AWS Partner Network (APN) Blog

Building intelligent data foundations: The Grubhub and Vody partnership on AWS

Nneoma Okoroafor — Mon, 17 Aug 2026 19:16:16 +0000

By: Dr. Yubin Kim, Chief Scientist – Vody
By: Nneoma Okoroafor, Partner Solutions Architect – AWS
By: Swagat Kulkarni, Sr. Solutions Architect – AWS
By: Siraj Gadne, Sr. Mgr, CSM, US SWIM – AWS

Vody

This post was co-written with Grubhub and Vody, an AWS Partner, for data engineers, ML platform teams, and retail technology leaders. Familiarity with Amazon EKS, Amazon Bedrock, and data pipeline concepts is helpful but not required.

Retailers are racing to adopt AI, but the companies that pull ahead won’t win because they shipped a single breakthrough feature. They’ll win because they invested early in the data foundations that can make AI initiatives faster, smarter, and more effective. At Amazon Web Services (AWS), we see this pattern across the most innovative customers: the shift from fragmented data projects to unified, intelligent data layers built on top of cloud-centered infrastructure.

Grubhub and Vody are taking that shift directly. Together, they’re modernizing the core building blocks of catalog, content, and behavioral data using AWS services and building the durable foundation required for the next era of AI-powered commerce. The early results are promising:

More than 400 thousand merchants and tens of millions of menu items cataloged and updated regularly; ensuring fresh, structured data flows reliably into downstream systems
Delivered results from initial model deployment in only 6-10 weeks, proving that major retailers can move quickly when the foundation is right
Improved search recall, with initial tests showing improved relevance of candidates retrieved
Higher conversion and click-through rates for dietary-intent searches, showing how enriched data directly improves customer experience

What’s emerging isn’t just better search and recommendations. It’s a future where structured, AI-ready data enables personalization that feels intuitive, discovery that understands intent, and merchandising that keeps pace with fast-moving cultural and consumer trends. Grubhub and Vody’s work on AWS is a blueprint for retailers preparing for what comes next: a world where the companies with the strongest data foundations will lead every wave of AI innovation.

Why the data foundation matters now

Three forces are rewriting how retailers think about data:

Generative AI everywhere: Large language models (LLMs) can analyze, recommend, and create, but they perform best when sitting on top of structured, consistent, buyer-relevant data. AI can’t invent signals retailers never stored. AWS customers across commerce, marketplaces, and delivery are recognizing this opportunity and investing in their data foundations.

Demand signals live outside the organization: Trends start on TikTok, Instagram, and community spaces long before they show up in dashboards. Modern catalog enrichment workflows need to operate at this velocity-updating in hours, not quarters, and syncing internal datasets with emerging external demand.

The opportunity for unified data: When search teams, merchandising, CRM, and marketing build on a shared source of truth, experimentation accelerates and AI projects scale more effectively across functions. Retailers are moving toward unified data platforms that all systems and teams can build on.

Establishing the foundation: Clean, structured, buyer-relevant data

Grubhub, with more than 400,000 merchants and tens of millions of menu items, recognized the opportunity to build a data layer that could support AI workloads at scale. Built on AWS, Vody transforms massive volumes of unstructured merchant content into clean, structured, AI-ready data.

Figure 1: Vody AWS architecture

The architecture, shown in Figure 1, implements network segmentation with public and private subnets. Customer traffic enters through an application load balancer, while outbound connectivity from the Amazon Elastic Kubernetes Service (Amazon EKS) cluster (such as calls to Amazon Bedrock) routes through a NAT gateway, maintaining security isolation for compute resources.

The platform uses Amazon EKS for container orchestration and integrates with Amazon Bedrock for generative AI capabilities. Amazon Relational Database Service (Amazon RDS) provides relational data storage, while Amazon ElastiCache serves dual purposes: as a queuing backend for background job processing and as a caching layer for API endpoints, optimizing overall system performance. AWS IAM Identity Center provides secure access management across the platform.

Using the diverse model portfolio provided by Amazon Bedrock (Claude, Nova, and Llama families), Vody generates customer-aligned search queries that enrich even low-data SKUs, ensuring consistent discoverability across the entire catalog.

The Vody platform operates as a software as a service (SaaS) solution hosted by Vody, providing merchants with a fully managed catalog enrichment service. With this managed approach, retailers can benefit from continuous AI improvements and scale without infrastructure overhead.

The platform delivers:

Normalized, enriched product and item attributes aligned to real-world buyer behavior
Labels that reflect how people discover restaurants and food
Structured metadata that feeds both traditional ranking systems and modern generative models
Frequent updates as restaurants, menus, and items change

This work represents the first key milestone toward establishing a future-looking data foundation at Grubhub and delivers measurable value from day one: better search recall, higher search conversion, and more intuitive product discovery-all without replacing existing search engines.

“Developing this in-house may have shifted focus away from our core product. After evaluating the resources required, we decided a third-party solution was the more efficient path”
– Jayesh Kataria, Sr. Director of Engineering, Grubhub

Results: Measurable impact across the business

The AWS-powered Vody platform now processes merchant data at impressive scale:

Daily processing: Over 500,000 items enriched daily
Weekly throughput: 2-5 million items processed

Business impact and ROI

The 12-week deployment to full production demonstrates that major retailers can move quickly when building on the right foundation. Key business outcomes include:

Enhanced search recall: More candidate merchants retrieved and more results matching actual customer intent during preliminary analyses
Higher conversion rates: Particularly for dietary and food characteristic searches
Faster time-to-market: Teams can now ship campaigns, taxonomies, and product updates in days instead of weeks
Optimized resource allocation: Strategic investment in data infrastructure versus building custom solutions

“We’re running enrichment across millions of items in our catalog across multiple facets, effectively reshaping and simplifying how our search and discovery systems operate”
– Jayesh Kataria, Sr. Director of Engineering, Grubhub

Towards an intelligent data platform on AWS

Consistent, structured product data is just the beginning. Vody envisions a roadmap toward what we call an intelligent data platform (IDP): a cloud-centered, AI-ready layer that unifies signals and supports every downstream experience.

An IDP on AWS brings three capabilities together:

Unified signals: Catalog, clickstream, availability, and fulfillment data live alongside external trends, search behavior, and micro-signals from social platforms. AWS services such as Amazon Simple Storage Service (Amazon S3), AWS Glue, Amazon OpenSearch Service, and Amazon Redshift make this unification possible at scale.
Adaptive metadata: As buyer language shifts, attributes evolve without breaking pipelines. Merchants and brands can introduce new concepts-aesthetics, dietary signals, styles, emerging themes-as needed.
Shared context and memory: Every A/B test, campaign, and model output feeds back into a shared knowledge layer. Teams stop re-creating their own one-off datasets and instead build on a common foundation. This is how retailers move from large amounts of unstructured data to a true AI data strategy.

After an IDP is in place, the business impact compounds:

Better search and discovery: Search engines unlock new relevance opportunities. Queries map to buyer intent, not just keywords.
Personalization that feels human: LLMs and ranking models operate on rich contextual signals rather than sparse metadata.
Faster experimentation: Teams ship campaigns, taxonomies, and product updates in days instead of weeks.
New AI surfaces: A structured foundation on AWS unlocks next-generation acquisition and engagement channels-from Generative Engine Optimization (GEO) to conversational shopping to agent-driven merchandising.

Retailers choose AWS for this work because AWS services provide:

Scalability: Ingestion of millions of SKUs, items, documents, and user behaviors
Security and governance: Essential for enterprise-grade catalog and customer data
AI/ML integration: Seamless use of Amazon Bedrock, Amazon SageMaker, and OpenSearch for retrieval and inference

Grubhub’s deployment demonstrates how quickly retailers can reach scale. Within 6-10 weeks, the joint AWS-Vody solution enriched millions of items, and pushed cleaner structured data into downstream systems while keeping merchant updates current, creating enormous potential to lift search performance.

The evolution of this work

Building an intelligent data foundation isn’t a one-time effort, it’s an iterative process. With the foundation in place, the team focused on scaling, speed, and operational efficiency. Three areas stood out:

Scaling across merchant diversity: The team built modular extraction pipelines that could adapt to merchant variability without retraining entire models, enabling consistent attribute structure across hundreds of thousands of merchants.
Rapid integration impact: Enriched attributes began influencing downstream relevance signals quickly once integrated. Improvements were measurable without requiring changes to the core ranking infrastructure.
Continuous optimization: Early alignment on evaluation metrics and performance dashboards streamlined cross-team visibility and reduced iteration cycles during rollout.

Looking ahead: The shift to intelligent retail

Many retailers are somewhere on the journey from fragmented data to intelligent data foundations. Grubhub’s work with Vody on AWS shows what the next stage looks like: a flexible, adaptive data layer that keeps pace with consumers, channels, and AI systems.

