accurate catalog of business functions and verify requirements coverage before you build.

Business functions are now grouped only when they affect the same data fields. They also include screens and queues and carry clearer names and descriptions. The new requirements coverage report shows how every part of your application is accounted for in the generated requirements. Every line of source code is classified by how it was handled, every business rule links to the exact lines it came from, and every requirement is backed by the business rules that support it. You can review coverage from the full portfolio down to a single line before moving into forward engineering in Kiro and other IDEs.

These capabilities are available in all AWS Regions where AWS Transform for mainframe is available. For more information, see the AWS Region table. To learn more, visit AWS Transform for mainframe or see the AWS Transform for mainframe documentation.

Amazon CloudWatch now supports bearer token authentication, using API keys (bearer tokens), as an additional option for sending OpenTelemetry traces to the AWS X-Ray OpenTelemetry Protocol (OTLP) traces endpoint. Any OTLP/HTTP client that can set an Authorization header, including the OpenTelemetry Collector and OpenTelemetry SDK exporters, can now authenticate with a bearer token instead of signing requests with AWS Signature Version 4 (SigV4). This helps teams send traces from workloads that can't use the AWS SDK or short-term credentials, such as applications running on premises or in other clouds, CI/CD pipelines, and third-party tools that support only a static Authorization header.

SigV4 remains the recommended authentication method for sending traces to CloudWatch, and the AWS Distro for OpenTelemetry (ADOT) SDKs continue to use SigV4 by default with no changes required. Traces sent with either method get the same CloudWatch capabilities, including Transaction Search, Amazon CloudWatch Application Signals, and Amazon CloudWatch Omni.

Bearer token authentication for traces is available in all commercial AWS Regions where the AWS X-Ray OTLP traces endpoint is available.

To learn more, see Setting up bearer token authentication for traces in the AWS X-Ray Developer Guide.

Amazon Relational Database Service (Amazon RDS) for SQL Server now supports the latest Cumulative Updates (CU) and General Distribution Release (GDR) updates for Microsoft SQL Server. This release includes support for Microsoft SQL Server 2017 CU31+GDR KB5128496 (RDS version 14.00.3560.2.v1), SQL Server 2019 CU32+GDR KB5128494 (RDS version 15.00.4500.2.v1), SQL Server 2022 CU27+GDR KB5126934 (RDS version 16.00.4305.5.v1) and SQL Server 2025 CU10 KB5125471 (RDS version 17.00.5035.5.v1).

For additional information on the improvements and fixes included in these updates, see Microsoft documentation for KB5128496, KB5128494, KB5126934 and KB5125471. We recommend that you upgrade your Amazon RDS for SQL Server instances to apply these updates using Amazon RDS Management Console, or by using the AWS SDK or CLI. You can learn more about upgrading your database instance in the Amazon RDS SQL Server User Guide for upgrading your RDS Microsoft SQL Server DB engine.

The agentic launches that stayed with me last week had nothing to do with how capable a model is. They were about reach. AWS Step Functions, which already orchestrates over 220 AWS services, can now be handed to an agent as a tool, so workflows teams already trust became callable without a rewrite. In the […]

Kiro が自身のコードの一部を Lean でモデル化し、そのモデルについての定理を証明し、各モデルを TypeScript、Rust、Python のコードと照らし合わせる作業を、自動で進める仕組みを作りました。最初に適用した対象は Kiro 自身です。

OpenAI GPT-6.1 Terra が Amazon Bedrock で一般提供開始、Amazon EKS Auto Mode が Kubernetes Gateway API をサポート、Amazon ECS で NVIDIA MPS による GPU 共有が可能に、Amazon SageMaker AI のリアルタイム推論で GPU パーティショニングに対応、AWS Lambda Managed Instances で SOCI による遅延読み込みに対応、Amazon Quick でエージェントアクションのスマート承認に対応、次世代 Amazon OpenSearch Serverless で時系列コレクションが利用可能に、Amazon Redshift で自動クロスリージョンバックアップが可能に、AWS KMS がポスト量子暗号の ML-KEM をサポート、Amazon Aurora PostgreSQL でポスト量子 TLS 鍵交換をサポート等

