AWS Networking & Security Releases

2026-11-05 · All commercial Regions

You can stop re-importing CRLs into Roles Anywhere each time your CA publishes, as long as your certificates carry publicly accessible CDP URLs.

Bring it up when

Client uses IAM Roles Anywhere for on-premises workloads with its own CA, and either scripts CRL re-imports or skips revocation checks because re-importing is a chore.

Replaces

Scheduled jobs that re-import CRLs into IAM Roles Anywhere each time the CA publishes.

Watch out for

CreateSession is denied if a valid CRL cannot be obtained from a checked distribution point. Each checked URL must be reachable from the internet on its default port and return at most 1 MB.

AWS sources: 1 2

2026-11-04 · N. California (San Jose), N. Virginia (Northern Virginia)

You can trial 1 Gbps links through Equinix at no charge during preview, with setup automated and MACsec on by default, instead of ordering cross-connects.

Bring it up when

Client already uses Equinix Fabric and orders cross-connects or configures routers by hand to reach AWS from a San Jose or Northern Virginia site.

Replaces

Manually ordered cross-connects and hand-configured BGP, VLANs and ASNs on Equinix-based links to AWS.

Watch out for

Preview: 1 Gbps at no charge, San Jose and Northern Virginia metros only. Scaling to 100 Gbps is promised at GA. The AWS availability page does not list Equinix yet.

AWS sources: 1 2 3

2026-10-23 · All commercial Regions where Transit Gateway and Cloud WAN operate

Networks with overlapping CIDRs can connect without renumbering or NAT appliances, which changes the design for mergers, partner links, and independently built VPCs.

Bring it up when

Client has overlapping CIDRs from an acquisition, partner links or independently built VPCs and is facing renumbering or NAT appliances to connect them.

Replaces

Renumbering projects and NAT appliances deployed to connect overlapping networks.

Watch out for

IPv4 only, and NAT cannot be enabled on a VPC attachment with appliance mode on, on both Transit Gateway and Cloud WAN.

AWS sources: 1 2 3

2026-09-22 · All Regions where second-generation Outposts are supported

Multi-rack Outposts get local DNS by default that survives Service Link loss, but billing of $0.65 per Resolver on Outpost per hour starts December 22, 2026 unless you opt out.

Bring it up when

Client has multi-rack second-generation Outposts, runs its own DNS there or sends DNS over the Service Link, and needs name resolution during Service Link loss.

Replaces

Customer-managed DNS servers on the Outpost, or DNS queries sent over the Service Link to the parent Region.

Watch out for

Priced at $0.65 per Resolver on Outpost per hour on second-generation racks. Those racks also do not support Resolver endpoints or Resolver DNS Firewall on the Outpost.

AWS sources: 1 2 3

2026-09-15 · All commercial Regions except China; Dedicated Connections only

Sustained data transfer can move to a fixed monthly price with a second port at no added port fee, though cross-connect and colocation fees still apply. Compare tiers against your per-GB bill.

Bring it up when

Client pushes large, steady data out over 10G or 100G dedicated Direct Connect and finance wants a predictable monthly network bill.

Replaces

Pay-as-you-go per-GB data transfer billing on dedicated connections, and paying separately for a second port.

Watch out for

Connections in one account at a Direct Connect location cannot mix billing modes. Transfer from Regions outside the chosen tier is billed at standard rates.

AWS sources: 1 2 3 4

2026-08-31 · N. Virginia, N. California, Sydney, Frankfurt

AWS-to-Azure links can now be tested through the same managed service as Google Cloud and OCI, as an alternative to do-it-yourself multicloud networking.

Bring it up when

Client runs a self-managed VPN or colocation link between AWS and Azure and wants to test a managed private path in N. Virginia, N. California, Frankfurt or Sydney.

Replaces

Do-it-yourself AWS-to-Azure networks built on VPN tunnels or colocated routers.

Watch out for

Still preview: limited to 1 Gbps and one Interconnect per supported Region, and all preview connections are removed from the account as GA approaches.

AWS sources: 1 2 3

2026-08-20 · All commercial, GovCloud (US), and China Regions with Direct Connect

VIFs can take up to 1,000 inbound prefixes rather than 100, so you may drop route summarization or extra VIFs, but allocations now draw from capacity pools to plan.

Bring it up when

Client advertises more than 100 on-premises prefixes over Direct Connect and summarizes routes or splits them across extra VIFs to stay under the limit.

Replaces

Route summarization or extra VIFs and connections used to stay under the former 100-prefix limit.

Watch out for

Each DXGW caps allocations at 10,000 combined IPv4 and IPv6, and advertising past a VIF's allocation takes its BGP session down. Allocations default to 100.

AWS sources: 1 2

2026-07-29 · US East (N. Virginia)

Private links to OCI can now use the same managed provisioning as Google Cloud, replacing do-it-yourself multicloud networks in that Region.

Bring it up when

Client runs Oracle workloads on OCI Ashburn alongside AWS in N. Virginia and manages its own cross-cloud network.

Replaces

Do-it-yourself AWS-to-OCI networks built on VPN tunnels or colocated routers.

