10/30/2026, 12:00:00 AM ~ 11/2/2026, 12:00:00 AM (UTC)
Recent Announcements
Amazon Bedrock now supports the OpenAI GPT-5.6 models (Terra and Luna) on the bedrock-runtime endpoint, with support for the Responses, Converse, and Chat Completions APIs in AWS GovCloud (US). It also adds support for cross-Region inference, allowing customers to use cross-Region inference within AWS GovCloud (US) regions to access higher throughput and increased redundancy. \n Cross-Region inference automatically routes inference requests across both AWS GovCloud (US) Regions to give you higher throughput, without you needing to manage capacity across multiple Regions. Cross region inference within AWS GovCloud (US) routes requests across both regions so you can scale while maintaining US data sovereighnty, giving you the broadest access to Bedrock capacity and the highest throughput during demand spikes. This launch also expands API support; you can use OpenAI GPT models with the Responses API, Chat Completions API, and the Converse API on the bedrock-runtime endpoint. Because these native OpenAI APIs now run on bedrock-runtime, the models work with the same account-level controls you already use for other models on Bedrock: usage appears in Bedrock model invocation logging (deliverable to Amazon S3 or Amazon CloudWatch Logs) and in Amazon CloudWatch metrics covering invocation counts, token counts, latency, throttles, and errors, and it is itemized in AWS Cost Explorer and the AWS Cost and Usage Report so you can attribute spend by model.
Cross-Region inference for OpenAI models is available in all AWS Regions where OpenAI models on Amazon Bedrock are offered. To get started, review the model cards for GPT 5.6 (Terra and Luna) in the Amazon Bedrock User Guide.
Web Search now available on Kiro in AWS GovCloud (US)
Kiro web search gives the agent real-time access to current information on the internet, so its answers draw on up-to-date search results and page content. The agent uses web search automatically when a question involves recent changes or topics beyond the model’s training data. Answers that use web results include citations.\n Kiro enterprise administrators can turn off web search and web fetch for their organization from the Kiro console under Settings. Teams can also remove web tools from individual custom agents, or block them with capability-based permission rules.
For more details, visit the AWS GovCloud (US) documentation, the monitoring and tracking guide, or contact your AWS account team. To learn more about Kiro, visit the Kiro product page.
Amazon Connect Customer automatically saves in-progress emails as drafts
Amazon Connect Customer automatically saves in-progress emails as drafts, helping agents resume work without losing progress when connectivity is interrupted or when their browser is accidentally closed or refreshed. When agents return, their drafts are restored with the message body, recipients, subject line, and attachment references intact. Customers can also access saved draft data in their Amazon S3 buckets to build integrations with other applications.
Security teams need powerful tools to find vulnerabilities, test exploits, and build defenses. Daybreak Red from OpenAI is now available to eligible customers on Amazon Bedrock in AWS GovCloud (US-East), bringing advanced AI to this work.\n
Part of OpenAI’s Daybreak cyber defense initiative, Daybreak Red: GPT-5.6 Cyber is built for authorized vulnerability research, exploit reproduction, and mitigation development. It gives verified defenders more room to investigate complex security problems, with fewer refusals for this work and stronger identity verification, monitoring, and access controls.
Daybreak Red runs on Bedrock’s next-generation inference engine, with zero-operator access enforced at the chip. Your inference data is not used to train models, and you do not need to share your Daybreak Red data with OpenAI.
The model is available in US East (Ohio) and AWS GovCloud (US-East). Access to the model requires enrollment in Daybreak access from OpenAI. To get started, contact OpenAI or your AWS account team about Daybreak eligibility. Once approved, work with your AWS account team to enable access. Learn more in the blog.
Amazon CloudFront now provides viewer ISP and post-quantum TLS details
Amazon CloudFront can now forward two new optional headers to your origin. The CloudFront-Viewer-ISP header contains the name of the viewer’s internet service provider (ISP), so you can see which network a request came from. The CloudFront-Viewer-TLS-Details header describes the cryptography used on each viewer’s TLS connection, so you can see whether a connection used post-quantum cryptography (PQC).\n With CloudFront-Viewer-ISP, you can break down traffic and performance by network. You can also isolate unusual traffic from a single provider. CloudFront-Viewer-TLS-Details includes the key exchange, signature scheme, and signature public key type for each connection. You can use it to measure the share of viewers that actually connect with PQC and identify clients that do not yet do so. To forward either header to your origin, add it to an origin request policy and attach the policy to your distribution.
