AWS

AWS HealthOmics now supports workflow versioning, enabling customers to manage multiple versions of their bioinformatics workflows efficiently. AWS HealthOmics is a HIPAA-eligible service that helps healthcare and life sciences customers accelerate scientific breakthroughs with fully managed biological data stores and workflows. With this release, workflow developers can create and maintain multiple versions of their workflows while retaining consistent workflow IDs and base ARNs across versions.

With workflow versioning, users can select specific workflow versions when starting a run, enabling better control and reproducibility of their analyses. This simplifies collaboration by automatically sharing new workflow versions with existing subscribers, eliminating the need for manual resharing and ensuring teams always have access to the latest workflow iterations.

Workflow versioning is supported in all regions where AWS HealthOmics is available: US East (N. Virginia), US West (Oregon), Europe (Frankfurt, Ireland, London), Asia Pacific (Singapore), and Israel (Tel Aviv).

To get started with workflow versioning, see the AWS HealthOmics documentation.

Read More for the details.

AWS launches CloudWatch cross-account observability in the AWS GovCloud (US) Regions, enabling monitoring and troubleshooting of applications across multiple AWS accounts within an AWS GovCloud (US) Region. CloudWatch Cross-account observability allows seamless searching, visualization, and analysis of metrics, logs, and traces, removing account boundaries.

Security teams, operations teams, and service owners can now easily explore cross-account telemetry and analyze them to drive powerful insights helping to efficiently monitor and troubleshoot application health issues. CloudWatch Cross-account observability enables searching log groups across multiple accounts, running cross-account Logs Insights queries, and creating Contributor Insights rules to identify top contributors generating log entries. You can now run Metrics Insights queries on your cross-account metrics for a consolidated view and create cross-account alarms. With cross-account observability, you can now use AWS X-Ray Trace Map to monitor your cross-account applications or achieve single pane of glass observability on your end-to-end distributed traces for requests spanning across multiple accounts. For example, users can obtain end-to-end distributed traces tracking AWS Lambda functions calling each other across accounts. This eliminates the need to switch between accounts during troubleshooting, saving time and providing comprehensive visibility.

CloudWatch cross-account observability is now available in all commercial AWS Regions and the AWS GovCloud (US) Regions with no extra cost for logs and metrics, and the first trace copy is free. Detailed pricing information and documentation are available on the Amazon CloudWatch pricing page and documentation pages.
 

Read More for the details.

AWS customers can now access Amazon Lightsail from within the AWS Console Mobile App to monitor and manage Lightsail instances, containers, databases, network, storage, snapshots, domains and DNS while on the go. Visit the Services tab in the AWS Console Mobile App and select Lightsail to get started.

The AWS Console Mobile App enables AWS customers monitor and manage a select set of resources and receive push notifications to stay informed and connected with their AWS resources while on-the-go. The sign-in process supports biometrics authentication, making access to AWS resources simple, secure, and quick. Lightsail offers easy-to-use virtual private server (VPS) instances, storage, databases, and more for a cost-effective monthly price. For AWS services not available natively, customers can access the AWS Management Console via an in-app browser to access service pages without additional authentication, manual navigation, or need to switch from the app to a browser.

Visit the AWS Console Mobile App product page for more information about the AWS Console Mobile App, including a full list of supported services and regions. Visit the Amazon Lightsail product page for more information about Amazon Lightsail, including supported regions.

Read More for the details.

Amazon CloudWatch agent support for Red Hat OpenShift Service on AWS (ROSA) enables monitoring of applications and infrastructure using familiar CloudWatch tools such as Container Insights and Application Signals. ROSA is a fully-managed cloud service that helps customers to quickly deploy, operate, and scale containerized applications on AWS with the same consistent OpenShift experience they have on-premises. This new capability allows DevOps teams and application owners to gain deep visibility into their ROSA clusters’ performance, health, and resource utilization leveraging AWS’s native observability tools.

CloudWatch agent on ROSA enables the collection and analysis of metrics, logs, and traces from containerized applications and underlying infrastructure components, helping customers to identify the impact of anomalies on end-user experience. This integration streamlines the troubleshooting process and allows teams to quickly identify issues across their ROSA clusters and other AWS services. Through unified infrastructure and application monitoring, customers can set up automated alerts, track performance trends, and correlate events across their entire application stack.

