AWS is announcing the general availability of Amazon EC2 Storage Optimized I8g instances in Europe (Ireland) region. I8g instances offer the best performance in Amazon EC2 for storage-intensive workloads. I8g instances are powered by AWS Graviton4 processors that deliver up to 60% better compute performance compared to previous generation I4g instances. I8g instances use the latest third generation AWS Nitro SSDs, local NVMe storage that deliver up to 65% better real-time storage performance per TB while offering up to 50% lower storage I/O latency and up to 60% lower storage I/O latency variability. These instances are built on the AWS Nitro System, which offloads CPU virtualization, storage, and networking functions to dedicated hardware and software enhancing the performance and security for your workloads.

Amazon EC2 I8g instances are designed for I/O intensive workloads that require rapid data access and real-time latency from storage. These instances excel at handling transactional and real-time databases, including MySQL, PostgreSQL, and NoSQL solutions like ClickHouse, Apache Druid, and MongoDB. They’re also optimized for real-time analytics platforms such as Apache Spark. I8g instances are available in 10 different sizes with up to 48xlarge, 1,536 GiB of memory, and 45 TB local instance storage. They deliver up to 100 Gbps of network performance bandwidth, and 60 Gbps of dedicated bandwidth for Amazon Elastic Block Store (EBS).

To learn more, visit EC2 I8g instances. To begin your Graviton journey, visit the Level up your compute with AWS Graviton page.

 

​AWS is announcing the general availability of Amazon EC2 Storage Optimized I8g instances in Europe (Ireland) region. I8g instances offer the best performance in Amazon EC2 for storage-intensive workloads. I8g instances are powered by AWS Graviton4 processors that deliver up to 60% better compute performance compared to previous generation I4g instances. I8g instances use the latest third generation AWS Nitro SSDs, local NVMe storage that deliver up to 65% better real-time storage performance per TB while offering up to 50% lower storage I/O latency and up to 60% lower storage I/O latency variability. These instances are built on the AWS Nitro System, which offloads CPU virtualization, storage, and networking functions to dedicated hardware and software enhancing the performance and security for your workloads. Amazon EC2 I8g instances are designed for I/O intensive workloads that require rapid data access and real-time latency from storage. These instances excel at handling transactional and real-time databases, including MySQL, PostgreSQL, and NoSQL solutions like ClickHouse, Apache Druid, and MongoDB. They’re also optimized for real-time analytics platforms such as Apache Spark. I8g instances are available in 10 different sizes with up to 48xlarge, 1,536 GiB of memory, and 45 TB local instance storage. They deliver up to 100 Gbps of network performance bandwidth, and 60 Gbps of dedicated bandwidth for Amazon Elastic Block Store (EBS). To learn more, visit EC2 I8g instances. To begin your Graviton journey, visit the Level up your compute with AWS Graviton page.  

Today, Amazon Verified Permissions announces price reduction for single authorization requests by up to 97% to $5 per million API requests. This price reduction makes it substantially cost-effective for customers to implement fine-grained authorization across all their applications, enabling authorization checks for every user action.

Amazon Verified Permissions is a scalable, fully managed authorization service that uses Cedar, an open-source policy language for access control. By decoupling permissions from application logic, Amazon Verified Permissions allows you to centrally manage authorization policies while improving your applications’ security posture and development efficiency.

The price reduction applies to all AWS Regions where Amazon Verified Permissions is available starting June 12, 2025, at midnight UTC, and is enabled for all customers without any further action. The reduction applies to requests made to the isAuthorized and isAuthorizedWithToken APIs. The pricing for batch authorization requests and policy management operations remains unchanged. For more information about Amazon Verified Permissions pricing, visit the Verified Permissions pricing page or AWS Pricing calculator.
 

 

​Today, Amazon Verified Permissions announces price reduction for single authorization requests by up to 97% to $5 per million API requests. This price reduction makes it substantially cost-effective for customers to implement fine-grained authorization across all their applications, enabling authorization checks for every user action. Amazon Verified Permissions is a scalable, fully managed authorization service that uses Cedar, an open-source policy language for access control. By decoupling permissions from application logic, Amazon Verified Permissions allows you to centrally manage authorization policies while improving your applications’ security posture and development efficiency. The price reduction applies to all AWS Regions where Amazon Verified Permissions is available starting June 12, 2025, at midnight UTC, and is enabled for all customers without any further action. The reduction applies to requests made to the isAuthorized and isAuthorizedWithToken APIs. The pricing for batch authorization requests and policy management operations remains unchanged. For more information about Amazon Verified Permissions pricing, visit the Verified Permissions pricing page or AWS Pricing calculator.    

