AWS News - 2026-11-06

Amazon FSx for Lustre now supports up to 192,000 metadata I/O operations per second (IOPS) on file systems that use the Intelligent-Tiering storage class, 16x higher than the previous maximum of 12,000 IOPS.

The FSx for Lustre Intelligent-Tiering storage class delivers the lowest-cost and only fully elastic Lustre file storage in the cloud. It is optimized for workloads that mix hot and cold data and do not require consistent SSD-level performance. A file system's metadata IOPS determine how many files and directories you can create, list, read, and delete per second. Today's launch allows you to scale to even higher levels of performance, accelerate time-to-results, and optimize your storage costs for metadata-intensive machine learning research and high-performance computing (HPC) workloads.

Higher metadata IOPS are available on new FSx for Lustre Intelligent-Tiering file systems in all AWS Regions where the Intelligent-Tiering storage class is available. For more information about the file system metadata performance, see the Amazon FSx for Lustre User Guide.

Today, the Amazon OpenSearch Service optimized engine adds support for agent traces, including OpenTelemetry traces. Your traces and logs now live in the same place. You can follow a request or an agent session from start to finish, find the step that failed or slowed down, and check the related logs without switching tools. 

The optimized engine maps OpenTelemetry logs and traces to object, nested, and flat object fields, with support for multi-valued arrays. Span events, span links, prompts, and tool calls retain their nested structure, allowing field-level queries without flattening data during ingestion.

On hot-tier data, the engine supports update, delete, and upsert operations by document ID. When data arrives late or with errors, you can correct it in place, so your dashboards and alerts work from accurate data. In OpenSearch UI, you can analyze this data with Discover Traces, application performance monitoring, the service map, and the agent traces and sessions views.

These features are available on OpenSearch 3.7, at no additional charge in the following AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Asia Pacific (Mumbai), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Frankfurt), Europe (Ireland), Europe (London), and Europe (Spain).  To get started, send OpenTelemetry data to your domain, for example by using Amazon OpenSearch Ingestion. To learn more, see the documentation.

AWS Identity and Access Management (IAM) Roles Anywhere now supports automatic revocation checking using certificate revocation list (CRL) distribution points (CDPs). This helps keep revocation checks in sync with your certificate authority (CA) and can help improve your security posture. When you enable this capability on a trust anchor, IAM Roles Anywhere reads the CDP URLs embedded in authenticating certificates, downloads the corresponding CRLs, and denies credential requests that use revoked certificates.

Previously, to check revocation status, you had to import CRLs into IAM Roles Anywhere and re-import them each time your CA published an update, which added operational overhead. With this launch, IAM Roles Anywhere downloads CRLs from your CDPs and refreshes them periodically, so you no longer need to re-import them. You can use this capability with AWS Private Certificate Authority or your own public key infrastructure (PKI), provided your certificates include publicly accessible CDP URLs that meet the distribution point requirements. To enable it on a trust anchor, use the IAM Roles Anywhere console, AWS SDKs, or AWS CLI.

This feature is available at no additional cost in all commercial AWS Regions. To learn more, see Automatic revocation checking with CRL distribution points in the IAM Roles Anywhere User Guide.

Today, AWS announces the general availability of bulk put items for Amazon DynamoDB, a fully managed feature that writes data from Amazon S3 into your existing DynamoDB tables. Many DynamoDB applications use data that other systems produce and store in Amazon S3. Writing this data into existing DynamoDB tables has typically meant building custom pipelines and managing table capacity. With bulk put items, developers and data engineers can write this data without impacting existing workloads or building a custom ingestion pipeline, in a cost-efficient way.

You point bulk put items at the S3 location of your input files, and DynamoDB handles the rest. Each item supports its own condition expression, so you can enforce insert-only or version-guarded writes. The Standard tier fits most workloads, and the Accelerated tier is for more time-sensitive workloads. Common use cases include daily refreshes, large catalog enrichments, backfills, and migrations.

Bulk put items with Standard tier is available in all commercial AWS Regions and the AWS GovCloud (US) Regions, to see the list where the Accelerated tier is available see the regional availability. To learn more, visit the Introducing bulk put items for Amazon DynamoDB blog and the Amazon DynamoDB Developer Guide.

Starting November 1, 2026, the Amazon Cognito Service Level Agreement (SLA) commits to a Monthly Uptime Percentage of 99.99% for user pools on the Plus feature plan, up from 99.9%. User pools already on Plus are automatically covered by the new Service Commitment. User pools on Essentials and Lite stay at the 99.9% Service Commitment with no change to their terms.

