techlist.io
KREN

AWS

101 posts

aws.amazon.com/blogs/aws

Filter by tag

Amazon Bedrock38AWS30AI Agents24Amazon Ec220Generative AI20Amazon S316AI16Aws Lambda15Serverless13Kubernetes10PostgreSQL10Aws Cli10+360
aws4 min readCurated summary

AWS Weekly Roundup: NY Summit recap, Local Zone in Hanoi, Grok 4.3 in Bedrock, price reductions, and more (June 22, 2026) | Amazon Web Services

AWS’s June 22, 2026 roundup centers on the New York Summit’s focus on AI agents that continuously create value across work, security, software development, and customer applications. It also highlights new regional infrastructure, developer tools, Bedrock models, data capabilities, performance improvements, and several price reductions. Overall, AWS is emphasizing agent-driven automation while lowering barriers and costs for building and operating cloud workloads. ## New York Summit: Agents Across the AWS Stack - **Agents for working:** Amazon Quick supports autonomous, multi-step agents and provides a prioritized activity feed combining email, Slack, calendars, and tasks. - **Agents for securing:** AWS Continuum is an AI-native security service designed to reason about, validate, and remediate vulnerabilities across the development lifecycle. - AWS Security Agent adds threat modeling, pull-request scanning and remediation, and IDE integrations through Kiro, Claude Code, and MCP. - **Agents for building:** Kiro, AWS DevOps Agent, and AWS Transform support continuous coding, deployment, release assessment, and autonomous modernization. - Kiro now includes a native iOS app. - AWS DevOps Agent can evaluate code changes before production release. - **Agents customers create:** Amazon Bedrock AgentCore adds a generally available infrastructure and orchestration harness, Web Search, Managed Knowledge Base, Guardrails integrations, and AWS Context for mapping organizational data relationships. ## New Infrastructure and Developer Services - **AWS Local Zone in Hanoi:** The new `ap-southeast-1-han-1a` zone supports Amazon S3 and Amazon EBS Local Snapshots, helping customers satisfy local data residency and backup requirements. - **AWS Blocks:** This preview open-source TypeScript framework provides a local environment with Postgres, authentication, and real-time messaging without requiring an AWS account. Applications can later deploy to AWS without code changes, with optional CDK integration. - **AWS Management Console Private Access:** Enterprises can access the AWS Console from isolated VPCs without internet connectivity, supporting air-gapped security models. - **AWS Marketplace Storefront:** Partners can publish branded catalogs of AWS Marketplace solutions on their own websites or applications. ## AI, Data, and Agent Capabilities - **Grok 4.3 in Amazon Bedrock:** xAI’s model is available for reasoning, agentic, and enterprise workflows, with tool calling, structured output, and response streaming. - **Amazon S3 annotations:** Objects can now carry up to 1 GB of mutable, queryable context, reducing the need for separate metadata systems in AI-agent and autonomous workflows. - **Strands Agents:** The open-source toolkit adds improved Harness SDK context management, isolated execution through Strands Shell, and chaos testing and red-team capabilities in Strands Evals. - **NVIDIA-powered EC2 G7:** G7 instances use NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs and sixth-generation Intel Xeon processors, delivering up to 4.6 times the AI inference performance and 2.1 times the graphics performance of G6 instances. ## Performance and Security Improvements - **Faster Amazon ECS auto scaling:** Support for 20-second metrics reduces scale-out trigger time from 363 to 86 seconds and total scaling and task provisioning time from 386 to 109 seconds in AWS benchmarks. - **Palo Alto Networks DNS Security:** Route 53 Resolver DNS Firewall can apply PANW Advanced DNS Security protections directly, without separate firewalls or VPC changes. ## Price Reductions - **Amazon S3 Vectors:** Query charges for large vector indexes fall by up to 80%, with no application changes required. - **Amazon GameLift Servers:** Generation 6 and newer instances now include free inbound and outbound network bandwidth for both On-Demand and Spot usage. - **AWS Marketplace professional services:** Listing fees drop from 2.5% to 0.5%, reducing transaction costs for consulting, managed services, and software partners. AWS’s latest direction is to combine increasingly autonomous agents with faster infrastructure, broader model choice, stronger security, and lower operating costs. Developers and organizations should evaluate Bedrock AgentCore, AWS Blocks, S3 annotations, and the new regional and private-access options where they can simplify agent development or satisfy data and security requirements.

Read original(opens in new tab)
AI AgentsGenerative AIPostgreSQLTypeScript+4
aws2 min readCurated summary

Announcing Amazon EC2 G7 instances accelerated by NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs | Amazon Web Services

Amazon EC2 G7 instances are now generally available with NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs and custom sixth-generation Intel Xeon processors. Compared with G6 instances, they provide up to 4.6× higher AI inference performance and 2.1× better graphics performance. AWS positions them for AI inference, rendering, video, virtual desktops, spatial computing, and GPU-accelerated analytics. ## GPU and Performance Improvements - Each GPU provides 32 GB of memory, with up to 256 GB across eight GPUs. - GPU memory capacity is 1.33× higher and bandwidth is 2.45× higher than G6. - GPUs include fifth-generation Tensor Cores and fourth-generation RT Cores. - G7 instances accelerate analytics workloads running on Amazon EMR with Amazon EKS. ## Networking and Storage - Up to 700 Gbps of EFA-enabled networking—seven times the G6 throughput. - Up to 7.6 TB of local NVMe SSD storage keeps large models and datasets close to the GPUs. - Support for NVIDIA GPUDirect P2P and GPUDirect RDMA with EFA enables low-latency GPU communication across GPUs, nodes, and FSx for Lustre. ## Video Processing - Ninth-generation NVENC and sixth-generation NVDEC engines support 4:2:2 encoding and decoding. - They deliver up to 1.5× more concurrent video streams than G6 instances. ## Instance Configurations - Seven instance sizes are available. - Configurations offer up to: - 8 NVIDIA RTX PRO 4500 GPUs - 192 vCPUs - 768 GiB of system memory - 700 Gbps network bandwidth - 7.6 TB local NVMe storage - Detailed instance specifications were listed as “coming soon” in the announcement. ## Software and Availability - AWS provides Deep Learning AMIs and NVIDIA Workstation AMIs with preinstalled drivers. - Amazon EKS users should build AMIs with NVIDIA driver version R595. - Supported operating systems include Amazon Linux, Ubuntu, RHEL, and Windows Server. - NVIDIA integration supports DirectX, Vulkan, and OpenGL. - G7 instances are initially available in US East (Ohio) and US West (Oregon). - Purchasing options include On-Demand, Savings Plans, Spot Instances, and Dedicated Instances for selected sizes. G7 instances are a strong option for GPU-intensive workloads requiring higher inference, graphics, networking, and video performance. Organizations can launch them through the EC2 console and evaluate pricing across the available purchasing models.