Amazon CloudWatch agent is available in all public AWS Regions and AWS GovCloud (US). Please see Amazon CloudWatch pricing for pricing details.

To get started with Amazon CloudWatch agent on Red Hat OpenShift Service on AWS, see Setting up Container Insights on RedHat OpenShift on AWS (ROSA) in the Amazon CloudWatch User Guide.

Read More for the details.

AWS Security Token Service (AWS STS) now automatically serves all requests to the global endpoint (sts.amazonaws.com) in the same AWS Region as your deployed workloads, enhancing resiliency and performance. Previously, all requests to the STS global endpoint were served from the US East (N. Virginia) Region.

With this enhancement, your applications benefit from improved latency and fault isolation as requests are processed in the same Region as your workloads. For example, if your application runs in US West (Oregon) and calls the STS global endpoint, your requests are now served locally in US West (Oregon) instead of being routed to US East (N. Virginia).

This update is available in all AWS Regions that are enabled by default. No action is required from customers to benefit from these improvements. Any requests to the STS global endpoint from Regions not enabled by default (i.e. opt-in Regions) will continue to be served in US East (N. Virginia).

We continue to recommend that you use the appropriate STS Regional endpoints whenever possible. For more information about these changes, see AWS STS global endpoint changes , and the announcement blogpost.
 

Read More for the details.

Amazon Managed Service for Prometheus now supports label-based active series limits within your workspace. This feature helps you manage active series volume across different producers such as applications, services or teams that share a workspace.

You can now allocate specific active series limits to different metric producers in your workspace, enabling you to protect your critical metrics. If a sub-set of metrics experience an unexpected surge, only the metrics sharing the same label-based active series limits are throttled. For example, you can set different limits for metrics from different applications using label sets like {app=”payment-service”, environment=”prod”}. If the payment-service application produced an unexpected surge in metrics, only ingested metrics originating from the payment-service application are throttled.

This experience is enabled by the new Workspace Configuration APIs. Using these APIs, you can also manage the data retention period of your workspace. You can specify the number of days to retain metrics data within your workspace, before permanent deletion. To get started, visit AMP console’s workspace configuration tab or use AWS CLI, SDK, or APIs. Check out the Amazon Managed Service for Prometheus user guide for detailed documentation.

This feature is now available in all AWS regions where Amazon Managed Service for Prometheus is generally available.

Read More for the details.

AWS announces AWS Security Incident Response with AWS PrivateLink integration, enabling customers to manage their service membership directly from their Amazon Virtual Private Cloud (VPC). Now, together with AWS PrivateLink, customers can access AWS Security Incident Response APIs while keeping their traffic off the public internet, adding an extra layer of security when managing and recovering from sensitive security events.

This integration offers several benefits to AWS customers. First, it can improve the security perimeter of incident response processes by keeping all traffic within AWS-supported private networks. Second, it simplifies network architecture by removing the requirement for internet gateways, NAT devices, or firewall rules. Lastly, it helps meet compliance requirements that mandate private connectivity for sensitive security response and recovery, making it easier for organizations in regulated industries to adopt and use AWS Security Incident Response.

AWS Security Incident Response with AWS PrivateLink integration is now available in all service supported regions.

To get started with this new feature, visit the AWS Security Incident Response console or refer to the AWS Security Incident Response documentation. For more information about AWS PrivateLink, please visit the AWS PrivateLink page.

Read More for the details.

Amazon Connect Cases now provides capabilities to help contact centers track and meet service level agreements (SLAs) on cases. Using the Amazon Connect UI, admins can set up SLA rules based on case attributes and configure target statuses and resolution times. Agents and managers can view the real-time SLA status directly in their case list view to prioritize urgent work, while admins can create rules to automatically escalate or route cases to another team when SLAs are not met. For example, a company can use this feature to monitor whether high-priority cases are reviewed within 4 hours and closed within 24 hours, making it easier to meet case handling service commitments.

Amazon Connect Cases is available in the following AWS regions: US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (London), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), and Asia Pacific (Tokyo) AWS regions. To learn more and get started, visit the Amazon Connect Cases webpage and documentation.

Read More for the details.

