AWS SAM CLI now supports AWS CloudFormation Language Extensions, enabling you to reduce duplication in your infrastructure as code (IaC) templates while retaining the full local development workflow. This accelerates your serverless development by letting you define resources once and iterate locally without waiting for cloud deployments.
Developers frequently need to define multiple similar resources, such as Lambda functions, DynamoDB tables, or SNS topics, from a single template definition. However, developers who use SAM CLI to build, test, and deploy their serverless applications previously could not process templates that use CloudFormation Language Extensions. This required choosing between reducing template duplication and using SAM CLI for local development. Now, SAM CLI processes Language Extensions in memory for local operations while preserving your original template for CloudFormation deployment. You can define your resources once and test them locally across all SAM CLI commands, catching errors like invalid syntax or missing dependencies before deploying. This shortens your iteration cycles and reduces time spent debugging failed deployments in the cloud.
To get started, download or update SAM CLI to the latest version. Add the AWS::LanguageExtensions transform to your SAM template and use Fn::ForEach to generate multiple resources from a single definition. SAM CLI commands including sam build, sam local invoke, sam sync, sam local start-api, and sam validate will automatically expand your loops and process each generated resource. You can invoke expanded functions by name, for example sam local invoke AlphaFunction. SAM CLI also supports Fn::Length, Fn::ToJsonString, Fn::FindInMap with DefaultValue, and conditional DeletionPolicy and UpdateReplacePolicy attributes.
AWS SAM CLI now supports AWS CloudFormation Language Extensions, enabling you to reduce duplication in your infrastructure as code (IaC) templates while retaining the full local development workflow. This accelerates your serverless development by letting you define resources once and iterate locally without waiting for cloud deployments.
Developers frequently need to define multiple similar resources, such as Lambda functions, DynamoDB tables, or SNS topics, from a single template definition. However, developers who use SAM CLI to build, test, and deploy their serverless applications previously could not process templates that use CloudFormation Language Extensions. This required choosing between reducing template duplication and using SAM CLI for local development. Now, SAM CLI processes Language Extensions in memory for local operations while preserving your original template for CloudFormation deployment. You can define your resources once and test them locally across all SAM CLI commands, catching errors like invalid syntax or missing dependencies before deploying. This shortens your iteration cycles and reduces time spent debugging failed deployments in the cloud.
To get started, download or update SAM CLI to the latest version. Add the AWS::LanguageExtensions transform to your SAM template and use Fn::ForEach to generate multiple resources from a single definition. SAM CLI commands including sam build, sam local invoke, sam sync, sam local start-api, and sam validate will automatically expand your loops and process each generated resource. You can invoke expanded functions by name, for example sam local invoke AlphaFunction. SAM CLI also supports Fn::Length, Fn::ToJsonString, Fn::FindInMap with DefaultValue, and conditional DeletionPolicy and UpdateReplacePolicy attributes.
To learn more, visit the SAM CLI developer guide and launch blog post.
Today, AWS announces that the AWS Partner Central agents now accelerate opportunity creation through natural language conversation. AWS Partner Central agents, released on March 16, 2026, are AI-powered capabilities built on Amazon Bedrock AgentCore that help partners surface pipeline insights, advance deals with next-step recommendations, and identify funding opportunities. With this update, partners create opportunities through a short conversation instead of completing a multi-step form, so partner sales teams spend less time on data entry and more time selling.
Partners describe a deal in natural language, upload meeting notes, proposals, or call transcripts (PDF, DOCX, Excel, TXT), or clone an existing opportunity. The agent extracts the information, enriches customer details, and recommends improvements — such as adding missing context, correcting field values, or strengthening the business problem statement — so partners submit higher-quality opportunities, improve pipeline hygiene, and shorten sales cycles. Partners use the feature in the AWS Console through Amazon Q chat, and programmatically through Model Context Protocol (MCP), so sales teams create opportunities from their existing tools.
AWS Partner Central agents are available in all commercial AWS Regions. To learn more about agentic capabilities in AWS Partner Central, review this blog. Partners can start using agents by visiting AWS Partner Central in the AWS console and accessing opportunities, after reviewing the agents guide, and to integrate agents into your existing tools, visit the Partner Central agents MCP server guide.
