Machine-filtered, human-readable judgment for DevOps and Platform leaders.
Update IAM policies and Service Control Policies (SCPs) to incorporate tag-based access control for Neptune, ensuring that IAM principals can only perform actions against clusters whose tags match their own, thereby enhancing security and reducing risk.
Update your Kubernetes clusters to leverage the increased Horizontal Pod Autoscaler (HPA) sync concurrency in Amazon EKS Provisioned Control Plane, which now processes up to 40 times more HPA objects in parallel, reducing the time it takes for workloads to scale in response to increased load.
Update your deployment strategy to include second-generation AWS Outposts racks in the Asia Pacific (Mumbai) Region, ensuring your hybrid cloud architecture aligns with the new regional support.
The Amazon Web Servies (AWS) Open Data Sponsorship Program makes high-value, cloud-optimized datasets freely available for analysis, helping researchers and developers worldwide access critical data without cost barriers.
Update the aws-smithy-http-server to version 0.66.5 to address the CVE-2026-16756 vulnerability and prevent potential denial of service attacks.
Update the awslabs.aws-api-mcp-server to version 1.3.47 and ensure any derivative code is patched to address the security policy bypass vulnerability identified as CVE-2026-16584.
Update s2n-tls to version v1.7.6 to address critical security vulnerabilities (CVE-2026-16317 and CVE-2026-16318), ensuring the security and stability of TLS/SSL connections and preventing potential data breaches and increased memory consumption.
Update your Amazon MWAA environments to Apache Airflow 2.11.2 to incorporate the latest security patches, bug fixes, and dependency upgrades, ensuring stability and compliance with minimal operational disruption.
Update existing agents by setting the `UNIFIED_TRACES_DESTINATION_ENABLED=true` environment variable and upgrading ADOT to version 0.17.1 or later to leverage unified observability, reducing the complexity of debugging and improving operational efficiency.
Update existing ECS services to enable zone-aware routing by performing a one-time redeployment, ensuring reduced cross-AZ traffic and improved service-to-service communication within the same Availability Zone.
Update your test environments to include the MySQL 9.7 version in the RDS Preview Environment to begin testing applications and exploring new capabilities.
Update your Amazon RDS for SQL Server instances to the latest versions (13.00.6490.1.v1, 14.00.3530.2.v1, 15.00.4470.1.v1, 16.00.4255.1.v1) to apply critical security patches (CVE-2026-40370) and benefit from performance improvements and bug fixes.
Update your Corretto deployments to the latest versions (26.0.2, 25.0.4, 21.0.12, 17.0.20, 11.0.32, and 8u502) to incorporate critical security patches and improvements, and configure your systems to use the new default Amazon Linux 2023 Docker images.
Update RDS for SQL Server deployments to SQL Server 2025 to utilize AI integration, new free edition, and increased Standard Edition capacities, ensuring alignment with the latest capabilities.
Migrate your AWS Load Balancer Controller (LBC) Ingress resources to the Gateway API using the lbc-migrate CLI tool and Migration Console to ensure a validated and error-free migration process.
Update existing Apache Flink applications to version 2.3 to take advantage of adaptive partition selection, improved CDC pipeline handling, and new SQL functions, ensuring smoother operations under uneven loads and better data management.
Configure and monitor the new capacity provider logs for Lambda Managed Instances to gain insights into scaling activities and instance lifecycle events, enabling quicker issue resolution and reduced toil through CloudWatch Logs filtering.
Configure the new Mail Manager guided setup in Amazon SES to simplify SMTP email sending, automating resource creation and reducing manual configuration steps by up to 50%.
Update your IaC templates to leverage the increased RCP quota for more granular resource access controls, ensuring compliance with organization-wide access control guidelines without policy limits.
Configure AWS Secrets Manager to utilize the new secret update notifications feature that automatically publishes events to Amazon EventBridge, allowing for real-time detection of secret changes and routing notifications to targets like AWS Lambda or Amazon SNS, thereby reducing manual monitoring and toil.
Configure Amazon ECS clusters to opt-in for Action Logs via the console or CloudWatch vended logs APIs to streamline troubleshooting and monitoring of service deployments and ECS Managed Daemon updates.
Update your Prometheus monitoring setup to leverage the increased support for up to 1.5 billion active metrics and 200,000 rules per workspace, ensuring your monitoring infrastructure can scale with your growing operational needs.