Read original(opens in new tab)
KubernetesAWSAmazon Ec2Gpu Acceleration+4
aws2 min readCurated summary

Amazon ECS introduces new high-resolution metrics for faster service auto scaling | Amazon Web Services

Amazon ECS now supports 20-second high-resolution metrics for faster service auto scaling. AWS reports that scale-out triggers improved from 363 to 86 seconds, while total scaling and task provisioning dropped from 386 to 109 seconds. The update helps applications handle traffic spikes more reliably, reduce excess baseline capacity, and achieve aggressive scaling with simpler target-tracking policies. ## Faster Scaling with High-Resolution Metrics - ECS service auto scaling can use predictive, scheduled, or reactive target-tracking policies. - New 20-second metrics allow ECS to detect workload changes faster than standard 60-second metrics. - AWS benchmarking showed: - 76% faster scale-out triggering, or 4.2× improvement. - 72% faster total scaling and task provisioning, or 3.5× improvement. - Faster scaling can reduce latency and failures during sudden demand increases. ## Lower Costs and Simpler Configuration - Applications may reduce baseline task counts because capacity can be added quickly during spikes. - This can lower compute costs without sacrificing availability. - High-resolution target tracking can provide aggressive scaling behavior that previously required custom step-scaling policies. ## Configuration and Supported Metrics - Enable high-resolution metrics for the ECS service, then configure a target-tracking scaling policy. - New options include: - `ECSServiceAverageCPUUtilizationHighResolution` - `ECSServiceAverageMemoryUtilizationHighResolution` - The feature works with AWS Fargate, ECS Managed Instances, and Amazon EC2. - It can be configured through the ECS console, AWS SDKs, AWS CLI, Application Auto Scaling, or CloudFormation. - Existing services must first enable high-resolution metrics and complete deployment before their scaling policy can be updated. ## Cost and Availability - The ECS feature itself has no additional charge. - High-resolution CloudWatch metrics incur additional CloudWatch costs, unlike standard 60-second metrics. - The capability is available now. For workloads with unpredictable or rapid traffic changes, enabling high-resolution metrics with target tracking can improve responsiveness while reducing the need for overprovisioned ECS tasks.

Read original(opens in new tab)
Amazon Ec2Aws CliAmazon EcsAws Cloudformation+4
aws3 min readCurated summary

Top announcements of the AWS Summit in New York, 2026 | Amazon Web Services

AWS Summit New York 2026 focused on making AI agents more capable, secure, autonomous, and easier to operate in production. Announcements spanned Amazon Bedrock AgentCore, security automation, developer tooling, workplace agents, and S3 data management. The overall direction is toward agents that can access governed knowledge, act independently, and continuously improve while remaining subject to enterprise controls. ## Building More Capable Agents - **Amazon Bedrock Managed Knowledge Base** simplifies enterprise RAG with native data connectors, Smart Parsing for multi-format data, and an Agentic Retriever for complex, multi-step queries. - **Web Search for Bedrock AgentCore** provides managed, current, cited web knowledge while keeping data within the customer’s secured AWS environment. - **Bedrock AgentCore harness** is now generally available, allowing developers to define an agent’s model, tools, skills, and instructions through configuration rather than custom orchestration loops. - **AWS Context**, coming soon, will map relationships across organizational data into a knowledge graph. Agents will be able to use governed relationships, business rules, and domain knowledge at runtime. - **AWS WAF Bot Control** lets publishers and content owners price, meter, and collect payment from AI bots accessing content and APIs, with scoped access enforced at the edge. ## Securing Agents and Applications - **AWS Continuum**, available in gated preview, aggregates vulnerability findings, ranks them by business impact, verifies exploitability, and routes fixes through existing development processes. - **AWS Security Agent**, now part of Continuum, adds: - Threat modeling based on the STRIDE framework - Pull-request code scanning and remediation across major Git platforms - IDE integrations through Kiro, Claude Code, and MCP - These tools are intended to let developers perform security reviews and address vulnerabilities without leaving their normal workflows. ## AI-Assisted Software Development - **Kiro for iOS**, in gated preview, lets developers start, monitor, steer, and approve Kiro sessions from a phone, including reviewing diffs and approving changes without keeping a laptop running. - **AWS DevOps Agent** adds release readiness reviews and autonomous release testing. It evaluates changes against natural-language standards and tests them in production-like environments. - **AWS Transform continuous modernization**, in preview, scans repositories against configurable technical-debt baselines and can autonomously generate remediation pull requests. ## Autonomous Workplace Agents - New **Amazon Quick autonomous agents** can work in the background with defined expertise, tone, permissions, and tools. - Example use cases include: - A finance agent processing incoming orders - A sales agent analyzing CRM, email, and Slack activity - Agents drafting follow-ups, identifying risks, and recommending next steps - A new **activity feed** combines email, messaging, calendars, and tasks into a prioritized view that adapts to the user’s communication and work patterns. ## Richer Metadata for Amazon S3 - **S3 annotations** allow up to 1 GB of mutable, queryable context to be attached directly to an object. - The feature targets AI agents and autonomous workflows that need to discover and interpret data without maintaining separate metadata systems. AWS’s announcements point toward an agent ecosystem that combines managed knowledge retrieval, web access, security automation, autonomous development workflows, and persistent workplace assistance. Organizations adopting these capabilities should pair autonomy with strong governance, scoped permissions, and continuous validation in production.

