Amazon Cognito

3 posts

aws3 min readCurated summary

AWS Weekly Roundup: One-click Lambda setup prompt, OpenAI GPT-5.6 models on Bedrock, and more (July 20, 2026) | Amazon Web Services

The AWS Weekly Roundup highlights new tools for AI-assisted serverless development, including a one-click Lambda setup prompt that configures coding agents with AWS Serverless skills and MCP. It also covers major service updates such as OpenAI models on Bedrock, faster S3 storage-class transitions, self-managed Lambda code storage, and Cognito password-hash imports. Additional stories include SQS’s 20th anniversary, open agent protocols, DynamoDB bulk operations, and a resolved Cost Explorer billing-data incident. ## One-Click Lambda Setup for Coding Agents - The Lambda console now provides a prompt that configures AI coding agents with: - AWS Serverless skills - The Serverless Model Context Protocol (MCP) server - Embedded serverless best practices - The setup guide supports Claude Code, Kiro, Cursor, GitHub Copilot, Codex, Devin Desktop, and OpenCode. - Developers can copy the setup URL into their preferred agent: ```text fetch https://docs.aws.amazon.com/lambda/latest/dg/samples/aws-lambda-agent-setup.md ``` - AWS’s Agent Toolkit can also install the AWS MCP Server, providing current AWS knowledge and controlled resource access. ## Major AWS Service Launches - **OpenAI GPT-5.6 models on Amazon Bedrock** - Sol: flagship reasoning - Terra: balanced performance - Luna: faster, lower-cost inference - All are available through Bedrock’s Responses API and its high-performance inference engine. - **Same-day S3 transitions** - Objects can transition to S3 Standard-IA or S3 One Zone-IA on the day they are created. - The previous 30-day minimum retention period in S3 Standard no longer applies. - These classes can reduce storage costs by up to 40% while retaining millisecond access. - Suitable for backups, log analytics, and compliance data that becomes cold quickly. - **Self-managed Lambda code storage** - Lambda can reference code directly from customer-owned S3 buckets. - Lambda no longer needs to create intermediate copies. - This removes code-storage limits and can shorten activation times after deployments. - **Cognito password-hash imports** - CSV user imports can now include password hashes. - Users can sign in immediately with existing credentials instead of resetting passwords. - Import configuration specifies the source system’s hashing algorithm. ## Additional AWS Updates - **Amazon SQS at 20** - SQS continues to provide scalable decoupling between message producers and consumers, two decades after its public launch. - **Open protocols with Strands Agents SDK** - An example demonstrates how MCP, A2A, UTCP, AG-UI, and x402 can work together when building AI agents. - **Open-source DynamoDB Bulk Executor** - Performs large-scale table operations without custom code. - Supports `count`, `find`, `delete`, and `update` commands. - **Kiro CLI for AWS Support** - MCP integration combines investigation, documentation lookup, and support-case creation. - Examples cover Glue failures, Lambda cold starts, and WAF false positives. ## Cost Explorer Incident - Some customers saw inaccurate estimated billing and usage data in Cost Explorer. - The issue generated erroneous budget and cost-anomaly alerts. - AWS resolved the incident and is conducting a retrospective to improve billing-incident prevention and response. AWS’s latest releases emphasize faster serverless development, more capable AI tooling, lower-cost storage, and easier automation of operational tasks. Developers should explore the Lambda agent setup and Agent Toolkit while reviewing the new storage, identity, and bulk-operation capabilities for relevant workloads.

Read original(opens in new tab)
aws3 min readCurated summary

Improve your application resilience with Amazon Cognito multi-Region replication | Amazon Web Services