Watch out for

The only OCI pairing is us-east-1 to OCI Ashburn. Default quota is 2 multicloud connections per provider per account.

AWS sources: 1 2 3

2026-06-11 · All AWS Regions

You can replace custom EventBridge automation for exported certificates on Apache and NGINX, with Secrets Manager Agent compatibility in one provider.

Bring it up when

Client exports ACM certificates to NGINX or Apache on EC2 or on-premises servers and maintains its own renewal scripts.

Replaces

Custom EventBridge automation that detects ACM renewals and redeploys exported certificates.

Watch out for

Only exportable ACM certificates work, and refresh runs on a fixed 24-hour interval. ACM docs also offer ACME as the alternative for public certificates, with no export.

AWS sources: 1 2

2026-06-01 · All commercial and China Regions with dedicated connections

You can cap a VIF so it is less likely to starve others on a shared connection, but excess packets are dropped, so size limits using the new CloudWatch metrics.

Bring it up when

Client shares one dedicated Direct Connect across production and lower-priority VIFs, and a traffic spike on one VIF has hurt the others.

Replaces

Separate connections kept only to isolate noisy VIFs from critical ones.

Watch out for

Dedicated connections only. For traffic into AWS, on-premises sources can still congest the physical port before the limiter applies, so AWS recommends on-premises policers.

AWS sources: 1 2

2026-05-07 · All Regions where Route 53 Resolver endpoints are supported

IPv6-only on-premises clients can reach IPv4-only AWS services when Resolver DNS64 is paired with NAT64, which removes a workaround in hybrid DNS during IPv6 transitions.

Bring it up when

Client is moving on-premises networks to IPv6-only, still has IPv4-only workloads in VPCs, and forwards DNS to AWS over VPN or Direct Connect.

Replaces

Self-managed DNS64 resolvers placed between on-premises IPv6 clients and Route 53.

Watch out for

DNS64 only synthesizes AAAA records using the 64:ff9b::/96 prefix. AWS says it works with NAT64 for complete IPv6-to-IPv4 translation, and the setting defaults to false.

AWS sources: 1 2 3

2026-04-23 · All Regions where AWS Client VPN is available

Remote access can drop the intermediate VPC and SNAT, so client IPs stay visible for authorization rules, audits and Transit Gateway flow logs.

Bring it up when

Client terminates Client VPN in a shared VPC that routes on to other VPCs, and security audits cannot trace traffic to a remote user because of SNAT.

Replaces

An intermediate VPC used only to connect Client VPN to Transit Gateway, with SNAT on client traffic.

Watch out for

Security group-based authorization is not supported. An endpoint cannot mix VPC subnet and Transit Gateway associations, and it must be in the same Region as the Transit Gateway.

AWS sources: 1 2

2026-04-14 · 9 AWS and Google Cloud Region pairs

Private links to Google Cloud can replace do-it-yourself multicloud networking, reaching many VPCs through a same-Region Transit Gateway or Cloud WAN across Regions, on single-fee bandwidth pricing.

Bring it up when

Client runs a self-managed VPN mesh or colocation network between AWS and Google Cloud.

Replaces

Do-it-yourself AWS-to-Google Cloud networks built on VPN tunnels or colocated routers.

Watch out for

Transit Gateway and virtual private gateways reach only an Interconnect local to their Region. Wider reach needs Cloud WAN, and its highest-tier CNE sets the pricing tier.

AWS sources: 1 2 3 4

2026-04-13 · us-east-1 through the NYC metro

Branch and data center links can be ordered from the console with BGP, VLAN and ASN automated, MACsec on by default, and bandwidth scaling up to 100 Gbps.

Bring it up when

Client connects US branches or data centers to AWS over Lumen circuits and wants to stop configuring cross-connects, BGP and VLANs by hand.

Replaces

Self-managed cross-connects and hand-configured BGP, VLANs and ASNs on links from US sites to AWS.

Watch out for

Lumen is the only partner not marked preview, in us-east-1 through the NYC metro, with fabric reach across the continental US. Default quota is 2 connections per provider per account.

AWS sources: 1 2 3 4

2026-03-09 · 30 AWS Regions

Authorized clients anywhere can resolve public and private hosted zone names with filtering and central logging; a 30-day free trial lets you test this.

Bring it up when

Client runs its own DNS forwarders for offices and remote users, wants DNS filtering and central logs, and needs private hosted zone names resolved from those locations.

Replaces

Self-managed DNS forwarders and filtering for on-premises and remote clients that need private hosted zone resolution.

Watch out for

The first two Regions cost $5.00 per hour with DNS filtering ($4.50 without), additional Regions cost more, and queries beyond 1 billion per deployment per month are charged.

AWS sources: 1 2 3 4

2025-11-20 · All Regions where AWS Cloud WAN is available

Route filtering, summarization, and BGP attributes let you limit route blast radius and shape paths with external networks at no added charge, which could change your segmentation design.

Bring it up when

Client on Cloud WAN has route tables filling up or asymmetric paths, or needs route filtering, summarization or BGP attributes toward external networks.

Replaces

Route filtering and summarization done only on on-premises routers because Cloud WAN could not do it.

Watch out for

Requires core network policy version 2025.11, which also starts propagating BGP community tags. Limits are 10 rules per policy and 5 match conditions per rule, not adjustable.