Read original(opens in new tab)
AI AgentsAmazon BedrockRAGAmazon S3+4
aws3 min readCurated summary

Introducing Amazon Bedrock Managed Knowledge Base for faster, more accurate enterprise AI applications | Amazon Web Services

Amazon Bedrock Managed Knowledge Base is a managed service for building enterprise generative AI applications over proprietary data. It abstracts storage, retrieval, embeddings, reranking, and model selection while adding native connectors, automated parsing, and agentic retrieval. The result is a faster way to create scalable, accurate RAG-based agents without maintaining the underlying infrastructure. ## Enterprise Knowledge Base Challenges - Enterprise data is distributed across systems with different formats, permissions, and access controls. - RAG accuracy requires ongoing experimentation with parsing, chunking, embedding models, and retrieval behavior. - Organizations must support either massive knowledge bases containing millions of documents or thousands of smaller ones while controlling cost and enforcing security. - These infrastructure tasks divert developers from building application functionality. ## Managed RAG Infrastructure - Managed Knowledge Base combines storage, retrieval, embeddings, reranking, and foundation model selection into one managed primitive. - The service automatically selects and manages default embedding, reranking, and foundation models. - It can scale end-to-end RAG pipelines with only a few lines of code. - Through Amazon Bedrock AgentCore Gateway, it is available as a pre-built target with automatically generated role-based permissions, observability, and evaluation metrics. ## Native Data Connectors - Six built-in connectors ingest enterprise content and permissions directly from: - Amazon S3 - SharePoint - Confluence - Web Crawler - Google Drive - OneDrive - Connectors eliminate the need to build and maintain application-specific ingestion logic. - IAM roles are created automatically, with the option to customize permissions. ## Smart Parsing Smart Parsing automatically chooses ingestion and parsing techniques based on the source and content type. - Connector-specific models preserve important structure: - Web Crawler retains HTML structure, embedded images, and tables. - SharePoint preserves document hierarchies and relationships. - Multimodal processing detects document content types, identifies bounding boxes, and uses foundation models for extraction and captions. - Optimized chunking uses document structure and content type to balance retrieval quality and performance. - Developers can rely on defaults or customize chunking strategies for advanced use cases. ## Agentic Retriever Agentic Retriever is designed for complex questions requiring multi-step reasoning and retrieval. - It decomposes a query into a sequence of subquestions. - It performs multihop retrieval within one knowledge base or across multiple knowledge bases. - It evaluates intermediate results and stops once sufficient relevant passages have been found. - For example, it can connect a team’s cloud budget with an expense policy governing annual prepayments—something a single retrieval step might miss. - Retrieved context can then support more accurate, grounded responses from enterprise agents. ## Getting Started - Create a Managed Knowledge Base from the Amazon Bedrock AgentCore or Amazon Bedrock console. - Choose **Create Managed KB** and select **Unstructured Vector Store KB**. - Select a supported data connector and accept the optimized defaults. - After synchronization, connect the knowledge base to an agent or expose it as a tool for a foundation model. Managed Knowledge Base is best suited to teams that want production-ready enterprise RAG without assembling and operating every component themselves, while retaining customization options for specialized accuracy or governance requirements.

Read original(opens in new tab)
AI AgentsGenerative AIAmazon BedrockRAG+2
aws3 min readCurated summary

Announcing Web Search on Amazon Bedrock AgentCore: Ground your AI agents in current, accurate web knowledge | Amazon Web Services

Amazon Bedrock AgentCore Web Search is now generally available, giving AI agents access to current, cited web information without sending prompts or queries outside a customer’s AWS environment. Built into AgentCore Gateway through the Model Context Protocol (MCP), it combines Amazon’s web index with structured knowledge graph data to provide relevant snippets, URLs, titles, dates, and verified facts. The service lets developers ground agent responses in up-to-date information without building or managing search infrastructure themselves. ## How Web Search Works - Agents submit natural-language queries through an AgentCore Gateway. - The tool returns: - Relevant web snippets - Source URLs - Page titles - Publication dates - Results are powered by: - Amazon’s web search index - Amazon Knowledge Graph data - The combination of web results and structured facts is intended to improve relevance and accuracy over conventional search alone. - Retrieved information can support both grounded responses and follow-up agent actions. ## Secure, Managed Agent Integration - Web Search is a fully managed connector target for Bedrock AgentCore Gateway. - Customer prompts and retrieval queries remain within the AWS environment rather than being sent to external search API providers. - Developers avoid implementing search integrations and operating related infrastructure. - The service supports enterprise governance requirements and secured data workflows. ## Getting Started - Create or open a Bedrock AgentCore Gateway in the AWS console. - Select: - **MCP** as the target protocol - **Connectors** as the target type - **Web Search** as the preconfigured target - After the Gateway URL is created, interact with the tool using: - API calls - AWS CLI - MCP Python SDK - Strands MCP Client - MCP Inspector - MCP Inspector can be used to connect to the Gateway, enter a query, and run the Web Search tool for testing and debugging. - Web Search can also be added to an existing Gateway. ## Early Customer Use Cases - **Benchling** uses Web Search to combine institutional scientific data with published literature, helping researchers generate more complete answers and hypotheses in a governed environment. - **Gen Digital** uses the tool in Norton Revamp to create current online reputation content based on real-world developments. - Customers highlighted the value of current information, AWS-native security, and keeping search queries within their trusted environment. ## Availability and Pricing - Web Search is generally available in **US East (N. Virginia)**. - It is offered at no additional cost initially. - Customers pay applicable Gateway data transfer charges. - New AWS customers may receive up to $200 in Free Tier credits. Developers can try Web Search through the Amazon Bedrock AgentCore console and consult the Gateway documentation for implementation details.

