AWS News - 2026-11-05

AWS Interconnect - last mile is now available in preview with Equinix. You can connect your infrastructure across Equinix's global network of 282 data centers worldwide to AWS in a few clicks.

Interconnect - last mile gives you managed, private, and resilient connections to AWS, so you don't have to order cross-connects or configure routers. To set up in the AWS Management Console, choose an AWS Region, a bandwidth speed, a Direct Connect gateway, and your Equinix Fabric One project ID. AWS generates an activation key, which you enter in the Equinix Fabric One portal to complete the setup. You can also initiate the connection from the Equinix Fabric One portal. AWS and Equinix set up quad-redundant capacity in advance, across two locations and four separate links, with BGP peering, VLANs and ASNs configured for you. Every connection is built for maximum resilience and comes with a 99.99% availability SLA. Traffic between AWS and Equinix edge devices is encrypted with MACsec by default.

During the preview, you can order 1 Gbps Interconnect - last mile connections at no charge to the US West (N. California) Region through the San Jose metro and to the US East (N. Virginia) Region through the Northern Virginia metro. When Interconnect - last mile with Equinix becomes generally available, you'll be able to scale bandwidth from 1 Gbps to 100 Gbps in the console. You can create connections using the console, the AWS CLI, or the API. Partners can integrate using the open API package on GitHub. To learn more, see the AWS Interconnect - last mile documentation.

Amazon Connect Customer now includes case IDs and reference numbers in contact records, helping supervisors and analysts understand which customer issues drive contact volume. Cases track issues, such as refund requests or billing disputes, across interactions and teams. Supervisors can now identify the cases associated with an interaction directly on the Contact Details page without searching individual cases. Analysts can access the same information through the DescribeContact API and contact event streams to measure the number of interactions per case.

Cases is available in the following AWS regions: US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (London), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Africa (Cape Town). To learn more and get started, visit the Cases webpage and documentation.

Amazon RDS for Oracle now lets you copy the option group associated with a DB snapshot when you copy that snapshot to another AWS Region.

Amazon RDS for Oracle uses option groups to enable and configure features that make it simple to manage your databases. Option groups are specific to the AWS Region where you create them. Previously, customers wanting to replicate RDS backups that had option groups to a different AWS Region had to copy the snapshot without the option group and then recreate the option group in the target Region before restoring the snapshot. Now, you no longer need to separate the steps and can instead initiate the snapshot copy and specify the option group copy in the same request as the snapshot copy.

The existing boolean parameter CopyOptionGroup on the CopyDBSnapshot API and CLI commands now also support cross-Region copy, along with cross-account copy. You can now copy options groups to the destination snapshot in the target AWS Region from the source snapshot by setting this parameter to true.

This capability is available on Amazon RDS for Oracle in all commercial AWS Regions and the AWS GovCloud (US) Regions. To learn more, review the Amazon RDS API Documentation. 

Amazon DocumentDB (with MongoDB compatibility) is now available in the Asia Pacific (Taipei) and Asia Pacific (New Zealand) Regions, adding to the list of available Regions where you can use Amazon DocumentDB.

Amazon DocumentDB is a fully managed, native JSON database that makes it simple and cost-effective to operate critical document workloads at virtually any scale without managing infrastructure. Amazon DocumentDB is designed to give you the scalability and durability you need when operating mission-critical MongoDB workloads. Storage scales automatically up to 128 TiB without any impact to your application. In addition, Amazon DocumentDB natively integrates with Amazon CloudWatch, AWS CloudTrail, AWS Lambda, AWS Backup, and more. Amazon DocumentDB supports millions of requests per second and can be scaled out to 15 low-latency read replicas in minutes with no application downtime.

To learn more about Amazon DocumentDB, please visit the Amazon DocumentDB product page and pricing page. You can create an Amazon DocumentDB cluster from the AWS Management Console, AWS Command Line Interface (CLI), or AWS SDKs.

AWS Sign-In now supports OAuth 2.0 Token Exchange (RFC 8693), enabling applications to exchange third-party OpenID Connect (OIDC) tokens for short-lived, AWS service-scoped OAuth access tokens. This allows customers to securely integrate third-party applications with supported AWS services without sharing AWS credentials, while maintaining access controls through AWS Identity and Access Management (IAM).

This capability is available for supported AWS services that use AWS Sign-In OAuth, enabling customers to use existing identity providers to securely access AWS services without managing additional credentials.

To learn more, see the AWS Sign-In User Guide, AWS MCP Server User Guide and the AWS Glue launch announcement.

Amazon Elastic Container Service (Amazon ECS) introduces json-file log driver support for Amazon ECS Managed Instances and log driver volumes for Amazon ECS Managed Daemons. Together, these features let you collect application logs with the observability agent of your choice and forward them to any destination you choose.