Amazon Elastic Container Services (Amazon ECS) now supports updating capacity providers for an existing ECS service. With this enhancement, customers can seamlessly update the underlying compute configuration for their ECS services, without incurring operational overhead or potential disruption from needing to recreate their services.

Amazon ECS enables customers to update their service configurations programmatically via the UpdateService API or AWS Management console. Previously, customers could choose the underlying compute configuration during service creation by specifying capacity providers for AWS Fargate or EC2 Auto Scaling groups, or the EC2 launch type for self-managed EC2 instances. Modifying the underlying compute configuration of a service, such as transitioning from EC2 to Fargate (or vice versa), required recreating or replacing the ECS service with a new version containing the updated configuration. This process could lead to potential service disruption and incurred additional operational overhead for spinning up a new service and managing safely switching traffic to it. Starting today, customers can seamlessly switch compute configuration of their ECS services by updating capacity providers, without any operational overhead or service disruption.

This capability is now available across all AWS Regions via the AWS Management Console, API, SDK, CLI, and CloudFormation. To learn more, visit the ECS Update Service documentation.
 

 

​Amazon Elastic Container Services (Amazon ECS) now supports updating capacity providers for an existing ECS service. With this enhancement, customers can seamlessly update the underlying compute configuration for their ECS services, without incurring operational overhead or potential disruption from needing to recreate their services. Amazon ECS enables customers to update their service configurations programmatically via the UpdateService API or AWS Management console. Previously, customers could choose the underlying compute configuration during service creation by specifying capacity providers for AWS Fargate or EC2 Auto Scaling groups, or the EC2 launch type for self-managed EC2 instances. Modifying the underlying compute configuration of a service, such as transitioning from EC2 to Fargate (or vice versa), required recreating or replacing the ECS service with a new version containing the updated configuration. This process could lead to potential service disruption and incurred additional operational overhead for spinning up a new service and managing safely switching traffic to it. Starting today, customers can seamlessly switch compute configuration of their ECS services by updating capacity providers, without any operational overhead or service disruption. This capability is now available across all AWS Regions via the AWS Management Console, API, SDK, CLI, and CloudFormation. To learn more, visit the ECS Update Service documentation.    

Amazon Lex now offers a Large Language Model (LLMs) assisted Natural Language Understanding (NLU) to improve intent classification and slot resolution capabilities for English and Spanish locales. This feature allows you to leverage Large Language Models (LLMs) to enhance accuracy when the standard NLU encounters challenges, helping you deliver more natural, resilient conversational experiences, while maintaining complete control over your bot’s responses, defined intents, and slots. For example: interpreting complex or lengthy utterances, maintaining accuracy despite spelling errors, extracting slots from verbose inputs, delivering better results with minimal training data and does not require any changes to permissions or integration settings.

This feature is available in all commercial AWS Regions where Amazon Lex operates except Canada (Central) and Europe (London). To learn more about the assisted NLU or how Amazon Connect and Amazon Lex deliver cloud-based conversational AI experiences for contact centers, please visit the Amazon Connect website.
 

 

​Amazon Lex now offers a Large Language Model (LLMs) assisted Natural Language Understanding (NLU) to improve intent classification and slot resolution capabilities for English and Spanish locales. This feature allows you to leverage Large Language Models (LLMs) to enhance accuracy when the standard NLU encounters challenges, helping you deliver more natural, resilient conversational experiences, while maintaining complete control over your bot’s responses, defined intents, and slots. For example: interpreting complex or lengthy utterances, maintaining accuracy despite spelling errors, extracting slots from verbose inputs, delivering better results with minimal training data and does not require any changes to permissions or integration settings. This feature is available in all commercial AWS Regions where Amazon Lex operates except Canada (Central) and Europe (London). To learn more about the assisted NLU or how Amazon Connect and Amazon Lex deliver cloud-based conversational AI experiences for contact centers, please visit the Amazon Connect website.    