AWS sources: 1 2 3

2025-11-19 · All commercial and AWS GovCloud (US) Regions where VPN is available

Up to 100 low-bandwidth sites can share one Transit Gateway attachment, which could replace virtual appliance fleets for 25+ site networks and lower per-site VPN cost.

Bring it up when

Client connects 25 or more low-bandwidth branch sites to AWS using self-managed virtual appliances or one VPN attachment per site.

Replaces

Self-managed virtual appliance fleets terminating many low-bandwidth branch VPNs, or a separate Transit Gateway VPN attachment per site.

Watch out for

Supported with Transit Gateway only, not Cloud WAN or Virtual Private Gateway. Aggregate is 5 Gbps, each site is limited to 100 Mbps, and routing is BGP only.

AWS sources: 1 2 3

2025-11-12 · Commercial and GovCloud (US) Regions, except five listed Regions

A single tunnel may now carry enough that you can drop ECMP bonding, and VPN becomes a more credible backup or overlay for high-capacity Direct Connect links.

Bring it up when

Client bonds several VPN tunnels with ECMP for throughput, or wants an encrypted backup for a high-capacity Direct Connect link.

Replaces

ECMP across multiple 1.25 Gbps tunnels to reach higher VPN bandwidth.

Watch out for

Transit Gateway or Cloud WAN attachments only, not Virtual Private Gateway. Accelerated VPN is not supported, customer gateways need a fixed IP, and five Regions are excluded.

AWS sources: 1 2 3

2026-10-12 · Worldwide, except the CloudFront China region

Lambda Web Functions can sit behind CloudFront with OAC blocking direct access, adding edge TLS, caching, custom domains, and WAF without application code changes.

Bring it up when

Client serves a web app from Lambda Web Functions and wants a custom domain, edge caching or WAF without leaving the function endpoint directly reachable.

Replaces

Viewers calling the Lambda Web Function endpoint directly, with no edge caching, WAF or single front door.

Watch out for

OAC is not supported for Lambda Web Function global endpoints that include opt-in Regions. Requests routed to an opt-in Region return HTTP 403.

AWS sources: 1 2

2026-09-24 · US East (N. Virginia)

A new service for org-wide WAF and Shield Advanced rollout with drift remediation; AWS's Firewall Manager page now points WAF and Shield users to it, so review any Firewall Manager plans.

Bring it up when

Client manages WAF and Shield Advanced across many accounts, sees rule drift on internet-facing apps, or is planning a Firewall Manager rollout for them.

Replaces

Firewall Manager WAF and Shield Advanced policies, or web ACL rollout through custom per-account pipelines.

Watch out for

Handles only AWS WAF and Shield Advanced, so Network Firewall policies cannot move to it yet. GA was announced for US East (N. Virginia).

AWS sources: 1 2 3 4 5

2026-07-22 · All commercial and GovCloud (US) Regions

One dual-stack NLB can keep client IPs for both address families, so you may be able to retire paired load balancers and DNS splits.

Bring it up when

Client runs separate IPv4 and IPv6 NLBs split by DNS, or loses client IPs to protocol translation on a dual-stack NLB.

Replaces

Paired IPv4 and IPv6 NLBs with DNS splitting, or protocol translation that hides the original client IP.

Watch out for

Rules match IP version only, not CIDR. One dual-stack NLB carries both families' load, while two separate NLBs provide natural fault isolation per address family.

AWS sources: 1 2

2026-07-08 · Commercial Regions where Security Hub is available

Internet probes confirm actual reachability of AWS resources and Azure public IP addresses, which can separate real exposure from what configuration only suggests.

Bring it up when

Client needs evidence of what is actually reachable from the internet in AWS and Azure, because security group and route analysis only shows what could be.

Replaces

Scheduled external port scans of public IPs run with separate tools or scripts.

Watch out for

Scans a fixed list of well-known TCP ports, and Azure coverage is public IP addresses only, so services on other ports produce no findings.

AWS sources: 1 2

2026-07-06 · All commercial Regions

App teams can get public certificates with standard ACME clients without holding DNS credentials, ahead of the mandated 47-day lifetimes.

Bring it up when

Client terminates TLS on on-premises servers or Kubernetes, and app teams need public certificates without DNS credentials, ahead of shorter certificate lifetimes.

Replaces

Manual public certificate requests and DNS credentials shared with app teams on customer-managed hosts.

Watch out for

ACME certificates cannot be bound to ELB, CloudFront or API Gateway, last 45 days, and renew through the ACME client rather than ACM managed renewal.

AWS sources: 1 2 3

2026-06-15 · Edge locations with web ACLs on CloudFront distributions

Publishers can charge AI bots at the edge instead of only allowing or blocking them. It launched with stablecoin settlement, and fiat payouts through Stripe followed in November 2026.

Bring it up when

Publisher or data provider behind CloudFront sees heavy AI crawler traffic and wants to charge for access rather than only allow or block it.

Replaces

Nothing direct: new capability.

Watch out for

CloudFront web ACLs only. AWS says bot classification is probabilistic and might not categorize all bot traffic correctly.