The message is clear: The future of retail belongs to companies that invest in their data foundation today. After the structure is in place, new AI initiatives can be implemented faster, with less effort, and be more valuable.

AWS is committed to helping retailers make that move and to supporting partners like Vody, who are building the connections that enable the AI future of commerce.

Conclusion

The Grubhub-Vody partnership demonstrates that AI-ready data foundations deliver real outcomes fast: tens of millions of entities enriched monthly, all within 6-10 weeks on AWS-accomplished by investing in a unified data infrastructure at the start. AI initiatives that follow can be faster and more effective.

Ready to build your intelligent data foundation?

Vody – AWS Partner Spotlight

Vody is an AWS Advanced Technology Partner that transforms messy, static product catalogs into enriched, continuously updated data feeds optimized for downstream AI performance, including on-site search, generative engine optimization, advertising, and emerging agentic shopping assistants.

Contact Vody | Partner Overview | AWS Marketplace

Securing the AI development lifecycle with Aikido and Kiro

Len Gomes — Thu, 13 Aug 2026 20:32:30 +0000

By: Len Gomes, Partner Solutions Architect – AWS
By: Akram Al Sheikh, Security Partner Solutions Architect – AWS
By: Alex Llobet, Global Cloud Alliances Lead – Aikido
By: Johan de Keulenaer, Head of Partnerships – Aikido

Aikido

Aikido Security and Kiro help development teams secure the AI development lifecycle and ship AI-generated code with confidence. Kiro is an AI-powered development environment from Amazon Web Services (AWS) that helps developers build and ship production-ready applications through spec-driven development. As AI agents take on more of the development workflow, from code to infrastructure to API integrations, organizations benefit from continuous security scanning that runs alongside every change. Aikido Security strengthens this workflow and now also through Kiro Powers with automated vulnerability detection, secrets scanning, and infrastructure as code (IaC) checks that run continuously as code is written keeping security in step with development velocity.

Aikido Security is a developer-first cybersecurity company trusted by more than 50,000 organizations. Aikido’s AI-first platform secures applications from code to cloud to runtime, replacing the fragmented tooling that creates alert fatigue and slows development teams.. Built to integrate where developers already work, Aikido operates inside integrated development environments (IDEs), continuous integration and continuous delivery (CI/CD) pipelines, and AI development environments.

In this post, we explain what Kiro powers are, how the Aikido power works, and how organizations can secure AI-generated code from day one.

The opportunity: Security that matches the speed of AI development

Development teams using AI assistants report five- to sevenfold productivity gains as AI agents handle code generation, infrastructure provisioning, and documentation. This acceleration creates an opportunity to rethink how security fits into the development lifecycle.

Rather than relying on security review as a final gate before deployment, organizations now embed security directly into the development workflow. Continuous scanning that runs alongside AI agents gives teams immediate visibility into vulnerabilities, exposed secrets, and infrastructure misconfigurations as code is written, not after it ships.

This shift from end-of-pipeline review to continuous, in-workflow security delivers measurable benefits: faster release cycles, fewer post-deployment remediations, and consistent security standards across every change an AI agent produces.

What are Kiro powers?

Kiro powers are specialized bundles that add expert-level context and tools to Kiro AI agents on demand. Rather than loading all tools at the same time (which overloads the context window), powers activate dynamically based on the task at hand. For example, the Aikido power activates when your conversation involves security-related topics such as scanning, vulnerabilities, or secrets detection. Each power packages three components working together:

Model Context Protocol (MCP) server – Provides direct connectivity between the Kiro agent and external tools or services.
Steering file (POWER.md) – Contains domain-specific best practices curated by technology experts.
Optional hooks – Automatically verify code against best practices, providing immediate feedback.

This modular design means Kiro can access dozens of technologies without overwhelming the agent context. Only the relevant power loads when needed. AWS and partner teams have published powers across a growing range of domains and technologies, each bringing production-grade best practices directly into the development workflow. Browse the full catalog at Kiro powers.

Introducing the Aikido Kiro power

Aikido Security has built a Kiro power that creates a continuous security loop inside the development workflow. Every agent-generated code change is automatically analyzed for vulnerabilities, exposed secrets, and infrastructure misconfigurations, and Kiro’s agents act on Aikido’s findings to fix issues before they ship.

The Aikido Kiro power provides three categories of scanning:

Static Application Security Testing (SAST) – Detects common vulnerability patterns such as SQL injection, path traversal, and cross-site scripting.
Secrets detection – Identifies exposed API keys, tokens, and hardcoded credentials.
IaC scanning – Finds misconfigurations in Terraform, AWS CloudFormation, and similar configuration files before they reach production.

When the power detects security issues, it explains each finding clearly (including title, severity, file location, and line numbers) and Aikido’s remediation engine guides the applied fixes. After applying fixes, the power rescans automatically to verify resolution, creating a self-correcting loop that operates without developer intervention.

How the hook configuration works

The key mechanism that provides continuous security is the Aikido hook. After it’s installed, a hook named “Aikido Scan on Write” triggers automatically after a file is written or modified by the Kiro agent. The hook activates the Aikido power and runs a full scan on all files created or modified in the current session.

The scan-fix-verify cycle works as follows:

The Kiro agent writes or modifies code files.
The hook triggers automatically and collects all affected file paths.
Aikido runs SAST, secrets, and IaC scanning across those files.
If issues are found, the agent explains each finding and applies fixes guided by Aikido’s remediation.
The power rescans to verify fixes and resolve the issues without introducing new ones.

This approach means security validation runs in parallel with development, not after it. Developers avoid context switching since the Aikido Power handles security in the background. The following screenshot shows this scan-fix-verify cycle.

Figure 1: The Aikido Scan on Write hook configuration in the Kiro IDE

Business scenarios

The Aikido Kiro power addresses security challenges across different organizational contexts:

High-growth startup shipping to production – A startup using Kiro to accelerate its first product generates IaC through AI agents. The Aikido power gives teams early visibility into misconfigured AWS Identity and Access Management (IAM) policies and storage bucket permissions, enabling remediation during development rather than post-deployment.
ISV managing developer scale – An independent software vendor (ISV) with a distributed engineering team needs consistent security standards across AI-assisted development without adding headcount to a security team. The Aikido power runs on every agent-generated change, enforcing security baselines uniformly without slowing release velocity.
Enterprise meeting compliance requirements – An enterprise in a regulated industry needs to demonstrate that AI-generated code meets security and compliance standards for audits. Aikido captures evidence continuously throughout the development lifecycle, replacing manual evidence-gathering with automated reporting across SOC 2, ISO 27001, Health Insurance Portability and Accountability Act (HIPAA), NIS2, DORA, and Payment Card Industry Data Security Standard (PCI DSS). Learn more about automated compliance checks in Aikido’s plataform.

Measured results

Production deployments of Aikido demonstrate measurable impact:

90% reduction in false-positive security alerts through reachability analysis and auto-triaging, so only exploitable risks surface
Security fixes in under 30 seconds through AutoFix, which proposes and implements remediation automatically
Developer onboarding in under 5 minutes with Aikido’s developer-native integrations (IDE, CI/CD, and issue management)
Compliance coverage across SOC 2, ISO 27001, PCI DSS, DORA, NIS2, and HIPAA through automated evidence collection

Getting started with the Aikido Kiro power

Installing the Aikido Kiro power takes one click:

Open the powers panel in the Kiro IDE or visit Kiro powers.
Search for “Aikido Security” and choose Install.
Configure your Aikido API key. You can find it by visiting Aikido and then choosing Settings, Integrations, and IDE Plugins.
The power activates on demand, and the hook begins scanning automatically after every code change.

The following screenshot shows the powers panel in the Kiro IDE.

Figure 2: Installing the Aikido power from the Kiro IDE powers panel

After the Aikido Kiro power is installed, developers can also explicitly prompt Kiro to scan files (for example, “Scan my changed files for security vulnerabilities”) for on-demand assessment at any point during development. The following are some suggested prompts to use with the Aikido power.

Good for getting a baseline security posture on your whole project in one shot:

“Scan all Python files in the backend/ directory for security vulnerabilities and hardcoded secrets. Fix any issues you find and verify the fixes are clean.”

Good for a quick gate before pushing code to catch things that slipped through during development:

“Scan my staged git changes for security issues: secrets, SQL injection, path traversal, or any IaC misconfigurations. Summarize what you find with severity levels.”

Good for learning from the findings, not merely patching them blindly. This one is great for when you want to educate the team or write up security notes:

“List all open Aikido security issues for this repo, then fix the high-severity ones. For each fix, explain what the vulnerability was and why the fix resolves it.”

Source code and documentation: github.com/AikidoSec/aikido-kiro-power. Learn more about the integration at integrations.aikido.dev/integrations/kiro.

