From AWS Security Blog · 40 stories
Strategic Frameworks and Systems Vital for Successful AI Integration in Enterprises
AI's integration in enterprises is moving beyond model development to focus on creating robust systems for execution and governance. This shift highlights the importance of developing adaptable frameworks to support AI's role across various functions such as finance, HR, and operations. It reflects a broader industry trend where the focus is on building the necessary infrastructure to ensure AI's ongoing, safe, and productive incorporation into real-world workflows, addressing the current challenges and limitations.
Amazon Bedrock Enhances AI Capabilities with Security and Operational Features
Amazon Bedrock has introduced several updates to improve the security and operational management of AI applications, emphasizing capabilities for multi-tenant AI, data retention policies, and compliance with US government standards. Key features include resource-based policies, managed entitlements for model subscriptions, zero data retention enforcement, and AI model support in AWS GovCloud. These advancements aim to streamline AI adoption across diverse sectors while maintaining security and governance standards.
Dependabot introduces default three-day cooldown for version updates
Dependabot now includes a default three-day cooldown before opening version update pull requests. This change aims to reduce the risk of merging compromised versions immediately after their release, enhancing supply chain security for developers.
AWS Unveils New AI and Security Features at NYC Summit
Amazon Web Services introduced new AI and security features at the NYC Summit, including Amazon Bedrock AgentCore and AWS Continuum. These updates enhance AI applications and security, offering capabilities for organizational knowledge access and proactive security measures. The announcements indicate a focus on advancing AI operations and cybersecurity strategies.
Amazon launches GuardDuty investigation agent for AI-powered threat assessment
Amazon introduced the GuardDuty investigation agent in public preview, enhancing threat assessments across AWS environments. This tool automates investigation processes, reducing time from hours to minutes and providing structured risk assessments and actionable recommendations.
AWS & Google Cloud Designated as Critical Third Parties to UK's Financial Sector
HM Treasury has designated Amazon Web Services and Google Cloud as critical third parties to the UK financial sector. Under the Critical Third Party (CTP) regime effective January 1, 2025, these tech giants will be subject to oversight from UK regulators such as the Bank of England. This move aims to enhance the operational resilience of the financial sector amidst increasing reliance on cloud services.
AWS Certificate Manager Adds ACME Support, Deprecates Email Validation by September 2027
AWS Certificate Manager (ACM) now supports the Automated Certificate Management Environment (ACME) protocol for automated public certificate issuance and renewal, addressing the operational burden of reduced certificate validity periods. Concurrently, ACM will discontinue support for email-validated public certificates by September 30, 2027, requiring users to migrate to DNS validation in alignment with CA/B Forum standards.
AWS introduces IAM role manager to automate IAM role creation for services
AWS has launched IAM role manager, a new feature that automates the creation and configuration of IAM roles when building applications in supported service consoles. This feature simplifies the initial setup process for developers by automatically provisioning necessary roles, allowing them to refine permissions later.
Amazon Cognito Introduces Self-Service Provisioned Limits for Rate Limit Management
Amazon Cognito now offers provisioned limits, allowing users to adjust authentication rate limits on-demand through the AWS Management Console. This change reduces the time required for capacity increases from up to two weeks to minutes, enabling better cost optimization and responsiveness to traffic fluctuations.
AWS renews PCI DSS and PCI 3DS compliance, expands scope to new services and region
AWS has renewed its Payment Card Industry Data Security Standard (PCI DSS) and Three Domain Secure (PCI 3DS) certifications, adding three new services and the Asia Pacific (New Zealand) region to its compliance scope. This update allows customers to use these additional AWS services and the new region for handling payment card data while maintaining compliance, reducing their compliance overhead.
AWS Releases HIPAA Security Rule Technical Safeguards Implementation and Readiness Guidance
AWS has released new guidance to help healthcare entities configure and implement HIPAA Security Rule Technical Safeguards when using AWS services. This guidance covers current regulations and proposed 2025 NPRM changes, including mandatory encryption and multi-factor authentication, providing a practical reference for compliance.
Amazon Inspector SBOM Generator Adds Plugin System for Custom Package Collectors
Amazon Inspector's SBOM Generator (inspector-sbomgen) now includes a plugin system, allowing users to create custom package collectors for unsupported software ecosystems. This update enables immediate inventorying of new or niche package formats without requiring source code compilation or official releases, addressing a previous visibility gap for security teams.