AWS sources: 1 2 3

2026-05-14 · Not stated

You can put CloudFront in front of an origin that already validates client certificates without moving validation or building a trust store.

Bring it up when

Client already validates client certificates at its origin, such as an on-premises reverse proxy or ALB, and wants CloudFront in front without moving that logic.

Replaces

Keeping mTLS endpoints off CloudFront, or rebuilding certificate validation at the edge with a trust store.

Watch out for

Passthrough mode requires the CachingDisabled policy on all cache behaviors, so no content is cached. Origin Shield and Lambda@Edge are also prohibited.

AWS sources: 1 2

2026-05-14 · Not stated

Viewer mTLS can check revocation with the issuing CA at connection time, instead of only through static lists in KeyValueStore, at no added cost on pay-as-you-go.

Bring it up when

Client uses viewer mTLS on CloudFront and a regulator or internal policy requires checking client certificate revocation at connection time.

Replaces

Some uses of static revocation lists in CloudFront KeyValueStore. AWS still documents those as an option alongside OCSP.

Watch out for

CloudFront denies the connection by default when revocation status cannot be determined, such as an unreachable responder. Status changes can take up to 30 minutes to show.

AWS sources: 1 2

2026-02-02 · Not stated

Origins can verify CloudFront by certificate, replacing shared secret headers and IP allow-lists, including for on-premises and other cloud origins, at no added charge.

Bring it up when

Client has CloudFront in front of public, on-premises or other-cloud origins and proves traffic came from CloudFront with a shared secret header or IP allow-list.

Replaces

Shared secret headers and IP allow-lists used to verify that origin requests came from CloudFront.

Watch out for

Origin mTLS cannot be used with VPC origins, and WebSocket and gRPC are not supported on origins that have it enabled.

AWS sources: 1 2 3

2025-12-15 · All commercial, GovCloud (US), and China Regions where ACM is available

Pods and third-party ingress controllers that terminate TLS can get ACM certificates through ACK, replacing manual export and Secret updates at renewal, though private keys now live in Secrets.

Bring it up when

Client terminates TLS in pods or a third-party ingress controller on Kubernetes and updates Secrets by hand when ACM certificates renew.

Replaces

Manual export of ACM certificates and scripted Kubernetes Secret updates at each renewal.

Watch out for

The controller stores the exported private key in a Kubernetes Secret, so Secret access controls join the design. Exportable public certificates are charged per domain.

AWS sources: 1 2 3

2025-11-24 · Not stated

Client certificates can be validated at the edge for B2B APIs and IoT, at no added cost on pay-as-you-go, so you may be able to retire your own client access management.

Bring it up when

Client needs to authenticate B2B API partners or IoT devices by certificate and wants untrusted clients stopped at CloudFront before they reach the origin.

Replaces

Client certificate checks at the origin, or custom client access management in front of the application.

Watch out for

Viewer mTLS is not supported on HTTP/3, so the distribution must use HTTP/2, and cache behaviors cannot allow plain HTTP connections.

AWS sources: 1 2 3

2025-11-21 · All commercial, GovCloud (US), and China Regions

Listeners created by CLI, CloudFormation or CDK still need a PQ-TLS policy set explicitly, so test client compatibility. Connection and access logs show which key exchange each client used.

Bring it up when

Client holds long-lived sensitive data and has a harvest-now, decrypt-later or post-quantum requirement for traffic terminating on ALB or NLB.

Replaces

Nothing direct: new capability.

Watch out for

Clients must support ML-KEM to get hybrid key exchange. Listeners created by CLI, CloudFormation or CDK default to ELBSecurityPolicy-2016-08, not a PQ policy.

AWS sources: 1 2 3

2025-11-18 · Not stated

CloudFront with WAF, DDoS protection and DNS can be bought per distribution at one monthly price with no overage charges, which could replace multi-service cost modeling. Compare tier allowances.

Bring it up when

Client runs a website or app with unpredictable traffic and wants one monthly CloudFront, WAF and DNS price instead of modeling each service and risking spike costs.

Replaces

Pay-as-you-go cost modeling across CloudFront, WAF, Route 53 and CloudWatch Logs for that distribution.

Watch out for

There are no overage charges, but if usage substantially exceeds the allowance without an upgrade, traffic delivery might be adjusted, such as fewer or more distant edge locations.

AWS sources: 1 2

2025-11-13 · All commercial and AWS GovCloud (US) Regions

Mobile clients can keep connection state when their IP changes because NLB sticks on QUIC Connection ID, with traffic forwarded to targets in passthrough mode.

Bring it up when

Client has mobile apps that lose sessions when users move between Wi-Fi and cellular, and runs QUIC servers it controls behind a load balancer.

Replaces

Nothing direct: new capability.

Watch out for

Server software must encode an 8-byte Server ID in the QUIC Connection ID, targets are registered by instance ID, and IPv6 target groups are not supported.

AWS sources: 1 2 3 4

2026-10-21 · All commercial Regions with Network Firewall and DNS Firewall

Domain rules can now cover protocols like SFTP and SSH, and SNI spoofing gets harder because destination IPs must come from your VPC Resolver.

