AWS Weekly Roundup: Amazon Bedrock agent workflows, Amazon SageMaker private connectivity, and more (February 2, 2026) | Amazon Web Services

The AWS Weekly Roundup highlights new capabilities for AI agents, private connectivity, encryption management, and resilience testing. Major launches include Bedrock server-side tools and longer prompt caching, SageMaker Unified Studio support for PrivateLink, and S3 encryption changes without data movement. Additional updates strengthen event-driven architectures, observability, zero-trust access, and AI-assisted AWS deployments.

AI Agents and Developer Workflows

• Amazon Bedrock’s Responses API now supports server-side tools such as web search, code execution, and database updates within AWS security boundaries.
• Bedrock also offers a one-hour prompt-cache TTL for select Anthropic Claude models, improving performance and reducing costs for long-running, multi-turn agents.
• AWS MCP Server deployment SOPs, currently in preview, let agents deploy applications from natural-language prompts using CDK, CloudFormation, and CI/CD workflows.
• The deployment preview supports React, Vue.js, Angular, and Next.js through tools such as Kiro, Cursor, and Claude Code.
• CloudWatch Application Signals integration with Kiro provides AI-assisted investigation of service health, SLO compliance, and observability issues.

Private Connectivity and Zero-Trust Security

• SageMaker Unified Studio now supports AWS PrivateLink, allowing VPC traffic to remain within the AWS network instead of traversing the public internet.
• IAM policies can govern private SageMaker connectivity for stricter security and compliance requirements.
• AWS Verified Access guidance demonstrates centralized zero-trust application access across multi-account environments using IAM Identity Center and AWS RAM.
• AWS Network Firewall adds predefined web categories for identifying and controlling generative AI application traffic, with full-URL filtering available alongside TLS inspection.

Storage, Encryption, and Database Performance

• Amazon S3’s UpdateObjectEncryption API changes encryption for existing objects without moving or re-uploading data.
• Supported operations include switching from SSE-S3 to SSE-KMS, rotating customer-managed KMS keys, and standardizing encryption with S3 Batch Operations.
• Amazon Keyspaces table pre-warming prepares tables for predictable high-throughput workloads, reducing throttling and cold-start delays during traffic spikes.
• Pre-warming works with on-demand and provisioned capacity, including multi-Region tables.
• DynamoDB MRSC global tables now integrate with AWS Fault Injection Service, enabling simulated Regional failures and validation of replication and application resilience.

Event-Driven Systems and Observability

• EventBridge’s event payload limit increased from 256 KB to 1 MB, allowing events to carry richer JSON, telemetry, ML, and generative AI data without external storage or fragmentation.
• Lambda’s enhanced observability for Kafka event source mappings adds CloudWatch logs and metrics for polling, scaling, processing state, permissions, and failures.
• The feature supports both Amazon MSK and self-managed Apache Kafka sources.

CloudFormation and Community

• AWS’s 2025 CloudFormation review covers improved troubleshooting, drift-aware change sets, stack refactoring, StackSets, the CloudFormation language server, and IaC MCP tooling.
• AWS Community Day Romania will take place April 23–24, 2026, featuring technical sessions, AWS experts, and networking opportunities.

Together, these updates point toward more private, observable, resilient, and AI-assisted AWS operations. Teams should evaluate the new capabilities against their security, scalability, and automation needs, particularly Bedrock agent tooling, S3 encryption updates, PrivateLink connectivity, and resilience testing.