11/5/2026, 12:00:00 AM ~ 11/6/2026, 12:00:00 AM (UTC)

Recent Announcements

AWS Interconnect - last mile announces new metro in Northern Virginia, USA

Today, AWS announced a new AWS Interconnect - last mile metro in Northern Virginia, USA. Northern Virginia joins New York as the second metro where you can connect your data center, branch office, or colocation facility to AWS. \n AWS Interconnect - last mile gives you managed, private, resilient connections to AWS, so you don’t have to order cross-connects or configure routers. Every connection is provisioned by default across two physically diverse locations with four redundant links, providing maximum resilience out of the box and backed by a 99.99% availability SLA up to the Direct Connect port. Traffic between AWS and partner edge devices is encrypted with MACsec by default.

Lumen customers anywhere in the continental United States can order generally available connections through the Northern Virginia metro to reach all public AWS Regions (except those in China) and AWS Local Zones. AWS Interconnect - last mile is also available in preview through Megaport and Equinix in the Northern Virginia metro. You can create connections using the AWS Management Console, AWS CLI, or AWS Interconnect API. For pricing, see AWS Interconnect - last mile pricing.

Announcing Web Answer on Amazon Bedrock AgentCore

Today, we are announcing the general availability of Web Answer on Amazon Bedrock AgentCore. Web Answer is a managed tool that returns a synthesized, grounded, cited answer to a natural-language question in a single call, so agent builders can attach it to an agent and get back a finished answer grounded in current web sources, without building and maintaining their own search, retrieve, synthesis, and citation pipeline. \n Web Answer builds on Web Search on Amazon Bedrock AgentCore, which launched in June, extending it from “find the web content” to “return the finished answer,” a capability customers have been asking for. With Web Answer, your agent sends a question and receives a synthesized cited answer in one tool call. Web Answer works like an agent; it plans its own searches, runs several in parallel, and decides when it has gathered enough evidence to answer. You stay in control of the boundaries, with domain include, deny lists and publish-date filters that scope where it looks. It attaches as a target on an AgentCore Gateway and is called over MCP, authenticated with IAM, with zero data egress. 

Web Answer is available in the US East (N. Virginia) Region, with per-tool call pricing. 

To learn more about Web Answer on Amazon Bedrock AgentCore, see Web Answer’s documentation page and Web Answer’s website. For Region availability, see the AWS Region table.

Amazon DynamoDB now supports bulk put items

Today, AWS announces the general availability of bulk put items for Amazon DynamoDB, a fully managed feature that writes data from Amazon S3 into your existing DynamoDB tables. Many DynamoDB applications use data that other systems produce and store in Amazon S3. Writing this data into existing DynamoDB tables has typically meant building custom pipelines and managing table capacity. With bulk put items, developers and data engineers can write this data without impacting existing workloads or building a custom ingestion pipeline, in a cost-efficient way.\n You point bulk put items at the S3 location of your input files, and DynamoDB handles the rest. Each item supports its own condition expression, so you can enforce insert-only or version-guarded writes. The Standard tier fits most workloads, and the Accelerated tier is for more time-sensitive workloads. Common use cases include daily refreshes, large catalog enrichments, backfills, and migrations.

Bulk put items with Standard tier is available in all commercial AWS Regions and the AWS GovCloud (US) Regions, to see the list where the Accelerated tier is available see the regional availability. To learn more, visit the Introducing bulk put items for Amazon DynamoDB blog and the Amazon DynamoDB Developer Guide.

Amazon Cognito announces 99.99% Service Level Agreement for the Plus feature plan

Starting November 1, 2026, the Amazon Cognito Service Level Agreement (SLA) commits to a Monthly Uptime Percentage of 99.99% for user pools on the Plus feature plan, up from 99.9%. User pools already on Plus are automatically covered by the new Service Commitment. User pools on Essentials and Lite stay at the 99.9% Service Commitment with no change to their terms.\n To qualify for the 99.99% Service Commitment, you can switch a user pool to the Plus feature plan using the AWS Management Console, AWS Command Line Interface (CLI), or AWS Software Development Kits (SDKs). The Plus feature plan also includes threat protection features such as adaptive authentication, compromised credentials detection, and threat and user activity logging and export.