Configure CloudTrail to use UserIdentity filtering for network activity events to log only relevant events, such as access denied events from untrusted identities, thereby reducing logging costs and improving security monitoring efficiency.
Centralized VPC inspection with Amazon VPC Route Server and AWS Transit Gateway helps you route traffic from multiple virtual private clouds (VPCs) through a shared firewall for security enforcement. Spoke VPCs send traffic through AWS Transit Gateway to a dedicated inspection VPC, where firewall appliances examine it before forwarding. The challenge is making this inspection [โฆ]
In this post, we share how PDI Technologies implemented Amazon Quick Sight to transform their business intelligence infrastructure, cutting manual reporting from hours to minutes and expanding analytics from one team to seven. The result is a modern technology foundation that supports company-wide analytics deployment while improving reporting efficiency across our organization.
Deploy AWS Continuum and Amazon GuardDuty to automate security operations, reduce mean-time-to-remediation, and focus on high-impact threats, ensuring your security team can operate at machine speed.
This post is co-written with Reshma Nuggehally, Jai Bagmar and Kanai Lal Dutta from Accenture Background: Organizations running mainframes face a critical challenge: 90% are pursuing cloud modernization, yet organizations have transitioned fewer than 20% of workloads. Rising operating costs, retiring talent, and rigid architectures demand a fundamentally different approach. In this post, we explore how [โฆ]
Amazon Bedrock AgentCore optimization surfaces silent behavioral failures in production AI agents: the ones that pass every health check but still deliver wrong outcomes. Learn how insights discovers, explains, and ranks failure patterns across sessions so you can fix the highest-impact issues first.
Organizations in regulated industries like financial services, insurance, healthcare, and government ingest large volumes of data containing personally identifiable information (PII). Your applications, claims processing systems, partner data feeds, and internal workflows produce files that may include names, addresses, Social Security numbers, and domain-specific identifiers such as policy numbers, member IDs, and medical record numbers. [โฆ]
In this post, we describe how Tradeshift deployed Amazon Quick with agentic AI capabilities to replace our legacy BI tool, resulting in query response times up to 30 times faster, a 40 percent reduction in total cost of ownership, and turned embedded analytics into a product that generates revenue.
Update Athena Query Federation to version v2026.21.1 and sanitize inputs for Synapse tables to address the security vulnerability CVE-2026-12283.
Update aws-healthomics-mcp-server to version 0.0.36 to address the path traversal vulnerability (CVE-2026-15415) and ensure that all forked or derivative code is patched accordingly.
Update Bedrock AgentCore Python SDK to version 1.5.1 or later to address CVE-2026-15737 and prevent sensitive content disclosure in OpenTelemetry spans.
Update jsii-diff to version 1.131.0 to address the OS command injection vulnerability (CVE-2026-15895) and ensure secure operation of API comparison tasks.
Update strands-agents-tools to version 0.7.0 to resolve the SSRF issue (CVE-2026-15746) and rotate the ELASTICSEARCH_API_KEY to enhance security posture and prevent potential data breaches.
Update the AWS Load Balancer Controller to version 3.4.2 and apply necessary patches to forked or derivative code to resolve the CVE-2026-15738 vulnerability, ensuring that ALB listener rule priorities are correctly assigned based on route specificity rather than route kind.
Update AWS HealthLake MCP Server to version 0.0.14 to address the SSRF vulnerability (CVE-2026-15643) and ensure pagination URLs are validated, reducing the risk of credential exfiltration.
Migrate your existing OpenSearch Dashboards to OpenSearch UI using the new one-click migration feature, enabling seamless transition without manual recreation of tenants and saved objects, and reducing operational toil.
Update your Lambda function deployment process to use self-managed S3 buckets by setting the S3ObjectStorageMode to REFERENCE, ensuring you configure appropriate IAM permissions and S3 bucket policies for secure access.
Deploy PostgreSQL 19 Beta 2 in the Amazon RDS Database Preview Environment to test new features such as parallel autovacuum and REPACK CONCURRENTLY, which can help manage large databases more efficiently and reduce downtime for maintenance activities.
Update your MSK Express Brokers to Apache Kafka 4.2 to leverage ELR enhancements, new rebalance protocols, and improved performance metrics, ensuring smoother operations and reduced recovery times.
Update your migration workflows to utilize the new automated rollback and support for migrating stopped WorkSpaces from PCoIP to DCV protocol, reducing manual intervention and speeding up large-scale migrations.