Bring it up when

Client filters outbound traffic by domain but worries about SNI spoofing, or needs domain control for SFTP and SSH that domain rules cannot inspect today.

Replaces

IP-based allow lists for non-HTTP protocols and custom workarounds for SNI spoofing on egress.

Watch out for

Validation is scoped per Availability Zone, so traffic crossing zones to a firewall that is not transit gateway-attached fails as unresolved.

AWS sources: 1 2 3 4

2026-08-04 · US East (Ohio)

A single firewall policy can now serve both explicit proxy and transparent firewall roles, so test the no-source-preservation deployment for egress control.

Bring it up when

Client runs self-managed forward proxies for egress control and wants one firewall policy across explicit proxy and transparent inspection.

Replaces

Self-managed explicit proxy fleets, and the separate proxy policy from the November 2025 Network Firewall Proxy preview.

Watch out for

Still public preview and only in US East (Ohio), with behavior subject to change. Deployment mode is set at creation, so an existing firewall cannot be converted.

AWS sources: 1 2

2026-06-30 · Not stated

Rules can target namespaces, clusters, and labels rather than IPs that break when pods restart, which could change how you segment container egress.

Bring it up when

Client runs shared EKS or ECS clusters and needs different egress rules per namespace or app, but pod IPs change too often for IP-based firewall rules.

Replaces

IP-based firewall rules for pods and tasks, and any scripts that keep those IP lists current.

Watch out for

EKS pods need SNAT disabled or rules do not match, ECS tasks must use awsvpc mode, and ECS attribute filters do not match Fargate tasks.

AWS sources: 1 2

2026-01-27 · All commercial Regions where Network Firewall is supported

You can allow or block GenAI and other web categories with pre-defined URL categories instead of maintaining domain lists, and pairing with TLS inspection extends matching to the full URL path.

Bring it up when

Client must allow or block GenAI tools and other web categories from workloads and does not want to maintain domain lists by hand.

Replaces

Hand-maintained domain allow and deny lists for web categories.

Watch out for

Category matching on full HTTPS URLs needs TLS inspection. Without it, only domain-level filtering works on encrypted traffic.

AWS sources: 1 2

2025-11-19 · All commercial Regions, except GovCloud (US) and China

One NAT Gateway can follow workloads across AZs with no public subnet and no route table edits per AZ, which could replace the per-AZ NAT design after you test it.

Bring it up when

Client runs one NAT gateway per AZ in public subnets across many VPCs and wants to remove those public subnets and the per-AZ route tables.

Replaces

Zonal NAT gateways in per-AZ public subnets, with separate private subnet route tables for each AZ.

Watch out for

No private NAT: use zonal gateways for that. Expansion to a new AZ can take up to 60 minutes, with traffic processed across zones until then. Constrained AZs are not supported.

AWS sources: 1 2

2026-10-30 · Not stated

CloudFront can insert the WAF script tag for you, which could close gaps in Bot Control and Fraud Control client signals, but it changes how objects are fetched, so test it first.

Bring it up when

Client runs Bot Control targeted or Fraud Control on CloudFront across many apps and struggles to keep the WAF script tag on every page.

Replaces

Manually added and maintained WAF SDK script tags, except on pages that must always include the SDK or apps that attach tokens to their own API calls.

Watch out for

When on, CloudFront strips Range headers and returns whole objects, affecting video players and download managers. Origin Shield is unsupported, and no metric shows missing tags.

AWS sources: 1 2

2026-09-29 · All Regions where DNS Firewall is offered (32 AWS Regions)

You can block malicious DNS with Palo Alto Networks rules from VPCs and hybrid networks without deploying firewalls, subject to AWS Marketplace pricing.

Bring it up when

Client runs Palo Alto firewalls in VPCs only to inspect DNS, or wants Palo Alto DNS threat categories applied to VPC and forwarded on-premises queries.

Replaces

Palo Alto firewalls deployed across VPCs and accounts solely for DNS inspection.

Watch out for

Subscribing authorizes AWS to share DNS query metadata with Palo Alto Networks. Rule groups also need the Advanced pricing option, and the Marketplace subscription has its own pricing.

AWS sources: 1 2 3

2026-09-03 · All Regions where Gateway Load Balancer is available

Inspection appliance failures can interrupt flows for seconds rather than minutes, but TCP Reset is off by default, so test client behavior.

Bring it up when

Client inspects traffic through GWLB firewall appliances and TCP sessions stall for minutes when an appliance fails or is replaced.

Replaces

Waiting on client TCP retransmit and back-off timers to recover flows after an appliance failure.

Watch out for

Applies to TCP traffic only; UDP and other protocols are unaffected. It also cannot be enabled when target failover is set to rebalance or stickiness.enabled is true.

AWS sources: 1 2 3

2026-07-30 · All commercial Regions where Transit Gateway is available

Steering by source, port, or protocol no longer needs extra VPCs and hops, which could simplify inspection and path selection designs.

Bring it up when

Client wants only some traffic, by source, port or protocol, sent through inspection or over a chosen hybrid path, and has added VPCs to achieve it.

Replaces

Multi-VPC steering designs with extra routing hops built only to classify traffic.

