techlist.io
KREN

AWS

101 posts

aws.amazon.com/blogs/aws

Filter by tag

Amazon Bedrock38AWS30AI Agents24Amazon Ec220Generative AI20Amazon S316AI16Aws Lambda15Serverless13Kubernetes10PostgreSQL10Aws Cli10+360
aws3 min readCurated summary

AWS Weekly Roundup: AWS Heroes Summit, Web Search on Amazon Bedrock, Dogwood, Kiro Crew, and more (August 10, 2026) | Amazon Web Services

The August 10, 2026 AWS Weekly Roundup highlights the AWS Heroes Summit and several launches focused on AI agents, modernization, data retrieval, and developer productivity. Major updates include web search for Amazon Bedrock, vector search in DynamoDB, dedicated AgentCore runtime instances, and faster Lambda networking. AWS also introduced Dogwood for temporal agent governance, portable Agent Plugins, and Kiro Crew for persistent multi-agent development. ## AWS Heroes Summit - AWS Heroes from around the world gathered for technical collaboration, deep dives, and feedback sessions with AWS teams. - The invite-only event featured: - A fireside chat with AWS CEO Matt Garman. - An AMA with James Hamilton. - Breakout sessions led by AWS product teams. - The summit emphasized knowledge sharing, community support, and collaboration between AWS experts and internal teams. ## New Amazon Bedrock and AI Capabilities - **Web Search on Amazon Bedrock** - OpenAI models, including GPT-5.4, GPT-5.5, and GPT-5.6 variants, can browse and retrieve current information from the internet. - Applications can use real-time web content while keeping data within a secured AWS environment with zero data egress. - **Runtime Instances for Bedrock AgentCore** - AI agents can run on dedicated runtime instances. - This provides more predictable performance, execution control, and costs. - **Vector Search for DynamoDB** - Applications can store and query vector embeddings alongside existing DynamoDB data. - This supports semantic retrieval and grounding for AI agents without deploying a separate vector database. ## Modernization and Lambda Networking - **AWS Transform continuous modernization** - Now generally available for analyzing and remediating technical debt across repositories. - Supports ongoing modernization of mainframe and legacy workloads rather than one-time migration projects. - Integrates with the AWS Transform Kiro Power and agent plugins. - **Higher Lambda bandwidth** - Lambda functions configured with at least 2 GB of memory and running outside a VPC can receive proportional network bandwidth increases. - Bandwidth ranges from 625 Mbps at 2 GB to 3,000 Mbps at 10 GB. - The change benefits data-intensive workloads and communication with other AWS services. ## Agent Governance and Portability - **Dogwood** - AWS open-sourced Dogwood, a governance language designed for AI agents. - It extends Cedar policies with temporal conditions. - AgentCore temporal policies can make decisions based on an agent’s prior actions within a session, not only the current request. - **Agent Plugins** - AWS supports an open, vendor-neutral specification for packaging agent extensions. - Developers can package an extension once and use it across compatible tools such as Kiro, VS Code, and Cursor. ## Kiro Crew - Kiro Crew provides a persistent workspace for collaborative, multi-agent development. - It is designed for work spanning multiple repositories, tools, and days rather than a single chat session. - Developers can run several efforts in parallel or delegate tasks to subagents that report results later. AWS’s latest updates point toward more capable, governed, and portable AI-agent workflows, while also improving modernization tools and infrastructure performance. Developers can explore the related documentation, AWS events, and the AWS Builder Center for further resources.

Read original(opens in new tab)
AI AgentsAWSAmazon BedrockAws Lambda+4
aws3 min readCurated summary

Runtime instances: persistent compute for production AI agents on Amazon Bedrock AgentCore | Amazon Web Services

Amazon Bedrock AgentCore Runtime Instances provides persistent, managed compute for production AI agents that need more than short-lived invocations. It supports multi-day workflows, shared state, GPU acceleration, multi-agent collaboration, and direct OS access while AWS manages the underlying EC2 infrastructure. Runtime Instances complements AgentCore’s lightweight microVMs, enabling teams to combine fast-scaling orchestration with persistent worker environments. ## Why Persistent Compute Matters - Production agents often run for hours or days and must preserve state across workflow steps. - Complex systems may require: - Collaboration between multiple agents - Shared files and context - GPU acceleration - Direct operating-system access - Continuous execution across multiple days - Previously, teams had to provision EC2 instances, configure networking, manage sessions and scaling, and build monitoring themselves. ## What Runtime Instances Provides - AWS-managed EC2 infrastructure for hosting multiple agents in one runtime. - Shared sessions that persist for up to 14 days. - Separate dependencies and artifacts for each deployed agent. - GPU-capable infrastructure for compute-intensive workloads. - Session stop and restart capabilities to reduce idle costs. - Support for zip packages and container images. - Compatibility with frameworks such as CrewAI, LangGraph, LlamaIndex, and Strands. - Integration with existing AgentCore APIs, identity controls, and observability. - Persistent knowledge storage through Amazon EBS and AgentCore Memory. ## Combining MicroVMs and Runtime Instances - Runtime microVMs remain useful for lightweight orchestrator agents that need rapid scaling. - Runtime Instances are better suited to persistent, resource-intensive workers. - An orchestrator can: - Route tasks to specialized agents - Make API calls - Aggregate results - Instance-based workers can handle tasks such as code compilation, security scanning, or GUI automation while retaining local state. ## Shared-Filesystem Agent Example The demonstration uses two Strands Agents applications: - A code writer: - Generates Python code from a natural-language task. - Saves the result as `code.py` in a session-specific shared directory. - A code reviewer: - Reads the writer’s file from the same filesystem. - Reviews it for bugs, style issues, and suggestions. - Both applications use: - An `@app.entrypoint` decorator - A selected Bedrock model - The session ID to identify shared storage - Because both agents share the host filesystem, they exchange artifacts without API calls or explicit data transfer. ## Deployment Workflow ### Create a Capacity Provider - Select the operating system, allowed EC2 instance types, VPC, subnets, and security groups. - The example uses: - Linux 64-bit ARM - `c7g.2xlarge` - 8 vCPUs and 16 GiB of memory - A default `gp3` volume - AgentCore creates or assigns the required infrastructure role and instance profile. - Once active, most capacity provider settings cannot be changed, so configuration should be verified beforehand. ### Create a Runtime and Deploy an Agent - Create a runtime using the **Instances** compute type. - Associate it with the capacity provider. - Upload the agent package to Amazon S3. - Specify the language runtime, such as Python 3.13, and the entry-point file containing `@app.entrypoint`. - Deployment can be performed through the AWS Management Console, AgentCore CLI, AWS CLI, or infrastructure as code. Runtime Instances are a strong fit for agents with long-running, stateful, collaborative, or compute-heavy workloads. Use them alongside microVMs when a system needs both elastic orchestration and persistent worker infrastructure, while relying on EBS or AgentCore Memory for state that must outlive individual sessions.