Configure the Agent Toolkit for AWS and integrate AI Agent Skills with existing AI coding agents to streamline Flink application management and reduce development toil.
Update your Amazon DocumentDB clusters to version 8.0.1 to leverage the new MongoDB operators, ensuring your applications benefit from enhanced query capabilities and compatibility.
Update S3 Lifecycle configurations to transition objects to S3 Standard-IA and S3 One Zone-IA as soon as 0 days after creation using the S3 console, AWS CLI, or SDKs.
Update your monitoring practices to include the new water withdrawals data available in the AWS Sustainability console and API for better environmental impact assessment.
Update your backup strategies to include the new regions for logically air-gapped vaults, ensuring that your IaC templates (Terraform, CloudFormation) are adjusted to utilize these new capabilities for enhanced security.
Update S3 bucket configurations to include system-generated tags in event notifications, leveraging EventBridge rules for efficient event management without additional cost.
Update your operational monitoring stack to include Amazon Managed Grafana in AWS GovCloud (US) regions to ensure FedRAMP High compliance for visualizing and alerting on metrics, reducing security risks and ensuring adherence to regulatory standards.
Update your deployment configurations to include R8g and M8g instances, taking advantage of the new sizes and enhanced networking capabilities to optimize your database performance and cost.
This blog introduces a governance framework designed for organizations with multiple business units that need to enable fast agent development while maintaining enterprise-wide visibility, cost control, and safety.
Read all about the latest AWS security features, compliance updates, and hands-on resources in our new, monthly digest posts. Youโll find expert blog posts, new service capabilities, code samples, and workshops. AWS Security Blog posts This monthโs AWS Security Blog posts covered identity and access management, threat intelligence, network security, AI-powered security tooling, and multi-account [โฆ]
Update your existing Aurora and RDS databases or create new ones using R8gd or M8gd instances in the newly supported regions to benefit from improved performance and cost-efficiency.
Introduction Itโs 7 AM in Singapore, and a finance controller is racing to close the month-end books in SAP โ but before she can, system authentication must verify her identity across three continents. Her team in Frankfurt is battling sluggish response times, and the security team in New York has just flagged an unverified connection [โฆ]
Insurance fraud remains a significant challenge for the insurance industry because fraudulent claims can increase loss costs, reduce trust, and consume investigation capacity that could otherwise be focused on serving customers. Traditional fraud detection approaches typically rely on rules-based controls, manual investigation triggers, historical claim patterns, and structured-data-only analysis. These approaches are useful for known [โฆ]
Update RES installations to version 2026.06 to address the improper link resolution vulnerability (CVE-2026-14904) and ensure the security of cluster-manager EC2 instances.
Update mcp-gateway-registry to version 1.0.13 to address the authenticated SQL injection vulnerability (CVE-2026-14471) and ensure the security of your metrics database.
Update existing Redshift clusters to rg.4xlarge or rg.xlarge instance types on the trailing track (P201) via AWS Management Console, CLI, or SDKs to leverage improved performance and cost benefits.
Update your existing RA3 clusters to RG instances using Snapshot & Restore, Elastic Resize, or Classic Resize to leverage improved performance and cost benefits, and ensure your IaC templates are updated to include the new instance types.
Update your development workflow to utilize Apache Spark Connect in AWS Glue interactive sessions, allowing for seamless integration with local IDEs and remote Spark execution, and consider migrating existing Spark applications to leverage this new capability.
Update existing Oracle Database instances to version 26ai using the Modify DB Instance workflow to leverage new AI features and ensure compatibility with the latest Oracle Long Term Support Release.
Update your VMware deployment strategy to include the new VCF 9.0 and 9.1 support on Amazon EVS, utilizing the provided GitHub repository for infrastructure as code templates to streamline the deployment process.
Update your VMware Cloud Foundation deployments to versions 9.0 and 9.1 on Amazon EVS, utilizing the provided GitHub repository for templates and examples to streamline the process.
Update your migration workflows to utilize the new offline SQL Server conversion feature in AWS DMS Schema Conversion, allowing for schema and code conversion without direct database connectivity, thus simplifying security reviews and firewall configurations.
Update your AI agent connections to utilize the new OAuth support for the AWS MCP Server, ensuring compliance with existing IAM policies and taking advantage of new OAuth capabilities like token introspection and revocation APIs.
Update your deployment strategies to include the new regions for Client VPN to ensure broader coverage and redundancy.