To qualify for the 99.99% Service Commitment, you can switch a user pool to the Plus feature plan using the AWS Management Console, AWS Command Line Interface (CLI), or AWS Software Development Kits (SDKs). The Plus feature plan also includes threat protection features such as adaptive authentication, compromised credentials detection, and threat and user activity logging and export.

For full terms and exclusions, see the Amazon Cognito SLA. To learn more about feature plans, see user pool feature plans.    

AWS Network Load Balancer is now available in the Phoenix Local Zone (us-west-2-phx-2a). AWS Local Zones is a type of AWS infrastructure deployment that places AWS compute, storage, database, and other select services closer to large population, industry, and IT centers where no AWS Region exists today.

With this launch, you can create an AWS Network Load Balancer directly in the Phoenix Local Zone. Previously, if your targets ran in the Phoenix Local Zone, you had to place the load balancer in an Availability Zone in the parent Region, so connections and their traffic had to travel to the parent Region and back. This added latency and routed traffic outside the zone where your application runs. Now, connection routing stays local to your targets, delivering lower and more consistent latency to end users in the Phoenix metro area and keeping traffic within the Local Zone. This is especially valuable for latency-sensitive workloads such as real-time gaming, media streaming, and live financial applications serving users in the region.

To learn more about Network Load Balancer, visit the documentation. For more information on AWS Local Zones, visit the AWS Local Zones website. The Locations webpage lists the available and announced Local Zones. You can enable AWS Local Zones from the Local Zones tab in the AWS Global View console, or the ModifyAvailabilityZoneGroup API.

Today, we are announcing the general availability of Web Answer on Amazon Bedrock AgentCore. Web Answer is a managed tool that returns a synthesized, grounded, cited answer to a natural-language question in a single call, so agent builders can attach it to an agent and get back a finished answer grounded in current web sources, without building and maintaining their own search, retrieve, synthesis, and citation pipeline. 

Web Answer builds on Web Search on Amazon Bedrock AgentCore, which launched in June, extending it from "find the web content" to "return the finished answer," a capability customers have been asking for. With Web Answer, your agent sends a question and receives a synthesized cited answer in one tool call. Web Answer works like an agent; it plans its own searches, runs several in parallel, and decides when it has gathered enough evidence to answer. You stay in control of the boundaries, with domain include, deny lists and publish-date filters that scope where it looks. It attaches as a target on an AgentCore Gateway and is called over MCP, authenticated with IAM, with zero data egress. 

Web Answer is available in the US East (N. Virginia) Region, with per-tool call pricing. 

To learn more about Web Answer on Amazon Bedrock AgentCore, see Web Answer’s documentation page and Web Answer’s website. For Region availability, see the AWS Region table. 

Today, AWS announced a new AWS Interconnect - last mile metro in Northern Virginia, USA. Northern Virginia joins New York as the second metro where you can connect your data center, branch office, or colocation facility to AWS. 

AWS Interconnect - last mile gives you managed, private, resilient connections to AWS, so you don't have to order cross-connects or configure routers. Every connection is provisioned by default across two physically diverse locations with four redundant links, providing maximum resilience out of the box and backed by a 99.99% availability SLA up to the Direct Connect port. Traffic between AWS and partner edge devices is encrypted with MACsec by default.

Lumen customers anywhere in the continental United States can order generally available connections through the Northern Virginia metro to reach all public AWS Regions (except those in China) and AWS Local Zones. AWS Interconnect - last mile is also available in preview through Megaport and Equinix in the Northern Virginia metro. You can create connections using the AWS Management Console, AWS CLI, or AWS Interconnect API. For pricing, see AWS Interconnect - last mile pricing.

Today, AWS announces that AWS Security Hub now provides a Software Bill of Materials (SBOM) inventory, giving central security teams a continuously updated, organization-wide view of the software packages and applications installed on their compute resources.

Security Hub builds the inventory from the SBOMs that Amazon Inspector generates for Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions, with no additional configuration. The SBOM page lists each package with its version, type, and the number of resources where it is installed. You can filter and group the list by package attributes, account, and region. On the resource detail page, the Installed software tab lists every package on that resource, so you can judge its function and criticality while triaging any finding. You can also query the inventory through the Security Hub API.

The SBOM inventory is included with Security Hub Essentials at no additional cost. It requires no new enablement and populates automatically where Amazon Inspector is enabled. It is available in all AWS Regions where Security Hub is available. To learn more, see the AWS Security Hub User Guide and the AWS Security Hub product page.