AWS re:Invent 2026 の Cloud Operations トラックから、Monitoring and Observability の 25 セッションを 6 つのテーマに沿って紹介します。本番環境の AI エージェントの観測、OpenTelemetry による標準化、ログ活用、フルスタックのパフォーマンストレース、マネージドなオープンソースオブザーバビリティまで、参加計画に役立つセッションを取り上げます。

As the email administrator for your organization’s domain, you receive a Domain-based Message Authentication, Reporting, and Conformance (DMARC) aggregate report showing email passing DomainKeys Identified Mail (DKIM) verification as though it came from your domain, sent from IP addresses you don’t recognize to recipients you didn’t contact. To clear the issue, you rotate your DKIM […]

Bulletin ID: 2026-161-AWS
Publication Date: 11/02/2026 08:30 AM PST

Description:

We are aware of CVE-2026-119301 in the Apache Iceberg write component, where improper neutralization of quoting syntax in SQL identifier construction could allow an authenticated user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.

Impacted versions: awswrangler >= 3.5.2, < 3.17.1

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read this article

Bulletin ID: 2026-162-AWS
Publication Date: 11/02/2026 09:30 AM PST

Description:

Virtual Engineering Workbench (VEW) is an open-source platform where platform engineers define and publish development environments, and developers provision them on demand through a web portal. We identified CVE-2026-119085, where improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role.

Impacted versions: All commits before c146486 (PR #31, merged 2026-05-04)

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read this article

Bulletin ID: 2026-163-AWS
Publication Date: 11/02/2026 11:00 AM PST

Description:

aidlc-traceability is an open source command-line tool, formerly published in the awslabs/aidlc-workflows repository, that generates traceability-matrix reports from a project's AI-DLC artifact files. We identified CVE-2026-120497, where stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI could allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions.

Impacted versions: >=0.1.0 AND <commit 96cf0ea (fixed 2026-07-03)

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read this article

Bulletin ID: 2026-164-AWS
Publication Date: 11/02/2026 13:30 PM PST

Description:

We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory.

Impacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read this article

Keeping a large Amazon EC2 fleet continuously recoverable with AWS Elastic Disaster Recovery is a lifecycle challenge. This post shows how to automate the full DRS agent lifecycle (install, heal, and offboard) using AWS Systems Manager Automation and Amazon EventBridge, driven by a single EC2 tag and no Lambda functions.

A disaster recovery strategy is only as strong as the business decisions behind it. Before you choose an architecture pattern, three decisions shape whether recovery succeeds: what you're actually recovering, what the business needs from that recovery, and what your dependencies allow you to commit to. Part 1 of a three-part series.

After you define your DR targets, testing tells you whether they hold. This post walks through a four-level progressive validation model (tabletop, planned failover, surprise drill, and game day) and shows how each level surfaces a different class of recovery gap that feeds back into your commitment. Part 2 of a three-part series.

This final post turns the DR framework into a repeatable engagement: a five-step sequence from kickoff and gap assessment through progressive validation to an updated recovery commitment, with a real before-and-after example and ways to compress the timeline from months to weeks. Part 3 of a three-part series.

Circle K's DevOps team cut incident triage from 45-60 minutes to under 15 by building an agentic triage system on Amazon Bedrock. This post walks through the architecture, the initial Amazon Bedrock Flows implementation, the migration to Amazon Bedrock AgentCore, and the lessons learned from scaling it.

Learn how to build a multi-agent engineering assistant that compresses aerospace component substitution evaluation from days to minutes, using Amazon Nova Multimodal Embeddings, Amazon Bedrock AgentCore, and the Strands Agents SDK to assemble substitution evidence while keeping the engineer as the decision-maker.

Agentic assistants built on frontier models run a multi-step tool loop, and paying frontier prices on every step is hard to sustain at production scale. This post shows how to use sequence-level knowledge distillation (SeqKD) to transfer a frontier teacher's agentic behavior into a small, lower-cost student on Amazon SageMaker AI.

This post shows how to use Crawl4AI, an open source web crawler, as a content preparation layer for Amazon Bedrock Knowledge Bases, handling JavaScript rendering, selective extraction, and custom metadata enrichment before web content reaches an Amazon S3 data source.

AWS Lambda event source mappings now support queue consumption mode for Apache Kafka. Using Kafka Share Groups, you can scale consumer parallelism independently of partition count, with per-record acknowledgment, visibility timeouts, and automatic retries on self-managed Kafka 4.2 or later clusters.