Update your ECS Managed Instances configurations to take advantage of the reduced GPU management fees, which apply automatically starting July 1, 2026, to minimize operational costs.
Update your EKS Auto Mode clusters to take advantage of the reduced GPU management fees, which require no action from your side as the changes apply automatically.
Deploy the Service Events feature in CloudWatch Application Signals to automatically capture errors, performance anomalies, and deployment events, reducing the need for manual instrumentation and improving application monitoring capabilities.
Update your infrastructure-as-code templates to include R8g.24xlarge and R8g.48xlarge instances for Amazon DocumentDB to take advantage of the new performance capabilities and DDR5 memory.
In this post, we walk through five capabilities now available in SageMaker HyperPod inference: multi-tier data capture for auditing and model improvement, direct deployment from Hugging Face Hub, local NVMe model loading for faster cold starts, automated Route 53 DNS for custom domains, and pod-level IAM through custom service accounts.
In 12 weeks, one Software as a Service (SaaS) organization cut AWS costs by 39% while preparing for 10x growth. This post walks through the phased approach the team used to sequence multiple optimizations without disrupting production. Each phase built on the last, compounding into a total 39% reduction within 12 weeks. You can apply [โฆ]
Organizations across industries struggle with labor-intensive verification and data collection processes that require manual follow-ups, phone calls, and email exchanges. These workflows consume time and resources, often taking days to complete verification tasks while generating high operational costs. Manual processes involve multiple touchpoints, repeated attempts to reach contacts, and documentation requirements that create operational bottlenecks [โฆ]
In this post, we introduce Reverse Direct Preference Optimization (rDPO), the novel unlearning technique behind Amazon Nova Customizable Content Moderation Settings (CCMS), and show how it reduces over-deflection while preserving model quality. We also provide pointers for customers who want to apply these preference optimization techniques to their own experiments.
Update your aws-cdk-lib to version 2.260.0 and ensure that all dependencies come from trusted sources to address the OS command injection vulnerability (CVE-2026-13760).
Update the AWS Advanced JDBC Wrapper to version 4.0.1 to address CVE-2026-14265, which involves deserialization of untrusted data in the RemoteQueryCachePlugin, to prevent potential security breaches.
Update AWS CLI to versions 1.44.78 (v1) or 2.34.29 (v2) to address CVE-2026-13769, ensuring secure file permissions and protecting credentials from local user access.
Deploy the new zone-aware routing feature in ECS Service Connect by redeploying existing services to take advantage of reduced cross-AZ traffic and improved load balancing, resulting in lower costs and better performance.
Update your deployment configurations to leverage the increased runtime quotas for Amazon Bedrock AgentCore, allowing for more concurrent sessions and higher interaction rates to optimize AI agent performance.
Update AWS Artifact to integrate Assurance Assistant for streamlined compliance inquiries, utilizing single-question and bulk processing modes to enhance efficiency and ensure accurate, sourced responses.
Update your monitoring setup to leverage Amazon Managed Service for Prometheus in AWS GovCloud (US) for FedRAMP High and DoD IL-4/5 compliance, ensuring secure and compliant metric monitoring.
DevRev built real-time AI guardrails into its enterprise agent system, powered by Amazon Nova 2 Lite through Amazon Bedrock. The guardrail layer evaluates every user input against default and custom policies in 247ms average latency without degrading the conversational experience. This post explores how DevRev delivers high support ticket automation and cost reduction while keeping content on-policy and safety controls firm.
In this post, we describe the innovations that make RG instances so much faster. We also share benchmark results showing that RG delivers up to 4.2x better price-performance than other leading data warehouses.
Update your EC2 configurations to utilize AMD SEV-SNP on Dedicated Hosts for improved security and control over instance placement, ensuring your infrastructure aligns with the latest AWS capabilities.
Itโs our goal for AWS to be the most secure place to run any workload, and in support of that weโve been deeply investing in security across our services since AWS's inception more than two decades ago. Our AI services like Amazon Bedrock are built on this foundation and with the same focus.โฏ
Organizations delivering content on a global scale rely on distributed edge networks to cache and serve billions of requests daily. These architectures depend on highly aggressive Time-To-Live (TTL) configurations to maximize performance and minimize origin load. On a cache miss, the network falls through to the origin to retrieve the requested content. At this scale, [โฆ]
Configure log query-based alarms in Amazon CloudWatch to eliminate the need for intermediate metric filters or custom metrics, thereby reducing setup time and improving the efficiency of log monitoring workflows.