Read original(opens in new tab)
AI AgentsModel Context ProtocolAmazon Bedrock AgentcoreKnowledge Graph+2
aws3 min readCurated summary

Proactively reduce tech debt autonomously with AWS Transform – continuous modernization (preview) | Amazon Web Services

AWS is previewing AWS Transform – continuous modernization, a capability designed to continuously detect, prioritize, and remediate technical debt across thousands of repositories. It replaces fragmented, manual tooling with configurable analysis, automated pull requests, and current compliance visibility. The goal is to help engineering and platform teams keep codebases modern as dependencies, frameworks, runtimes, and security requirements evolve. ## Continuous Technical Debt Analysis - Scans connected repositories against configurable organizational baselines. - Produces findings within hours, including: - End-of-life dependencies - Deprecated frameworks - Security and code-quality issues - Organization-specific technical debt patterns - Teams can define custom policies for approved libraries, internal standards, deprecated components, or preferred coding patterns. - Findings provide a current view of which repositories are behind baseline, by how much, and which files or components are affected. - This reduces reliance on manual status reports and periodic compliance checks. ## Autonomous Remediation - AWS Transform can automatically generate pull requests for affected repositories. - Built-in transformations support common tasks such as: - Java version upgrades - SDK migrations - Library updates - Custom transformations can be created for organization-specific modernization needs. - Teams retain control by reviewing and merging the generated pull requests or applying their own fixes. - Continuous analysis verifies when repositories return to compliance without requiring manual confirmation. ## Integrated Security Remediation - Integration with AWS Security Agent brings source-code security vulnerabilities into the same workflow. - Security findings appear alongside other technical debt in a prioritized list. - Remediation is delivered through pull requests rather than separate, disconnected security processes. ## Dashboard and Remediation Campaigns - The AWS Transform web application provides portfolio-level visibility across repositories. - Users can view finding severity, affected files, categories, repositories, and available remediation options. - Remediation campaigns track: - Pull requests created - Pull requests merged - Repositories restored to compliance - AWS Transform supports repositories connected from GitHub and local environments. ## Continuous Mode and Campaign Mode - **Continuous mode** handles recurring maintenance: - Dependency upgrades - Security patches - Runtime updates - Coding-standard enforcement - **Campaign mode** is intended for larger, project-based changes, such as migrating frameworks or upgrading a major runtime across hundreds of applications. - AWS Transform custom remains the flexible option for substantial modernization projects, while continuous modernization focuses on high-volume, ongoing maintenance. AWS Transform – continuous modernization is available in preview through the AWS Transform web application, AWS Transform Kiro Power, MCP, and skills for coding-agent integration. It is most useful for organizations that need automated, organization-wide visibility and pull-request-based remediation for continuously accumulating technical debt.

Read original(opens in new tab)
Model Context ProtocolJavaAws LambdaPull Requests+4
aws3 min readCurated summary

AWS DevOps Agent adds release management capabilities to assess code changes before production (preview) | Amazon Web Services

AWS DevOps Agent’s new preview release-management features extend its role from post-deployment incident response to pre-production review and testing. It evaluates code changes against production requirements, organizational standards, dependency risks, and access-control practices, then performs targeted tests in isolated or production-like environments. The goal is to help teams safely handle the growing volume of AI-generated code without sacrificing review quality or delivery speed. ## Release Readiness Reviews - Reviews changes for: - Production and dependency risks - Cross-repository impacts - AWS access-control changes and Well-Architected best practices - Compliance with organization-specific standards - Teams can provide standards in plain English, such as: - Encryption and network-access rules - Logging and observability requirements - Sensitive-data classification practices - Without custom instructions, the agent applies general best practices. - It runs lightweight user-journey tests in an AWS-managed isolated environment to confirm that the software builds, runs, and passes basic functional checks. - Findings are available in: - The AWS DevOps Agent console - GitHub or GitLab pull-request comments - IDE workflows through the Kiro power or Claude Code plugin ## Autonomous Release Testing - Generates test plans based on the specific code change rather than relying only on static test suites. - Tests web and API applications in customer-provisioned, production-like environments before merging. - Covers: - Functional correctness - Behavioral regressions - Integration scenarios - Produces structured artifacts for every run, including metrics, logs, traces, and execution summaries. ## Configuring and Running Reviews - At least one GitHub or GitLab repository must be connected to an AWS DevOps Agent Space. - The agent indexes connected code and builds a knowledge graph of cloud and cross-repository dependencies. - Reviews can be triggered by: - Submitting a pull request - Starting an on-demand chat request, such as “Perform a production risk analysis on my repository branch” - The target can be specified using a branch name, pull-request number, or commit SHA. - Reviews can also be initiated from supported development environments. ## Reviewing Results - The **Changes** section lists review executions and supports filtering by category or status. - The **Timeline** records the agent’s tools, consulted dependencies, observations, and timestamped reasoning steps. - The **Report** includes: - Recommended action: **BLOCK**, **Proceed with Caution**, or **Safe to Release** - Number of critical issues - Commit revision and changed-file count - Evidence supporting the recommendation - Severity-ranked findings - Actionable remediation steps - A file-by-file summary of modifications - Developers can ask follow-up questions about affected downstream consumers, impacted files and line numbers, and recommended fixes. AWS DevOps Agent’s preview release-management capabilities provide an automated layer of change analysis and targeted testing before production. Teams should configure organization-specific instructions, connect their repositories, and use the generated reports and test artifacts as an additional safety gate for AI-assisted development.

