awsMay 28, 2026

Introducing the next generation of AWS Resilience Hub for generative AI-based SRE resilience journey | Amazon Web Services (opens in new tab)

AWS introduces the next generation of AWS Resilience Hub to help organizations manage application resilience consistently across large portfolios. The update adds a new business-oriented application model, modular resilience policies, dependency discovery, generative AI failure-mode analysis, and organization-wide reporting. Its goal is to help SREs and development teams define expectations, identify weaknesses, implement fixes, and demonstrate resilience through testing. ## Modular Resilience Policies - Policies are built from composable requirements rather than a single fixed policy type. - Requirements can include: - Availability service-level objectives (SLOs) - Multi-AZ and multi-Region disaster recovery - Recovery time objectives (RTOs) - Recovery point objectives (RPOs) - Backup data recovery requirements - Example policies can define 99.95% availability, a 15-minute RTO, and a 5-minute RPO for financial applications. ## Business-Oriented Application Modeling - A **system** represents a business application. - **User journeys** describe critical end-user paths and business outcomes. - **Services** represent deployable units such as microservices, AWS resources, code, and observability components. - Resilience Hub automatically maps resource relationships into a topology showing data flow, containment, and permissions. ## Dependency Discovery - Resilience Hub analyzes VPC DNS query logs to identify dependencies that may not be documented. - It can discover: - AWS services - Internal endpoints - Third-party endpoints - Unexpected cross-Region calls - Critical external dependencies - Dependency discovery can be enabled or disabled for individual services. ## Generative AI Failure-Mode Assessments - Assessments analyze services against: - Configured resilience policies - AWS Well-Architected best practices - The AWS Resilience Analysis Framework - Findings explain the failure mode, its architectural impact, recommended remediation, and related policy requirement. - Users can add or modify assertions to guide the AI agents and improve assessment accuracy. - Findings can be marked as resolved after remediation or irrelevant when they do not apply. ## Getting Started and Enterprise Management - Users must configure an invoker IAM role granting read-only access to AWS resources. - Cross-account roles or AWS Organizations service-linked roles can support multi-account environments. - AWS Organizations integration allows a delegated administrator to assess resilience across the enterprise without signing into individual accounts. - A typical workflow is: - Create a resilience policy. - Create a system and service. - Associate resources through tags, CloudFormation, Terraform, or Amazon EKS. - Enable dependency discovery. - Run a failure-mode assessment. - Review and implement recommendations. ## Migration, Availability, and Pricing - Migration APIs convert older Resilience Hub policies and applications into the new model, including mapping multiple related applications into one system with multiple services. - The new version is generally available in supported AWS commercial Regions. - Pricing uses a service-based model and includes two failure-mode assessments per service per month, with automated dependency assessment available optionally. - AWS offers a free trial. The updated Resilience Hub is most useful for organizations that need consistent resilience standards and evidence across many AWS accounts and applications. Teams should begin by defining reusable policies, modeling critical services and dependencies, and using the AI assessments to prioritize remediation.

aws-organizationsgen-aiterraforminfrastructure-as-code+4

awsApr 3, 2026

Amazon Bedrock Guardrails supports cross-account safeguards with centralized control and management | Amazon Web Services (opens in new tab)

Amazon Bedrock Guardrails now supports cross-account safeguards, allowing organizations to centrally enforce safety controls across AWS accounts and organizational units. Administrators can apply immutable, versioned guardrails to all Bedrock model invocations while still allowing account- or application-specific policies. The capability is generally available across commercial and GovCloud Regions where Bedrock Guardrails is supported. ## Centralized Organization- and Account-Level Enforcement - **Organization-level enforcement** uses an Amazon Bedrock policy created in the AWS Organizations management account. - Policies can attach a specified guardrail and version to: - The organization root - Organizational units - Individual AWS accounts - The selected guardrail is automatically applied to Bedrock inference requests across targeted member entities. - Different policies and guardrails can be assigned to different accounts or organizational units. - **Account-level enforcement** applies a configured guardrail to all Bedrock inference API calls within one account and Region. ## Configuring Guardrail Coverage - Guardrails must use a specific version so their configuration remains immutable and cannot be changed by member accounts. - Administrators can choose whether enforcement: - Includes or excludes specific Bedrock models - Covers all or only selected system and user prompt content - **Comprehensive** mode guards all content, regardless of caller-provided tags. - **Selective** mode relies on callers to identify content requiring protection, reducing processing for pre-validated inputs. ## Testing and Verification - Account-level enforcement can be configured in the Amazon Bedrock Guardrails console. - Enforcement can be tested with: - `InvokeModel` - `InvokeModelWithResponseStream` - `Converse` - `ConverseStream` - Responses include guardrail assessment details and identify the enforced guardrail. - Member accounts can verify organization-level enforcement in the Bedrock console. ## Important Considerations - Organizations must meet prerequisites such as configuring resource-based policies for guardrails. - Incorrect or invalid guardrail ARNs can cause policy violations, prevent safeguards from being enforced, and block model inference. - Automated Reasoning checks are not supported. - Charges apply for each enforced guardrail based on its configured safeguards. ## Availability Cross-account safeguards are generally available in all commercial and GovCloud AWS Regions where Amazon Bedrock Guardrails is available. Organizations can enable the feature through the Amazon Bedrock and AWS Organizations consoles. Overall, the capability gives security teams a centralized way to enforce responsible AI requirements while reducing the need to audit guardrail settings independently in every account and application.

aws-organizationsamazon-bedrockguardrailai-safety+4