With this launch, your application containers on ECS Managed Instances can write their logs as local files in standard Docker json-file format, which most observability agents read natively. Your managed daemons can directly read these files through a volume mount, without specifying host bind mount paths or requiring root privileges. As a result, one managed daemon on each instance can collect logs from every application container that uses the json-file log driver. Amazon ECS keeps each container's logs in a dedicated directory named with the container ID and retains them until the container is removed, so your managed daemon can use native file-based log collection and trace every log back to the container that produced it.

To get started, set the log driver to json-file in the logConfiguration of your application task definition. Next, register a daemon task definition that specifies a volume with logDriverVolumeConfiguration, and mount the volume into your daemon container using mountPoints. You can configure this using the AWS Management Console, AWS CLI, API, AWS SDKs or AWS CloudFormation. This feature is available in all commercial AWS Regions where Amazon ECS Managed Instances and Managed Daemons are available, at no additional cost. To learn more, refer to our documentation page and visit Amazon ECS Managed Instances.

Amazon Managed Workflows for Apache Airflow (Amazon MWAA) now supports cost allocation tags. Tags you apply to an Amazon MWAA environment now propagate to the compute that runs it, including workers, schedulers, and web servers. You can then track Amazon MWAA spend by tag in AWS Cost Explorer and AWS Cost and Usage Reports.

With this launch, platform teams can show back or charge back Airflow costs to the team, project, or cost center that owns each environment. You can use cost allocation tags when you create a new environment or update an existing one. To get started, tag your environment using the Amazon MWAA console, AWS CLI, or Amazon MWAA API, then activate the tag key as a cost allocation tag in the AWS Billing and Cost Management console.

This feature is available in all AWS Regions where Amazon MWAA is available. For more information, see the AWS Region table. To learn more, visit Cost allocation tags in Amazon MWAA in the Amazon MWAA User Guide.

AWS Systems Manager Parameter Store now supports 13 new parameter data types that automatically validate parameter values when you create or update a parameter. With built-in validation, you can stop malformed configuration values, such as an invalid IP address, AWS account ID, or JSON document, before your applications read them, without writing your own validation logic. These types allow you to better organize your parameters across your workloads. You can filter by type when calling the DescribeParameters API or when browsing parameters in the Parameter Store console.

The following data types are available for both standard and advanced parameters:  aws:region, aws:account:id, boolean, integer, float, binary, hostname, email, ipv4-address, and ipv6-address. Three more data types, url, json, and jsonc, are available for advanced parameters. Parameter Store checks the value when you call PutParameter and rejects any value that doesn't match its data type. New data types work with String and SecureString parameters, and several also support StringList parameters, where each item in the list is validated. You can combine a data type with an AllowedPattern for additional constraints, and you can change the data type of an existing text parameter.

Amazon SageMaker AI now supports IAM Identity Center (IdC) multi-region replication, enabling you to deploy SageMaker AI Studio domains in different regions from your IdC instance's primary region. Previously, the primary IdC instance had to reside in the same region as the SageMaker AI Studio domain; now customers can replicate their primary IdC instance into the region where they wish to use SageMaker AI Studio domains. This capability helps customers maintain compliance while utilizing centralized workforce identity management.

As an Amazon SageMaker AI Studio administrator, you can deploy SageMaker AI domains that align with your workforce's location and data residency requirements, independent of where your primary IdC instance is set up. Organizations can retain their primary IdC instance in one region while operating SageMaker AI Studio workloads in compliance-mandated regions, support global operations through centralized identity management, and satisfy data sovereignty requirements without compromising single sign-on (SSO) capabilities.

To get started see the SageMaker AI documentation and to learn about setting up IAM Identity Center multi-region support see the IAM Identity Center User Guide.

Multi-region IdC replication is available in all standard AWS Regions where Amazon SageMaker AI Studio is supported, including: Asia Pacific (Tokyo), Europe (Ireland), US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Frankfurt), South America (São Paulo), Asia Pacific (Seoul), Europe (London), Asia Pacific (Singapore), Asia Pacific (Sydney), Canada (Central), Asia Pacific (Mumbai), Europe (Paris), Europe (Stockholm).

AWS WAF AI traffic monetization now integrates with Stripe. Publishers, content owners, and API providers can collect stablecoin payments from AI bots and agents that settle in local currency directly to their Stripe balance. With this launch, customers can monetize agent access without holding stablecoins or managing a crypto wallet. Stripe is now available as a new payout method alongside existing stablecoin payouts.

To get started, connect your Stripe account to AWS WAF through Stripe Connect in the AWS WAF console. Your existing pricing and agent policies work unchanged. When an agent requests protected content, AWS WAF returns an HTTP 402 response with the valid payment credential types that it accepts. Once the agent returns with a valid payment credential and makes the request again, the content is returned ungated. Revenue from all payment providers appears in the AWS WAF console revenue analytics.