Amazon links North Korean group to multiple open-source supply chain attacks on NPM libraries
Amazon Threat Intelligence has identified a North Korean-linked threat actor as responsible for recent compromises of popular Node Package Manager (NPM) libraries, including axios, debug, chalk, and typo-crypto. This connection, previously unreported, highlights the increasing sophistication of software supply chain attacks and the evolving tactics of state-sponsored groups targeting open-source infrastructure.
AWS releases 2026 Phase 1a IRAP report for Australian customers, adding four services
AWS has made its 2026 Phase 1a IRAP report available to Australian customers via AWS Artifact, which includes four new services assessed at the PROTECTED level. This update increases the total number of PROTECTED-level services to 167, providing Australian government and critical infrastructure customers with more options for secure cloud deployments.
AWS Shield Advanced Adopts WAF Anti-DDoS Managed Rule Group for Application-Layer Protection
AWS Shield Advanced is integrating the AWS WAF Anti-DDoS managed rule group as its default and eventually sole application-layer DDoS protection. This change, starting July 27, enhances detection and mitigation of HTTP request floods by profiling traffic and reacting within seconds, improving upon existing automatic mitigations.
AWS expands ISO and CSA STAR certificates to include two additional services
Amazon Web Services (AWS) has completed an audit adding two new services to its ISO and CSA STAR certifications. This expansion reflects AWS's ongoing commitment to quality management and information security in its cloud offerings.
AWS Enhances Bot Traffic Security with Web Bot Authentication in WAF Bot Control
AWS WAF Bot Control now includes Web Bot Authentication (WBA), using cryptographic signatures to distinguish legitimate AI bot traffic from malicious activity. This update addresses security challenges in multi-tenant environments such as Amazon Bedrock AgentCore, where traditional IP-based methods fall short. The method leverages two IETF drafts to verify bot identities securely.
Security Hub adds AI workload protection, supports Microsoft Azure
Security Hub introduces AI workload protection and support for Microsoft Azure. These enhancements address customer demand for integrated security management across multiple cloud environments, allowing for streamlined risk assessment and response.
HITRUST i1 Compliance Guidance Released for AWS Users
AWS has published a new guide for healthcare organizations seeking HITRUST i1 compliance. This guidance outlines how to implement the certification's requirements on AWS, covering 11 technical control domains relevant to healthcare data security.
AWS MCP Server Introduces OAuth Support for Enhanced Security
AWS MCP Server now supports OAuth sign-in methods for improved user authentication. This change enables IAM federation and simplifies access management for cloud users, facilitating better integration and security features within AWS services.
Security Focus on System Prompt Leakage in Generative AI Applications
System prompts, essential for LLMs, face leakage issues due to prompt injection risks. This risk highlights the need for robust security measures in generative AI designs.
Cedar enables least-privilege authorization for multi-agent AI systems
Cedar introduces a three-layer authorization model for multi-agent AI systems to prevent privilege abuse. This model addresses risks by enforcing least-privilege authorization as tasks are delegated through AI agents, crucial for maintaining security in complex systems.
AWS Network Firewall introduces container attribute-based rules for EKS and ECS
AWS Network Firewall now supports container attribute-based rules for Amazon EKS and ECS, enhancing security for traffic in Kubernetes environments. This feature allows users to define firewall rules based on container attributes instead of transient IP addresses, addressing challenges in dynamic container workloads.
AWS CIRT updates Threat Technique Catalog, focusing on container security
The AWS Customer Incident Response Team updated the Threat Technique Catalog, adding five new entries focused on container security, organization-level trust, and compute hijacking. This update provides essential insights into recent security threats, particularly around AWS Elastic Kubernetes Service, helping organizations mitigate risks in their cloud environments.
AWS adds resource-based policies for console access control from specific networks
AWS introduced resource-based policies and resource control policies to restrict AWS Management Console access to specific networks. This change allows organizations to enforce network-based restrictions for compliance and security purposes, significantly enhancing AWS account security.
AWS emphasizes egress controls to prevent data exfiltration in cloud workloads
Amazon Web Services (AWS) highlights the importance of egress controls to prevent data exfiltration in cloud environments. With traditional threats and emerging AI architectures posing risks, proper egress monitoring is necessary to detect unauthorized data flows and secure workloads.