Watch out for

Associating a policy table with a Site-to-Site VPN or Connect attachment stops all BGP route advertisements to that peer.

AWS sources: 1 2

2026-11-02 · All commercial Regions where Inspector is available

You can catch vulnerable AMIs before launch without starting instances or installing software, and pair results with Allowed AMIs to block noncompliant images.

Bring it up when

Client keeps a golden AMI catalog and finds vulnerabilities only after instances launch, or wants to block images that fail a security bar across the organization.

Replaces

Launching a temporary instance from each AMI to scan it, or separate image scanning tooling in the build pipeline.

Watch out for

Scanning covers AMIs the account owns, and images whose snapshots use a configuration Inspector can't read, such as LVM, report UNSUPPORTED_OS.

AWS sources: 1 2 3 4

2026-10-01 · All commercial and GovCloud (US) Regions

An organization policy can replace per-Region enablement and stop drift, but enablement it sets cannot be overridden from the GuardDuty console or API.

Bring it up when

Client has many accounts and Regions, GuardDuty enablement has drifted, and teams can switch protection plans off in member accounts.

Replaces

Per-Region GuardDuty enablement settings and any scripts that repair enablement drift.

Watch out for

Policies manage enablement only, not suppression rules or IP lists, and cannot reach accounts linked only by the legacy invitation method.

AWS sources: 1 2

2026-09-18 · 28 Regions including US East (N. Virginia), Europe (Ireland)

You can share a whole CIDR range with a vendor instead of one Resource Configuration per resource, but they need GENEVE tunneling and pay hourly and per-GB, and you pay per GB on resource gateways.

Bring it up when

Client must give a vendor private access to many or short-lived hosts in a VPC range, and listing each resource for sharing is impractical.

Replaces

One Resource Configuration per shared resource for vendor access.

Watch out for

Consumer compute must GENEVE-encapsulate traffic, inner application traffic must be TCP, and the sharing VPC cannot initiate connections into the endpoint VPC.

AWS sources: 1 2 3 4

2026-08-10 · All Commercial Regions enabled by default

You no longer have to choose between per-account federation and permission sets, since Identity Center users can be assigned existing IAM roles.

Bring it up when

Client federates users into each account with custom IAM roles, wants one sign-in through IAM Identity Center, and does not want to rebuild those roles as permission sets.

Replaces

Per-account IdP federation into IAM roles, or converting existing custom roles into permission sets.

Watch out for

Needs an organization instance of IAM Identity Center, and existing roles need trust policy changes: only roles that allow account access manager as a service principal can be assigned.

AWS sources: 1 2

2026-08-07 · All commercial Regions except GovCloud (US) and China

BYOIP owners could reduce manual ROA upkeep and third-party route monitoring with IPAM, after a one-time setup with a supported registry. Delegated RPKI and findings need Advanced Tier.

Bring it up when

Client advertises BYOIP prefixes to the internet and tracks ROA renewals by hand at its registry, or relies on a separate tool to detect route hijacks.

Replaces

Manual ROA creation and renewal in registry portals, and third-party route monitoring for hijack detection.

Watch out for

Free Tier gets only the route discovery API. RPKI findings, overlap detection and delegated RPKI need Advanced Tier. AFRINIC prefixes cannot use delegated RPKI.

AWS sources: 1 2

2026-07-06 · All Regions that support VPC Encryption Controls

You can stop configuring each VPC separately and set monitor or enforce mode once for existing and future VPCs. AWS guidance is to run monitor mode before enforce.

Bring it up when

Client must show encryption in transit for HIPAA, PCI or FedRAMP across many accounts and is configuring or auditing each VPC separately.

Replaces

Per-VPC Encryption Controls settings and manual tracking of which network paths are encrypted.

Watch out for

Gateway Load Balancer and AWS Network Firewall are not supported in enforce mode, so those VPCs must stay in monitor mode. Non-empty VPCs are billed hourly in either mode.

AWS sources: 1 2 3 4

2026-05-04 · All Regions where VPC Lattice is available

Teams with private DNS can share privately hosted FQDNs across accounts without public DNS entries, by setting the resource gateway to resolve names IN_VPC.

Bring it up when

Client has names on private DNS servers or in a Route 53 private hosted zone in one account and wants other accounts to reach them through VPC Lattice.

Replaces

Public DNS entries created only so a domain-name target could be shared through a resource configuration.

Watch out for

Resource gateway DNS resolution is immutable, so a PUBLIC gateway cannot be switched to IN_VPC. IN_VPC also rules out ARN resource configurations and IPv6-only subnets.

AWS sources: 1 2 3

2025-12-02 · AWS commercial Regions; see the Region table

Correlated GuardDuty, Inspector, and CSPM signals replace manual correlation across consoles, and streamlined pricing consolidates charges, so review both your workflow and your bill.

Bring it up when

Client's security team correlates GuardDuty, Inspector and CSPM findings by hand across consoles and accounts and wants one prioritized view.

Replaces

Manual correlation across security consoles and custom pipelines built to rank findings.

Watch out for

Exposure findings and trends need Security Hub CSPM and Amazon Inspector enabled, so the cost and rollout of those services are part of the decision.