The Stripe integration is available at no additional charge to all AWS WAF customers using Amazon CloudFront, in all edge locations where AWS WAF web ACLs are associated with CloudFront distributions. Standard AWS WAF and Stripe processing fees apply. See AWS WAF pricing for details.

To get started, visit the AWS WAF console or explore the AWS WAF Developer Guide.

Amazon Q Developer in the AWS Management Console and Console Mobile Apps is now called the AWS assistant. Previously, customers interacted with Amazon Q Developer across these surfaces. Now, the AWS assistant provides the same personalized, account-aware guidance and actions with a name that immediately communicates what the product does.

The AWS assistant simplifies how customers build, operate, and optimize on AWS. The AWS assistant is currently offered for free. Existing Amazon Q Developer Pro subscribers will automatically retain their Pro Tier capabilities under the AWS assistant.

The AWS assistant is available globally. To learn more, visit aws.amazon.com/products/assistant/.

AWS CodeConnections is now available in the AWS GovCloud (US-West) Region, in addition to AWS GovCloud (US-East). CodeConnections lets you connect AWS services such as AWS CodePipeline and AWS CodeBuild to source code repositories hosted with third-party providers such as Bitbucket.

With this launch, customers running workloads in AWS GovCloud (US-West) can create connections to their source repositories in the same Region as their pipelines. For example, a team can configure a connection so that a commit to their repository automatically starts a release in AWS CodePipeline, without managing provider credentials for each integration.

To learn more, see the AWS CodeConnections User Guide and the AWS GovCloud User Guide. To get started, visit the AWS GovCloud (US) console.

Amazon EC2 now supports an ImdsV1Enabled CloudWatch metric, giving customers visibility into which of their EC2 instances still have Instance Metadata Service Version 1 (IMDSv1) enabled. You can use this metric to track your migration to IMDSv2 across your accounts and Regions, at scale.

With the ImdsV1Enabled metric, you can configure CloudWatch dashboards and alarms to track instances that still allow IMDSv1, identify migration gaps, and prioritize remediation, without building your own tooling to check the metadata options of instances across accounts and Regions. This gives you a reliable, ongoing signal to track and complete your IMDSv2 migration.

The ImdsV1Enabled CloudWatch metric is available in all AWS Regions at no additional cost.

To learn more, see the ImdsV1Enabled CloudWatch metric in the Amazon EC2 User Guide. For step-by-step migration instructions, see Transition to IMDSv2 in the Amazon EC2 User Guide.

AWS Security Hub Network Scanning feature is now supported in AWS GovCloud (US).

Network Scanning probes your resources from the internet to detect actual reachability, not just what could be reachable based on security group rules and route tables. It discovers public IP addresses, virtual machines, and load balancers across your AWS environments, identifies reachable ports, and determines what services are running behind them. This complements Security Hub's existing network reachability findings, which identify configurations that could make a resource reachable from the internet. Network Scanning confirms that configurations do exist which make a resource reachable from the internet. Each reachable port generates a Security Hub finding with evidence of the port and service discovered. Security Hub Exposures then automatically correlates these findings with other findings and resource configurations to determine broader risk.

Existing customers can enable Network Scanning in individual accounts and regions, or across an organization via a configuration policy. For new Security Hub customers, Network Scanning is on by default. Network Scanning is included with Security Hub Essentials at no additional cost in all AWS commercial and GovCloud (US) Regions that support Security Hub. To learn more, see the AWS Security Hub User Guide and the AWS Security Hub product page. For the full list of Regions, see the AWS Regional Services List.

Amazon Relational Database Service (Amazon RDS) for Oracle (Amazon Relational Database Service (Amazon RDS) for Oracle) now allows customers to join their RDS for Oracle DB instances directly to their self-managed Microsoft Active Directory (AD) domain. Your self-managed AD can run on premises, on Amazon EC2, or with another cloud provider. Users in your AD domain can authenticate to RDS for Oracle DB instances using Kerberos.

Previously, in order to use Kerberos authentication with self-managed AD for their RDS for Oracle instances, customers were required to deploy AWS Managed Microsoft AD and establish trust between AWS managed domain and self-managed domain. Now, customers can join their existing self-managed AD directly to authenticate and authorize users without setting up an additional directory or trust relationship. You can set this up using the AWS Management Console, AWS CLI, or AWS SDK. You can use self-managed AD without any additional charge.

Kerberos authentication with self-managed Active Directory in Amazon RDS for Oracle is available in all commercial AWS Regions where Amazon RDS for Oracle is available. To learn more about Kerberos authentication with self-managed Active Directory, visit Working with self-managed Active Directory with an Amazon RDS for Oracle DB instance in the Amazon RDS User Guide.