Read original(opens in new tab)
PythonMulti Agent SystemsAmazon Bedrock AgentcoreAws Ec2+2
aws3 min readCurated summary

Amazon DynamoDB now supports real-time vector search at any scale | Amazon Web Services

Amazon DynamoDB now offers native vector search, allowing applications to store embeddings beside operational data and query them without a separate vector database. The serverless service provides single-digit millisecond latency, 99%+ recall, horizontal scaling, and support for trillions of vectors. This removes synchronization pipelines, data movement, and additional infrastructure for applications already built on DynamoDB. ## Native Vector Search in DynamoDB - Embeddings are stored directly in DynamoDB as lists of floating-point numbers. - Similarity searches use the `SearchVectors` API and return up to 100 ranked results. - Vector indexes scale horizontally without storage limits or servers to manage. - Pricing follows DynamoDB’s pay-per-request model. - Common use cases include: - Agent memory - Retrieval-augmented generation - Recommendations - Personalized experiences - Anomaly detection ## Supported Search Capabilities - Supports vectors with up to 4,096 dimensions. - Offers three distance functions: - **Cosine**: Useful for semantic text similarity. - **Euclidean**: Useful when vector magnitude is meaningful. - **Dot product**: Useful when both direction and magnitude affect relevance. - Supports optional partition keys to distribute data and scope searches. - Supports inline exact-match filters, but not range operators such as `BETWEEN` or `BEGINS_WITH`. - Search results can include operational attributes through index projections. ## Adding Embeddings to an Existing Table - Generate embeddings with a model such as Amazon Bedrock Titan Text Embeddings, Cohere Embed, or OpenAI embeddings. - Store them in a new attribute, such as `descriptionEmbedding`, using `UpdateItem` or other AWS tooling. - No new DynamoDB data type or schema migration is required because vectors use the existing `List` and `Number` types. ## Creating and Using a Vector Index - Create a vector index on the embedding attribute. - Configure: - Index name - Vector attribute - Embedding dimensions - Distance function - Optional partition key - Filter attributes - Generate a query embedding with the same model used for stored data. - Call `SearchVectors` with the query vector, result count, partition key, and filters. - Scores depend on the distance function: - Lower scores indicate greater similarity for Cosine and Euclidean distance. - Higher scores indicate greater similarity for Dot product. ## Example: Product Catalog Search - A `ProductCatalog` table stores product details such as `productId`, `name`, `description`, `category`, `marketplace`, and `price`. - Product descriptions receive embeddings stored in `descriptionEmbedding`. - A `ProductDescriptionIndex` can use: - `marketplace` as the partition key - `category` as an inline filter - Cosine distance for semantic matching - A query such as “lightweight running shoes for summer” can return the five most relevant footwear products in the US marketplace, along with attributes such as name and price. DynamoDB vector search is best suited to applications whose operational data already resides in DynamoDB and need semantic retrieval without operating a second database or synchronization system.

Read original(opens in new tab)
RAGServerlessVector DbAmazon Dynamodb+2
aws2 min readCurated summary

AWS Weekly Roundup: Price reduction of GPT models in Bedrock, CloudWatch managed collectors for Prometheus metrics, and more (August 3, 2026) | Amazon Web Services

The AWS Weekly Roundup highlights major updates in AI pricing, observability, multicloud networking, identity resilience, and data lakes. The biggest change is an up to 80% price reduction for OpenAI GPT‑5.6 Luna models in Amazon Bedrock, alongside several managed services that reduce infrastructure and operational overhead. ## Lower Bedrock Pricing for GPT‑5.6 - Effective July 30, GPT‑5.6 Luna inference prices dropped by 80%. - New pricing is: - $0.20 per million input tokens - $1.20 per million output tokens - GPT‑5.6 Terra prices decreased by 20%. - The reductions apply automatically and require no customer action. ## Managed Prometheus Monitoring in CloudWatch - Amazon CloudWatch now provides fully managed Prometheus collectors. - Customers can collect metrics from: - Amazon EKS - Amazon EC2 - Amazon ECS - Amazon MSK - Amazon OpenSearch Service - This removes the need to deploy and maintain custom Prometheus scraping agents. ## Private Multicloud Connectivity with OCI - AWS Interconnect for Oracle Cloud Infrastructure is now generally available. - It enables resilient, scalable private connections between AWS and OCI. - Traffic avoids the public internet, improving security, performance, and reliability for multicloud workloads. ## Multi-Region IAM Identity Center - IAM Identity Center can now replicate its built-in Identity Center directory across Regions. - During a primary-Region disruption, users can continue accessing AWS accounts through provisioned entitlements in additional Regions. - Previously, multi-Region support was limited to deployments using external identity providers. ## Variant Support in S3 Tables - Amazon S3 Tables now supports Apache Iceberg V3’s Variant data type. - Variant provides native, high-performance support for semi-structured data. - Suitable use cases include IoT sensor data, application logs, and schema-flexible payloads without storing everything as JSON blobs. ## Additional AWS Resources - New AWS CLI single-line commands simplify installation and upgrades across platforms and CI environments. - A deployment guide covers running Moonshot AI’s Kimi K3 on SageMaker HyperPod and Amazon EKS. - Amazon MSK Express brokers can deliver Kafka data to Apache Iceberg streaming tables on S3 Tables, with throughput of up to 10 GB/s. - AWS Summits and AWS Community Days offer upcoming opportunities for cloud and AI learning and networking. AWS users should review the new Bedrock pricing, consider managed CloudWatch collectors to reduce monitoring maintenance, and evaluate the multicloud, identity, and Iceberg updates for architectures requiring greater resilience and scalability.