Video 1: Aikido Kiro power in action

Conclusion

AI-driven development is the new baseline for how fast-moving organizations build software. The Aikido Kiro power brings automated scanning directly into the agentic development workflow, helping teams ship securely at the pace AI development allows. Security runs continuously, findings surface in context, and fixes apply automatically, so teams ship with confidence at the pace AI enables.

Explore Aikido Security in AWS Marketplace. Activate the Aikido power in Kiro at Kiro powers. Learn more about Aikido’s compliance certifications at Aikido’s Trust Center.

Aikido Security – AWS Partner Spotlight

Aikido Security is a cybersecurity company that secures everything developers build, ship, and run. Its software security platform protects code, cloud infrastructure, devices, and runtime environments, providing real-time visibility and automatically identifying and remediating vulnerabilities. Trusted by more than 50,000 organizations, Aikido is purpose-built to integrate where developers already work: inside IDEs, CI/CD pipelines, and AI development environments. Founded in 2022, Aikido Security has grown to 300 employees, reached unicorn status faster than any other European cybersecurity company, and was among one of the first AWS Security ISVs in EMEA selected for the Kiro pilot program.

Contact Aikido | Partner Overview | AWS Marketplace

Enhance DNS protection with Palo Alto Networks on Amazon Route 53 DNS Firewall

Rizwan Mushtaq — Fri, 07 Aug 2026 21:40:00 +0000

By: Anthony Smith, Sr. Security Partner Solutions Architect – AWS
By: Rizwan Mushtaq, Principal Solutions Architect – AWS
By: Ashmeet Singh, Sr. Customer Solutions Manager – AWS
By: Adhish Bhobe, Principal Product Manager – AWS
By: Arun Kumar, Director of Product Management, CDSS – Palo Alto Networks

Palo Alto Networks

Amazon Route 53 Resolver DNS Firewall now integrates Palo Alto Networks Advanced DNS Security to protect your DNS infrastructure. Because DNS queries are fundamental to how applications communicate, protecting them at the resolver gives security teams a powerful, centralized control point for safeguarding cloud traffic. This integration delivers comprehensive DNS threat protection that is effective and operationally straightforward to deploy across your cloud environments.

Palo Alto Networks, an AWS Partner Network (APN) partner, detects DNS-based threats such as command and control and fast flux. Palo Alto Networks Advanced DNS Security integrates with Amazon Route 53 Resolver DNS Firewall, delivering these threat-intelligence categories as DNS Firewall rules so you can enforce them with the availability and low latency of Amazon Web Services (AWS). By integrating Palo Alto Networks Advanced DNS Security with Route 53 Resolver DNS Firewall, security administrators can enforce trusted DNS threat protections across their Amazon Virtual Private Cloud (Amazon VPC) resources without deploying or managing additional infrastructure.

This post explores how the integration works, the threat coverage it adds on top of built-in DNS Firewall protections, and how security teams can extend that coverage across accounts, virtual private clouds (VPCs), and hybrid environments. Whether you’re securing a multi-account cloud environment or extending protections to hybrid-cloud traffic, this integration helps security teams deploy comprehensive DNS threat coverage faster and at scale.

Solution overview

Palo Alto Networks Advanced DNS Security is available directly from the Route 53 DNS Firewall console under the Advanced rule tier, with usage-based pricing and activation completing within 2 minutes—requiring no additional infrastructure. The integration operates through DNS Firewall rule groups, which are containers of one or more rules that can be associated with multiple VPCs and shared across accounts.

Each rule within a group specifies a security category, query type, and enforcement action, either BLOCK to deny resolution or ALERT to log without blocking. Rules are evaluated by configurable priority ordering within a group, giving administrators fine-grained control over how different threat types are handled.

A single rule group can protect any number of VPCs, and multi-account environments benefit from three sharing mechanisms: AWS Resource Access Manager (AWS RAM) for specific accounts or organizational units, Amazon Route 53 Profiles for consistent DNS configurations, and AWS Firewall Manager for centralized policy enforcement. AWS License Manager distributes subscriptions in bulk to an entire organization, specific organizational units (OUs), or individual accounts, with automatic licensing for newly added accounts.

How Palo Alto Networks Advanced DNS Security works with Amazon Route 53 DNS Firewall

By integrating Palo Alto Networks Advanced DNS Security with Route 53 DNS Firewall, organizations can enforce DNS threat protections across multiple traffic paths. As shown in the following demo, DNS Firewall rules with Palo Alto Networks security categories govern DNS query traffic from:

Amazon VPC traffic — Protecting workloads within your cloud environment
Hybrid-cloud traffic — Forwarded through Route 53 Resolver endpoints

The integration delivers more than 30 DNS threat detections from Palo Alto Networks—including fast flux protection, DNS hijacking protection, DNS rebinding protection, domain generation algorithm (DGA) detection, and newly registered domain identification—across the following use cases.

Cloud infrastructure DNS protection

Enforce Palo Alto Networks’ DNS threat protections directly on VPCs through DNS Firewall rules, with no need to deploy separate firewalls across multiple VPCs or AWS accounts. This removes the operational overhead of per-VPC firewall configurations while keeping coverage consistent. You can subscribe one time and share that subscription across multiple accounts or your entire organization using AWS License Manager.

Hybrid-cloud security operations

For on-premises or remote environments, DNS query traffic can be forwarded using Route 53 inbound endpoints, giving security operations center (SOC) teams unified DNS filtering and centralized logging across both AWS and hybrid traffic.

Centralized observability

Gain centralized observability across VPC and hybrid environments through log delivery via Amazon S3, Amazon Data Firehose, or Amazon CloudWatch Log Groups. Combined with AWS Security Hub, teams receive consolidated alerts and findings for faster detection and response.

Compliance and threat intelligence

Palo Alto Networks automatically updates its security categories and detection models, propagating changes to DNS Firewall with no customer intervention, keeping the latest threat intelligence applied to your DNS queries and streamlining compliance reporting.

Taken together, these use cases converge on a single enforcement point for DNS threat protection. The following demo illustrates how this comes together end to end, with visibility and control centralized through Amazon CloudWatch and AWS Security Hub.

Figure 1: How DNS query traffic from VPCs and hybrid environments is enforced through DNS Firewall rules with Palo Alto Networks threat intelligence

Monitoring and insights

After the solution is deployed, monitor your DNS security posture through:

AWS Security Hub — Security findings for blocked and alerted queries
Amazon Route 53 Resolver query logs — Viewable and storable using S3 buckets, Amazon Data Firehose, or CloudWatch log groups

Cleanup and cost considerations

This solution incurs costs for the AWS and Palo Alto Networks services involved, priced as part of the existing DNS Firewall Advanced tier. You pay an hourly rate for each rule group containing one or more Palo Alto Networks rules associated with a VPC. During preview, the Palo Alto Networks subscription in AWS Marketplace is free and not charged; only DNS Firewall Advanced charges apply.

To avoid unnecessary charges:

Disassociate rule groups from VPCs and delete DNS Firewall rules containing Palo Alto Networks security categories. Charges continue until all Palo Alto Networks rules are removed, so clean up before or after unsubscribing.
Remove any license distributions configured through AWS License Manager.

Conclusion

Integrating Palo Alto Networks Advanced DNS Security with Amazon Route 53 Resolver DNS Firewall delivers comprehensive DNS threat protection without operational complexity. You’ll get streamlined deployment from the DNS Firewall console, automated threat-intelligence updates, and centralized multi-account management along with the performance you expect from Amazon Route 53 Resolver DNS Firewall, augmented with the latest threat intelligence from Palo Alto Networks.

To get started with Palo Alto Networks Advanced DNS Security, subscribe on the DNS Firewall console or in AWS Marketplace. For a step-by-step guide, visit Subscribe to Palo Alto Networks Advanced DNS Security. Use Palo Alto Networks’ documentation and the Amazon Route 53 Developer Guide to accelerate your deployment.

Palo Alto Networks – AWS Partner Spotlight

Palo Alto Networks is an AWS Security Competency Partner that helps organizations strengthen their security posture across cloud and hybrid environments—protecting against advanced threats, securing network infrastructure, and maintaining compliance to stay ahead of evolving adversaries.

Contact Palo Alto Networks | Partner Overview | AWS Marketplace

How ASCENDING’s Jarvis Registry bridges agents and developer tools

Lu Zou — Thu, 06 Aug 2026 21:21:06 +0000

By: Ryo Hang, Technical Cofounder – ASCENDING
By: Celeste Shao, AI Specialist – ASCENDING
By: Jason Zhang, CTO – Vegogarden
By: Lu Zou, Sr. Partner Solution Architect – AWS

Ascending

Your agents are deployed on Amazon Bedrock AgentCore. Now, people across your teams are wondering if they can use it with their preferred developer tool, whether that’s Claude Desktop, Visual Studio Code (VS Code), Cursor, or GitHub Copilot. That’s where the complexity starts, and you hit the last mile: making your agents reachable from an integrated development environment (IDE) safely, with the right identity, authorization, and discovery controls. This is the experience layer: the authentication, authorization, discovery, and developer UX infrastructure that sits between your deployed agents and the tools people actually work in.