AWS Application Migration Service is now authorized for Department of Defense Cloud Computing Security Requirements Guide Impact Levels 4 and 5 (DoD CC SRG IL4 and IL5) in the AWS GovCloud (US-East and US-West) Regions.

This authorization builds on AWS Application Migration Service’s existing FedRAMP High categorization level in the AWS GovCloud (US-East and US-West) Regions as well as numerous compliance programs and standards, including HIPAA (Health Insurance Portability and Accountability Act), PCI DSS (Payment Card Industry – Data Security Standard), ISO (International Organization for Standardization), SOC 1, 2, and 3 (System and Organization Controls). To learn more about AWS Application Migration Service compliance validation, visit the documentation here.

Application Migration Service minimizes time-intensive, error-prone manual processes by automating the conversion of your source servers to run natively on AWS. It also helps simplify modernization of your migrated applications by allowing you to select preconfigured and custom optimization options during migration.

To start using Application Migration Service for free, sign in through the AWS Management Console. For more information, visit the Application Migration Service product page.
 

Read More for the details.

AWS Lambda now supports IPv6-only and dual-stack PrivateLink interface VPC Endpoints, enabling you to access the Lambda API without traversing the public internet or being constrained by the limited number of IPv4 addresses in your VPC. AWS PrivateLink is a highly available, scalable service that allows you to privately connect your VPC to services and resources as if they were in your VPC.

Previously, Lambda supported inbound private connectivity over PrivateLink using IPv4-only VPC endpoints. With today’s launch, we are expanding Lambda’s inbound private connectivity to include IPv6-only and dual-stack VPC endpoints, enabling you to invoke and manage Lambda functions over IPv6 from dual-stack or IPv6-only VPCs. This launch combines the benefits of private connectivity with the larger address space and simpler network configuration of the IPv6 protocol.

AWS Lambda supports inbound IPv6 connectivity over PrivateLink in all AWS Regions. For more information, see the AWS Region table. Please refer to PrivateLink Pricing for price of using VPC endpoints. You can get started by creating a VPC endpoint for Lambda using the AWS Management Console, AWS CLI, AWS CDK, AWS CloudFormation, and the AWS SDK. To learn more, visit the Lambda developer guide.

Read More for the details.

You can now activate deletion protection for your Amazon Verified Permissions policy stores. When you configure a policy store with deletion protection, the policy store cannot be deleted by any user. This provides your applications resiliency as you can ensure that production policy stores are not accidentally deleted during deployments. Deletion protection is active by default for new policy stores created through the AWS Console. You can activate or deactivate deletion protection for an policy store in the AWS Console, the AWS Command Line Interface, and API. Deletion protection prevents you from requesting the deletion of a policy store unless you first explicitly deactivate deletion protection.

Amazon Verified Permissions is a scalable permissions management and fine-grained authorization service for the applications that you build. Using Cedar, an expressive and analyzable open-source policy language, developers and admins can define policy-based access controls using roles and attributes for more granular, context-aware access control. For example, an HR application might call Amazon Verified Permissions to determine if Alice is permitted access to Bob’s performance evaluation, given that she is in the HR Managers group.

Read more in the Deletion Protection section of the Amazon Verified Permissions user guide. This feature is available in all regions where Verified permissions is available. For more information visit the product page.
 

Read More for the details.

Starting today, customers can use Amazon Managed Service for Apache Flink in Asia Pacific (Thailand) Region to build real-time stream processing applications.

Amazon Managed Service for Apache Flink makes it easier to transform and analyze streaming data in real time with Apache Flink. Apache Flink is an open source framework and engine for processing data streams. Amazon Managed Service for Apache Flink reduces the complexity of building and managing Apache Flink applications and integrates with Amazon Managed Streaming for Apache Kafka (Amazon MSK), Amazon Kinesis Data Streams, Amazon OpenSearch Service, Amazon DynamoDB streams, Amazon Simple Storage Service (Amazon S3), custom integrations, and more using built-in connectors.

You can learn more about Amazon Managed Service for Apache Flink here. For Amazon Managed Service for Apache Flink region availability, refer to the AWS Region Table.
 

Read More for the details.

Amazon MemoryDB clusters now support the IPv6 protocol, allowing clients to connect to MemoryDB clusters using IPv6. You can now configure your cluster to accept only IPv6 connections or to accept both IPv4 and IPv6 connections. This allows you to work to meet IPv6 compliance requirements and more efficiently integrate with existing IPv6-based applications.