Read original(opens in new tab)
Amazon BedrockApache KafkaApache IcebergAmazon Cloudwatch+4
aws3 min readCurated summary

AWS Weekly Roundup: Local Zone in Athens, Claude Opus 5 on AWS, Lambda durable execution for .NET, and more (July 27, 2026) | Amazon Web Services

The week’s AWS updates focus on bringing infrastructure closer to users, expanding AI capabilities, and improving reliability and observability. Highlights include a new Athens Local Zone, Claude Opus 5 availability, durable Lambda workflows for .NET, and unified Amazon Bedrock AgentCore telemetry. The post also points to new data, contact-center, developer-productivity, and community resources. ## AWS Local Zone in Athens - AWS launched its second EMEA Local Zone in Athens, Greece. - It supports: - Amazon EC2 C7i, M7i, and R7i instances - Amazon S3 One Zone-Infrequent Access - Amazon EBS and EBS Local Snapshots - Amazon ECS - Greek organizations can process and store data locally to help satisfy data-residency requirements. - The zone enables single-digit-millisecond latency for workloads such as gaming, media production, and financial services while still connecting to the nearest AWS Region. ## New AI and Serverless Capabilities - **Claude Opus 5 on AWS** is available through Amazon Bedrock and Claude Platform on AWS. - It provides top-tier Opus-level intelligence. - Bedrock enables zero data retention by default, supporting stricter governance requirements. - **Lambda durable execution for .NET** is now generally available. - C# developers can create long-running, multi-step workflows without custom checkpointing or external orchestration. - Workflows can pause for up to one year. - Use cases include payment pipelines, AI agents, and human approvals. ## Improved Agent Observability - Amazon Bedrock AgentCore now stores traces, prompts, inputs, outputs, and application logs in a single CloudWatch log group. - Engineers can investigate individual agent invocations without searching multiple destinations. - Agent-level access controls and customer-managed key encryption are also supported. ## Contact Center, Data, and Developer Updates - Amazon Connect added more natural agentic voice experiences across more than 50 languages. - The service now includes over 100 new voice options and improved handling of tone and sentiment. - SageMaker Unified Studio can query Amazon OpenSearch data alongside Redshift, S3, and relational database assets. - CloudWatch coding agent insights measures the organizational impact of tools such as Claude Code, Codex, and GitHub Copilot using OpenTelemetry telemetry without custom instrumentation. ## Additional Resources and Events - AWS published guidance for evaluating AI agents with Strands Agents and Bedrock AgentCore. - A new guide covers multi-region resiliency for CloudFormation custom resources. - Amazon SES introduced pricing plans intended to make large-scale email costs more predictable. - Upcoming opportunities include AWS Summits and AWS Community Day Belo Horizonte on August 22. Together, these releases suggest AWS is prioritizing lower-latency regional infrastructure, production-ready AI workflows, and better operational visibility. Builders should assess the Athens Local Zone for residency-sensitive workloads, consider durable Lambda execution for complex .NET processes, and adopt the new observability tools as agent deployments grow.

Read original(opens in new tab)
AWSAmazon BedrockAws LambdaAmazon Sagemaker+4
aws3 min readCurated summary

AWS Weekly Roundup: One-click Lambda setup prompt, OpenAI GPT-5.6 models on Bedrock, and more (July 20, 2026) | Amazon Web Services

The AWS Weekly Roundup highlights new tools for AI-assisted serverless development, including a one-click Lambda setup prompt that configures coding agents with AWS Serverless skills and MCP. It also covers major service updates such as OpenAI models on Bedrock, faster S3 storage-class transitions, self-managed Lambda code storage, and Cognito password-hash imports. Additional stories include SQS’s 20th anniversary, open agent protocols, DynamoDB bulk operations, and a resolved Cost Explorer billing-data incident. ## One-Click Lambda Setup for Coding Agents - The Lambda console now provides a prompt that configures AI coding agents with: - AWS Serverless skills - The Serverless Model Context Protocol (MCP) server - Embedded serverless best practices - The setup guide supports Claude Code, Kiro, Cursor, GitHub Copilot, Codex, Devin Desktop, and OpenCode. - Developers can copy the setup URL into their preferred agent: ```text fetch https://docs.aws.amazon.com/lambda/latest/dg/samples/aws-lambda-agent-setup.md ``` - AWS’s Agent Toolkit can also install the AWS MCP Server, providing current AWS knowledge and controlled resource access. ## Major AWS Service Launches - **OpenAI GPT-5.6 models on Amazon Bedrock** - Sol: flagship reasoning - Terra: balanced performance - Luna: faster, lower-cost inference - All are available through Bedrock’s Responses API and its high-performance inference engine. - **Same-day S3 transitions** - Objects can transition to S3 Standard-IA or S3 One Zone-IA on the day they are created. - The previous 30-day minimum retention period in S3 Standard no longer applies. - These classes can reduce storage costs by up to 40% while retaining millisecond access. - Suitable for backups, log analytics, and compliance data that becomes cold quickly. - **Self-managed Lambda code storage** - Lambda can reference code directly from customer-owned S3 buckets. - Lambda no longer needs to create intermediate copies. - This removes code-storage limits and can shorten activation times after deployments. - **Cognito password-hash imports** - CSV user imports can now include password hashes. - Users can sign in immediately with existing credentials instead of resetting passwords. - Import configuration specifies the source system’s hashing algorithm. ## Additional AWS Updates - **Amazon SQS at 20** - SQS continues to provide scalable decoupling between message producers and consumers, two decades after its public launch. - **Open protocols with Strands Agents SDK** - An example demonstrates how MCP, A2A, UTCP, AG-UI, and x402 can work together when building AI agents. - **Open-source DynamoDB Bulk Executor** - Performs large-scale table operations without custom code. - Supports `count`, `find`, `delete`, and `update` commands. - **Kiro CLI for AWS Support** - MCP integration combines investigation, documentation lookup, and support-case creation. - Examples cover Glue failures, Lambda cold starts, and WAF false positives. ## Cost Explorer Incident - Some customers saw inaccurate estimated billing and usage data in Cost Explorer. - The issue generated erroneous budget and cost-anomaly alerts. - AWS resolved the incident and is conducting a retrospective to improve billing-incident prevention and response. AWS’s latest releases emphasize faster serverless development, more capable AI tooling, lower-cost storage, and easier automation of operational tasks. Developers should explore the Lambda agent setup and Agent Toolkit while reviewing the new storage, identity, and bulk-operation capabilities for relevant workloads.