In this post, we walk through the experience layer challenge, show the architecture you’d need to build yourself, and introduce an open source solution that handles it for you.

The experience layer for usability

The gap between “deployed” and “usable” comes down to a recurring set of integration problems:

Identity – The agent and downstream tools need to trust who the caller is without prompting again, which means integrating with the organization’s identity provider (IdP).
Authorization – After identity is established, the platform has to decide which agents, tools, and data each user can reach, often with policies that vary by team or environment.
Token management – Every downstream tool brings its own OAuth lifecycle: token exchange, refresh, and re-auth when an agent calls Jira, GitHub, or internal APIs.
Interactive re-auth. Tools sometimes need to pause mid-call to ask for input or fresh credentials, then resume cleanly inside the copilot.
Discovery – The right agents and tools need to surface at the right moment, filtered by context, rather than overwhelming the client with the full catalog.

This gets especially complex when you multiply it by every IDE the business cares about and every agent your team ships. The experience layer quickly becomes a larger investment than the agents themselves.

The components of an experience layer

The following are the components of the experience layer:

A protocol gateway – Supports Model Context Protocol (MCP) MCP and Agent2Agent (A2A) to clients on one side and translates to Amazon Bedrock AgentCore Runtime, Amazon Bedrock AgentCore Gateway, and downstream tools on the other. You’ll handle multiple MCP transports, such as stdio, streamable HTTP, or server-sent events (SSE), and A2A variants such as JSON-RPC, gRPC, or HTTP+JSON). Streaming introduces the most complexity: interleaved progress events, sessions resumed mid-call, and a spec that keeps moving.
A registry with resource discovery – A catalog of which agents and tools exist, who owns them, and who can reach them. Beyond cataloging, it provides the ability to surface the right things to the right user at the right moment, filtered by identity, role, and conversation context. Without this, every client is configured by hand, and every governance question becomes a manual audit.
An identity service – Integrates with your IdP (such as Okta, Microsoft Entra, Amazon Cognito, or Auth0) and issues tokens that Amazon Bedrock AgentCore Runtime trusts as a custom JSON Web Token (JWT) authorizer: asymmetric keys, a /.well-known/jwks.json endpoint, and a key rotation story that doesn’t require redeploying agents.
The OAuth lifecycle, end to end – Every downstream tool has its own OAuth requirements: token exchange, refresh, scope changes, and secure storage. When a tool returns 401 mid-call, the gateway has to detect it, kick off the right flow through MCP elicitation (where the client supports it), and deep-link the user back to their actual VS Code window or Claude Desktop session, not a generic browser tab. Done right, re-auth feels instant. Done wrong, the user hunts for their IDE every time.
End-to-end observability – A single audit trail joining the gateway, the agent runtime, and downstream tools: “user X called tool Y through agent Z and got result W.”

The following diagram shows the components and interconnections for a self-built experience layer.

Figure 1: Experience layer components

All of these are solvable individually but maintaining them together is a sustained engineering investment that grows with every new agent and copilot you add.

What ASCENDING built after the fifth time

ASCENDING is an AWS Partner that has spent nearly a decade helping customers build on AWS. Over the last 2 years, that work has focused on AI and automation: assistants, Retrieval Augmented Generation (RAG) systems, and autonomous agents deployed on Amazon Bedrock AgentCore.

After their fifth AgentCore integration, the ASCENDING team recognized a pattern: every customer needed the same experience layer, and every customer was building it from scratch. The work was similar enough to be recognizable each time, but different enough that no previous solution was directly reusable.

For Amazon Bedrock AgentCore, ASCENDING built an open source experience layer, the Jarvis Registry, which includes a protocol gateway, registry, resource discovery, identity service, OAuth orchestrator, in-session auth UX, deep-link return paths, and end-to-end observability. It’s packaged as a self-contained platform that runs inside the customer’s AWS environment and integrates with AgentCore Runtime as a first-class identity and routing target. With Jarvis Registry, customers can focus on building agents without worrying about the integration infrastructure needed to make them accessible from every IDE.

The following graphic shows the Amazon Bedrock AgentCore and Jarvis interaction layer.

Figure 2: Jarvis Registry interaction layer

What it looks like for users

Here’s what that looks like in practice. Vegogarden is a customer running two very different workloads on Amazon Bedrock AgentCore. The first is a distributed fleet of customer-support agents that look up product information and place orders on behalf of customers. The second is a cluster of data-analytics MCP servers that expose detailed sales, inventory, and operations data to internal users. Both workloads needed an experience layer, and the agents and MCP servers needed to be reachable from the tools their users actually used.With Jarvis sitting between the copilots and AgentCore, the same agents and MCP servers now serve two distinct workflows.

Business users in Claude Desktop. A regional manager asks the analytics agent to render a bar chart of last quarter’s revenue, broken down by region. Support specialists ask the support agent to summarize closed tickets for a given week, suggest responses for the email they’re writing, or surface similar past cases from the company’s historical database. No dashboards, no copy-pasting, no engineering tickets to “give me access.”

Engineers in VS Code. When something doesn’t work correctly, the on-call engineer calls the same agent from VS Code. Jarvis’s audit trail shows exactly which tools and APIs were called, and where the chain broke. Triage that used to require pulling logs from three separate systems now happens in a single conversation.

Department-scoped access. Each team only sees what they should. Sales can’t reach engineering tools, support can’t query payroll data, engineers don’t accidentally pull personally identifiable information (PII). You define these access rules one time in the registry, and Jarvis Registry enforces them uniformly across every IDE the business uses.

The impact on day-to-day work is harder to quantify but immediately noticeable. Business users began answering their own questions through the tools they already use, reducing the volume of one-time requests routed to engineering. On-call engineers saw fewer off-hours pages for issues that turned out to be business-logic questions rather than system failures. The agents Vegogarden’s team built reached the people they were built for.

Try it

In this post, we showed how Amazon Bedrock AgentCore handles production agent deployment and how the Jarvis Registry adds the experience layer that makes those agents accessible from the IDEs and copilots your team uses. Together, they provide a complete platform for building, deploying, and consuming agents across your organization.

The Jarvis Registry is available as open source. A two-minute demo shows a developer calling a production AgentCore agent from inside their IDE, encountering an upstream auth challenge, and resolving it in place—the experience layer at work. To deploy the Jarvis Registry in your own AWS environment, integrate it with your IdP, and extend it for your team’s use cases, reach out to the ASCENDING team.

ASCENDING – AWS Partner spotlight

ASCENDING is an AWS Partner focused on AI-driven solutions and cloud transformation. As an AWS Agentic AI launch partner, ASCENDING helps customers accelerate AI adoption with solutions such as Jarvis, enabling organizations to build and integrate production-ready AI agents more efficiently on AWS. We’ve also released several AI solutions as open source to support the broader community and help organizations innovate faster.

Contact ASCENDING | Partner Overview | AWS Marketplace

Accelerating software development with OpenAI ChatGPT Codex on Amazon Bedrock

Sunil Bemarkar — Tue, 04 Aug 2026 19:28:35 +0000

By: Sunil Bemarkar, Sr. Partner Solutions Architect – AWS
By: Garrett McCarthy, Partner Leader – OpenAI
By: Erik Anderson, Principal Solutions Architect – AWS

OpenAI

The pace of software development continues to accelerate, with organizations under increasing pressure to ship features faster, reduce technical debt, and do more with constrained engineering resources. According to Gartner, more than 80% of enterprises will have used generative AI APIs or deployed generative AI–enabled applications in production environments by 2026, up from less than 5% in 2023, signaling a fundamental shift in how software is built. Meanwhile, research from GitHub shows that developers using AI coding assistants complete tasks up to 55% faster while reporting significantly reduced cognitive load on repetitive work.

Yet for enterprises managing large codebases across distributed teams, merely adopting AI tools isn’t enough. Gartner predicts that by 2028, 75% of enterprise software engineers will use AI code assistants, up from less than 10% in early 2023. With the question of whether to adopt AI-assisted development resolved, the challenge becomes how to do so with security, governance, and operational controls that enterprise environments demand.

In this post, we explore how OpenAI ChatGPT Codex on Amazon Bedrock, OpenAI’s powerful coding agent for end-to-end software development, enables enterprises to adopt advanced AI-assisted development while maintaining the governance, security, and operational excellence that AWS provides. ChatGPT Codex is now available on Amazon Bedrock with OpenAI’s frontier models.