Today, AWS announces that the AWS Partner Central agents now accelerate opportunity creation through natural language conversation. AWS Partner Central agents, released on March 16, 2026, are AI-powered capabilities built on Amazon Bedrock AgentCore that help partners surface pipeline insights, advance deals with next-step recommendations, and identify funding opportunities. With this update, partners create opportunities through a short conversation instead of completing a multi-step form, so partner sales teams spend less time on data entry and more time selling. Partners describe a deal in natural language, upload meeting notes, proposals, or call transcripts (PDF, DOCX, Excel, TXT), or clone an existing opportunity. The agent extracts the information, enriches customer details, and recommends improvements — such as adding missing context, correcting field values, or strengthening the business problem statement — so partners submit higher-quality opportunities, improve pipeline hygiene, and shorten sales cycles. Partners use the feature in the AWS Console through Amazon Q chat, and programmatically through Model Context Protocol (MCP), so sales teams create opportunities from their existing tools. AWS Partner Central agents are available in all commercial AWS Regions. To learn more about agentic capabilities in AWS Partner Central, review this blog. Partners can start using agents by visiting AWS Partner Central in the AWS console and accessing opportunities, after reviewing the agents guide, and to integrate agents into your existing tools, visit the Partner Central agents MCP server guide.
Amazon CloudWatch Logs now supports retrieving up to 100,000 results using the Logs Insights query language. Customers can specify the limit in their query using the LIMIT command.
Previously, customers were limited to 10,000 results and had to split their queries into smaller time ranges to retrieve all results. With this launch, customers can view a larger set of results and use existing features such as patterns, visualization, and export on the full 100,000 result set. The GetQueryResults API has also been updated to support pagination; each invocation can return up to 10,000 results along with a token that can be used to fetch the next set of results.
The increased query result limits are available in all commercial AWS regions. You can execute queries and view up to 100,000 results using the Amazon CloudWatch console, AWS CLI, AWS CDK, and AWS SDKs. To learn more, see the Amazon CloudWatch Logs documentation.
Amazon CloudWatch Logs now supports retrieving up to 100,000 results using the Logs Insights query language. Customers can specify the limit in their query using the LIMIT command. Previously, customers were limited to 10,000 results and had to split their queries into smaller time ranges to retrieve all results. With this launch, customers can view a larger set of results and use existing features such as patterns, visualization, and export on the full 100,000 result set. The GetQueryResults API has also been updated to support pagination; each invocation can return up to 10,000 results along with a token that can be used to fetch the next set of results. The increased query result limits are available in all commercial AWS regions. You can execute queries and view up to 100,000 results using the Amazon CloudWatch console, AWS CLI, AWS CDK, and AWS SDKs. To learn more, see the Amazon CloudWatch Logs documentation.
Amazon EMR Serverless is now generally available in six additional AWS Regions – Asia Pacific (Hyderabad), Asia Pacific (Malaysia), Asia Pacific (New Zealand), Asia Pacific (Taipei), Asia Pacific (Thailand), and Mexico (Central).
Amazon EMR Serverless is a deployment option in Amazon EMR that makes it simple and cost effective for data engineers and analysts to run petabyte-scale data analytics in the cloud. With EMR Serverless, you can run your Apache Spark and Apache Hive applications without having to configure, optimize, tune, or manage clusters. EMR Serverless offers fine-grained automatic scaling, fast launch times, customizable worker configurations, and support for batch, interactive and streaming workloads.
Amazon EMR Serverless is now generally available in six additional AWS Regions – Asia Pacific (Hyderabad), Asia Pacific (Malaysia), Asia Pacific (New Zealand), Asia Pacific (Taipei), Asia Pacific (Thailand), and Mexico (Central). Amazon EMR Serverless is a deployment option in Amazon EMR that makes it simple and cost effective for data engineers and analysts to run petabyte-scale data analytics in the cloud. With EMR Serverless, you can run your Apache Spark and Apache Hive applications without having to configure, optimize, tune, or manage clusters. EMR Serverless offers fine-grained automatic scaling, fast launch times, customizable worker configurations, and support for batch, interactive and streaming workloads. To get started, visit the Amazon EMR Serverless User Guide. For pricing info, visit the EMR Serverless pricing page.
Amazon Connect Cases now supports editing and deleting related items, and deleting cases directly from the agent workspace without administrator help. Agents can update comments, unlink contacts associated with the wrong case, or delete cases opened in error. Agents can also create, edit, and delete custom related items such as orders, returns, and invoices to capture additional case context.
Amazon Connect Cases is available in the following AWS regions: US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (London), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Africa (Cape Town). To learn more and get started, visit the Amazon Connect Cases webpage and documentation.