Read original(opens in new tab)
AI AgentsAmazon BedrockAmazon S3Aws Lambda+4
aws3 min readCurated summary

Amazon SQS turns 20: Two decades of reliable messaging at scale | Amazon Web Services

Amazon SQS has spent two decades helping distributed systems communicate asynchronously without tightly coupling services. While its core purpose remains unchanged—decoupling producers and consumers, buffering traffic, and isolating failures—its scale, security, integrations, and workload support have expanded significantly. Recent improvements also make SQS suitable for high-throughput, multi-tenant, and AI-driven architectures. ## SQS’s Core Role in Distributed Systems - Producers place messages in queues and continue processing without waiting for consumers. - Consumers process messages when they are ready, preventing slow or unavailable services from causing cascading failures. - Customers use SQS to: - Decouple application components - Absorb traffic bursts - Improve resilience when individual services fail - Coordinate independent services and AI agents ## Higher Throughput for FIFO Queues - High-throughput FIFO mode launched in 2021 at up to 3,000 transactions per second per API action. - Capacity increased progressively to: - 6,000 TPS in 2022 - 9,000 TPS in 2023 - 18,000 TPS later in 2023 - Up to 70,000 TPS per API action in select Regions - The FIFO in-flight message limit grew from 20,000 to 120,000 in 2024, enabling more concurrent processing. ## Stronger Security and Access Controls - SSE-SQS launched in 2021, providing server-side encryption with AWS-managed keys and eliminating customer key-management requirements. - Encryption became the default for newly created queues in 2022. - Attribute-based access control was introduced in 2022, allowing permissions to be based on queue tags rather than static resource policies. ## Improved Message Recovery and Integration - Dead-letter queue redrive became available in the SQS console in 2021. - SDK and CLI APIs—including `StartMessageMoveTask`, `CancelMessageMoveTask`, and `ListMessageMoveTasks`—followed in 2023. - FIFO queue redrive support was added later that year. - JSON protocol support reduced processing latency by up to 23% for 5 KB payloads while lowering client CPU and memory use. - SQS queues can connect directly to EventBridge Pipes, enabling routing to many AWS services without custom integration code. ## Larger Messages and Fairer Queuing - The Extended Client Library for Python allows payloads up to 2 GB by storing message data in Amazon S3 and sending a reference through SQS. - In 2025, the native maximum message size increased from 256 KiB to 1 MiB for standard and FIFO queues. - Fair queues help prevent one tenant in a shared standard queue from delaying others. Producers provide a message group ID, while consumers require no changes. ## SQS for AI Workloads - SQS can buffer requests to large language models and regulate inference throughput. - Queues also help coordinate autonomous AI agents that operate as separate services. - These use cases apply the same established messaging model to more complex, distributed AI systems. Amazon SQS’s recommendation remains straightforward: use asynchronous queues when systems need loose coupling, burst management, and resilience. Its newer throughput, security, recovery, integration, and fairness features extend that pattern to larger and more demanding applications.

Read original(opens in new tab)
AWSDistributed SystemsAmazon S3Amazon Sqs+4
aws4 min readCurated summary

AWS Weekly Roundup: AWS Builder Center at 1 year, Network Scanning in Security Hub, Loom for AWS, and more (July 13, 2026) | Amazon Web Services