The continued growth of the internet is rapidly depleting available Internet Protocol version 4 (IPv4) addresses. By supporting IPv6, MemoryDB helps customers simplify their network architecture by providing a significantly larger address space and eliminating the need to manage overlapping address spaces in their VPCs. Customers can now standardize their applications on IPv6 and future-proof their infrastructure while maintaining compatibility with existing IPv4 systems through dual-stack support.

To get started, create your new MemoryDB cluster using the Amazon Web Services Management Console, CLI, or SDKs and choose which protocol(s) it supports by setting its network type. IPv6 is supported when using Valkey 7 and above, Redis OSS version 6.2 and above, in all AWS global regions and at no additional cost.

To learn more about MemoryDB, visit the Amazon MemoryDB product page.
 

Read More for the details.

Amazon Elastic Container Services (Amazon ECS) is introducing a new account setting, defaultLogDriverMode, allowing you to define whether tasks in your account use “blocking” or “non-blocking” log driver mode by default, when you do not specify or omit it in your applications’ Task Definitions.

A “non-blocking” log driver mode allows your applications to continue operating when log routing destinations become unavailable, therefore increasing availability if getting logs is not critical to your application, whereas “blocking” log driver mode signifies you do not want your applications to continue running if you cannot route logs to their intended destination, e.g. to record business-critical transactions or mandated by regulation. You can override this account setting for each application using the “mode” log configuration parameter in its Task Definition.

The new defaultLogDriverMode Account Setting is enabled in all AWS Regions. Click here and here for more details on how to set the new account setting.

Read More for the details.

Amazon Connect Contact Lens dashboards now supports the ability for contact center administrators to enforce granular access control based on a specific agent hierarchy. Assigning hierarchies to a user allows you to define organizational groups that a user belongs to and you can enable granular access controls by allowing users to only view metrics for agents within their hierarchy or a specific assigned hierarchy. For example, you can configure hierarchy groups and levels for a team, and only agents assigned to a hierarchy group within that team will be able to see metrics for those agents.

Amazon Connect Contact Lens dashboards are available in all commercial AWS regions where Amazon Connect is offered. To learn more about dashboards, see the Amazon Connect Administrator Guide. To learn more about Amazon Connect, the AWS cloud-based contact center, please visit the Amazon Connect website.
 

Read More for the details.

Amazon Bedrock Evaluations allows you to evaluate foundation models and retrieval-augmented generation (RAG) systems, whether hosted on Amazon Bedrock or multicloud and on-prem deployments. Bedrock Evaluations offers human-based evals, programmatic evals such as BERTScore, F1 and other exact match metrics, as well as LLM-as-a-judge for both model and RAG evaluation. For both model and RAG evaluation with LLM-as-a-judge, customers can select from an extensive list of built-in metrics such as correctness, completeness, faithfulness (hallucination detection), as well as responsible AI metrics such as answer refusal, harmfulness, and stereotyping. But, there are times when they want to define these metrics differently, or make new metrics that are relevant to their needs. For example, customers may define a metric that evaluates an application response’s adherence to their specific brand voice, or they want to classify responses according to a custom categorical rubric.

Now, Amazon Bedrock Evaluations offers customers the ability to create and re-use custom metrics for both model and RAG evaluation powered by LLM-as-a-judge. Customers can write their own judge prompts, define their own categorical or numerical rating scales, and use built-in variables to inject data from their dataset or GenAI responses into the judge prompt during runtime to fully customize the data flow in their evaluations. Customers can be inspired to create new judge prompt templates/rubrics with provided quickstart templates or they can make their own from scratch.

To get started, visit the Amazon Bedrock console or use the Bedrock APIs. For more information, see the user guide.
 

Read More for the details.

AWS customers in Europe can now use Advance Pay, which allows them to pay for their AWS usage in advance and automate future invoice payments. With Advance Pay, customers can add funds to their account, which AWS will automatically use to pay invoices as they become due. This feature provides customers in Europe with more flexibility in managing their AWS expenses and simplifies the payment process for ongoing cloud services.