Read original(opens in new tab)
ObservabilityCI/CDGitlabGithub+4
aws3 min readCurated summary

AWS Security Agent adds threat modeling, Kiro power and Claude Code plugin, and more | Amazon Web Services

AWS Security Agent, now part of AWS Continuum, is expanding into a unified security platform spanning design, development, and deployment. New capabilities include threat modeling, deeper pull-request and repository reviews, compliance validation, and integrations with Kiro, Claude Code, and other AI IDEs through MCP. AWS’s central promise is to find vulnerabilities, verify exploitability, and provide actionable fixes without interrupting developers’ workflows. ## Enhanced Code Reviews - Supports GitHub, GitLab, and Bitbucket, including SaaS and self-hosted installations. - Integrates with Confluence so reviews can use existing technical and security documentation as context. - Performs reasoning-based analysis of pull requests and entire repositories, identifying vulnerabilities beyond pattern matching. - Checks code against organizational security requirements and common security risks. - Validates findings in simulated environments to demonstrate proof of exploitability. - Provides remediation guidance and fix commits directly in the repository workflow. - Supports pull-request scanning, remediation, security requirement packs, and simulated validation. ## Compliance and Design Reviews - Managed compliance packs include: - AWS WAF - NIST CSF - PCI DSS - AWS best practices - Organizations can import their own security requirements from internal documents or Confluence. - Findings are mapped to the organization’s compliance posture, helping teams maintain audit readiness throughout development. ## Threat Modeling - Generates threat models from design documents or source-code repositories. - Builds an application context model covering: - Architecture - Data flows - Trust boundaries - Application components - Identifies likely threat actors, attack vectors, and weaknesses. - Uses the STRIDE framework to classify threats. - Prioritizes risks and recommends mitigations. - Threat models can be generated from the Security Agent console or through supported development tools. ## Kiro, Claude Code, and MCP Integrations - A Kiro power is available, with a Claude Code plugin coming soon. - An open MCP integration enables use from Kiro, Claude Code, or other AI-powered IDEs. - Developers can trigger scans, threat models, and remediation directly from their IDE or CLI. - Kiro commands include: - `Set up AWS Security Agent` - `Run a full security scan on this repo` - `help me remediate my findings` - `Build a threat model for this application` - Findings can be downloaded into the local workspace, prioritized, and used to start bug-fix specification sessions. - Generated threat models are saved at `.security-agent/threat_model.md`. - A Kiro agent hook can automatically evaluate whether a code-review scan should run after an agent turn. ## Lifecycle Coverage and Availability - Design-time security: design reviews and threat modeling, both in preview. - Development-time security: repository and pull-request code reviews, in preview. - Deployment-time security: on-demand penetration testing, generally available. - The features are available in supported AWS commercial Regions, with regional availability and pricing listed in AWS documentation. AWS Security Agent is positioned as a continuous security layer across the software lifecycle. Teams interested in automated, context-aware security analysis can try it through the Security Agent console, while developers can use the IDE and MCP integrations to keep scanning and remediation within their existing workflows.

Read original(opens in new tab)
Model Context ProtocolCode ReviewClaude CodeThreat Modeling+3
aws3 min readCurated summary

Amazon S3 annotations: attach rich, queryable context directly to your objects | Amazon Web Services

Amazon S3 annotations let organizations attach rich, mutable context directly to objects without rewriting the underlying data. Each object can have up to 1,000 named annotations, with a combined limit of 1 GB, in formats such as JSON, XML, YAML, or plain text. The annotations move with objects during copying and replication, can be queried through S3 Metadata tables, and are intended to support large-scale analytics and AI-driven workflows. ## Richer Metadata at Object Scale - Annotations address limitations of existing S3 metadata features: - System metadata describes properties such as size and storage class. - Object tags support operational tasks but are limited to 10 immutable tags. - User-defined metadata is limited to approximately 2 KB of headers and must be supplied during upload. - Annotations can be modified or deleted independently without rewriting the object. - Each annotation has a unique name and can hold up to 1 MB, with up to 1 GB total per object. - Supported content includes structured formats such as JSON, XML, and YAML, as well as plain text. ## Supporting AI and Industry Workflows - AI-generated transcripts, summaries, classifications, ratings, and technical specifications can remain attached to the relevant data. - Media companies can store transcripts, moderation results, subtitles, licensing information, and media specifications alongside video assets. - Financial institutions can attach investment summaries and sentiment analysis to research documents for autonomous discovery. - Life sciences organizations can add regulatory status, cohort information, and approval chains to clinical-trial data. - Annotations remain available for objects in archival storage classes without restoring the objects or paying retrieval charges. ## Object Lifecycle and Synchronization - Annotations automatically move with objects during copy, replication, and cross-Region transfers. - S3 removes annotations when the associated object is deleted. - This reduces dependence on separate metadata databases or sidecar files and avoids synchronization overhead. - Different teams or enrichment processes can maintain separate annotations on the same object without overwriting one another. ## Working with Annotations - IAM or bucket policies must grant: - `s3:PutObjectAnnotation` - `s3:GetObjectAnnotation` - The main APIs are: - `PutObjectAnnotation` to create or update an annotation - `GetObjectAnnotation` to retrieve one annotation - `ListObjectAnnotations` to view all annotations on an object - `DeleteObjectAnnotation` to remove an annotation - Reusing an annotation name with `PutObjectAnnotation` updates its content. - For multipart uploads, annotations are added after the upload is completed. - The example uses separate `mediainfo` JSON and `ai_summary` text annotations on a video object. ## Querying Through S3 Metadata - When S3 Metadata is enabled, annotations automatically populate managed annotation tables. - These tables can be queried with Amazon Athena and other analytics engines. - The S3 Tables MCP server provides a standardized interface for AI models and agents to query annotation data using natural-language workflows. - This enables discovery across large collections of S3 objects without retrieving the objects themselves. S3 annotations are most useful when object context is large, frequently updated, and needed for cross-object search or AI automation. Organizations should use them to keep business and machine-generated metadata directly associated with the data while using S3 Metadata tables for scalable querying.