Amazon Connect Cases now supports editing and deleting related items, and deleting cases directly from the agent workspace without administrator help. Agents can update comments, unlink contacts associated with the wrong case, or delete cases opened in error. Agents can also create, edit, and delete custom related items such as orders, returns, and invoices to capture additional case context. Amazon Connect Cases is available in the following AWS regions: US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (London), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Africa (Cape Town). To learn more and get started, visit the Amazon Connect Cases webpage and documentation.
AWS Organizations now supports higher quotas for service control policies (SCPs). The maximum number of SCPs that can be attached to a single node (root, OU, or account) has increased from 5 to 10, and the maximum SCP size has increased from 5,120 to 10,240 characters.
With these higher quotas, you can write SCPs with finer-grained permissions and conditions, and attach more SCPs per node to build more comprehensive security controls across your organization.
These higher quotas are available in all commercial AWS Regions, the AWS GovCloud (US) Regions, and the China Regions, and are available automatically to all organizations with no action required. To learn more, see quotas for AWS Organizations in the AWS Organizations User Guide.
AWS Organizations now supports higher quotas for service control policies (SCPs). The maximum number of SCPs that can be attached to a single node (root, OU, or account) has increased from 5 to 10, and the maximum SCP size has increased from 5,120 to 10,240 characters.
With these higher quotas, you can write SCPs with finer-grained permissions and conditions, and attach more SCPs per node to build more comprehensive security controls across your organization.
These higher quotas are available in all commercial AWS Regions, the AWS GovCloud (US) Regions, and the China Regions, and are available automatically to all organizations with no action required. To learn more, see quotas for AWS Organizations in the AWS Organizations User Guide.
¿Cuáles son las habilidades humanas esenciales para el éxito de la IA? Enfóquense en las 5C
En un extracto de su nuevo libro, los principales líderes de LinkedIn trazan cómo el futuro de la IA se desarrolla a través de la capacidad humana, no del código.
De manera tradicional, si se necesitaba aprender una nueva tecnología en el trabajo, el proceso era sencillo. Toman cursos, registran horas con las herramientas y, con el tiempo, su experiencia se vuelve más especializada y valiosa. Para entender la IA, se esperaría seguir un camino similar. Pero nada en la IA es tradicional. Y para un cambio de paradigma que se siente algorítmico, la eficacia con la que usan los agentes depende de las cosas que nos hacen más humanos.
Esa es la base de Open to Work: How to Get Ahead in the Age of AI, un nuevo libro de Ryan Roslansky, CEO de LinkedIn y vicepresidente ejecutivo de Microsoft, y de Aneesh Raman, director de oportunidades económicas de la compañía. (Ya está disponible y pueden comprarlo aquí.) Open to Work ofrece anécdotas, perspectivas y orientaciones prácticas para trabajadores de todo tipo—desde empleados de nivel inicial hasta líderes ejecutivos—para comprender el cambio radical que se produce en el trabajo. A lo largo de la obra, Roslansky y Raman enfatizan la importancia de la ventaja humana. En este extracto, presentan las 5Cs, o cinco capacidades innatas que nos dan una ventaja para trabajar con IA.
Las capacidades únicas que tenemos como humanos son lo que nos hace insustituibles. Para comprender e identificar mejor estas capacidades, hablamos con neurocientíficos, psicólogos organizacionales, economistas del comportamiento y líderes de talento, una amplia gama de expertos que piensan en la capacidad humana y trabajan cada día.
Nos centramos en cinco capacidades, centrándonos en los insumos centrales que cada uno puede desarrollar de manera individual y que, en muchos sentidos, permiten todo lo demás. Las llamamos las 5C. Las 5C nos hacen mejores compañeros y pensadores más agudos. Juntas, son el motor de la innovación humana.
Curiosidad
La IA puede procesar patrones. Solo los humanos se preguntan: ¿Y si probáramos algo que es diferente por completo?
En un momento en que la IA transforma todos los aspectos de nuestro trabajo, la curiosidad es nuestra ventaja más importante como humanos. Ahora mismo, podemos aprovechar esa curiosidad y la apertura que conlleva para aprender sobre la IA y cómo va a transformar nuestro trabajo, para entendernos a nosotros mismos y descubrir qué nos hace insustituibles y, lo más importante, para alinear nuestras carreras con nuestras curiosidades. Las preguntas que les fascinan, aquellas que los mantienen despiertos por las noches o les hacen perder la noción del tiempo, serán fundamentales para encontrar su ventaja competitiva en la era de la IA.