Today, AWS announces enhanced application layer (L7) DDoS protection capabilities with faster automatic detection and mitigation, designed to respond to events within seconds. AWS WAF application layer (L7) DDoS protection is an AWS Managed Rule group that automatically detects and mitigates DDoS events of any duration to ensure your applications on Amazon CloudFront, Application Load Balancer (ALB) and other AWS services supported by WAF stay available and responsive to your users. This enhancement helps cloud security administrators and site reliability engineers protect applications while reducing the operational overhead of manually configuring and managing rules.

This AWS Managed Rule group monitors traffic data to establish a baseline within minutes of activation, then leverages machine learning models to detect anomalies from normal traffic patterns. When traffic deviates from the established baseline, the system automatically applies rules designed to address suspicious requests. You can configure rules to suit the needs of your applications, such as presenting a challenge or blocking a request.

AWS WAF application layer (L7) DDoS protection can be enabled by all AWS WAF and AWS Shield Advanced subscribers in all supported AWS Regions, except Asia Pacific (Thailand), Mexico (Central), and China (Beijing and Ningxia). You can deploy this AWS Managed Rule group for your Amazon CloudFront, ALB, and other supported AWS resources. See the Pricing page for more details.

To learn more about AWS WAF application layer (L7) DDoS protection, visit the AWS WAF documentation or the AWS WAF console. To get started, refer to our technical documentation for detailed information about enabling this feature to protect your web applications.
 

 

​Today, AWS announces enhanced application layer (L7) DDoS protection capabilities with faster automatic detection and mitigation, designed to respond to events within seconds. AWS WAF application layer (L7) DDoS protection is an AWS Managed Rule group that automatically detects and mitigates DDoS events of any duration to ensure your applications on Amazon CloudFront, Application Load Balancer (ALB) and other AWS services supported by WAF stay available and responsive to your users. This enhancement helps cloud security administrators and site reliability engineers protect applications while reducing the operational overhead of manually configuring and managing rules. This AWS Managed Rule group monitors traffic data to establish a baseline within minutes of activation, then leverages machine learning models to detect anomalies from normal traffic patterns. When traffic deviates from the established baseline, the system automatically applies rules designed to address suspicious requests. You can configure rules to suit the needs of your applications, such as presenting a challenge or blocking a request. AWS WAF application layer (L7) DDoS protection can be enabled by all AWS WAF and AWS Shield Advanced subscribers in all supported AWS Regions, except Asia Pacific (Thailand), Mexico (Central), and China (Beijing and Ningxia). You can deploy this AWS Managed Rule group for your Amazon CloudFront, ALB, and other supported AWS resources. See the Pricing page for more details. To learn more about AWS WAF application layer (L7) DDoS protection, visit the AWS WAF documentation or the AWS WAF console. To get started, refer to our technical documentation for detailed information about enabling this feature to protect your web applications.    

Amazon Nova Sonic, a state-of-the-art speech-to-speech foundation model, now supports Spanish language, bringing natural, real-time voice conversations to more users and developers worldwide. This expands on its original support for English, with expressive voices in American and British accents, to now include Spanish with two additional (masculine and feminine-sounding) expressive voices.

Nova Sonic unifies speech understanding and speech generation into a single model, to enable human-like voice conversations in AI applications. The novel architecture enables the model to adapt the generated voice response to the acoustic context (e.g., tone, style) and the spoken input, resulting in more natural human-like dialogue. Additionally, Amazon Nova Sonic supports function calling, agentic workflows, and knowledge grounding with enterprise data.

To learn more, read the AWS News Blog, Amazon Nova Sonic product page, and User Guide. To get started, visit the Amazon Bedrock Console.
 

 

​Amazon Nova Sonic, a state-of-the-art speech-to-speech foundation model, now supports Spanish language, bringing natural, real-time voice conversations to more users and developers worldwide. This expands on its original support for English, with expressive voices in American and British accents, to now include Spanish with two additional (masculine and feminine-sounding) expressive voices. Nova Sonic unifies speech understanding and speech generation into a single model, to enable human-like voice conversations in AI applications. The novel architecture enables the model to adapt the generated voice response to the acoustic context (e.g., tone, style) and the spoken input, resulting in more natural human-like dialogue. Additionally, Amazon Nova Sonic supports function calling, agentic workflows, and knowledge grounding with enterprise data. To learn more, read the AWS News Blog, Amazon Nova Sonic product page, and User Guide. To get started, visit the Amazon Bedrock Console.    

AWS Marketplace now provides streamlined Private Marketplace management within the AWS Marketplace console. Administrators can create and manage custom Private Marketplace experiences, controlling what products can be procured from AWS Marketplace by users in their organization. These customized Private Marketplace experiences can be tailored for an entire organization, specific organizational units (OUs), or individual accounts providing flexible control over software procurement.