Scaling developer productivity without sacrificing quality

Enterprise software teams face a common set of challenges:

Growing complexity – Modern applications span microservices, multi-cloud environments, and diverse technology stacks, making it harder for any single developer to comprehend the full system context.
Talent constraints – The demand for experienced software engineers continues to outpace supply, and onboarding new developers to large codebases takes months.
Quality and security requirements – Enterprises can’t trade speed for safety. Every line of code must meet compliance, security, and operational standards before reaching production.
Technical debt accumulation – Teams often deprioritize refactoring and modernization under delivery pressure, creating a compounding burden that slows future development.

These challenges call for a new approach that augments human developers with AI agents capable of reasoning through complex problems at scale.

Introducing OpenAI ChatGPT Codex on Amazon Bedrock

ChatGPT Codex goes beyond straightforward code completion to work across the entire software development lifecycle (SDLC). Powered by OpenAI’s latest frontier models with advanced reasoning capabilities, Codex can:

Understand full codebase context – Codex reasons across entire repositories, understanding dependencies, architectural patterns, and business logic to produce contextually appropriate solutions.
Execute multistep coding tasks – From implementing new features to refactoring legacy code, Codex breaks down complex tasks into logical steps and executes them end to end.
Generate tests and documentation – Codex can independently write unit tests, integration tests, and documentation aligned with your team’s conventions.
Operate as a collaborative agent – Rather than replacing developers, Codex acts as a force multiplier that handles routine and complex coding tasks so engineers can focus on architecture, design, and innovation.

By making ChatGPT Codex available on Amazon Bedrock, enterprises gain access to OpenAI’s frontier reasoning models through fully managed, serverless API, thus eliminating the need to manage infrastructure while benefiting from the enterprise-grade capabilities of AWS services.

The case for AI-assisted development: What the research shows

The impact of AI coding assistants on developer productivity is well-documented by independent research:

As mentioned in the first paragraph, a controlled study by GitHub research found that developers using AI coding assistants completed tasks 55% faster, averaging 1 hour 11 minutes compared to 2 hours 41 minutes without assistance.
In an enterprise study with Accenture, GitHub found that AI-assisted developers saw an 84% increase in successful builds and a 15% rise in pull request merge rates, demonstrating improved code quality at scale.
Productivity gains are becoming more measurable; Gartner insights reveal that 90% of software engineering leaders report visible improvements, logging a net average developer productivity gain of 19.3% from AI integration.

ChatGPT Codex builds on these foundations by going beyond code suggestions to deliver full agentic reasoning, understanding multifile context, executing complex multistep tasks, and collaborating with developers as an intelligent partner rather than an autocomplete tool.

Why Amazon Bedrock for OpenAI ChatGPT Codex?

Amazon Bedrock provides the foundation for enterprises to adopt generative AI responsibly, at scale. Running ChatGPT Codex on Amazon Bedrock delivers several critical advantages, including zero operator access, enterprise security and governance, operational visibility and monitoring, and unified billing.

The next-generation inference engine of Amazon Bedrock implements a zero operator access (ZOA) design that intentionally eliminates the technical means for AWS or OpenAI operators to access customer data, including inference prompts and completions.

AWS Identity and Access Management (IAM) integration provides fine-grained access control, limiting the ability to invoke Codex capabilities to only authorized users and systems. For customers who require private connectivity, AWS PrivateLink can be configured so traffic between your virtual private cloud (VPC) and Amazon Bedrock stays on the AWS network instead of traversing the public internet.

Amazon CloudWatch provides real-time metrics on usage, latency, and error rates, so your operations teams can maintain visibility into AI-assisted development workflows. AWS CloudTrail logs every API call for compliance auditing and security investigations.

You can enjoy consolidated billing through your existing AWS account alongside other AWS workloads. Pay-per-token pricing has no seat licenses or upfront commitments. Existing Amazon Bedrock customers can access OpenAI’s latest frontier models in one place.

Business outcomes: What enterprises can expect

Organizations adopting ChatGPT Codex on Amazon Bedrock can realize measurable impact across their software development lifecycle, as outlined in the following table.

Outcome	Impact
Developer productivity	Offload repetitive coding work to Codex, so developers can redirect their time to making architectural decisions, solving engineering challenges, and exercising judgment.
Time to market	Accelerate feature delivery cycles by augmenting teams with AI-powered development agents.
Code quality	Improve consistency and reduce defects through Codex, leading to more successful builds and fewer production issues.
Developer efficiency	Achieve more output per developer without proportional headcount growth.
Onboarding speed	New team members ramp faster with an AI agent that understands full code base context and provides answers for new teammates.

Who benefits from OpenAI ChatGPT Codex on Amazon Bedrock?

ChatGPT Codex on Amazon Bedrock serves a broad spectrum of enterprise personas:

Engineering leaders and CTOs seeking to scale development capacity without proportional headcount growth while maintaining security and compliance.
Individual developers looking for an intelligent coding partner that understands their code base, reduces context-switching, and handles tedious tasks.
Executive decision-makers evaluating generative AI investments who need a solution that integrates with existing AWS infrastructure, governance, and procurement workflows.
Other technical teams (product managers, data analysts, technical writers) who work alongside engineering and want an agent that can read the code base, query documentation, and automate repetitive tasks without writing code.

Getting started

ChatGPT Codex runs locally on your machine using the command line interface (CLI), desktop app, or integrated development environment (IDE) extension and routes model requests to Amazon Bedrock using AWS authentication.

To begin using ChatGPT Codex on Amazon Bedrock, complete the following steps:

To download and install, visit Codex. You can download the Codex CLI, Codex App, or the Codex VS Code extension and get started with Amazon Bedrock for model inference. Confirm you’re on Codex CLI 0.128.0 or later, the Codex desktop app, or Visual Studio Code extension 26.429.30905 or later. Earlier builds don’t support Amazon Bedrock as a model provider.
Configure authentication. Codex supports two Amazon Bedrock authentication paths, the Amazon Bedrock API key or AWS SDK credential chain, which gives teams the flexibility to choose the approach that best fits their existing security posture and infrastructure setup. When you set a value for AWS_BEARER_TOKEN_BEDROCK, Codex uses that first. If that doesn’t exist, it falls back to the AWS SDK credential chain. You can set the bearer token in the environment as:

export AWS_BEARER_TOKEN_BEDROCK=<your-bedrock-api-key>

Set Amazon Bedrock as your provider, your preferred Region, and the model ID in the Codex configuration in ~/.codex/config.toml, which is required for Bedrock-API-key authentication as shown in the following code. Confirm that you provide models that match the model Region compatibility. As of this writing, openai.gpt-5.6 (Sol, Terra, and Luna), openai.gpt-5.5, and openai.gpt-5.4 are supported.

model = "openai.gpt-5.5"
model_provider = "amazon-bedrock"
model_reasoning_effort = "medium"
[model_providers.amazon-bedrock.aws]
region = "us-east-2"

Restart the desktop app or VS Code extension after changing ~/.codex/config.toml. For Codex CLI, type codex in the terminal to get started with Codex on Amazon Bedrock.

All model inference is routed through the Responses API on Amazon Bedrock, with pay-per-token pricing that requires no seat licenses or per-developer commitments, and data residency stays within the Amazon Bedrock Region you select.

To learn more about how to configure ChatGPT Codex to use OpenAI models on Amazon Bedrock, visit Use Codex with Amazon Bedrock.

Conclusion

The convergence of frontier AI reasoning and enterprise cloud infrastructure changes how organizations build software and perform knowledge work. With Gartner forecasting that 75% of enterprise engineers will use AI code assistants by 2028, the early adopters who invest in secure, governed AI development will be better positioned as adoption scales.ChatGPT Codex on Amazon Bedrock combines OpenAI’s advanced coding intelligence with AWS security, governance, and operational maturity. Enterprises can confidently adopt AI-assisted development that accelerates delivery, reduces technical debt, empowers developers with an AI collaborator, and still meet enterprise requirements.

To get started, explore OpenAI models on Amazon Bedrock and follow the guide to use ChatGPT Codex with Amazon Bedrock.

OpenAI – AWS Partner Spotlight

OpenAI is an AWS Advanced Technology Partner offering frontier AI models and platforms that help organizations solve complex problems. ChatGPT Codex, their agentic coding platform, brings advanced reasoning capabilities to software development workflows.

Contact OpenAI | Partner Overview

Say Hello to 149 New AWS Competency and MSP Partners Added in July

Nick Paris — Mon, 03 Aug 2026 15:54:57 +0000

By Nick Paris, APN Marketing Manager – AWS Partner Network

The AWS Partner Network (APN) is a global community that leverages Amazon Web Services (AWS) technologies, programs, expertise, and tools to build solutions and provide services for customers.

The APN has more than 130,000 partners from over 200 countries, with 70% headquartered outside of the United States. Together, partners and AWS provide innovative solutions, solve technical challenges, win deals, and deliver greater customer value.