For full terms and exclusions, see the Amazon Cognito SLA. To learn more about feature plans, see user pool feature plans.

IAM Roles Anywhere now supports automatic certificate revocation checking

AWS Identity and Access Management (IAM) Roles Anywhere now supports automatic revocation checking using certificate revocation list (CRL) distribution points (CDPs). This helps keep revocation checks in sync with your certificate authority (CA) and can help improve your security posture. When you enable this capability on a trust anchor, IAM Roles Anywhere reads the CDP URLs embedded in authenticating certificates, downloads the corresponding CRLs, and denies credential requests that use revoked certificates.\n Previously, to check revocation status, you had to import CRLs into IAM Roles Anywhere and re-import them each time your CA published an update, which added operational overhead. With this launch, IAM Roles Anywhere downloads CRLs from your CDPs and refreshes them periodically, so you no longer need to re-import them. You can use this capability with AWS Private Certificate Authority or your own public key infrastructure (PKI), provided your certificates include publicly accessible CDP URLs that meet the distribution point requirements. To enable it on a trust anchor, use the IAM Roles Anywhere console, AWS SDKs, or AWS CLI.

This feature is available at no additional cost in all commercial AWS Regions. To learn more, see Automatic revocation checking with CRL distribution points in the IAM Roles Anywhere User Guide.

Amazon RDS for Oracle now supports Kerberos authentication with self-managed Active Directory

Amazon Relational Database Service (Amazon RDS) for Oracle (Amazon Relational Database Service (Amazon RDS) for Oracle) now allows customers to join their RDS for Oracle DB instances directly to their self-managed Microsoft Active Directory (AD) domain. Your self-managed AD can run on premises, on Amazon EC2, or with another cloud provider. Users in your AD domain can authenticate to RDS for Oracle DB instances using Kerberos.\n Previously, in order to use Kerberos authentication with self-managed AD for their RDS for Oracle instances, customers were required to deploy AWS Managed Microsoft AD and establish trust between AWS managed domain and self-managed domain. Now, customers can join their existing self-managed AD directly to authenticate and authorize users without setting up an additional directory or trust relationship. You can set this up using the AWS Management Console, AWS CLI, or AWS SDK. You can use self-managed AD without any additional charge.

Kerberos authentication with self-managed Active Directory in Amazon RDS for Oracle is available in all commercial AWS Regions where Amazon RDS for Oracle is available. To learn more about Kerberos authentication with self-managed Active Directory, visit Working with self-managed Active Directory with an Amazon RDS for Oracle DB instance in the Amazon RDS User Guide.

AWS Security Hub Network Scanning now available in AWS GovCloud (US)

AWS Security Hub Network Scanning feature is now supported in AWS GovCloud (US).\n Network Scanning probes your resources from the internet to detect actual reachability, not just what could be reachable based on security group rules and route tables. It discovers public IP addresses, virtual machines, and load balancers across your AWS environments, identifies reachable ports, and determines what services are running behind them. This complements Security Hub’s existing network reachability findings, which identify configurations that could make a resource reachable from the internet. Network Scanning confirms that configurations do exist which make a resource reachable from the internet. Each reachable port generates a Security Hub finding with evidence of the port and service discovered. Security Hub Exposures then automatically correlates these findings with other findings and resource configurations to determine broader risk.

Existing customers can enable Network Scanning in individual accounts and regions, or across an organization via a configuration policy. For new Security Hub customers, Network Scanning is on by default. Network Scanning is included with Security Hub Essentials at no additional cost in all AWS commercial and GovCloud (US) Regions that support Security Hub. To learn more, see the AWS Security Hub User Guide and the AWS Security Hub product page. For the full list of Regions, see the AWS Regional Services List.