In addition to availability in the AWS Marketplace console, Private Marketplace has been updated to include an improved configuration and management experience that reduces setup time, improves visibility, and streamlines administration. Administrators can utilize a multi-step wizard for creating Private Marketplace experiences, and an enhanced wizard for bulk product approvals. All Private Marketplace management actions can be tracked through a new dedicated change sets page, providing real-time visibility and a comprehensive audit trail. With this launch, Private Marketplace also includes support for multiple languages.

To learn more about Private Marketplace, visit the Private Marketplace overview page. To get started, access the Private Marketplace buyer guide.
 

 

​AWS Marketplace now provides streamlined Private Marketplace management within the AWS Marketplace console. Administrators can create and manage custom Private Marketplace experiences, controlling what products can be procured from AWS Marketplace by users in their organization. These customized Private Marketplace experiences can be tailored for an entire organization, specific organizational units (OUs), or individual accounts providing flexible control over software procurement. In addition to availability in the AWS Marketplace console, Private Marketplace has been updated to include an improved configuration and management experience that reduces setup time, improves visibility, and streamlines administration. Administrators can utilize a multi-step wizard for creating Private Marketplace experiences, and an enhanced wizard for bulk product approvals. All Private Marketplace management actions can be tracked through a new dedicated change sets page, providing real-time visibility and a comprehensive audit trail. With this launch, Private Marketplace also includes support for multiple languages. To learn more about Private Marketplace, visit the Private Marketplace overview page. To get started, access the Private Marketplace buyer guide.    

Today, we are excited to announce support for service-linked AWS Config rules in AWS Control Towers detective controls. A service-linked AWS Config rule is managed entirely by AWS services and cannot be edited or deleted by users. To maintain consistency, prevent configuration drift, and simplify user experience, you can only update these rules through AWS Control Tower.

With this release, AWS Control Tower now deploys service-linked Config rules directly in managed accounts, replacing the previous AWS CloudFormation StackSets deployment method. This change delivers substantial improvements to deployment speed, significantly reducing the time required to enable service-linked Config rules across multiple AWS Control Tower managed accounts and regions. Additionally, these service-linked Config rules are designed to ensure consistent governance of your resources through detective controls by preventing unintentional configuration drift.

AWS Control Towers Config rules detect resource noncompliance within your accounts, such as policy violations, and provide alerts through the dashboard. You can deploy AWS Control Tower controls via the console or using AWS Control Tower control APIs. For a complete list of supported AWS Regions, please refer to the AWS Region Table.

 

​Today, we are excited to announce support for service-linked AWS Config rules in AWS Control Towers detective controls. A service-linked AWS Config rule is managed entirely by AWS services and cannot be edited or deleted by users. To maintain consistency, prevent configuration drift, and simplify user experience, you can only update these rules through AWS Control Tower. With this release, AWS Control Tower now deploys service-linked Config rules directly in managed accounts, replacing the previous AWS CloudFormation StackSets deployment method. This change delivers substantial improvements to deployment speed, significantly reducing the time required to enable service-linked Config rules across multiple AWS Control Tower managed accounts and regions. Additionally, these service-linked Config rules are designed to ensure consistent governance of your resources through detective controls by preventing unintentional configuration drift. AWS Control Towers Config rules detect resource noncompliance within your accounts, such as policy violations, and provide alerts through the dashboard. You can deploy AWS Control Tower controls via the console or using AWS Control Tower control APIs. For a complete list of supported AWS Regions, please refer to the AWS Region Table.  

Amazon EKS Pod Identity now provides a simplified experience for configuring application permissions to access AWS resources in separate accounts. With enhancements to EKS Pod Identity APIs, you can now seamlessly configure access to resources across AWS accounts by providing the resource account’s IAM details during the creation of the Pod Identity association. Your applications running in the EKS cluster automatically receive the required AWS credentials during runtime without requiring any code changes.

EKS Pod Identity enables applications in your EKS cluster to access AWS resources across accounts through a process called IAM role chaining. When creating a Pod Identity association, you can provide two IAM roles — an EKS Pod Identity role in the same account as your EKS cluster and a target IAM role from the account containing your AWS resources (like S3 buckets or DynamoDB tables). When your application pod needs to access AWS resources, it requests credentials from the EKS Pod Identity, which automatically assumes the roles through IAM role chaining to provide your pod with the necessary cross-account temporary credentials.