You can now migrate existing Apache Hive datasets in Amazon S3 to fully managed Apache Iceberg tables in Amazon S3 Tables, with no pipelines to build or compute to provision, while production workloads keep running.

Toyota Motor North America は、20 の SAP システムと 60 台以上の Amazon EC2 ホストを対象に、AI アシスト型の SAP 運用プラットフォーム BasisPilot を AWS 上に構築しました。AWS Lambda、Amazon DynamoDB、AWS Systems Manager によるサーバーレスかつフェーズベースのワークフローと、RBAC・承認ゲートの背後で動作する Amazon Bedrock のツール呼び出し型 AI アシスタントを組み合わせています。本記事では、そのアーキテクチャとガードレールの設計を解説します。パイロットでは SAP カーネルアップグレードの所要時間が約 70% 短縮されました。

Amazon S3 Tables で、AWS Glue Data Catalog に登録された Parquet 形式の Apache Hive テーブルを Apache Iceberg へマネージドに移行できるようになりました。パイプラインの構築やコンピューティングのプロビジョニングは不要で、本番ワークロードを動かしたまま移行でき、料金はコピーしたデータ分のみです。

Kiro Enterprise で、チーム全体の Kiro クレジットを 1 つの共有プールにまとめて使える「クレジットプーリング」が提供開始されました。パワーユーザーはライトユーザーの余剰クレジットを使えるため、無駄を減らせます。管理者は個人・グループ・プロファイルの各レベルで利用上限やしきい値アラートを設定でき、請求は AWS アカウント経由で行われます。

はじめに みなさんこんにちは、ソリューションアーキテクト チームリーダーの白石です。2026 年 9 月 17 […]

Bulletin ID: 2026-169-AWS
Publication Date: 11/04/2026 11:30 AM PST

Description:

We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device.

Impacted versions: Firecracker v0.23.0 through v1.16.1, inclusive.

Refer to the article below for the most up-to-date and complete information.

Read this article

Bulletin ID: 2026-170-AWS
Publication Date: 11/04/2026 13:30 PM PST

Description:

We identified CVE-2026-122266, an issue in Amazon EKS Network Policy Agent (aws-network-policy-agent). Improper isolation of shared eBPF connection tracking state might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods.

Impacted versions:
- aws-network-policy-agent < 1.3.7
- Amazon VPC CNI Managed Add-on < 1.22.3

Refer to the article below for the most up-to-date and complete information.

Read this article

U Mobile, Malaysia's newest 5G network provider, built AiDaH, an agentic AI operations platform on Amazon Bedrock AgentCore that moves beyond AI assistance to autonomous action across telco operations. Nine months after production launch, AiDaH handles over 150 operational scenarios across six divisions, cutting trouble tickets by up to 84.5%.

This post explores how Indegene built a production-grade, LLM-powered Data Quality Agent in its NEXT Unified Data Platform on AWS. The agent generates context-aware data quality rules, validates them, and produces ready-to-run SQL and Python under human-in-the-loop governance, helping life sciences organizations scale enterprise data quality.

In production AI agents, context management is the real bottleneck. This post presents a four-layer context engineering framework (architecture, prompts, file-based tools, and verification agents), implemented in working code from Deep Insight, an open source multi-agent data analysis solution on the Strands Agents SDK and Amazon Bedrock AgentCore.

Smart Approvals in Amazon Quick reviews eligible agent actions within your existing controls, reducing unnecessary approval prompts while keeping consequential decisions with a person. See how policy sets the boundary, how a classifier reviews actions, and how AWS CloudTrail and Amazon CloudWatch Logs support audit.

Smart Approvals in Amazon Quick reviews eligible agent actions within your existing controls, reducing unnecessary approval prompts while keeping consequential decisions with a person. See how policy sets the boundary, how a classifier reviews actions, and how AWS CloudTrail and Amazon CloudWatch Logs support audit.

Some agent-evaluation questions are narrow and repeatable, and decision models answer exactly that kind of question. This post shows how to connect two decision models, Jev and Strands Decider, to Amazon Bedrock AgentCore Evaluations through code-based evaluators, and how to validate a decision-model check before you gate a release on it.

Amazon EC2 Capacity Manager offers real-time supportability checks and capacity fulfillment metrics for large EC2 fleets. This post shows how to measure how well your instance type and Availability Zone flexibility performs, find where capacity is strongest before a scale-up, and add it to Auto Scaling groups, Amazon EC2 Fleet, or Karpenter.

Learn how to configure PostgreSQL logical replication between two Amazon RDS for PostgreSQL instances on separate AWS Outposts racks, keeping all replication traffic and backups within your on-premises environment by using Customer-owned IP addresses and Local Gateways, without any data traversing the AWS Region.

In this 34th quarterly recap post, discover the most impactful AWS serverless launches, features, and resources from Q3 2026 that you might have missed.