La curiosidad no es solo recopilar información. Es preguntarse por qué las cosas son como son y qué pasa cuando rompes esas suposiciones. Todo avance en la historia humana comenzó cuando alguien hacía una pregunta que nadie había hecho antes. La vacuna contra la polio no surgió al analizar tratamientos existentes, que es lo que haría la IA. Se inventó porque Jonas Salk y sus colegas se preguntaban si los virus muertos podían enseñar al cuerpo a combatir los vivos. Podría haberse equivocado. Aun así, se tomó el tiempo para probar su idea.
El electricista que se pregunta por qué un circuito salta y lo sigue más allá de las respuestas obvias para encontrar un problema oculto que podría haber causado un incendio. El contable que cuestiona por qué ciertos gastos aumentan cada tercer trimestre y descubre una ineficiencia, para ahorrar millones. La rutina de repente se convierte en descubrimiento.
Coraje
La IA puede calcular el riesgo. Solo los humanos deciden qué riesgo merece la pena asumir.
El coraje es la disposición a actuar sin información completa y a avanzar cuando el resultado no está garantizado. Es elegir ser el caso de prueba cuando todos los demás esperan pruebas. Hace miles de años, los viajeros polinesios trepaban a árboles huecos y navegaban a través del Pacífico, navegaban solo con las estrellas y su profundo conocimiento del mar. Descubrieron nuevas islas, las habitaron y establecieron culturas que aún prosperan hoy en día. Siglos después, la tripulación del Apollo 13 llevó ese mismo espíritu al espacio. Atarte a un cohete y apuntar a la luna, con el conocimiento de que había muchas posibilidades de que no regresaras, fue un acto de profundo coraje. Aun así fueron, en la búsqueda de una mejor comprensión del universo para la humanidad.
En el trabajo, el coraje convierte la vacilación en acción. El desarrollador que propone cambiar a un nuevo marco de trabajo a mitad de proyecto porque servirá mejor a los clientes a largo plazo. El responsable de ventas que le dice a un cliente importante que su petición no es lo que necesita, y luego le ayuda a encontrar la solución adecuada. El diseñador que defiende un cambio de imagen completo cuando todos los demás están cómodos con el statu quo. No son personas que sean difíciles. Son personas que eligen el progreso antes que la comodidad. Y no hay ningún algoritmo para hacer lo correcto cuando es difícil.
Creatividad
La IA puede remezclar lo que existe. Solo los humanos reimaginan lo que es posible.
La creatividad no es solo expresión artística. Es la capacidad de generar algo en verdad nuevo, no solo a través de recombinar elementos existentes, sino de imaginar posibilidades que antes no existían.
La creatividad no se limita a roles «creativos». Steve Jobs no inventó el ordenador, el teléfono ni el reproductor de música. Se tomó el tiempo para imaginar cómo podrían convertirse en un solo dispositivo. Sara Blakely se cortó los pies de las medias y creó Spanx, para construir un negocio de mil millones de dólares al ver posibilidades donde otros habrían visto un fallo en el vestuario. Esas personas no solo resolvían problemas, sino que creaban nuevas formas de responder a situaciones que otros no veían.
Compasión
La IA puede simular la preocupación. Solo los humanos la sienten y lo expresan.
Somos una especie que se preocupa unos por otros. De hecho, la evidencia arqueológica de hace miles y miles de años muestra que las personas con discapacidades graves vivieron durante años, algo que habría sido imposible sin la atención comunitaria. La compasión es, en muchos sentidos, la base de la civilización. Cuando un médico sostiene la mano de un paciente moribundo, ese toque significa que ningún confort robótico puede igualar. La IA puede imitar la compasión, pero no puede preocuparse en verdad por otra criatura, porque mucho sobre cómo hace esto el cerebro humano es todavía desconocido. Dicho de manera más sencilla, no podemos programar la empatía porque no sabemos con exactitud cómo hacerlo. Sólo lo hacemos, como el responsable que nota que el rendimiento de un empleado baja y descubre que es porque cuida a un padre enfermo, y luego organiza horarios flexibles en silencio. La compasión es lo que nos hace humanos, no solo empleados.
Comunicación
La IA puede traducir el lenguaje. Solo los humanos pueden convertir el lenguaje en significado.