To achieve APN specializations such as AWS Competency, AWS Service Delivery, AWS Service Ready, and AWS Managed Service Provider (MSP), organizations must undergo rigorous technical validation and assessment of their AWS solutions and practices.

NEW! AWS Competency Partners

To succeed with cloud adoption in today’s complex IT environment and continue to advance in the future, customers can team up with an AWS Competency Partner.

The AWS Competency Program validates and promotes AWS Partners with demonstrated technical expertise and proven customer success in specialized areas across industries, use cases, and workloads. Guidance from these skilled professionals can lead to better business and bigger results.

Team up with our newest AWS Competency Partners:

AWS Advertising and Marketing Technology Competency

Branch Metrics | NAMER | Ad Intelligence & Measurement
Omnichat | China | Ad Intelligence & Measurement; Ad Platforms; Audience & Customer Data Management; Digital Customer Experience

AWS AI Competency

AceCloud | APAC | Agentic AI Consulting Services
act digital | LATAM | Generative AI Consulting Services
allOps Solutions | EMEA | Generative AI Consulting Services
allOps Solutions | EMEA | Agentic AI Consulting Services
Altimetrik Corp | NAMER | Generative AI Consulting Services
ARKHO | LATAM | Agentic AI Consulting Services
beSharp | EMEA | Agentic AI Consulting Services
biia Group | LATAM | Agentic AI Consulting Services; Generative AI Consulting Services
Calyza Tech | APAC | Generative AI Consulting Services
CGI Inc | NAMER | Generative AI Consulting Services
Ci&T Software | LATAM | Agentic AI Consulting Services
CloudHesive | NAMER | Agentic AI Consulting Services
Coforge | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
CONSULTEDGE GLOBAL SERVICES (OPC) | APAC | Generative AI Consulting Services
CONSULTEDGE GLOBAL SERVICES (OPC) | APAC | Agentic AI Consulting Services
Coresys Solutions Limited | EMEA | Generative AI Consulting Services
DD Consulting | APAC | Generative AI Consulting Services
Demo Account | NAMER | Generative AI Consulting Services
Descasio | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
devx labs | APAC | Generative AI Consulting Services
DIU | EMEA | Generative AI Consulting Services
EMB Global | APAC | Generative AI Consulting Services
Emumba | NAMER | Agentic AI Consulting Services
Escala24X7 | NAMER | Agentic AI Consulting Services
Euristiq | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Flatiron Software Corporation | NAMER | Generative AI Consulting Services
Future Processing | EMEA | Generative AI Consulting Services
Hong Kong Qineasy Technology Limited | China | Generative AI Consulting Services
Idexcel | NAMER | Agentic AI Consulting Services
Intelligence Cloud Sphere- (Intel CS) | EMEA | Agentic AI Consulting Services
Jacobian Engineering Inc. | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Karsun Solutions LLC. | NAMER | Generative AI Consulting Services
KIIRO | EMEA | Agentic AI Consulting Services
kloudr | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
LCM Go Cloud | EMEA | Generative AI Consulting Services
LCM Go Cloud | EMEA | Agentic AI Consulting Services
Leapfrog Technology | NAMER | Agentic AI Consulting Services
LeverX | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Metaage Corporation | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Mindware | EMEA | Agentic AI Consulting Services
Mist Avinya Technologies | APAC | Agentic AI Consulting Services
Mitra Innovation | EMEA | Generative AI Consulting Services
Motherson Technology Services | APAC | Generative AI Consulting Services
One Cloud Utopia | NAMER | Agentic AI Consulting Services
Red Oak Strategic | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Registfy | EMEA | Agentic AI Consulting Services
Samsung SDS | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
SK | APAC | Agentic AI Consulting Services
SkyGRID Global Technologies | EMEA | Agentic AI Consulting Services
Stormit | EMEA | Generative AI Consulting Services
TATA ELXSI | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Trustsoft | EMEA | Generative AI Consulting Services
Tuxpas | LATAM | Agentic AI Consulting Services
Uberfusion (part of fourtitude.asia) | APAC | Generative AI Consulting Services
V2 AI | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Vontech IT | NAMER | Generative AI Consulting Services
太美医疗科技 | China | Generative AI Applications
Abnormal AI | NAMER | Generative AI Applications
CloudHound | APAC | Agentic AI Tools
CloudHound | APAC | Agentic AI Applications
Datadog | NAMER | Generative AI Applications
HERE Technologies | NAMER | Agentic AI Applications; Agentic AI Tools; Generative AI Applications
impress.ai | APAC | Agentic AI Applications; Generative AI Applications
Pega | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
Process Street | NAMER | Agentic AI Applications
Qodo, AI Code Review & Governance Platform | NAMER | Agentic AI Applications
Shanghai Yabaiwo Software Technology | China | Generative AI Applications
ThoughtBox AI | NAMER | Generative AI Applications
Thundersoft | China | Generative AI Applications
Tianjin Hualai Technology | China | Agentic AI Tools
Zuora | NAMER | Agentic AI Applications; Agentic AI Tools; Generative AI Applications

AWS Cloud Operations Competency

A3Data | LATAM | Monitoring & Observability
allOps Solutions | EMEA | Operations Management
Cloud Capital | NAMER | Cloud Financial Management
ELEKS | EMEA | Operations Management
F6S Advisors | EMEA | Compliance & Auditing
Fuama Technologies | EMEA | Cloud Financial Management; Cloud Governance
GWCLOUD TECNOLOGIA E SERVICOS | LATAM | Operations Management
Horus Technologies | NAMER | Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
TranSnet Cloud | EMEA | Cloud Financial Management; Cloud Governance; Monitoring & Observability; Operations Management

Consumer Goods Competency

Clearscale | NAMER | IT & Digital Transformation; Manufacturing
Spectro Cloud | NAMER | IT & Digital Transformation; Manufacturing

AWS Data & Analytics Competency

Cloudwalker | EMEA | Consulting Services
Comprinno Technologies | APAC | Consulting Services
Mphasis | NAMER | Consulting Services
RYSUN LABS | NAMER | Consulting Services

AWS DevOps Competency

BASIS | NAMER | Consulting Services
DFX5 | NAMER | Consulting Services
FPT Software | APAC | Consulting Services
OneData Software Solutions | NAMER | Consulting Services
Operisoft Technologies | APAC | Consulting Services
Saudi Telecom Company | EMEA | Consulting Services
Synechron | NAMER | Consulting Services
Bitrise | NAMER | Continuous Integration & Continuous Delivery

AWS Digital Sovereignty Competency

Ankercloud | EMEA | Consulting Services
LOGIC media solutions | EMEA | Consulting Services
Redington Gulf | EMEA | Consulting Services

AWS Digital Workplace Competency

Workspot | NAMER | Application Management

AWS Financial Competency

Apexon | NAMER | Banking; Capital Markets; General Financial Services
Datamellon | EMEA | Banking; Payments
Bridgewise | EMEA | Banking; Capital Markets
Vonage | NAMER | Banking; General Financial Services; Insurance; Payments

AWS Government Competency

Innovation Process Technology (ipt) | EMEA | Citizen Services

AWS Healthcare Competency

dataRain Consulting | LATAM | Consulting Services
goML (Neuralgo) | NAMER | Consulting Services

AWS Manufacturing and Industrial Competency

Celonis SE | EMEA | Engineering and Design; Enterprise Solutions; Operational Technology; Operational Technology Security; Smart Manufacturing; Smart Products and Services; Supply Chain Management; Sustainability
Karini AI | NAMER | Enterprise Solutions; Operational Technology; Operational Technology Security; Smart Manufacturing; Smart Products and Services; Supply Chain Management

AWS Migration and Modernization Competency

BIP – Business Integration Partners | EMEA | Migration Services
CloudEQ | NAMER | Migration Services; Modernization Services
CloudJournee | APAC | Migration Services; Modernization Services
Logicalis Spain | EMEA | Migration Services
NOVOSOFT | APAC | Migration Services
SEC AND DEVOPS AI | APAC | Migration Services; Modernization Services

AWS Resilience Competency

CloudZenia | APAC | Resilience Design
Rapyder Cloud Solution | APAC | Resilience Recovery
Visionet Systems | NAMER | Resilience Design

AWS Retail Competency

Clearscale | NAMER | Consulting Services
MadeinWeb | LATAM | Consulting Services
ByteDance | China | IT and Core Applications
Grafana Labs | NAMER | Digital Commerce
Retool | NAMER | Advanced Data Insights; Customer Engagement; Digital Commerce; Intelligent Supply Chain; IT and Core Applications; Merchandising and Planning

AWS Security Competency

Atomic Computing | EMEA | AI Security; Application Security; Compliance and Privacy; Data Protection; Identity and Access Management; Infrastructure Protection; Perimeter Protection; Threat Detection and Response
DataArt | NAMER | Application Security
Quantiphi | NAMER | Identity and Access Management
SEC AND DEVOPS AI | APAC | Identity and Access Management
TranSnet Cloud | EMEA | Data Protection; Identity and Access Management; Infrastructure Protection

AWS Small and Medium Business (SMB) Competency

Cheppers Zrt. | EMEA | Small and Medium Business
Cloudtech | NAMER | Small and Medium Business
cloudvests | EMEA | Small and Medium Business
ELCORE UA | EMEA | Small and Medium Business
Pump | NAMER | Small and Medium Business
RealCloud | LATAM | Small and Medium Business
SVA (System Vertrieb Alexander) | EMEA | Small and Medium Business

AWS Storage Competency

EMB Global | APAC | Consulting Services

AWS Travel and Hospitality Competency

Matterport | NAMER | Smart Assets

NEW! AWS Managed Service Providers (MSPs)

The AWS Managed Service Provider (MSP) Program validates AWS Partners with a proven track record and experience providing end-to-end AWS solutions to customers at any stage of the cloud journey, including planning and design, building and migration, operations and support, and automation and optimization.