Amazon SageMaker AI Studio Now Supports IAM Identity Center Multi-Region Replication

Amazon SageMaker AI now supports IAM Identity Center (IdC) multi-region replication, enabling you to deploy SageMaker AI Studio domains in different regions from your IdC instance’s primary region. Previously, the primary IdC instance had to reside in the same region as the SageMaker AI Studio domain; now customers can replicate their primary IdC instance into the region where they wish to use SageMaker AI Studio domains. This capability helps customers maintain compliance while utilizing centralized workforce identity management.\n As an Amazon SageMaker AI Studio administrator, you can deploy SageMaker AI domains that align with your workforce’s location and data residency requirements, independent of where your primary IdC instance is set up. Organizations can retain their primary IdC instance in one region while operating SageMaker AI Studio workloads in compliance-mandated regions, support global operations through centralized identity management, and satisfy data sovereignty requirements without compromising single sign-on (SSO) capabilities.

To get started see the SageMaker AI documentation and to learn about setting up IAM Identity Center multi-region support see the IAM Identity Center User Guide.

Multi-region IdC replication is available in all standard AWS Regions where Amazon SageMaker AI Studio is supported, including: Asia Pacific (Tokyo), Europe (Ireland), US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Frankfurt), South America (São Paulo), Asia Pacific (Seoul), Europe (London), Asia Pacific (Singapore), Asia Pacific (Sydney), Canada (Central), Asia Pacific (Mumbai), Europe (Paris), Europe (Stockholm).

AWS WAF AI traffic monetization now supports fiat payouts through Stripe

AWS WAF AI traffic monetization now integrates with Stripe. Publishers, content owners, and API providers can collect stablecoin payments from AI bots and agents that settle in local currency directly to their Stripe balance. With this launch, customers can monetize agent access without holding stablecoins or managing a crypto wallet. Stripe is now available as a new payout method alongside existing stablecoin payouts.\n To get started, connect your Stripe account to AWS WAF through Stripe Connect in the AWS WAF console. Your existing pricing and agent policies work unchanged. When an agent requests protected content, AWS WAF returns an HTTP 402 response with the valid payment credential types that it accepts. Once the agent returns with a valid payment credential and makes the request again, the content is returned ungated. Revenue from all payment providers appears in the AWS WAF console revenue analytics.

The Stripe integration is available at no additional charge to all AWS WAF customers using Amazon CloudFront, in all edge locations where AWS WAF web ACLs are associated with CloudFront distributions. Standard AWS WAF and Stripe processing fees apply. See AWS WAF pricing for details.

To get started, visit the AWS WAF console or explore the AWS WAF Developer Guide.

AWS Systems Manager Parameter Store now allows organization and validation with built-in data types

AWS Systems Manager Parameter Store now supports 13 new parameter data types that automatically validate parameter values when you create or update a parameter. With built-in validation, you can stop malformed configuration values, such as an invalid IP address, AWS account ID, or JSON document, before your applications read them, without writing your own validation logic. These types allow you to better organize your parameters across your workloads. You can filter by type when calling the DescribeParameters API or when browsing parameters in the Parameter Store console.\n The following data types are available for both standard and advanced parameters:  aws:region, aws:account:id, boolean, integer, float, binary, hostname, email, ipv4-address, and ipv6-address. Three more data types, url, json, and jsonc, are available for advanced parameters. Parameter Store checks the value when you call PutParameter and rejects any value that doesn’t match its data type. New data types work with String and SecureString parameters, and several also support StringList parameters, where each item in the list is validated. You can combine a data type with an AllowedPattern for additional constraints, and you can change the data type of an existing text parameter.

AWS Blogs

AWS Japan Blog (Japanese)

AWS Architecture Blog

AWS Big Data Blog

AWS Compute Blog

AWS Database Blog

AWS Developer Tools Blog

AWS for Industries

Artificial Intelligence

Networking & Content Delivery

AWS Security Blog

Open Source Project

AWS CLI