La comunicación es lo que nos une como humanos a través del tiempo y el espacio. Así es como el conocimiento respira y se difunde, desde antiguos escribas que conservaban la sabiduría en tablillas de arcilla hasta científicos que construyen sobre siglos de descubrimientos compartidos. Las palabras bien comunicadas tienen el poder de cambiar el mundo. «Tengo un sueño» movilizó un movimiento. «Todo lo que necesitas es amor» replanteó a una generación. «Eso es un pequeño paso para el hombre…» unieron al mundo en un solo momento de asombro.
En el trabajo, los CEOs destacados convierten a inversores escépticos en inversores a largo plazo convenciéndolos de un futuro para el negocio que aún no existe. Los representantes de ventas efectivos escuchan primero y luego presentan su propuesta basándose en los conocimientos obtenidos, para después adaptar las soluciones a las necesidades reales. No es de extrañar que la comunicación se haya clasificado a nivel mundial como la habilidad número 1 en demanda en LinkedIn en 2024.
El término «habilidades blandas», que a menudo se usa para describir las 5C que acabamos de explorar, proviene de una época en la que las habilidades técnicas se consideraban los principales motores del éxito. Eso fue entonces. Esto es ahora. A medida que la IA asume más trabajo rutinario y técnico, las habilidades que nos hacen humanos son cada vez más importantes. En los próximos años, creemos que estas llamadas habilidades «blandas» serán de las más difíciles y valiosas de desarrollar.
Es importante destacar que las 5C no son capacidades que se puedan aprender en un taller de fin de semana o en un módulo de formación online. Son piezas fundamentales de quienes somos y de cómo pensamos como seres humanos, y solo se desarrollan a través del tiempo, la conexión y el desafío. Los obligan a enfrentarse a problemas difíciles, explorar caminos inesperados y probar ideas novedosas en entornos reales.
Por eso la IA representa una oportunidad tan profunda. La IA puede procesar información a una velocidad vertiginosa, pero no puede experimentar el lento desarrollo de la curiosidad, en especial como un esfuerzo compartido con otros. Puede optimizar las soluciones existentes de manera eficiente, pero no puede sentir la frustración que provoca enfoques completamente nuevos. Puede simular una conversación, pero no puede crear conexiones auténticas donde surjan ideas revolucionarias porque una relación significativa ha echado raíces.
Una vez que dejemos de intentar competir con la IA en eficiencia, podemos aprovechar el momento para usar la IA y construir trabajo alrededor de lo que nos hace más humanos.
Amazon Relational Database Service (RDS) for PostgreSQL announces Amazon RDS Extended Support minor versions 11.22-rds.20260224, 12.22-rds.20260224, and 13.23-rds.20260224. We recommend that you upgrade to these versions to fix known security vulnerabilities and bugs in prior versions of PostgreSQL.
Amazon RDS Extended Support provides up to three additional years of critical security and bug fixes beyond a major version’s end of standard support date, giving you more time to upgrade to a new major version. Learn more about Extended Support in the Amazon RDS User Guide.
You can upgrade your databases during scheduled maintenance windows using automatic minor version upgrades. To simplify operations at scale, enable automatic minor version upgrades and use the AWS Organizations Upgrade Rollout Policy to orchestrate thousands of upgrades in phases, first to development environments before upgrading production systems. You can also use Amazon RDS Blue/Green deployments with physical replication to minimize downtime for minor version upgrades.
Amazon RDS for PostgreSQL makes it simple to set up, operate, and scale PostgreSQL deployments in the cloud. See Amazon RDS for PostgreSQL Pricing for pricing details and regional availability. Create or update a fully managed Amazon RDS database in the Amazon RDS Management Console or by using the AWS Command Line Interface (CLI).
Amazon Relational Database Service (RDS) for PostgreSQL announces Amazon RDS Extended Support minor versions 11.22-rds.20260224, 12.22-rds.20260224, and 13.23-rds.20260224. We recommend that you upgrade to these versions to fix known security vulnerabilities and bugs in prior versions of PostgreSQL. Amazon RDS Extended Support provides up to three additional years of critical security and bug fixes beyond a major version’s end of standard support date, giving you more time to upgrade to a new major version. Learn more about Extended Support in the Amazon RDS User Guide. You can upgrade your databases during scheduled maintenance windows using automatic minor version upgrades. To simplify operations at scale, enable automatic minor version upgrades and use the AWS Organizations Upgrade Rollout Policy to orchestrate thousands of upgrades in phases, first to development environments before upgrading production systems. You can also use Amazon RDS Blue/Green deployments with physical replication to minimize downtime for minor version upgrades. Amazon RDS for PostgreSQL makes it simple to set up, operate, and scale PostgreSQL deployments in the cloud. See Amazon RDS for PostgreSQL Pricing for pricing details and regional availability. Create or update a fully managed Amazon RDS database in the Amazon RDS Management Console or by using the AWS Command Line Interface (CLI).