Read original(opens in new tab)
AI AgentsAmazon S3JsonAws Cli+3
aws4 min readCurated summary

AWS WAF adds AI traffic monetization capability to help content owners charge AI bots for content access | Amazon Web Services

AWS WAF introduces AI traffic monetization, allowing publishers to charge AI bots for content access at the network edge. Owners can set prices and access rules by content path and agent verification tier without changing origin infrastructure or building payment systems. The capability uses stablecoin payments and the x402 protocol, helping publishers recover costs from AI traffic that generates little referral value. ## Why AI Traffic Monetization Matters - AI crawlers now represent more than half of web traffic for many content providers. - AI-specific crawler activity has reportedly grown over 300% year over year. - Unlike search crawlers, AI agents often consume content without sending users back to the publisher. - Publishers still pay for bandwidth and infrastructure while losing potential page views, advertising impressions, and subscriptions. - AWS WAF Bot Control previously supported visibility, blocking, and rate limiting, but not payment collection. ## Setting Up a Protection Pack - AWS WAF Bot Control must be enabled at the Common or Targeted level on the web ACL associated with a CloudFront distribution. - A protection pack defines: - Monetized content paths - Pricing by agent verification tier - Accepted payment methods - License terms - Protection packs can be created in the AWS WAF and Shield console. - Users can associate CloudFront distributions, select managed security protections, and customize monetization settings. - Multiple protection packs can apply different pricing policies to separate content zones. ## Analyzing AI Bot Traffic - The AI traffic analysis dashboard divides requests into: - All bot requests - AI bot requests - Verified AI bot traffic - Unverified AI bot traffic - It reports bandwidth usage, estimated monthly cost, and peak request rates. - A per-path heatmap shows when and where AI agents access content. - AWS WAF Bot Control classifies more than 650 AI bot and agent types, including GPTBot, Claude-Web, and Perplexity-Bot. ## Agent Verification Tiers - **Verified:** Identity is confirmed through Web Bot Auth Ed25519 signatures or documented IP ranges with known user-agent and domain information. - **Unverified:** The agent is identified using user-agent matching, behavioral fingerprints, and IP reputation, but lacks cryptographic confirmation. ## Access and Pricing Actions For each verification tier, publishers can choose one of six actions: - **Monetize:** Charge for access and return an HTTP 402 response. - **Allow:** Provide free access. - **Block:** Deny the request. - **Count:** Log the request without charging. - **CAPTCHA:** Require human verification. - **Challenge:** Silently verify that the client is a browser rather than a bot. ## Stablecoin Payments and x402 - Publishers select supported blockchain networks and provide a wallet address. - Pricing is set as a base page price in USDC, with support for multiple networks. - AWS does not process payments or take a share of content revenue; settlement is handled by the publisher or wallet provider. - Monetized requests return an HTTP 402 response containing an x402 JSON price manifest. - The manifest specifies: - USDC price - Accepted networks, such as Base and Solana - Destination wallet - Payment timeout - Payment scheme - Compatible AI agents can submit signed payment authorizations autonomously. - AWS WAF verifies the payment, uses third-party facilitators such as Coinbase’s x402 Facilitator for on-chain settlement, retrieves the content, and returns it to the agent. ## Deployment Limits and Testing - Monetization rules are supported only on web ACLs associated with Amazon CloudFront distributions. - Regional web ACLs cannot use the Monetize action. - Real and Test currency modes can be switched from the monetization configuration page. - Test mode is intended for validating pricing, wallet settings, and x402 payment flows before production deployment. - Stripe account payments and Machine Payments Protocol support are planned for future releases. Publishers should first enable Bot Control and study AI traffic patterns before setting prices. Protection packs and test mode provide a way to apply differentiated policies while validating that automated payment and content delivery work correctly.

Read original(opens in new tab)
StablecoinsX402BlockchainCloudfront+3
aws4 min readCurated summary

AWS Weekly Roundup: AWS FinOps Agent in preview, Gemma 4 on Bedrock, Kiro Pro Max, and more (June 15, 2026) | Amazon Web Services