AWS sources: 1 2

2025-11-21 · All commercial Regions where Transit Gateway is available

Sender-pay is no longer the only option: data costs can go to the source, destination, or central account, per attachment or flow, which changes chargeback for shared networks.

Bring it up when

Client runs a shared Transit Gateway or central inspection and wants data charges to land on application or destination accounts, not the sender.

Replaces

Sender-pays billing with manual chargeback calculated outside AWS billing.

Watch out for

Attachment hourly charges and multicast data processing stay outside metering policies, so hourly costs are not reallocated.

AWS sources: 1 2

2025-11-19 · All commercial Regions and AWS GovCloud (US) Regions

Central public IP allocation rules for regional NAT Gateways and Elastic IPs apply by default, which helps keep allow-lists on known pools, though explicit choices at creation override them.

Bring it up when

Client allow-lists NAT gateway or Elastic IP public addresses at partners or firewalls and cannot rely on app teams to pick the right IPAM pool.

Replaces

Relying on application teams to follow IP allocation guidance when they create resources with public IPv4 addresses.

Watch out for

If an account can't access the pool, the request still succeeds with an Amazon-provided IP. Exhausted pools fall back too, and choosing a pool or EIP at creation overrides the policy.

AWS sources: 1 2

2026-10-26 · Regions with Identity Center multi-Region support

Compute and data can sit in different Regions while keeping per-user access control and audit, so you can drop broad IAM roles or single-Region consolidation.

Bring it up when

Client queries data in one Region from analytics or AI services in another and needs per-user permissions and audit trails across both.

Replaces

Broad IAM roles that cannot distinguish individual users, or consolidating all services into one Region to keep per-user identity.

Watch out for

Requires a multi-Region Identity Center instance with a multi-Region customer managed KMS key. Multi-Region support is available in select Regions only.

AWS sources: 1 2 3 4

2026-10-05 · All Regions where Client VPN is available

VPN access can depend on CrowdStrike, Jamf, or JumpCloud device signals with mid-session disconnects, and monitoring-only mode lets you test policies before enforcing.

Bring it up when

Client lets staff reach AWS over Client VPN from any authenticated laptop, and an auditor asks how unencrypted or unmanaged devices are kept off the network.

Replaces

Nothing direct: new capability.

Watch out for

Needs the AWS provided client 6.2.0 or later; other OpenVPN clients are not supported. OS coverage varies by provider, for example Jamf is macOS only.

AWS sources: 1 2 3 4

2025-11-19 · All commercial, AWS GovCloud (US), and China Regions

AWS workloads can exchange IAM credentials for short-lived JWTs to call third-party services, removing long-term credentials; IAM policies control token lifetime, audience, and signing algorithm.

Bring it up when

Client stores API keys or long-term secrets so AWS workloads can call a SaaS product, another cloud, or a self-hosted application that can validate JWTs.

Replaces

Long-term credentials for third-party services kept in AWS, along with the rotation jobs around them.

Watch out for

Off until enabled: you must turn on outbound identity federation before requesting tokens. The GetWebIdentityToken API is not available on the STS Global endpoint.

AWS sources: 1 2

2025-11-19 · All commercial Regions

Partner products can get temporary, auditable access for onboarding and upgrades, but a role created through a request can persist, so partner access reviews need to cover this new path.

Bring it up when

Client onboards security or SaaS partner products by creating standing cross-account IAM roles, and its access reviews flag those roles or the manual setup they need.

Replaces

Manual onboarding steps and standing cross-account roles created up front for partner products.

Watch out for

Any IAM role created through a delegation request persists after temporary access expires, so the provider keeps that access. Only onboarded Amazon products and qualified Partners can send requests.

AWS sources: 1 2

2025-11-12 · All Regions where Application Load Balancer is supported

Service-to-service token validation can move from application code to the ALB, covering signature, expiry, and claims, which changes where your M2M auth logic lives.

Bring it up when

Client has services validating OAuth 2.0 machine tokens in each application and wants that check done once at the load balancer.

Replaces

JWT signature, expiry and claims validation code in each backend service, for traffic through ALB.

Watch out for

Only RS256 is supported, the JWKS endpoint must be publicly accessible and within 150 KB and 10 keys, and the rule requires an HTTPS listener.

AWS sources: 1 2

2026-10-26 · All KMS Regions except Middle East (UAE), Middle East (Bahrain), and China

Teams addressing harvest-now, decrypt-later risk can establish shared secrets with HSM-protected ML-KEM private keys, while partners encapsulate locally with the public key.

Bring it up when

Client must establish keys with partners or devices and has a post-quantum roadmap or harvest-now, decrypt-later concern about RSA or ECDH key establishment.

Replaces

RSA key transport or ECDH key agreement used to establish shared secrets, where a post-quantum option is required.

Watch out for

Not available in Middle East (UAE), Middle East (Bahrain) or China Regions. KMS returns a 32-byte shared secret, so the application derives its own symmetric keys.

AWS sources: 1 2

2026-10-08 · All commercial and GovCloud (US) Regions with GuardDuty RDS Protection

PostgreSQL detection now covers query-level exfiltration and destruction with no agents, as a paid add-on with a 30-day trial to judge value and noise.