To get started, see adding CloudFront headers and controlling origin requests with a policy in the Amazon CloudFront Developer Guide
Amazon MSK now supports TLS 1.3 for data in transit
Amazon MSK now supports version 1.3 of Transport Layer Security (TLS) protocol for MSK Provisioned clusters through encryption policies. TLS 1.3 delivers faster, more secure encryption for streaming data and is increasingly required by compliance frameworks and enterprise security standards. It is also one of the prerequisites for post-quantum cryptography for protecting data against attacks that collect encrypted traffic now with the intent to decrypt it later.\n Customers can opt in to TLS 1.3 by selecting a named security policy in their MSK cluster configuration, with no change to existing clusters until a policy is applied. A named security policy defines which TLS version and cipher suites a cluster can accept. With this launch, Amazon MSK provides a set of policies customers can select and any connection that does not meet the selected policy requirements is rejected. This allows customers to stay in control of their security and compliance posture. Policies that support both TLS 1.2 and TLS 1.3 allow connections to negotiate the highest version the client supports allowing clients that support TLS 1.3 to connect on it immediately while clients on TLS 1.2 continue to connect on TLS 1.2. This lets customers upgrade their clients at their pace before applying a stricter policy. Customers can also select stricter policies that align closer with their compliance requirements to restrict connections to TLS 1.3 only.
This capability is available at no additional cost in all AWS Regions where Amazon MSK Provisioned is available. To learn more, see the Amazon MSK documentation.
Amazon Relational Database Service (Amazon RDS) for Oracle now lets you turn off automatic minor version upgrades on new and existing DB instances that use the JVM, Spatial, Locator, or OLAP option. Previously, these options required automatic minor version upgrades to be enabled.\n With this change, you decide when to apply minor version upgrades to DB instances using these options. If you turn off automatic minor version upgrades, we recommend that you apply new minor versions regularly so your DB instances keep the latest Oracle security fixes. To keep automatic minor version upgrades turned on and still control the order in which your environments are upgraded, you can use AWS Organizations upgrade rollout policy.
This change is available in all commercial AWS Regions and the AWS GovCloud (US) Regions where Amazon RDS for Oracle is available. To learn more about options available in Amazon RDS for Oracle, see Adding options to Oracle DB instances in the Amazon RDS User Guide.
AWS WAF announces automatic SDK integration for Amazon CloudFront distributions
AWS WAF announces automatic SDK integration for Amazon CloudFront distributions. When you enable it, CloudFront adds the script tag for the AWS WAF JavaScript SDK to the HTML it serves, with no change to your application code, build process, or deployment. The SDK supplies the client-side signals used by three AWS WAF managed rule groups: Bot Control at the targeted inspection level, Fraud Control account takeover prevention (ATP), and Fraud Control account creation fraud prevention (ACFP).\n Previously, supplying those signals required you to add a script tag to every page of every application you wanted to protect, and to maintain that tag across releases. For teams running many applications, or serving pages produced by systems they do not control, this created recurring work and a common source of misconfiguration, where a protection was enabled in AWS WAF but the client-side integration was missing. Enabling automatic SDK integration on the web ACL protecting your CloudFront distribution removes that per-application work. Automatic SDK integration is available for web ACLs that are used with Amazon CloudFront and contain at least one of those managed rule groups. You can configure it using the AWS Management Console, CLI, SDK, CDK, or CloudFormation. In the AWS WAF console, the setting appears with the managed rule group settings and is on by default for new web ACLs that you create with one of those rule group. When you create a web ACL programmatically, the setting is off by default. Web ACLs created before this release are unchanged. There is no additional charge for automatic SDK integration. For requirements, limitations, and Content Security Policy guidance, see Automatic SDK integration for CloudFront distributions in the AWS WAF Developer Guide.
AWS Glue Data Catalog now supports automatic table optimization for Apache Iceberg tables in the US West (N. California) Region. Apache Iceberg is an open table format that delivers fast query performance over large tables in data lakes. With this launch, you can enable table optimization for individual tables or for all tables in your Data Catalog.\n Apache Iceberg tables accumulate small files, snapshots, and unreferenced files with every write, which slows queries and increases storage costs over time. Table optimization continuously monitors your tables to compact small files in the background, remove snapshots that are past your retention settings, and delete unreferenced files that are no longer needed. You can monitor each run from the AWS Glue console, Amazon CloudWatch metrics, and logs.
You can enable table optimization using the AWS Glue console, AWS CLI, or AWS SDKs. For the full list of Regions where table optimization is available, see Supported Regions for table optimizers. To learn more, see Optimizing Iceberg tables in the AWS Glue Developer Guide. To get started, visit the AWS Glue product page.
AWS Blogs
AWS Japan Blog (Japanese)
- Operating in the Age of Agents: AIOps Sessions for re:Invent 2026
- [Updated from time to time] Inter BEE 2026 AWS booth information: People create, people decide. Next-generation broadcasters supported by AI agents
- Commercial introduction of Amazon EKS Auto Mode on KDDI: solving operational issues with custom controllers
- AWS Weekly Roundup: Amazon Polly’s Generative Engine, TorchNeuron for Trainium, etc. (2026/10/26)
- AWS Continuum for Code Continuation is now generally available
- When entrusting writing to an AI agent, where do you place the boundary — a record of creating a mechanism with Kiro CLI and operating for 1 month
AWS Japan Startup Blog (Japanese)
AWS Big Data Blog
AWS for Industries
Artificial Intelligence
- Preview web apps live as your coding agent builds them with Amazon Bedrock AgentCore runtime
- How Worldwide Express automated freight exceptions with Amazon Bedrock
- Configure the ChatGPT desktop app with Amazon Bedrock in AWS GovCloud (US)