AWS’s weekly roundup highlights the first anniversary of AWS Builder Center and its expansion into a broader learning and experimentation ecosystem. It also introduces major security, AI, container, database, and developer-tool updates, including internet reachability scanning, Azure support in Security Hub, Hugging Face integration with SageMaker, lower GPU management fees, and Aurora DSQL change data capture. The overall direction is toward more integrated, governed, and accessible cloud development workflows. ## AWS Builder Center Turns One - Launched on July 9, 2025, Builder Center has expanded from a community hub into an ecosystem with: - Sandbox environments - Workshops and the Builders’ Library - Community Spaces, profiles, badges, and streaks - AWS regional capability listings - Saved items, article series, availability notifications, and GitHub/Amazon sign-in - In its first year: - 5,548 authors published 6,448 articles. - Articles received more than 10.4 million page views. - Builders earned 99,226 badges. - The community submitted 565 feature wishes, with 10 already delivered. - The most popular articles covered MCP and Strands Agents, Linux migration with Kiro, and multimodal AI for neurological screening. ## Free AWS Sandbox Environments - Builder Center now offers free, pre-provisioned AWS accounts for workshop exercises. - Each sandbox: - Remains active for eight hours. - Automatically removes the account and resources afterward. - Requires no personal AWS account, credit card, or manual cleanup. - Users can have one active sandbox and request one sandbox per week. ## Security Hub Adds Network and Azure Coverage - Security Hub Network Scanning probes AWS and Azure environments from the public internet. - It identifies: - Public IP addresses, virtual machines, and load balancers. - Reachable ports. - Services operating behind those ports. - Each reachable port produces a finding, which Security Hub Exposures correlates with other configuration and security findings. - Existing customers can enable the feature by account, Region, or organization policy; it is enabled by default for new customers. - Network Scanning is included with Security Hub Essentials at no extra cost. - Security Hub also now evaluates Azure VMs, container images, Function Apps, and identities for vulnerabilities, misconfigurations, and internet exposure. ## SageMaker Studio and Hugging Face Integration - Users can deploy or customize supported Hugging Face models in SageMaker Studio with one click. - New customers receive automatically configured Studio environments for: - Fine-tuning and reinforcement learning with custom reward functions. - Model evaluation. - Deployment to SageMaker or Bedrock endpoints. - Verified customers receive default GPU access to G5, G6, and G4dn instances, while quota usage is visible in Studio. ## Lower GPU Management Fees - Starting July 1, 2026, EKS Auto Mode and ECS Managed Instances reduced accelerated-instance management fees: - G-series: 35% reduction. - P-series and Trainium: 60% reduction. - Existing customers receive the reductions automatically. - EKS adds accelerator-aware node repair and parallel image pulling. - ECS provides GPU metrics through CloudWatch Container Insights and monitors GPU hardware health. ## Aurora DSQL Change Data Capture - Aurora DSQL CDC is generally available and streams insert, update, and delete events to Kinesis Data Streams. - The events can synchronize microservices, invoke Lambda functions, or feed S3, Redshift, and OpenSearch through Firehose. - CDC is designed to avoid database performance impact and requires no infrastructure management. ## Tools for Governed AI Agents - Loom for AWS is an open-source platform for deploying and managing Strands Agents on Bedrock AgentCore Runtime. - It includes: - Identity-provider integration and RBAC/ABAC. - Lifecycle management for agents, memory, MCP servers, and agent-to-agent connections. - Automated tagging for cost attribution. - Agent Registry integration and human approval for sensitive actions. - The Claude apps gateway provides centralized access, policy, and spending controls for Claude Code and Claude Desktop. - It supports OIDC identity providers, per-user and per-group spending caps, managed request settings, and routing through Amazon Bedrock or Claude Platform on AWS. - AWS MCP Server now supports browser-based OAuth using AWS Console or CLI credentials, including IAM federation and IAM Identity Center, with short-lived tokens and automatic refresh. AWS’s updates favor managed services that reduce operational work while strengthening security and governance. Teams should evaluate Builder Center sandboxes for training, enable Security Hub’s broader scanning where appropriate, and consider the new AI-agent controls and managed GPU options for production workloads.

Read original(opens in new tab)
KubernetesModel Context ProtocolPostgreSQLAWS+4
aws3 min readCurated summary

AWS Weekly Roundup: Claude Sonnet 5 on AWS, Amazon WorkSpaces for AI agents, AWS service availability updates, and more (July 6, 2026) | Amazon Web Services

The July 6, 2026 AWS roundup highlights new infrastructure, AI, observability, and developer productivity capabilities. Major announcements include Claude Sonnet 5 on AWS, generally available WorkSpaces for AI agents, faster SageMaker inference scaling, and log-query alarms in CloudWatch. It also details AWS service lifecycle changes and upcoming community events. ## Featured AWS Launches - **Claude Sonnet 5 on AWS** - Anthropic’s latest Sonnet model is available for coding, agentic workflows, and professional tasks. - It can navigate large codebases, use tools accurately, and preserve state across long-running tasks. - **Amazon WorkSpaces for AI agents** - AI agents can securely operate desktop applications in managed WorkSpaces environments. - Organizations can use existing applications without modernization or custom integrations. - **OpenSearch log analytics optimization** - A new engine provides up to four times better price-performance in internal benchmarks. - It combines log aggregation with OpenSearch’s full-text search capabilities. - **Faster SageMaker AI inference scaling** - Container image caching can reduce generative AI scale-out time by up to half. - SageMaker supports up to two times faster end-to-end scaling during demand increases. - **CloudWatch alarms from log queries** - Users can create alarms directly from log query results and define thresholds in one workflow. - This removes the need to create metric filters or custom metrics first. ## Additional Infrastructure and Developer Updates - **EC2 C9g and C9gd instances** - Powered by AWS Graviton5 processors. - Offer up to 25% more compute performance than Graviton4 instances, five times more cache, faster memory, and optional local NVMe storage. - **CloudFormation Express mode** - Provides deployment confirmation within seconds. - Helps developers and AI agents iterate more quickly, at no additional cost in commercial Regions. - **Amazon EKS version rollbacks** - Kubernetes upgrades can be reversed within seven days. - Rollbacks avoid rebuilding clusters and reduce the risk of failed upgrades. - **ACME support in AWS Certificate Manager** - Automates issuance and renewal of public TLS certificates using the standard ACME protocol. ## AWS Service Availability Changes AWS updated its lifecycle guidance on June 30, 2026, including alternatives and migration support. - **Moving to maintenance for new customers from July 30** - Amazon Bedrock Agents becomes Bedrock Agents Classic. - Amazon Cognito Sync, Amazon Kendra, Amazon Q Business, Simple AD, and several other services and features will no longer accept new customers. - A number of SageMaker AI features are affected, including Clarify, Debugger, Ground Truth, Model Monitor, and Studio Lab. - AWS IoT Device Defender Detect changes on August 31, 2026. - **Entering sunset** - Amazon WorkSpaces PCoIP and Pool. - AWS Managed Services Advanced. - AWS re:Post Private. - SageMaker AI Profiler. - **End of support** - Amazon Chime SDK Carrier Voice Focus. - SageMaker AI Ground Truth Plus. ## Upcoming AWS Events - AWS Summits will take place throughout the second half of 2026. - AWS Community Day Belo Horizonte is scheduled for August 22. - The AWS Builder Center offers community discussions, technical content, and information about upcoming virtual and in-person events. Organizations using affected AWS services should review the relevant lifecycle documentation and contact AWS Support to plan migrations before availability or support deadlines.