Bring it up when

Client runs Aurora or RDS PostgreSQL with sensitive data and has no query-level monitoring to catch exfiltration using valid stolen credentials.

Replaces

Nothing direct: new capability.

Watch out for

Data activity monitoring covers PostgreSQL only: Aurora MySQL, RDS for MySQL, RDS for MariaDB and Aurora Limitless are not supported.

AWS sources: 1 2

2026-10-05 · All Regions where IAM Identity Center is available

You can limit Identity Store API calls to chosen VPC endpoints or IP ranges and SCIM to your IdP's ranges, so test first to avoid blocking provisioning.

Bring it up when

Client's security team wants Identity Store API and SCIM calls accepted only through approved VPC endpoints, VPCs or IP ranges, not from any network with valid credentials.

Replaces

Nothing direct: new capability.

Watch out for

If the SCIM allow list is empty, SCIM requests stay subject to other controls such as the VPC endpoint requirement, so test external IdP provisioning first.

AWS sources: 1 2

2026-07-29 · 17 enabled-by-default commercial Regions

Directory-sourced instances can keep account access through a primary Region disruption, but require a multi-Region customer managed KMS key.

Bring it up when

Client relies on Identity Center for workforce access to AWS accounts and worries about losing sign-in during a primary Region disruption, or needs apps closer to their data.

Replaces

Single-Region Identity Center deployments where a primary Region disruption interrupts workforce sign-in to AWS accounts.

Watch out for

All AWS managed applications in use must support Identity Center with a customer managed KMS key, which multi-Region requires. Active Directory identity sources are not supported.

AWS sources: 1 2 3

2026-07-14 · Not stated

Bedrock and SageMaker threats such as cost harvesting can be detected without custom tooling, so weigh its pricing during the 30-day trial.

Bring it up when

Client runs production Bedrock or SageMaker AI workloads with no detection for stolen credentials driving model abuse, token cost spikes or prompt injection.

Replaces

Custom CloudTrail data event pipelines and alerts built to watch model invocations.

Watch out for

Prompt injection findings need Bedrock Guardrails and cover only Bedrock workloads, so SageMaker AI gets no prompt injection finding.

AWS sources: 1 2 3

2026-07-07 · All Security Hub Regions except UAE, Bahrain, Taipei, and New Zealand

Teams on both clouds could replace a separate Azure security tool, paying the same as equivalent AWS resources after a 30-day trial.

Bring it up when

Client runs workloads on AWS and Azure with separate posture and vulnerability tools for each, which makes risks hard to rank in one place.

Replaces

Separate Azure security tooling and manual cross-cloud risk prioritization.

Watch out for

The Azure tenant must be in the commercial cloud: Azure Government and Azure China are not supported. Setup also needs an Entra ID Global Administrator.

AWS sources: 1 2

2025-11-20 · All commercial, GovCloud (US), and China Regions

Inference or compute-heavy targets can cap concurrent requests, even to one, but it needs a new target group, an AWS agent on targets, and generates more LCU usage.

Bring it up when

Client serves inference or other compute-heavy work behind ALB, and targets that can only handle a few requests at once return errors under load.

Replaces

Over-provisioning targets or app-side queues used to keep per-target concurrency low.

Watch out for

Every target must run the AWS agent as an inline proxy, it can only be enabled at target group creation, and traffic generates more LCU usage than regular target groups.

AWS sources: 1 2 3

2025-11-19 · Not stated

Interface endpoints can reach select AWS services in other Regions of the same partition, removing cross-Region peering for that access; check PrivateLink pricing and supported services first.

Bring it up when

Client needs private access from a VPC to AWS services such as S3 or ECR in another Region, and uses cross-Region peering or public endpoints today.

Replaces

Cross-Region peering or public internet paths used only to reach those AWS services in another Region.

Watch out for

Only listed services work, inter-Region transfer is charged on top of endpoint fees, and PrivateLink does not manage failover across Regions.

AWS sources: 1 2 3

2025-11-19 · All Regions where AWS Secrets Manager is available

Secrets for onboarded SaaS partners can rotate without you building rotation Lambdas, though rotation strategy options depend on what each provider supports.

Bring it up when

Client maintains its own rotation Lambdas for SaaS credentials such as Salesforce, Snowflake or Datadog API keys.

Replaces

Custom rotation Lambda functions for secrets held by onboarded SaaS partners.

Watch out for

Onboarded partners only, with no secrets under four hours or PKI certificates. Rotating directly in the SaaS can break sync until the value is corrected and RotateSecret is called.

AWS sources: 1 2 3

2025-11-10 · All commercial, AWS GovCloud (US), and China Regions

You can stand up ML-DSA CAs and test issuance, revocation, and code signing now, letting you find what breaks in your PKI before RSA and ECDSA are phased out.

Bring it up when

Client runs its own PKI for code signing, devices or mTLS and has a post-quantum mandate, or wants to find what breaks before RSA and ECDSA are phased out.

Replaces

Nothing direct: new capability.

Watch out for

ACM accepts RSA and ECDSA keys only, and ALB and NLB listeners accept RSA and ECDSA certificates only, so ML-DSA certificates cannot sit on those listeners.

AWS sources: 1 2 3