Amazon Simple Email Service (Amazon SES)  is now available in the Asia Pacific (New Zealand, Melbourne, Taipei, Thailand), Mexico (Central), EU (Spain). Customers can now use these new Regions to leverage Amazon SES to send emails and, if needed, to help manage data requirements.

Amazon SES is a scalable, cost-effective, and flexible cloud-based email service that allows digital marketers and application developers to send marketing, notification, and transactional emails from within any application. To learn more about Amazon SES, visit this page .

With this launch, Amazon SES is available in 35 AWS Regions globally: US East (N. Virginia, Ohio), US West (N. California, Oregon), AWS GovCloud (US-West, US-East), Asia Pacific (Osaka, Mumbai, Hyderabad, Sydney, Singapore, Seoul, Tokyo, Jakarta, Malaysia, New Zealand, Melbourne, Taipei, Thailand), Canada (Central, Calgary), EU (Ireland, Frankfurt, London, Paris, Stockholm, Milan, Zurich,Spain), Middle East (Bahrain, UAE), Israel (Tel Aviv), South America (Sao Paulo), Mexico (Central) and Africa (Cape Town).

For a complete list of all of the regional endpoints for Amazon SES, see  AWS Service Endpoints  in the AWS General Reference.

AWS Glue Data Catalog now supports external catalog's vended credentials in Apache Iceberg REST catalog federation. You can now read external Iceberg tables from Amazon Athena, Amazon EMR, Amazon Redshift, and AWS Glue using coarse-grained table grants in your external Iceberg catalog.

Glue Data Catalog already federates to external Iceberg REST catalogs through an AWS IAM role that you configure with access to your Amazon S3 buckets. This enhancement in Glue Data Catalog provides another way to connect to an external Iceberg catalog and read only the tables that the external catalog authorizes. It uses temporary security credentials that are scoped to the Amazon S3 storage prefix and vended by your external Iceberg catalog. AWS Lake Formation manages access control when you query an external table using any AWS analytics engine, letting you restrict access further down to specific rows and columns and share external Iceberg tables across AWS accounts.

This feature is available through the AWS Lake Formation Management Console, AWS CLI, and the AWS Glue and Lake Formation SDKs. This feature is available in all commercial AWS Regions where Glue and Lake Formation are supported. To learn more, visit the documentation.

​​AWS Elemental MediaConvert now integrates Smart Subtitles, an AI-powered subtitling solution built on AWS Elemental Inference and the latest speech recognition models. This feature brings automated subtitle generation directly into your video-on-demand (VOD) transcoding and packaging workflows, eliminating the need for separate external captioning pipelines. Customers can now manage both transcoding and subtitle creation within a single, unified workflow.

​Smart subtitles automatically transcribe your audio into subtitles with native support for six languages including English, French, German, Italian, Portuguese, and Spanish. With MediaConvert, you can package the outputs to text-based side-car formats and burn-in for all your streaming or distribution needs. To enhance transcription quality, you can now define custom dictionaries in Elemental Inference to guide the model on proper nouns, brand names, technical terminology, and more. Smart subtitles complement existing add-on features such as Smart Cropping for end-to-end media pipelines, intelligent framing and accessible subtitle delivery in distribution-ready formats like HLS and DASH.​

​​Smart subtitles is available in all AWS regions where Elemental Inference is available including US East (N. Virginia), US West (Oregon), Europe (Ireland), Asia Pacific (Mumbai), and Asia Pacific (Sydney).​

To learn more, visit Smart subtitles with MediaConvert, AWS Elemental MediaConvert  and AWS Elemental Inference smart subtitles.

Starting today, you can add Amazon EC2 Capacity Blocks for ML and interruptible Capacity Reservations to Capacity Reservation Resource Groups in AWS GovCloud (US) Regions. Amazon EC2 offers different reservation offerings such as On-Demand Capacity Reservations (ODCRs), interruptible Capacity Reservations, and Capacity Blocks for ML. Previously, a Capacity Reservation Resource Group could only include ODCRs. Now you can add any type of Capacity Reservation to a Capacity Reservation Resource Group, making it easier to launch EC2 instances across your entire portfolio of reserved capacity.

To use this feature, create a Capacity Reservation Resource Group, add any Capacity Reservation to it, and then target the group in your launch request. When using EC2 Fleet and EC2 Auto Scaling groups, you can also specify your prioritization preferences across reservation types, and configure automatic fall back to EC2 On-Demand capacity when there is no capacity remaining across your reservations.