AWS’s June 15, 2026 roundup highlights rapid adoption of AI-native development, a preview of the AWS FinOps Agent, and major infrastructure and model releases. AWS reports significant productivity gains from agent-assisted engineering, while new services target cost optimization, observability, security, and developer workflows. The overall direction is toward more autonomous, context-aware tools integrated throughout the AWS ecosystem. ## AI-Native Development at AWS - Amazon engineering teams are restructuring development around AI agents. - A six-engineer team rebuilt the Amazon Bedrock inference engine in 76 days, compared with an original estimate of 30 developers over 12–18 months. - Structured Amazon Stores pilots achieved a median 4.5× improvement in normalized deployment velocity, with some teams exceeding 10×. - Recommended practices for “frontier teams” include: - Building steering files, coding standards, and structured repositories to provide agent context. - Expecting an initial productivity slowdown while workflows change. - Maintaining a backlog of well-scoped tasks that agents can execute in parallel. - Writing structured specifications before generating code. - Moving testing earlier so agents can detect and correct issues. - AWS cautions that commit velocity is only one measure; future work will address release management, operations, security, and end-of-life upgrades. ## AWS FinOps Agent Preview - AWS FinOps Agent helps finance and engineering teams: - Answer AWS cost questions and generate reports. - Identify rightsizing, idle-resource, and Savings Plans opportunities. - Investigate cost anomalies automatically. - Schedule recurring FinOps workflows. - Recommendations come from AWS Cost Optimization Hub and AWS Compute Optimizer. - The agent can open Jira tickets and post anomaly-investigation findings to Slack. ## New EC2 M9g and M9gd Instances - M9g and M9gd instances use AWS Graviton5 processors and the sixth-generation Nitro System. - They provide: - Up to 25% better compute performance than Graviton4. - Up to 35% faster web applications and ML inference. - Up to 30% faster database performance. - Up to 15% more network bandwidth and 20% more EBS bandwidth than M8g. - Graviton5 adds PCIe Gen6, DDR5-8800 memory, and a 5× larger L3 cache. - The Nitro Isolation Engine uses formal verification to provide mathematically proven VM isolation. - M9gd adds up to 11.4 TB of local NVMe SSD storage and 30% higher IOPS than M8gd. - Instance Bandwidth Configuration can shift bandwidth between EBS and VPC networking by up to 25%. ## Bedrock Model Updates - Anthropic Claude Fable 5 launched on Bedrock with: - Extended asynchronous task execution. - Advanced vision for diagrams, charts, and PDFs. - Proactive self-verification. - Access required Data Retention API opt-in and 30-day retention for inputs and outputs. - Anthropic later asked AWS to revoke access to Claude Fable 5 and Claude Mythos 5 in response to a U.S. government export-control directive. - Google DeepMind’s Gemma 4 models are available in three versions: - Gemma 4 31B for reasoning and coding, with a 256K-token context window. - Gemma 4 26B-A4B, a mixture-of-experts model for cost- and latency-sensitive use. - Gemma 4 E2B for low-latency interactive applications. - All variants support function calling, structured output, reasoning, streaming, multimodal inputs, and more than 35 languages. ## OpenSearch MCP Apps for Agentic Observability - OpenSearch MCP Apps bring logs, traces, metrics, and alerts into compatible agentic environments such as Claude Desktop and VS Code. - Agents can investigate incidents across OpenSearch and Amazon Managed Service for Prometheus. - Each tool call produces both: - A text summary for the agent. - An interactive visualization displayed in the conversation. - Available tools cover log, metric, and trace analysis; service performance; topology; agent health; cluster health; dynamic visualizations; and instrumentation scoring. ## Additional AWS Updates - AWS CLI v1 is entering maintenance mode: - Dependencies such as `botocore` and `s3transfer` will be vendored into the CLI. - Future releases will focus on critical bugs and security fixes. - AWS recommends migrating to CLI v2. - AWS Workload Credentials Provider provides short-term credentials for applications running outside AWS, including on-premises and third-party environments, without requiring long-term access keys. - Kiro Pro Max adds higher usage limits, access to newer frontier models, and additional agentic development capabilities for professional teams. AWS’s latest releases suggest that teams should prepare for AI agents to handle not only code generation, but also cost management, observability, testing, and operational workflows. Migrating to AWS CLI v2, evaluating Bedrock’s newest models, and establishing strong repository context and specifications are practical next steps.

Read original(opens in new tab)
AI AgentsModel Context ProtocolAmazon BedrockAmazon Ec2+4
aws3 min readCurated summary

Now available: Amazon EC2 M9g and M9gd instances powered by new AWS Graviton5 processors | Amazon Web Services

AWS has generally released Amazon EC2 M9g and M9gd instances, powered by its Graviton5 processors. They deliver higher compute, memory, networking, and storage performance while improving energy efficiency and security. M9g targets general-purpose workloads, while M9gd adds up to 11.4 TB of local NVMe SSD storage for low-latency applications. ## Graviton5’s Performance Improvements - Graviton5 provides up to: - 25% better compute performance than Graviton4 - 35% faster web applications and ML inference - 30% faster database workloads - It includes: - 192 CPU cores - Five times more L3 cache - Up to 33% lower inter-core latency - DDR5-8800 memory - PCIe Gen6 support - These features improve concurrency, memory bandwidth, and CPU-heavy workloads such as agentic AI, code generation, real-time reasoning, and multi-step orchestration. - Customer results include: - ClickHouse: 36% better performance than M8g without code changes - Honeycomb: 36% higher throughput per core - HubSpot: up to 60% shorter MySQL query duration ## Networking and Storage Enhancements - M9g and M9gd provide: - Up to 15% higher network bandwidth - Up to 20% higher EBS bandwidth on average - Up to twice the network bandwidth on the largest instance - Instance Bandwidth Configuration lets customers shift bandwidth between EBS and VPC networking by up to 25%. - This is useful for databases, query processing, logging, and other workloads with demanding I/O requirements. ## Nitro Isolation Engine - M9g and M9gd introduce the Nitro Isolation Engine, an enhancement to the AWS Nitro System. - It isolates virtual machines by controlling access to: - Memory - CPU register state - I/O devices - The component uses formal verification to mathematically prove isolation behavior rather than relying solely on testing. - AWS describes Nitro as the first formally verified cloud hypervisor. ## M9g General-Purpose Instances - M9g instances provide one vCPU per 4 GiB of memory. - Suitable workloads include: - Application servers and microservices - Web applications and containerized applications - Midsize data stores and caching fleets - Gaming servers - Large-scale Java applications - Code repositories - Agentic AI workloads ## M9gd Instances with Local NVMe Storage - M9gd adds up to 11.4 TB of local NVMe SSD storage. - It offers up to 30% higher IOPS and storage performance than Graviton4-based M8gd instances. - Recommended for: - Low-latency caches and scratch files - Data and log processing - Media processing - Batch workloads - Key-value stores - Gaming and application servers ## Availability and Migration Resources - M9g and M9gd are available in: - US East (N. Virginia) - US East (Ohio) - US West (Oregon) - Europe (Frankfurt) - Purchasing options include Savings Plans, On-Demand, Spot Instances, Dedicated Instances, and Dedicated Hosts. - AWS provides a Graviton Getting Started Guide, Graviton Savings Dashboard, and AWS Transform for migrating Java applications from x86 to Graviton. Organizations seeking better compute efficiency, higher I/O throughput, or lower-cost Arm infrastructure should evaluate M9g for general-purpose workloads and M9gd when local NVMe storage is required.