Advance Pay offers several benefits to AWS customers in Europe. It allows for better financial planning and budgeting by enabling upfront payments for anticipated usage. This feature can be particularly useful for organizations that prefer to pay in advance for services or need to manage their cloud spending more proactively. Additionally, the automatic payment of invoices reduces administrative overhead and ensures timely payments, helping customers maintain good standing with AWS.

With the launch, Advance Pay is now available for both AWS Europe and AWS Inc customers.

Getting started with Advance Pay is straightforward. Customers can register for the service from the Payments page in the AWS Billing and Cost Management console. To add funds, users can generate a funding document and submit an advance payment through electronic fund transfer. For more information on managing Advance Pay, including viewing funding history and setting up recurring payments, customers can refer to the “Managing your Advance Pay” section in the AWS Billing and Cost Management user guide. To learn more about Advance Pay or to get started, visit the AWS Billing and Cost Management console.
 

Read More for the details.

Amazon OpenSearch Service now supports SAML (Security Assertion Markup Language) via IAM federation for the next-generation OpenSearch UI. OpenSearch UI is a modernized operational analytics experience that enables users to gain insights cross data spanning managed domains and serverless collections from a single endpoint. OpenSearch UI already supports authentication via AWS Identity & Access Management (IAM) and IAM Identity Center (IDC). With this feature, you can now configure the SAML identity federation between your identity provider and IAM, so that your end-users can have a Single Sign-On (SSO) experience, to login from your Identity Providers and land directly in OpenSearch UI.

With SAML support, you can define a Default Relay State URL so that your end-users can click on the URL to open the login page from your Identity Provider, complete the SSO, and then land directly on the page you defined in OpenSearch UI. You can also define fine-grained access control (FGAC) by mapping Identity Provider users and roles to IAM roles with different permissions in OpenSearch, so that you can easily manage user permissions as well as to track user activities from the Identity Provider.

OpenSearch UI supports SAML in all regions that OpenSearch UI is available. To get started, create an OpenSearch UI application and follow the instructions to complete the SAML configuration. Learn more at Amazon OpenSearch Service Developer Guide.
 

Read More for the details.

The AWS Well-Architected Generative AI Lens is now available, offering a guidance document to optimize generative AI workloads in the cloud. This new lens is a powerful addition to the Well-Architected Framework, designed to guide organizations through the complexities of implementing generative AI workloads. It provides structured, prescriptive guidance covering the entire generative AI lifecycle – from initial impact scoping to model selection, customization, integration, deployment, and continuous iteration.

The lens offers several key benefits, including cloud-agnostic guidance applicable across various environments and AI tools, comprehensive coverage of all six Well-Architected pillars, and flexible application for organizations at any stage of their AI journey. It enables thorough assessment of architectures using large language models (LLMs) and helps business leaders and data scientists navigate critical decisions in generative AI implementation.

By addressing specific data architecture requirements for generative AI workloads and providing a framework for continuous improvement, this lens promotes a robust, secure, and efficient solutions. Whether you’re exploring your first generative AI project or scaling existing implementations, the Well-Architected Generative AI Lens offers insights to enhance your cloud-based AI initiatives.

The Generative AI Lens is available as an AWS-official lens in the Lens Catalog of the AWS Well-Architected Tool.
 

Read More for the details.

Amazon EventBridge announces support for Amazon Key Management Service (KMS) Customer Managed Keys (CMK) in API destinations connections. This enhancement enables you to encrypt your HTTPS endpoint authentication credentials managed by API destinations with your own keys instead of an AWS owned key (which is used by default). With CMK support, you now have more granular security control over your authentication credentials used in API destinations, helping you meet your organization’s security requirements and governance policies.

Customer managed Keys (CMK) are KMS keys that you create and manage by yourself. You can also audit and track usage of your keys via CloudTrail. EventBridge API destinations are private and public HTTPS endpoints that you can invoke as the target of an event bus rule or pipe, similar to how you invoke an AWS service or resource as a target. API destinations provides flexible authentication options for HTTPS endpoints, such as API key and OAuth, storing and managing credentials securely in AWS Secrets Manager on your behalf.

CMK support for EventBridge API destinations connections is now available across all AWS Regions where EventBridge API destinations is available. Please refer to the EventBridge user guide and KMS documentation for details.
 

Read More for the details.