There are no additional charges for using this feature. With the addition of AWS GovCloud (US) Regions, this feature is now available in all AWS Regions where Capacity Blocks for ML and interruptible ODCRs are supported, excluding China Regions. To get started, see Capacity Reservation Resource Groups and the Capacity Reservations user guide.

2026 年 11 月 5 日、Kiro Crew で Kiro の Bot の一般提供が始まりました。Bot は、エージェントによる作業を組み立てて進めるための新しい方法です。ばらばらのセッションで作業する代わりに、作業の特定の部分を受け持つエージェントを Bot として定義し、カスタマイズします。Bot はそれぞれ名前を持ち、長く動き続けます。Bot は自分のメモリを持ち、自分でセッションを動かすので、あなたがセッションを 1 つずつ追いかける必要はなくなります。Kiro Crew はもともと、あなたの仕事の進め方から学習します。Bot によって、その学習が蓄積される場所が変わります。

本稿は、株式会社両備システムズ ガバメントクラウド推進室 岩倉 竜太 氏による寄稿です。 ※本記事でご紹介する […]

セキュリティやデータ損失インシデントは、金銭的損失だけでなく社会的信用の失墜にもつながります。AWS の責任共有モデルにおいて「クラウドにおけるセキュリティ」はお客様の責任範囲ですが、IAM ガバナンス、パッチ管理、脅威検出、インシデント対応、コンプライアンス維持を大規模に実装・運用し続けることは容易ではありません。AWS Managed Services（AMS）は、GuardDuty による 24/365 の脅威監視、NIST 準拠のインシデント対応、自動パッチ適用、AWS Config を活用したコンプライアンスの可視化など、予防・検出・対応にわたるセキュリティのベストプラクティスを包括的に提供します。本記事では、AMS を活用してクラウドインフラのセキュリティ体制を強化する方法を紹介します。

AWS Identity and Access Management (IAM) is introducing account access manager, a flexible new way to manage workforce access to your Amazon Web Services (AWS) accounts. This combines the IAM role flexibility your teams already rely on, delivered through the centralized federation of AWS IAM Identity Center, with user-level visibility built-in. Account access manager streamlines […]

Bulletin ID: 2026-171-AWS
Publication Date: 11/05/2026 08:30 AM PST

Description:

GluonTS is an open-source Python library for probabilistic time series modeling. We identified CVE-2026-119083, an issue in the archive extraction utility in GluonTS before 0.17.0. An actor who supplies a crafted tar archive containing symbolic or hard links might be able to write arbitrary files outside the intended extraction directory with the privileges of the extracting process.

Impacted versions: < 0.17.0

Refer to the article below for the most up-to-date and complete information.

Read this article

Bulletin ID: 2026-172-AWS
Publication Date: 11/05/2026 20:00 PM PST

Description:

An issue in the APT package manager (CVE-2026-109518) affects Ubuntu and Debian operating systems. Under specific conditions, when APT is configured to use HTTP package sources with retry settings enabled, a third party with a network position between the host and the package mirror could cause APT to install a package that did not pass verification. Updated APT packages are available from Canonical (USN-8996-1) and Debian (DSA-6607-1). The following fixed versions address this issue:
- Ubuntu 22.04 LTS: apt 2.4.15ubuntu0.1
- Ubuntu 24.04 LTS: apt 2.8.4ubuntu0.1
- Ubuntu 26.04 LTS: apt 3.2.1ubuntu0.1
- Debian (DSA-6607-1): See Debian Security Advisory for version details

Customers running Ubuntu or Debian-based Amazon EC2 instances or container images should apply the updates. For details, see the full AWS Security Bulletin.

Read this article

Learn how TUI, the world's leading tourism group, built an AI-powered threat modeling system on Amazon Bedrock and Amazon Bedrock AgentCore to scale security assessments across more than 100 product teams, cutting threat modeling time by up to 70% while applying security standards consistently.

See how Cognizant and AWS Professional Services transformed the OrderServ food-ordering platform into a multi-tenant SaaS offering on shared Amazon ECS, cutting compute costs up to 64%, reducing scaling time from minutes to seconds, and lowering authentication costs by 80%.

Learn how Amazon Marketplace evaluates A+ Content quality at scale on Amazon SageMaker AI by rendering each product page as a single snapshot, scoring it with a vision-language model fused with OCR readability signals in a CatBoost classifier, and using SHAP to turn each decision into prioritized, actionable recommendations for selling partners.

Web Answer on Amazon Bedrock AgentCore returns a synthesized, source-cited answer to a natural-language question in a single tool call, with no search, retrieve, synthesize, and citation pipeline to build. Learn how it works and how to add it to an AgentCore Gateway and call it from an agent.