Bartek Chojnacki

AWS IAM outbound identity federation now supports VPC endpoints for OIDC discovery, meaning you can fetch verification keys and metadata without exposing traffic to the public internet. This is perfect if your workloads live in locked-down VPCs and need to verify short-lived JWTs from external services while keeping everything within AWS's private network.

Amazon Transcribe now lets you encrypt custom vocabularies, vocabulary filters, and language models with your own AWS KMS keys instead of AWS-managed ones. You get full control over permissions, audit trails via CloudTrail, and the ability to revoke access whenever you want—available across all AWS regions where Transcribe operates.

AWS Elastic Disaster Recovery now supports arm64-based Graviton servers, automatically detecting and recovering them onto Graviton instances without extra configuration. This capability rolls out across all AWS Regions where DRS is available at no additional cost, giving your price-performance workloads the same disaster recovery coverage as x86 environments.

AWS pgcollection (PostgreSQL extension) versions 2.0.0–2.1.1 have a type confusion bug (CVE-2026-96883) that lets authenticated database users crash the backend or run arbitrary code. The vulnerability stems from improper type coercion when requesting stored icollection values as incompatible types. If you're running affected versions, update immediately to patch this important security issue.

Amazon EventBridge just relaunched its Custom event bus with enterprise-grade features like strict event ordering, 24-hour built-in retention (extendable to a year), and support for popular JSON formats like CloudEvents. The new bus is available across 14 regions including US, Europe, and Asia Pacific, and you can now share it across AWS accounts and deliver events to 250+ AWS services with automatic deduplication.

Amazon just dropped SageMaker HyperPod Inference Gateway, a Kubernetes-native routing system that replaces dumb round-robin load balancing with real-time inference signals—think KV cache utilization and queue depth. It's available now for per-cluster routing across all AWS regions where HyperPod inference is supported, with cross-cluster and cross-region magic coming soon.

AWS just dropped CloudWatch Omni in general availability, bringing AI-first observability that lets you monitor applications and agents across AWS, Azure, and other clouds from a single pane of glass. You can query telemetry in natural language, get automatic service discovery and dependency mapping, plus a dedicated agent evaluation workflow for LangGraph, CrewAI, and other frameworks—available now in US East (N. Virginia), US West (Oregon), and Europe (Ireland).

Amazon DynamoDB's multi-Region strong consistency feature just expanded to 15 AWS Regions, including new locations in Canada, Stockholm, Spain, Mumbai, and Singapore. You can now build zero-RPO applications across North America, Europe, and Asia Pacific with three-Region configurations, keeping your data strongly consistent while staying close to your users.

AWS just dropped native connectors for Amazon Bedrock Managed Knowledge Base that let you sync Salesforce articles and Zendesk help center content automatically—no more building custom pipelines. Your RAG apps stay fresh with real-time data, so you can spin up support bots and sales assistants that actually know what they're talking about.