Amazon Cognito multi-Region replication improves authentication resilience by maintaining synchronized user data, credentials, configurations, and machine secrets in a secondary AWS Region. During a regional outage, applications can redirect traffic while users continue using existing credentials and sessions, though registration and profile updates are unavailable during failover. The feature also adds customer managed AWS KMS keys for consistent, customer-controlled encryption across Regions. ## Challenges with Regional Failover - Custom replication solutions previously required significant engineering effort. - Manual user-data transfers introduced security and consistency risks. - Users could be forced to reset passwords or authenticate again after a regional switch. - Machine-to-machine systems required new app clients, application reconfiguration, and updated OAuth resource trust settings. ## How Multi-Region Replication Works - Replication is one-way, from a primary Region to a secondary Region. - The replica includes: - User profiles and credentials - User pool configuration - Machine-to-machine secrets - The secondary pool is read-only and remains available for authentication. - Existing sessions continue uninterrupted. - Users can authenticate with existing credentials, and either Region recognizes access tokens issued by the other. - Supported authentication methods include: - Social identity providers - SAML and OIDC federation - API authorization flows - Machine-to-machine authentication - New registrations and profile changes are unavailable while operating from the replica. ## Customer Managed KMS Keys - A multi-Region customer managed key is required before replication can be configured. - The key must be replicated into both the primary and secondary Regions. - Its policy must grant Amazon Cognito permission to use the key. - Customer managed keys provide consistent encryption across Regions and greater control over encryption policies. ## Configuration Process - The console guides administrators through three main steps: - Select and configure the customer managed KMS key. - Configure multi-Region OIDC issuer endpoints. - Select and create the replica Region. - Client applications must be updated with the new OIDC endpoints. - Server-side applications require redeployment, while mobile applications require updated store submissions. - After the replica is prepared, an administrator must manually activate it. ## Additional Regional Resources - Lambda functions used for custom authentication, SMS, or email must be deployed and configured in the secondary Region. - Logging and AWS WAF settings must also be recreated there. - Teams should verify that all supporting authentication infrastructure is available before failover. ## Health Checks and Failover - Both regional endpoints remain active and ready to serve traffic. - Applications should define health checks based on error rates, latency, or service alerts. - DNS can redirect traffic to the secondary Region when failover criteria are met. - Teams should test failover during low-traffic periods, potentially routing only a small percentage of traffic initially. - Managed login and federation with custom domains can use Amazon Route 53 health checks for built-in traffic routing. ## Pricing and Availability - Replication is available as an add-on for Cognito Essentials and Plus tiers. - User authentication costs: - $0.0045 per monthly active user per replica Region for Essentials - $0.006 per monthly active user per replica Region for Plus - M2M replication adds 30% to standard successful-token pricing. - The feature is available across selected Regions in North America, Europe, Asia Pacific, Canada, Africa, and South America. Organizations needing resilient authentication should pair Cognito replication with multi-Region KMS keys, replicated supporting services, tested health checks, and an automated or well-practiced DNS failover process.

Read original(opens in new tab)
awsOriginal article

AWS Weekly Roundup: Amazon ECS, Amazon CloudWatch, Amazon Cognito and more (December 15, 2025) (opens in new tab)

The AWS Weekly Roundup for mid-December 2025 highlights a series of updates designed to streamline developer workflows and enhance security across the cloud ecosystem. Following the momentum of re:Invent 2025, these releases focus on reducing operational friction through faster database provisioning, more granular container control, and AI-assisted development tools. These advancements collectively aim to simplify infrastructure management while providing deeper cost visibility and improved performance for enterprise applications. ## Database and Developer Productivity * **Amazon Aurora DSQL** now supports near-instant cluster creation, reducing provisioning time from minutes to seconds to facilitate rapid prototyping and AI-powered development via the Model Context Protocol (MCP) server. * **Amazon Aurora PostgreSQL** has integrated with **Kiro powers**, allowing developers to use AI-assisted coding for schema management and database queries through pre-packaged MCP servers. * **Amazon CloudWatch SDK** introduced support for optimized JSON and CBOR protocols, improving the efficiency of data transmission and processing within the monitoring suite. * **Amazon Cognito** simplified user communications by enabling automated email delivery through Amazon SES using verified identities, removing the need for manual SES configuration. ## Compute and Networking Optimizations * **Amazon ECS on AWS Fargate** now honors custom container stop signals, such as SIGQUIT or SIGINT, allowing for graceful shutdowns of applications that do not use the default SIGTERM instruction. * **Application Load Balancer (ALB)** received performance enhancements that reduce latency for establishing new connections and lower resource consumption during traffic processing. * **AWS Fargate** cost optimization strategies were highlighted in new technical guides, focusing on leveraging Graviton processors and Fargate Spot to maximize compute efficiency. ## Security and Cost Management * **Amazon WorkSpaces Secure Browser** introduced Web Content Filtering, providing category-based access control across 25+ predefined categories and granular URL policies at no additional cost. * **AWS Cost Management** tools now feature **Tag Inheritance**, which automatically applies tags from resources to cost data, allowing for more precise tracking in Cost Explorer and AWS Budgets. * **Amazon Step Functions** integration with Amazon Bedrock was further detailed in community resources, showcasing how to build resilient, long-running AI workflows with integrated error handling. To take full advantage of these updates, organizations should review their Fargate task definitions to implement custom stop signals for better application stability and enable Tag Inheritance to improve the accuracy of year-end cloud financial reporting.