Read original(opens in new tab)
KubernetesAWSAmazon SagemakerAmazon Eks+4
aws2 min readCurated summary

Upgrade Amazon EKS clusters with confidence using Kubernetes version rollbacks | Amazon Web Services

Amazon EKS now supports rolling back Kubernetes minor-version upgrades within seven days, providing a safety net that open-source Kubernetes traditionally lacks. The rollback returns a cluster to its previously validated production version rather than placing it in an emulated transitional state. This can help organizations upgrade more confidently, reduce lengthy upgrade cycles, and avoid remaining on outdated versions. ## Kubernetes Version Rollbacks - Rollbacks support one minor version at a time, matching EKS upgrade behavior. - Administrators can revert an upgrade such as Kubernetes 1.35 to 1.34 within the seven-day rollback window. - EKS uses cluster insights to check rollback readiness, including: - Node version compatibility - Add-on dependencies - Other potential upgrade issues - The `--force` option bypasses these checks when administrators need to proceed quickly. - The capability applies to both self-managed-node clusters and clusters using AWS-managed infrastructure. ## EKS Auto Mode Rollbacks - EKS Auto Mode must roll back both the control plane and managed nodes. - Node rollback operations honor pod disruption budgets, so completion time depends on workload configuration. - A cancel API allows administrators to stop an in-progress node rollback. - Disruption budgets are never bypassed automatically; users can modify or remove them if they need to accelerate the process. ## Rollback Experience and Availability - Rollbacks can be initiated from the EKS console after selecting an eligible cluster. - The console displays the remaining rollback window and relevant readiness insights. - In the example, the control plane rollback took about 20 minutes, while Auto Mode nodes rolled back according to their disruption budgets. - Rollbacks are available at no additional cost in all commercial AWS Regions where EKS operates. - Control plane rollbacks support all EKS clusters; node rollbacks are available for EKS Auto Mode. - Supported Kubernetes versions include those under standard or extended EKS support. Administrators can use the EKS console or documentation to begin using rollbacks, making incremental Kubernetes upgrades safer and easier to recover from.

Read original(opens in new tab)
KubernetesAWSAmazon EksEks Auto Mode+3
aws2 min readCurated summary

Accelerate your infrastructure deployments by up to 4x with AWS CloudFormation Express mode | Amazon Web Services

AWS CloudFormation Express mode speeds deployments by marking them complete once resource configuration is applied, rather than waiting for full stabilization checks. AWS says this can reduce deployment times by up to four times, while resources continue becoming operational in the background. It is intended for rapid infrastructure iteration and scenarios where eventual stabilization is acceptable, not workflows requiring resources to be fully ready before proceeding. ## How Express Mode Works - Standard CloudFormation deployments wait for post-configuration stabilization checks. - Express mode completes earlier, immediately after configuration is applied. - Resources continue stabilizing asynchronously. - CloudFormation retries dependent resources that encounter transient provisioning failures. - The provisioning process itself is unchanged; only the point at which deployment completion is reported changes. ## Performance Improvements - Creating an SQS queue with a dead-letter queue took: - Standard mode: 64 seconds - Express mode: up to 10 seconds - Deleting a Lambda function with attached network interfaces took: - Standard mode: 20–30 minutes - Express mode: up to 10 seconds in AWS’s benchmark ## Best Use Cases - Iteratively building infrastructure one component at a time. - Testing individual application components. - AI-assisted infrastructure development requiring sub-minute feedback. - Production workflows that can tolerate resources stabilizing after deployment completion. ## Enabling Express Mode - In the AWS Console, select **Enable** under stack deployment options. - With the CLI or SDKs, set the deployment configuration mode to `EXPRESS`: ```bash aws cloudformation create-stack \ --stack-name my-app \ --template-body file://template.yaml \ --deployment-config '{"mode": "EXPRESS", "disableRollback": true}' ``` - AWS CDK supports: ```bash cdk deploy --express ``` - No CloudFormation template changes are required. - Express mode supports existing templates, change sets, nested stacks, and IaC or AI tools such as Kiro. - Enabling it on a parent stack also applies it to nested stacks. ## Rollback and Operational Considerations - Rollback is disabled by default in Express mode to maximize iteration speed. - For production use, rollback can be restored with `"disableRollback": false`. - Teams should otherwise provide monitoring and cleanup procedures for failed deployments. - IAM templates should continue following least-privilege principles. ## Availability - Express mode is available at no additional cost in all AWS commercial Regions. - AWS recommends standard deployment behavior when resources must be fully operational before traffic shifting or testing. For fast development and AI-driven infrastructure iteration, Express mode is a useful optimization. Use it selectively, while retaining standard mode—or explicitly enabling rollback—when deployment readiness and failure recovery are critical.