Amazon Managed Grafana now supports in-place upgrade from Grafana version 10.4 to 12.4. You can upgrade with just a few clicks from the AWS Console or via AWS SDK or AWS CLI.
Upgrading to version 12.4 brings native Grafana Scenes-powered dashboards for faster rendering and queryless Drilldown apps for point-and-click exploration of Prometheus metrics, Loki logs, Tempo traces, and Pyroscope profiles. Amazon CloudWatch plugin enhancements simplify log analysis with PPL/SQL query support, broaden visibility through cross-account Metrics Insights, and surface issues proactively with log anomaly detection. The rebuilt table visualization delivers smoother performance with CSS cell styling and interactive Actions buttons, while trendline transformations and navigation bookmarks streamline data exploration.
In-place upgrade to Grafana 12.4 is supported in all AWS regions where Amazon Managed Grafana is generally available. For a complete list of new features, refer to Differences between Grafana versions in the Amazon Managed Grafana User Guide. For upgrade instructions, see Update your workspace version. To learn more about Amazon Managed Grafana features and its pricing, visit the product page and pricing page.
Amazon Managed Grafana now supports in-place upgrade from Grafana version 10.4 to 12.4. You can upgrade with just a few clicks from the AWS Console or via AWS SDK or AWS CLI.
Upgrading to version 12.4 brings native Grafana Scenes-powered dashboards for faster rendering and queryless Drilldown apps for point-and-click exploration of Prometheus metrics, Loki logs, Tempo traces, and Pyroscope profiles. Amazon CloudWatch plugin enhancements simplify log analysis with PPL/SQL query support, broaden visibility through cross-account Metrics Insights, and surface issues proactively with log anomaly detection. The rebuilt table visualization delivers smoother performance with CSS cell styling and interactive Actions buttons, while trendline transformations and navigation bookmarks streamline data exploration.
In-place upgrade to Grafana 12.4 is supported in all AWS regions where Amazon Managed Grafana is generally available. For a complete list of new features, refer to Differences between Grafana versions in the Amazon Managed Grafana User Guide. For upgrade instructions, see Update your workspace version. To learn more about Amazon Managed Grafana features and its pricing, visit the product page and pricing page.
Amazon CloudFront now supports Online Certificate Status Protocol (OCSP) revocation checking for viewer mTLS, enabling you to validate client certificate revocation status in real time during connection establishment. This enables customers using mutual TLS (mTLS) on CloudFront to verify that client certificates haven’t been revoked before accepting connections—a common requirement for regulated industries and zero-trust architectures.
Previously, customers implemented certificate revocation using CloudFront Functions and KeyValueStore, maintaining static revocation lists that were only as current as the last manual update. With OCSP, CloudFront queries the responder URL embedded in the client certificate at connection time, validating revocation status directly with the issuing Certificate Authority. CloudFront caches OCSP responses for up to 30 minutes to minimize latency impact on subsequent connections. The OCSP result is exposed in the connection function, enabling customers to implement custom logic—such as grace periods for certificate rotation, IP-based exceptions, or combining OCSP with their own revocation lists.
OCSP revocation checking for viewer mTLS is available at no additional cost. To learn more, refer to the documentation for CloudFront Mutual TLS (Viewer).
Amazon CloudFront now supports Online Certificate Status Protocol (OCSP) revocation checking for viewer mTLS, enabling you to validate client certificate revocation status in real time during connection establishment. This enables customers using mutual TLS (mTLS) on CloudFront to verify that client certificates haven’t been revoked before accepting connections—a common requirement for regulated industries and zero-trust architectures.
Previously, customers implemented certificate revocation using CloudFront Functions and KeyValueStore, maintaining static revocation lists that were only as current as the last manual update. With OCSP, CloudFront queries the responder URL embedded in the client certificate at connection time, validating revocation status directly with the issuing Certificate Authority. CloudFront caches OCSP responses for up to 30 minutes to minimize latency impact on subsequent connections. The OCSP result is exposed in the connection function, enabling customers to implement custom logic—such as grace periods for certificate rotation, IP-based exceptions, or combining OCSP with their own revocation lists.
OCSP revocation checking for viewer mTLS is available at no additional cost. To learn more, refer to the documentation for CloudFront Mutual TLS (Viewer).