This feature is available in all AWS Regions where Amazon EKS is available. To learn more, see Access AWS Resources using EKS Pod Identity Target IAM Roles.

 

​Amazon EKS Pod Identity now provides a simplified experience for configuring application permissions to access AWS resources in separate accounts. With enhancements to EKS Pod Identity APIs, you can now seamlessly configure access to resources across AWS accounts by providing the resource account’s IAM details during the creation of the Pod Identity association. Your applications running in the EKS cluster automatically receive the required AWS credentials during runtime without requiring any code changes. EKS Pod Identity enables applications in your EKS cluster to access AWS resources across accounts through a process called IAM role chaining. When creating a Pod Identity association, you can provide two IAM roles — an EKS Pod Identity role in the same account as your EKS cluster and a target IAM role from the account containing your AWS resources (like S3 buckets or DynamoDB tables). When your application pod needs to access AWS resources, it requests credentials from the EKS Pod Identity, which automatically assumes the roles through IAM role chaining to provide your pod with the necessary cross-account temporary credentials. This feature is available in all AWS Regions where Amazon EKS is available. To learn more, see Access AWS Resources using EKS Pod Identity Target IAM Roles.  

AWS announces the general availability for Security Group (SG) Referencing and enhanced Domain Name System (DNS) support across Amazon Virtual Private Clouds (VPCs) connected by AWS Cloud WAN. With SG Referencing, customers can simplify management of Security Groups and gain a better security posture for cross-VPC connectivity via Cloud WAN. With enhanced DNS support, customers can enable the resolution of public DNS hostnames to private IP addresses for DNS queries from VPCs attached to Cloud WAN.

Customers can configure Security Groups by specifying a list of rules that allow network traffic based on criteria such as IP addresses, Prefix-Lists, Ports and SG references. Until now, customers were not able to use SG references for controlling traffic between VPCs connected via Cloud WAN. SG Referencing allows customers to specify other SGs as references, or matching criterion in inbound security rules to allow instance-to-instance traffic. With this capability, customers do not need to reconfigure security rules as applications scale up or down or if their IP addresses change. Rules with SG references also provide higher scale as a single rule can cover thousands of instances and prevents customers from over-running SG rule limits. Both SG Referencing and enhanced DNS support are regional features on Cloud WAN, meaning VPCs must be connected to the same Core network edge (CNE) for these features to work.

Security Group Referencing and enhanced DNS support on Cloud WAN are available in all AWS Regions where Cloud WAN is available. You can enable these features using the AWS Management Console, AWS Command Line Interface (CLI) and the AWS Software Development Kit (SDK). There is no additional charge for enabling SG Referencing or DNS support on Cloud WAN. For more information, see the AWS Cloud WAN documentation pages.

 

​AWS announces the general availability for Security Group (SG) Referencing and enhanced Domain Name System (DNS) support across Amazon Virtual Private Clouds (VPCs) connected by AWS Cloud WAN. With SG Referencing, customers can simplify management of Security Groups and gain a better security posture for cross-VPC connectivity via Cloud WAN. With enhanced DNS support, customers can enable the resolution of public DNS hostnames to private IP addresses for DNS queries from VPCs attached to Cloud WAN. Customers can configure Security Groups by specifying a list of rules that allow network traffic based on criteria such as IP addresses, Prefix-Lists, Ports and SG references. Until now, customers were not able to use SG references for controlling traffic between VPCs connected via Cloud WAN. SG Referencing allows customers to specify other SGs as references, or matching criterion in inbound security rules to allow instance-to-instance traffic. With this capability, customers do not need to reconfigure security rules as applications scale up or down or if their IP addresses change. Rules with SG references also provide higher scale as a single rule can cover thousands of instances and prevents customers from over-running SG rule limits. Both SG Referencing and enhanced DNS support are regional features on Cloud WAN, meaning VPCs must be connected to the same Core network edge (CNE) for these features to work. Security Group Referencing and enhanced DNS support on Cloud WAN are available in all AWS Regions where Cloud WAN is available. You can enable these features using the AWS Management Console, AWS Command Line Interface (CLI) and the AWS Software Development Kit (SDK). There is no additional charge for enabling SG Referencing or DNS support on Cloud WAN. For more information, see the AWS Cloud WAN documentation pages.