Read original(opens in new tab)
Aws LambdaInfrastructure As CodeAws CliAws Cloudformation+4
aws3 min readCurated summary

Amazon EC2 C9g and C9gd instances powered by AWS Graviton5 processors are now available | Amazon Web Services

Amazon EC2 C9g and C9gd instances, powered by AWS Graviton5, are now generally available for compute-intensive workloads. They provide up to 25% better performance per vCPU than C8g, faster DDR5 memory, larger caches, and improved networking and EBS bandwidth. C9gd adds local NVMe SSD storage, making it suitable for workloads requiring both high CPU performance and low-latency temporary storage. ## Graviton5 Performance Improvements - Up to 25% higher performance per vCPU than previous-generation C8g instances. - DDR5 memory running at 8800 MT/s, described as the fastest memory available in a cloud processor instance. - Five times more L3 cache than Graviton4-based instances. - Up to three times higher packet-processing performance than Graviton4. - Benefits include faster in-memory analytics, higher throughput, and more responsive real-time applications. ## C9g and C9gd Workloads - C9g is designed for compute-heavy applications using Amazon EBS, including: - Batch processing - Video encoding - Distributed analytics - CPU-based machine learning inference - Agentic AI workloads - C9gd adds local NVMe SSD storage for: - HPC simulation scratch space - Machine learning inference caches - Ad-serving buffers - Other low-latency temporary-storage use cases - C9gd delivers up to 30% higher local storage performance than the previous generation. ## Networking, Storage, and Configuration - Available in 11 sizes from medium through 48xlarge, plus bare metal. - Up to 15% higher network bandwidth and 20% higher EBS bandwidth on average compared with the prior generation. - The largest instances provide up to 100 Gbps networking and 72 Gbps EBS bandwidth. - Instance Bandwidth Configuration allows up to 25% of bandwidth to be shifted between EBS and VPC networking. - Support includes ENA Express, up to 128 EBS volumes, and On-Demand, Spot, Savings Plans, Dedicated Instances, and Dedicated Hosts. - NVMe-equipped instances expose detailed I/O statistics, including latency histograms by I/O size at one-second granularity through CloudWatch or `nvme-cli`. ## Nitro Isolation Engine - C9g and C9gd are the first compute-optimized EC2 instances to use the AWS Nitro Isolation Engine. - The Rust-based Nitro System component isolates virtual machines by mediating access to memory, CPU register state, and I/O devices through a minimal API set. - AWS provides additional technical documentation covering the engine and its formal verification results. ## Availability - The instances are available in US East (Ohio and Northern Virginia), US West (Oregon), and Europe (Frankfurt). - They can be launched through the AWS Management Console, CLI, or SDKs, with more regions planned. For compute-intensive workloads, C9g is the general-purpose choice, while C9gd is preferable when fast local NVMe storage is also required.

Read original(opens in new tab)
RustAmazon Ec2Aws Graviton5Aws Nitro System+4
aws3 min readCurated summary

Automate public TLS certificate issuance with ACME support in AWS Certificate Manager | Amazon Web Services

AWS Certificate Manager (ACM) now supports public TLS certificate issuance through ACMEv2, enabling automation with clients such as Certbot, cert-manager, and acme.sh. This addresses increasingly short certificate lifetimes—100 days from 2027 and 47 days by 2029—while centralizing certificate governance and visibility in AWS. The service combines Amazon Trust Services certificates with IAM, domain scopes, CloudTrail, CloudWatch, and ACM expiry notifications. ## Why ACME Automation Matters - Manual certificate renewal risks outages and browser errors. - ACME is an open protocol used by Let’s Encrypt and many certificate clients. - ACM’s managed ACME endpoint allows organizations to continue using standard ACME tooling without relying on separate certificate authorities. - Certificates issued through ACME appear alongside other ACM certificates in centralized searches and dashboards. ## Centralized Governance and Monitoring - PKI administrators can create one or more managed ACME endpoints. - IAM roles can be associated with ACME accounts to control which domains clients may request. - Endpoint-level domain scopes restrict requests to: - Exact domains - Subdomains - Wildcard certificates - AWS CloudTrail records certificate requests for auditing. - Amazon CloudWatch provides operational metrics. - ACM sends notifications as certificates approach expiration. - Centralized controls reduce the need for separate lifecycle-management products or custom policy systems. ## Endpoint and Domain Configuration - Administrators create a public ACME endpoint in ACM. - Certificates are issued by Amazon Trust Services and are trusted by standard browsers and operating systems. - Supported key types include: - ECDSA P-256 by default - RSA 2048 - ECDSA P-384 - Domains are validated once at the endpoint level using DNS validation. - Route 53 hosted zones can be updated automatically; other DNS providers require manual creation of the supplied CNAME record. - Application owners do not need access to DNS credentials. ## External Account Binding - Clients register with the ACME server using External Account Binding (EAB). - EAB consists of: - A key identifier - An HMAC key - After registration, the ACME client creates its own asymmetric key pair for subsequent authentication. - EAB credentials can be named and given expiration dates, limiting their lifetime and exposure. ## Using Existing ACME Clients - ACM provides command examples for Certbot and acme.sh. - A Certbot request uses: - The ACM ACME directory URL - EAB key ID and HMAC key - An issuance timeout - The requested domain - Clients can run in containers such as `certbot/certbot`. - The same endpoint can support existing ACME-compatible automation workflows. ACM’s ACME support is best suited to organizations that want automated public certificate issuance without sacrificing centralized policy, auditing, and monitoring. Administrators should validate domains centrally, limit wildcard access where possible, use short-lived EAB credentials, and integrate the endpoint with their existing ACME client automation.

Read original(opens in new tab)
Tls CertificatesPkiAcmeAws Certificate Manager+4
aws3 min readCurated summary

AWS Weekly Roundup: Agentic CX designer for Amazon Connect Customer, EC2 AMI Watermarks, Open Governance for MySQL, and more (June 29, 2026) | Amazon Web Services