Read original(opens in new tab)
AI AgentsAmazon Ec2Aws Graviton5Aws Nitro System+4
aws3 min readCurated summary

Anthropic Claude Fable 5 on AWS: Mythos-class capabilities with built-in safeguards now available | Amazon Web Services

Claude Fable 5 is now available through Amazon Bedrock and Claude Platform on AWS, offering Mythos-level performance with safeguards for broader access. Anthropic highlights its ability to perform long-running tasks, analyze complex visual documents, and verify or improve its own work. Access requires specific data-sharing consent, and higher-risk requests may be routed to Claude Opus 4.8. ## Capabilities and Safeguards - Supports extended, asynchronous coding and knowledge-work tasks with minimal intervention. - Interprets diagrams, charts, tables, files, and PDFs for research, finance, legal, analytics, architecture, gaming, and software development. - Uses vision to compare implemented designs with intended goals. - Can update skills, create evaluation harnesses, and perform proactive self-verification. - Cybersecurity, biology, chemistry, and health prompts with elevated misuse risk may be handled by Opus 4.8 instead. - The unrestricted Claude Mythos 5 is limited to a small group of vetted customers. ## Accessing Fable 5 on Amazon Bedrock - Available through: - Anthropic’s Messages API using `bedrock-mantle` or `bedrock-runtime`. - AWS Invoke and Converse APIs through `bedrock-runtime`. - The Amazon Bedrock console Playground. - Model access is being expanded gradually across AWS accounts; customers can contact AWS Support for expedited access. ## Required Data Sharing - Users must opt into data sharing through the Data Retention API by setting `provider_data_share`. - No console interface is available for this setting at launch. - Anthropic requires: - 30-day retention of inputs and outputs. - Human review. - Data retention enables abuse detection across multiple interactions rather than isolated requests. - Example endpoints are provided for both `bedrock-mantle` and `bedrock-runtime`. ## SDK and API Usage - Install the Anthropic Python SDK with `pip install anthropic`. - The Messages API can be called through the Bedrock Mantle endpoint using model ID `anthropic.claude-fable-5`. - Boto3’s Converse API supports unified multi-model access through model ID `global.anthropic.claude-fable-5`. - Users can configure token limits and submit tasks such as designing a multi-region AWS architecture supporting 100,000 requests per second. ## Pricing and Routing - Requests routed to Opus 4.8 because of harmful content are charged at Opus rates. - If a conversation is blocked mid-request, initial tokens are charged at Fable rates and later tokens at Opus rates. - Pricing details are available on the Amazon Bedrock pricing page. Claude Fable 5 is best suited to ambitious, long-running workloads that benefit from advanced reasoning and document or visual understanding. Before using it, organizations should confirm account access, configure the required data-sharing settings, and evaluate whether the 30-day retention and human-review requirements fit their compliance policies.

Read original(opens in new tab)
Generative AIPythonAmazon BedrockAws Cli+4
aws3 min readCurated summary

AWS Weekly Roundup: BYOM for Amazon RDS for SQL Server, AWS IoT Device SDK for Swift, and more (June 8, 2026) | Amazon Web Services

The AWS roundup highlights the general availability of the AWS IoT Device SDK for Swift, bringing MQTT 5, Device Shadow, Jobs, and fleet provisioning to Apple platforms and Linux. It also covers major AWS releases involving SQL Server licensing, Cognito resilience, OpenAI models on Bedrock, Kubernetes, AI agents, cost reporting, and location services. Together, the announcements show AWS expanding support for Swift edge computing, enterprise AI, multi-Region architectures, and specialized infrastructure. ## AWS IoT Device SDK for Swift - Now generally available for macOS, iOS, tvOS, and Linux. - Provides production-ready support for: - MQTT 5 connectivity - Device Shadow - IoT Jobs - Fleet provisioning - Reflects Swift’s growing use across server-side development, IoT, and edge computing. - Projects such as WendyOS are also bringing Swift to NVIDIA Jetson and Raspberry Pi hardware. ## Major AWS Headlines ### Amazon RDS for SQL Server BYOM - Amazon RDS for SQL Server now supports Bring Your Own Media. - Customers migrating from on-premises SQL Server can reuse existing licenses, including Software Assurance. - Support is provided through Microsoft’s License Mobility program. - AWS License Manager tracks license usage and compliance. ### Multi-Region Amazon Cognito - Cognito can replicate user and machine identity data to a standby Region in near real time. - Replicated data includes credentials, user pool settings, and federation configurations. - Users can continue using applications without re-authentication after a primary-Region disruption. - Available as an add-on for Essentials and Plus user pools across 16 Regions. ### OpenAI Models on Amazon Bedrock - GPT-5.5, GPT-5.4, and Codex are generally available for production use. - GPT-5.5 targets agentic coding, data analysis, and complex autonomous tasks. - Codex supports the Codex App, CLI, and integrations with VS Code, JetBrains, and Xcode. - AWS governance and security controls remain available, pricing follows OpenAI rates, and usage counts toward existing AWS commitments. ## Recent AWS Launches - **Amazon Bedrock observability:** CloudWatch metrics now cover inference counts, token usage, and client errors for OpenAI- and Anthropic-compatible APIs. - **Redesigned Bedrock console:** Adds model catalogs, side-by-side comparisons, project organization, and pre-filled code examples. - **AgentCore Identity secrets:** Credential providers can reference existing AWS Secrets Manager secret ARNs, supporting custom KMS keys, tagging, and rotation. - **Step Functions agentic reasoning:** Workflows can invoke AgentCore-powered agents sequentially or in parallel, include human approval, and trace decisions. - **Kubernetes 1.36 on EKS:** Adds User Namespaces GA, Mutating Admission Policies, in-place pod resource scaling, and resource health reporting. - **ECS Managed Instances accelerators:** Supports Trainium1, Trainium2, and Inferentia2 instances with automatic accelerator allocation. - **Amazon Quick VPC connectivity:** Enables private connections to MCP servers without exposing internal tools to the public internet. - **Cost and Usage Report 2.0:** Adds Athena and Redshift integrations with generated infrastructure templates, table definitions, and loading guidance. - **Amazon Location Service:** Routes API now supports transit and intermodal journeys across 13 Regions. AWS also directs readers to its What’s New page, Builder Center, and upcoming events for further announcements and community resources.

Read original(opens in new tab)
KubernetesAmazon BedrockEdge ComputingAmazon Rds+3