AWS Weekly Roundup: Bedrock Agent Enhancements, SageMaker Private Connectivity, and More

This week's AWS roundup arrives as we approach the Lunar New Year, a time traditionally associated with reflection and preparation for new beginnings. The timing feels particularly apt given the wave of new capabilities AWS has introduced, each designed to help developers build more secure, efficient, and resilient cloud architectures.

Amazon Bedrock Elevates AI Agent Workflows

Amazon Bedrock has taken significant steps forward in agent development with two key enhancements that address common pain points in building AI-powered applications.

Server-Side Tool Integration

The Responses API now supports server-side tool use, allowing agents to perform actions like web search, code execution, and database updates while remaining within AWS security boundaries. This is a crucial improvement for enterprise deployments where data sovereignty and compliance requirements often prevent agents from accessing external services.

What makes this particularly powerful is the integration with OpenAI's GPT OSS models (20B and 120B variants). Organizations can now build sophisticated AI agents that leverage their existing AWS infrastructure without compromising security posture. The server-side approach means sensitive data never leaves the AWS environment, addressing one of the primary concerns enterprises have about AI adoption.

Extended Prompt Caching

Bedrock's new 1-hour time-to-live (TTL) option for prompt caching represents a significant advancement for long-running, multi-turn agent workflows. Previously, developers had to balance between caching duration and cost, often leading to suboptimal performance or unnecessary expenses.

The extended TTL is particularly valuable for complex agent interactions that span multiple sessions or require maintaining context over extended periods. For use cases like customer service bots, code assistants, or data analysis workflows, this means smoother experiences and reduced latency without the overhead of reprocessing prompts.

SageMaker Unified Studio Gets Private Connectivity

Data security took another leap forward with Amazon SageMaker Unified Studio's integration with AWS PrivateLink. This feature enables private connectivity between your VPC and SageMaker Unified Studio without routing customer data over the public internet.

For organizations operating under strict compliance requirements—whether HIPAA, PCI DSS, or internal security policies—this capability is transformative. Data traffic remains entirely within the AWS network and is governed by IAM policies, eliminating the attack surface that public endpoints introduce.

The implementation is straightforward: once SageMaker service endpoints are onboarded into a VPC, all communication flows through private connections. This not only enhances security but can also improve performance by reducing network hops and potential bottlenecks associated with internet routing.

S3 Encryption Without Data Movement

Perhaps the most technically impressive update this week is Amazon S3's ability to change server-side encryption types without moving or re-uploading data. Using the new UpdateObjectEncryption API, organizations can now:

• Switch from SSE-S3 to SSE-KMS
• Rotate customer-managed AWS KMS keys
• Standardize encryption across buckets at scale using S3 Batch Operations

The implications are substantial. Previously, changing encryption methods required downloading, re-encrypting, and re-uploading objects—a process that could take days or weeks for large datasets and incurred significant egress costs. Now, the same operation happens server-side in minutes, preserving object properties and lifecycle eligibility throughout the process.

This capability is particularly valuable for organizations undergoing encryption standardization initiatives or responding to new compliance requirements. The ability to rotate KMS keys without data movement also significantly reduces the operational overhead of key management.

Amazon Keyspaces Pre-Warming for Predictable Performance

Amazon Keyspaces (for Apache Cassandra) now supports table pre-warming, addressing one of the most common challenges in NoSQL database management: handling sudden traffic spikes without throttling.

Pre-warming allows you to proactively set warm throughput levels so tables can handle high read and write traffic instantly, eliminating cold-start delays. This is invaluable for scenarios like product launches, flash sales, or seasonal traffic patterns where performance predictability is critical.

The feature works across both on-demand and provisioned capacity modes, including multi-Region tables. For e-commerce platforms, media streaming services, or any application with bursty traffic patterns, pre-warming provides the confidence that infrastructure will perform when it matters most.

DynamoDB MRSC Meets Fault Injection Service

Amazon DynamoDB's multi-Region strong consistency (MRSC) global tables now integrate with AWS Fault Injection Service, enabling teams to test and validate application resiliency under Regional failure conditions.

This integration allows you to simulate Regional failures, test replication behavior, and validate application resiliency for strongly consistent, multi-Region workloads. In an era where downtime can cost millions and damage customer trust, the ability to proactively test failure scenarios is invaluable.

The combination of MRSC's strong consistency guarantees with controlled chaos engineering represents a mature approach to building truly resilient distributed systems. Teams can now move beyond theoretical disaster recovery plans to actual, tested procedures that work under real-world conditions.

Additional Notable Updates

EventBridge Payload Expansion

Amazon EventBridge now supports event payloads up to 1 MB, up from the previous 256 KB limit. This expansion enables event-driven architectures to carry richer context in single events, including complex JSON structures, telemetry data, and ML or generative AI outputs.

The increased payload size eliminates the need to split payloads or rely on external storage for event enrichment, simplifying architecture and reducing latency in event processing pipelines.

Lambda Enhanced Kafka Observability

AWS Lambda introduced enhanced observability for Kafka event source mappings, providing CloudWatch Logs and metrics to monitor event polling configuration, scaling behavior, and event processing state. This improvement helps teams diagnose configuration issues, permission errors, and function failures more efficiently.

The enhanced visibility is particularly valuable for organizations running complex event-driven architectures with Kafka as a backbone, enabling faster troubleshooting and more reliable operations.

AWS MCP Server Deployment SOPs

The AWS MCP Server now includes deployment standard operating procedures (SOPs) that AI agents can use to deploy web applications to AWS from natural language prompts in MCP-compatible IDEs and CLIs like Kiro, Cursor, and Claude Code.

These agents generate AWS CDK infrastructure, deploy CloudFormation stacks, and set up CI/CD workflows following AWS best practices. The preview supports frameworks including React, Vue.js, Angular, and Next.js, potentially accelerating development workflows while ensuring infrastructure follows established patterns.

Looking Ahead

As we enter the season of new beginnings marked by Lichun, these AWS updates collectively point toward a future where cloud infrastructure becomes more secure, performant, and developer-friendly. The emphasis on private connectivity, enhanced security controls, and improved observability reflects the maturing needs of enterprise cloud adoption.

The ability to change S3 encryption without data movement, pre-warm Keyspaces for predictable performance, and test DynamoDB resilience through fault injection represents AWS's continued focus on solving real-world operational challenges.

For developers and architects, these updates provide new tools to build more secure, efficient, and resilient applications. Whether you're building AI agents with Bedrock, managing sensitive data in SageMaker, or architecting multi-Region DynamoDB deployments, this week's releases offer concrete improvements to your toolkit.

Next week brings the first of the 24 solar terms, marking the official beginning of spring. In Chinese tradition, this is when growth begins and new cycles take shape—a fitting metaphor for the continuous evolution of cloud capabilities that AWS delivers to its global community of builders.