To achieve this level of specialization, AWS MSP Partners must complete an extensive independent audit to ensure business health and technical capabilities meet a high bar, and they must maintain this status through annual audits.

Say hello to our newest AWS MSP Partners:

AWS Managed Service Provider Program

Cloud2 Oy | EMEA
DNX Solutions | APAC
ETEVERS | APAC
IVCISA | LATAM
MadeinWeb | LATAM
MetanetX | APAC
Orient Technologies | APAC
Pentagon System and Services | APAC
Skaylink | EMEA
SnapSoft | EMEA
Sufle | EMEA
YASH Technologies | NAMER

More Value, Greater Profitability for AWS Partners

Our mission is to make the AWS Partner Network (APN) with AWS Marketplace your preferred route to market and empower partners to deliver differentiated value to millions of AWS customers, helping you to win more, win bigger, and win faster.

We’re aligning the AWS Partner experience—including programs, incentives, and enablement—around AWS services and the partner business models: business outcome solutions, technology solutions, managed services, services, and resell.

These enhancements provide you with more relevant and prescriptive guidance, where you need it, and in a consistent and predictable manner. Your profitability, along with helping you drive new business, is our number one goal.

In 2026, we’ll continue to ensure that AWS Marketplace and our AWS Partner programs provide demonstrated pathways to success—helping you drive greater customer value and profitability. There’s an exciting journey ahead, and we’re thrilled to be on it together!

Learn how AWS is transforming the partner experience >>

Orca just-in-time access & AWS IAM Identity Center solve permission sprawl

Merin Eralil — Tue, 28 Jul 2026 20:43:46 +0000

By: Merin Eralil, Security Partner Solutions Architect – AWS
By: Ashleigh Lee, Senior Product Marketing Manager – Orca Security

Orca Security

How can you maintain developer velocity across hundreds of accounts while enforcing least-privilege access? A contractor gets access for a 3-week engagement. A developer gets elevated privileges to debug a production issue. The continuous integration and continuous delivery (CI/CD) pipeline retains permissions from a sprint that ended months ago. How often is this type of access reviewed?

This is how permission sprawl grows. Just-in-time (JIT) access is emerging as the operational answer to permission sprawl, which is the accumulation of permanently assigned permissions spread across hundreds of identities. Orca Security’s integration with Amazon Web Services (AWS) IAM Identity Center gives organizations an operational path to address this.

The problem is accelerating: A 2026 SANS survey of over 500 security professionals found that 74% of organizations are already deploying AI agents or automations that require credentials or access permissions. According to the survey, this trend is doubling or tripling non-human identity (NHI) populations inside many enterprises.

When permissions are scoped and time-bound, the impact of a credential exposure drops significantly. Organizations that remove persistent, broad access reduce their risk, including in the event that credentials are obtained by an unauthorized party. The principle of least privilege has long been the right architectural answer. What’s been missing is the infrastructure that makes it operational at scale.

To help customers implement JIT access efficiently, Orca Security provides an integration with AWS IAM Identity Center. This post explores how the integration works and what it means for security and engineering teams operating at scale in the AWS Cloud.

Permission sprawl creates security gaps

Major compliance frameworks including System and Organization Controls 2 (SOC 2), Payment Card Industry Data Security Standard (PCI-DSS), ISO/IEC 27001, Federal Risk and Authorization Management Program (FedRAMP), and the Health Insurance Portability and Accountability Act (HIPAA) require the principle of least privilege.

There’s a critical difference between documenting a policy and enforcing it. Persistent access models shift the burden to humans: Someone has to remember to remove access after a project ends or a contractor offboards. The consequences are measurable:

Over-provisioned identities become dormant access risks. Credential abuse accounts for 22% of the incidents in the Verizon 2025 Data Breach Investigations Report, showing that threat actors are logging in, not breaking in.
Incident responders have more scope to contain when accounts with inadvertent access hold persistent, broad permissions.
Auditors ask for evidence that least privilege is enforced in practice. Persistent access models produce no automatic audit trail to demonstrate this.

Modern engineering compounds this further. Infrastructure-as-code has made spinning up resources trivial, but access governance hasn’t kept pace. Developers move fast, access gets provisioned for a sprint, and those permissions remain long after the work is done. This is the predictable outcome when access management depends on manual cleanup rather than built-in expiration.

The solution: JIT access

JIT makes least privilege operational by providing temporary, scoped access by default. No one has permanently assigned permissions. Instead, a user requests specific permissions for a defined time window, provides justification, receives approval, and access is automatically revoked when the window expires. Nothing to clean up. Nothing to forget.

The following screenshot shows the JIT access request interface in the Orca platform, where teams submit, track, and manage time-bound permission requests:

Figure 1: JIT access in the Orca platform

For cloud environments built on AWS, this approach must work at the identity infrastructure layer. A bolt-on solution that approximates access control from outside the AWS environment can’t deliver the same enforcement.

AWS IAM Identity Center provides the programmatic APIs for creating and revoking account assignments, forming the foundation of JIT access patterns. Customers use these APIs, orchestrated through Orca Security, to implement temporary permission workflows. That’s the design principle behind Orca’s JIT access integration with AWS IAM Identity Center.

How it works: Orca’s AWS IAM Identity Center integration

Organizations implementing JIT access through Orca benefit from its direct integration with AWS IAM Identity Center. When Orca orchestrates a JIT request, it acts within the customer’s AWS environment.

It creates and revokes access assignments in AWS IAM Identity Center on the customer’s behalf. When a user requests access, the integration creates a time-bound assignment in AWS IAM Identity Center, then automatically revokes it when the window expires.

The following image shows how JIT access requests flow between the Orca solution and AWS IAM Identity Center:

Figure 2: Architecture diagram showing how JIT AWS permissions are requested by Orca Security

The workflow is intentionally low friction for the requester. A team member submits an access request through the Orca solution or Slack specifying the required permission set, target AWS account, and duration for which access is needed. An administrator reviews and approves or denies the request. Upon approval, the requester receives a notification from Orca and an email with approver information and access details.

Orca then manages the full permission lifecycle, creating the temporary access assignment in AWS IAM Identity Center and automatically revoking it when the time window expires. Administrators can also revoke access manually before expiration. Every action is recorded in Orca’s audit logs.

To prevent conflicts of interest, Orca prevents self-approval: No one can approve their own request. This addresses one of the most common gaps in peer-reviewed access models.

Use cases include incident responders accessing a production account, developers debugging across accounts, and contractors needing scoped access for a sprint. In all cases, access is temporary by design.

The AWS IAM Identity Center integration: Scoped by design

One of the key architectural decisions in this integration is how Orca holds its own access to the AWS environment. The integration follows least-privilege principles by scoping Orca’s AWS permissions to only those required for JIT orchestration.

To orchestrate JIT requests, customers grant Orca a specific, defined set of AWS permissions. These aren’t broad administrative rights. They’re scoped to exactly what JIT requires, including:

Creating and deleting account assignments
Checking the status of assignment operations
Listing permission sets provisioned to accounts
Listing AWS IAM Identity Center instances and permission sets
Listing users in the Identity Store
Describing permission sets

This scoped permission model reflects the same least-privilege philosophy JIT is built on. Orca doesn’t get more access to your AWS environment than it needs to do the job. This matters both as a security property and as an architecture that customers can explain to their auditors.

To set up the integration, connect your AWS organization management account to Orca, or a delegated administrator account if that’s how your AWS IAM Identity Center is configured. After prerequisites are met, the enable JIT wizard in the Orca interface walks administrators through setup. Orca then handles the operational layer, processing requests, managing approvals, creating time-bound assignments in AWS IAM Identity Center, and revoking them automatically when the window closes.