The AWS Weekly Roundup highlights tools aimed at making AI, infrastructure management, and cloud operations faster and more accessible. The main announcement is Amazon Connect Customer’s no-code Agentic CX designer, which lets business teams create governed AI customer experiences without relying on lengthy engineering backlogs. Other updates cover isolated serverless compute, AMI governance, guided migrations, AI-assisted security investigations, and broader community initiatives. ## Agentic Customer Experience Design - Amazon Connect Customer launched the Agentic CX designer (NLX) in preview. - The no-code canvas enables business teams to design, test, simulate, and deploy voice and digital self-service experiences. - It combines agentic and deterministic AI within a governed workflow. - AWS also introduced Live Sync in preview, allowing web or mobile interfaces to update in real time as customers speak or type. - Customers could, for example, complete forms or open product pages while continuing a voice conversation. ## New AWS Infrastructure and Operations Features - **AWS Lambda MicroVMs** - Provides VM-level isolation with near-instant startup and resume times. - Supports suspending and resuming execution for up to eight hours. - Targets multi-tenant applications running user-generated or AI-generated code. - **Amazon EC2 AMI Watermarks** - Embeds custom identifiers in private AMIs. - Watermarks persist across copies, Regions, and account shares. - Works with Allowed AMIs and Declarative Policies to enforce approved-image usage. - **AWS Outposts lifecycle management** - Adds self-service configuration, quoting, ordering, subscription management, renewal, and decommissioning. - A new quoting tool provides rapid cost estimates and identifies account or regional constraints. ## AI-Assisted Developer and Migration Tools - **Amazon MSK AI Agent Skills** gives coding assistants such as Kiro, Claude Code, and Cursor operational guidance for Amazon MSK. - It supports Kafka sizing, configuration, troubleshooting, monitoring, and migrations to MSK Express. - **Amazon OpenSearch Service Migration Assistant** now offers agent-guided migrations from Solr, Elasticsearch, and OpenSearch to managed clusters or OpenSearch Serverless. - The migration tooling adds live traffic capture and replay for Solr workloads. ## AI-Powered Security Investigations - Amazon GuardDuty’s AI-powered investigations entered preview. - It analyzes findings, account context, related activity from the previous 90 days, knowledge graphs, and threat intelligence. - Investigations produce confidence-scored assessments, MITRE ATT&CK classifications, and recommended actions to help distinguish real threats from benign activity. ## Open Governance and AWS Community Updates - Oracle announced a community governance model for MySQL, including four non-Oracle seats on a new Steering Committee and a public GitHub presence. - AWS supports the initiative and contributes fixes upstream. - AWS Certification holders can renew eligible Associate and Professional certifications for an additional year through selected Skill Builder training and hands-on labs instead of retaking an exam. - The 2026 All Builders Welcome Grant offers selected early-career builders conference admission, airfare, and lodging for AWS re:Invent. AWS’s latest releases broadly point toward more self-service cloud management: business users can design AI experiences, developers can receive operational guidance from coding assistants, and teams can apply stronger controls to infrastructure and security workflows.

Read original(opens in new tab)
AWSApache KafkaServerlessAws Lambda+4
aws3 min readCurated summary

Run isolated sandboxes with full lifecycle control: AWS Lambda introduces MicroVMs | Amazon Web Services

AWS Lambda MicroVMs provide isolated, stateful execution environments for running untrusted user- or AI-generated code without managing virtual machine infrastructure. Built on Firecracker, they combine VM-level isolation, near-instant startup and resume, and persistent memory and disk state. The post concludes that MicroVMs fill the gap between slow, isolated VMs, less-secure containers, and stateless event-driven Lambda functions. ## The Need for Isolated, Stateful Execution - AI coding assistants, online development environments, analytics tools, vulnerability scanners, and game servers increasingly need a dedicated environment for each user or session. - Traditional options involve tradeoffs: - VMs provide strong isolation but often take minutes to start. - Containers launch quickly but share a kernel and require extensive hardening for untrusted workloads. - Standard serverless functions are designed for short, request-response workloads rather than long-running interactive sessions. - Building custom virtualization infrastructure requires significant security, operations, and virtualization expertise. ## What Lambda MicroVMs Provide - Each user or session receives its own Firecracker-powered MicroVM. - MicroVMs offer: - Dedicated VM-level isolation with no shared kernel between users. - Rapid launch and resume from a pre-initialized snapshot. - Persistent memory, disk state, and running processes during a session. - Automatic suspension during inactivity to reduce idle costs. - Automatic resume when new traffic arrives. - Firecracker already powers AWS Lambda at large scale, providing an established virtualization foundation. ## Creating a MicroVM Image - The example packages a Flask application and Dockerfile into a ZIP archive and uploads it to Amazon S3. - The Dockerfile uses: ```dockerfile FROM public.ecr.aws/lambda/microvms:al2023-minimal ``` - It installs Python and dependencies, copies the Flask application, and starts it with Gunicorn on port 5000. - An image is created with the `aws lambda-microvms create-microvm-image` command, specifying: - The S3 code artifact - An image name - An AWS-provided base image ARN - An IAM build role - Lambda builds the image, initializes the application, and captures its memory and disk state in a Firecracker snapshot. - Build logs are available in CloudWatch under `/aws/lambda/microvms/<image-name>`. ## Launching and Managing a MicroVM - A MicroVM is launched from the image ARN with `run-microvm`. - The example configures an idle policy that: - Suspends the MicroVM after 15 minutes of inactivity. - Keeps it suspended for up to 5 minutes. - Automatically resumes it when traffic returns. - Lambda assigns a unique MicroVM ID and provides a dedicated HTTPS endpoint. - No separate networking setup is required. - The application is already running when the MicroVM becomes available because it resumes from the image snapshot. ## Request Handling and State Preservation - Clients authenticate requests using a short-lived token in the `X-aws-proxy-auth` header. - The Flask API responds immediately after launch. - When the MicroVM becomes idle, Lambda snapshots and stores its memory and disk state. - A later request resumes the environment with the application state intact, making suspension effectively invisible to the client. ## Underlying Execution Model - Lambda MicroVMs use an image-then-launch workflow: - Build and initialize an environment once. - Snapshot the initialized state. - Launch future MicroVMs by resuming that snapshot. - This avoids repeating operating-system and application startup work. - The combination of Firecracker isolation, snapshot-based startup, and suspend/resume lifecycle control makes MicroVMs suitable for secure, interactive, multi-tenant workloads. For applications that must safely execute untrusted code while preserving session state and responsive startup times, Lambda MicroVMs offer a managed alternative to building custom VM infrastructure.

Read original(opens in new tab)
PythonDocker & ContainersAmazon S3Flask+3