Kiro CLI simplifies AWS security investigations with AI assistance
Kiro has introduced Kiro CLI, an AI-powered tool that assists security teams in investigating AWS incidents. It streamlines the process by providing AWS CLI command suggestions and explanations, significantly reducing the time required for investigations.
AWS Releases Spring 2026 SOC Reports with 188 Services, Now in OSCAL Format
AWS has released its Spring 2026 System and Organization Controls (SOC) 1, 2, and 3 reports, covering 188 services. The SOC 1 and 2 reports are available in both PDF and OSCAL formats for the first time, enhancing automation and efficiency in compliance workflows. These reports provide AWS customers with assurance spanning April 2025 to March 2026, reflecting AWS's ongoing commitment to meeting cloud service compliance standards.
AWS Launches Continuum for Automated Security Vulnerability Management
AWS introduced Continuum for code vulnerabilities, designed to automate the security lifecycle from discovery to resolution. It aims to prioritize vulnerabilities using contextual data and machine reasoning, addressing the increasing backlog of threats facing enterprises.
AWS security maturity roadmap provides phased improvement strategy
A new maturity roadmap for AWS security operations introduces a six-phase process aimed at improving security practices. By integrating AWS Security Hub and Amazon GuardDuty, organizations can enhance their threat detection and overall security posture.
Amazon Cognito enhances services with high-throughput, encryption, and replication features
Amazon Cognito has introduced high-throughput performance, customer-managed keys, and multi-Region replication capabilities. These enhancements support modern applications and improve data security and business continuity.
AWS Shield Advanced introduces DDoS attack flow logs for enhanced visibility
AWS Shield Advanced now includes attack flow logs that capture traffic metadata during DDoS attacks. This enables better analysis of attack traffic, showing the origins and mitigating actions taken, integrating seamlessly with existing monitoring tools.
Amazon Cognito introduces Lambda trigger for federated sign-in customization
Amazon Cognito has launched an inbound federation Lambda trigger, allowing developers to programmatically manage federated authentication flows. This feature enables customization of user attributes received from external identity providers before they are mapped in the Cognito user pool, addressing challenges in identity federation.
AWS KMS launches GetKeyLastUsage API for key management
AWS has introduced the GetKeyLastUsage API, allowing users to check when KMS keys were last utilized. This tool simplifies auditing and reduces reliance on AWS CloudTrail logs, enhancing key management efficiency and compliance tracking.
AWS Network Firewall Supports Transit Gateway Attachment for Cost Optimization
AWS Network Firewall now allows attachment to Transit Gateway, streamlining traffic routing without needing a central inspection VPC. This simplifies network architecture and enables flexible cost allocation for traffic inspection, making it more efficient for AWS users.
AWS Network Firewall introduces URL and Domain Category filtering for easier policy management
AWS Network Firewall now enables URL and domain category filtering, allowing security teams to manage access via predefined categories rather than individual domains. This update simplifies policy management and ensures domain lists stay current automatically, particularly benefiting organizations overseeing rapidly changing areas like AI services.
Post-quantum cryptography guidance released for CISOs
Over a dozen economies issued guidance on post-quantum cryptography (PQC) adoption. The focus is on strategic organization-wide changes required for compliance and modernization beyond just algorithm updates.
AWS Releases Independent Assessment Report for Landing Zone Accelerator's C5:2020 Compliance
AWS has made an independent assessment report available on AWS Artifact for its Landing Zone Accelerator (LZA) solution, detailing its alignment with the C5:2020 cloud security compliance standard. This report helps organizations in Europe demonstrate compliance by showing how LZA implements security controls for "security in the cloud" aspects of C5:2020.
AWS releases Summer 2026 SOC 1 report covering 185 services for 12 months
Amazon Web Services (AWS) has released its Summer 2026 SOC 1 report, which covers 185 services for the period of July 1, 2025, to June 30, 2026. This report provides customers with compliance assurance for a full year, aiding in their architectural and regulatory requirements.
AWS Completes 2025-26 NHS DSPT Assessment with "Standards Exceeded" Status
Amazon Web Services (AWS) has successfully completed its 2025-26 NHS Data Security and Protection Toolkit (DSPT) assessment, achieving a "Standards Exceeded" status. This assessment demonstrates AWS's compliance with data security standards required for organizations accessing NHS patient data and systems.