Complementing AWS security services

This JIT pattern complements AWS security services. AWS IAM Access Analyzer identifies unused permissions, and AWS CloudTrail logs all API activity. JIT access solutions complement these services by removing permanently assigned permissions. Organizations can correlate Orca’s audit logs with AWS CloudTrail events for end-to-end visibility into who accessed what, when, and why.

For teams using AWS Security Hub, JIT access means fewer findings related to over-provisioned or unused permissions because those permissions no longer exist to be flagged.

Automated compliance evidence

Compliance frameworks require least-privilege enforcement. Auditors are moving beyond policy documentation and asking for evidence. JIT access automatically generates audit trails showing the full lifecycle of each access event. This evidence supports SOC 2, ISO 27001, FedRAMP, and HIPAA certifications.

Each step in the access lifecycle is logged in Orca’s Audit Logs. For organizations pursuing or maintaining compliance certifications, that audit trail has a real value beyond the security posture improvement itself. It converts a manual attestation exercise into a queryable record.

What this means for security leaders and engineering teams

This integration delivers different value depending on your role. For CISOs and security directors, JIT access closes the gap between stated policy and actual enforcement. It makes least privilege operationally sustainable across large AWS environments without requiring a dedicated team to manually audit permissions.

For platform and DevSecOps teams, security stops being a separate step. The workflow handles scoping, approval, and revocation without changing how engineers request access. The security overhead gets absorbed by the system.

That’s the case worth making to any executive team: JIT doesn’t slow access down. It makes access defensible.

Get started

Orca Security is available through the AWS Marketplace. To explore how Orca’s JIT access integration can help your organization enforce least privilege at scale across your AWS environment, visit the AWS Marketplace listing or contact Orca Security for a demo.

Orca Security – AWS Partner spotlight

Orca Security is an AWS Specialization Partner Partner that delivers a unified cloud security experience that helps organizations identify, prioritize, and remediate risk across their cloud environments, code, and AI.
Contact Orca Security | Partner Overview | AWS Marketplace

Announcing 2026 AWS Partner Award Nominations

Andrew Somera — Fri, 10 Jul 2026 13:26:03 +0000

By Andrew Somera, Head of Partner Experiences – AWS

The 2026 AWS Partner Awards honor partners who have demonstrated outstanding results and innovation with the use of Amazon Web Services (AWS) products and solutions. These awards are an acknowledgment of exceptional partner success and innovations.

AWS Partner Awards recognizes a wide range of born-in-the-cloud and traditional services, software, and hardware partners whose business models have embraced specialization and collaboration.

Nomination-Based Award Categories

For the fifth year in a row, AWS Partners can self-nominate themselves to be considered across a select number of AWS Partner Award categories, related to partner focus areas, technologies, and the significant impact partners are making in delighting our customers.

Award submissions will be reviewed by a third-party, Canalys, and selected with special emphasis placed on customer success use cases presented in the nomination form. All winners will be informed by October 31, 2026, and will be recognized and celebrated at this year’s AWS re:Invent.

All nominations must be submitted by 11:59 PM PDT on August 14, 2026.

Nomination Categories and Forms

AWS Partners can apply to more than one award, but they may not submit multiple nominations per any given category. A list of the five categories accepting nominations with specific eligibility requirements and details is featured below. A separate application is required for each category.

We’ve also created PowerPoint versions of the nomination form to help prepare your submission. AWS Partners are encouraged to review and prepare this form alongside their Partner Development Manager (PDM) and/or Partner Marketing Manager (PMM).

Note that access to the PowerPoint version of the nomination forms requires an AWS Partner Central login.

Category Descriptions and Judging Criteria

Innovation Partner of the Year

Requirement to applying: Open to partners enrolled in the Services Partner Path.

Recognizes organizations that deliver innovative consulting, professional, managed, and value-added resale services. Recipients will have demonstrated proof in delivering outstanding customer experience via an integrated lifecycle of services, from initial assessments, architecting, developing, and deployment of cloud environments to ongoing migration and management of cloud infrastructure and applications.

Design Partner of the Year

Requirement to applying: Open to partners enrolled in the Hardware or Software Partner Path.

Recognizes organizations that develop software or hardware devices that runs on or is integrated with AWS. Recipients will have achieved a design win in either a software and/or hardware product built on or with AWS. Selected based on impact software/hardware has had on the regional market (e.g., applicability, size of audience, public status).

Social Impact Partner of the Year

Requirement to applying: Partner-nominated category covering all partner types.

Recognizes AWS Partners committed to giving back to society through their people, resources, and technology, and that are leading initiatives to change our world for the better.

Sustainability Partner of the Year

Requirement to applying: Partner nominated category covering all partner types.

Recognizes AWS Partners committed to achieving sustainability goals. Solutions may cover, but are not limited to, capabilities in Agentic AI, machine learning (ML), Internet of Things (IoT), data analytics, and computing to reach your organization’s or customer’s sustainability goals.

Collaboration Partner of the Year

Requirement to applying: Partner nominated category covering all partner types. Nomination will be submitted and distributed to the partner leading the collaborative efforts.

Recognizes situations where a partner has collaborated with one (1) or more AWS Partners in helping address customer problems. Awarded to a partner organization that collaborates with other AWS Partners to work on solving the same customer challenge with their skills and ability to deliver valuable customer solutions based on services and technology offered across multiple AWS Partners.

Don’t Miss Out!

We encourage all partners to participate in submitting a nomination to be considered for an AWS Partner Award.

View our 2025 AWS Partner Award winners, and watch the video below to see highlights from last year’s Awards Gala and Appreciation Event at re:Invent.

Video: 2025 AWS Partners of the Year Gala and Appreciation Event

Say Hello to 184 New AWS Competency, Service Delivery, and MSP Partners Added in June

Nick Paris — Mon, 06 Jul 2026 17:09:06 +0000

By Nick Paris, APN Marketing Manager – AWS Partner Network

The AWS Partner Network (APN) is a global community that leverages Amazon Web Services (AWS) technologies, programs, expertise, and tools to build solutions and provide services for customers.

NEW! AWS Competency Partners

To succeed with cloud adoption in today’s complex IT environment and continue to advance in the future, customers can team up with an AWS Competency Partner.

Team up with our newest AWS Competency Partners:

AWS Advertising and Marketing Technology Competency

ZiMetrics | APAC | Ad Intelligence & Measurement

AWS AI Competency

北京聚云立方科技有限公司 (Marshotspot) | China | Agentic AI Consulting Services
Aeonx Digital | EMEA | Agentic AI Consulting Services
Aivar Innovations | APAC | Agentic AI Consulting Services
Beijing Ultrapower Software | China | Agentic AI Consulting Services
Cambrian Technologies | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Cecure Intelligence | EMEA | Generative AI Consulting Services
Cloud TechOn | APAC | Generative AI Consulting Services
cloudvests | NAMER | Generative AI Consulting Services
cloudvests | NAMER | Agentic AI Consulting Services
Cumulus HQ | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
DataEconomy Inc. | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
dataRain Consulting | LATAM | Agentic AI Consulting Services
Dedalus | LATAM | Agentic AI Consulting Services
develeap | EMEA | Agentic AI Consulting Services
DFX5 | NAMER | Agentic AI Consulting Services
Directeam | EMEA | Agentic AI Consulting Services
DIRMOD | NAMER | Agentic AI Consulting Services
Doosan Corporation Digital Innovation | APAC | Generative AI Consulting Services
Fuama Technologies | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
G-Asiapacific | APAC | Generative AI Consulting Services
GFT Technologies SE | NAMER | Agentic AI Consulting Services
Going Cloud | APAC | Agentic AI Consulting Services
Hanjin Information Systems & Telecommunication | APAC | Generative AI Consulting Services
Inferdat | | Agentic AI Consulting Services; Generative AI Consulting Services
INIT | APAC | Agentic AI Consulting Services
Intelligence Cloud Sphere (Intel-CS) | EMEA | Generative AI Consulting Services
Intuitive.ai | NAMER | Generative AI Consulting Services
JetSweep | NAMER | Generative AI Consulting Services
KnackForge | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Logicalis Latin America | NAMER | Generative AI Consulting Services
Mindware | EMEA | Generative AI Consulting Services
NIX | NAMER | Generative AI Consulting Services
Nous Infosystems | NAMER | Agentic AI Consulting Services
Nova | NAMER | Agentic AI Consulting Services
Nuage It´s Everywhere | LATAM | Generative AI Consulting Services
Nuage It´s Everywhere | LATAM | Agentic AI Consulting Services
OMNYS | EMEA | Agentic AI Consulting Services
Openstack Business Consulting | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Rackspace Technology | NAMER | Agentic AI Consulting Services
Registfy | EMEA | Generative AI Consulting Services
SEC AND DEVOPS AI | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
SK Inc. | APAC | Generative AI Consulting Services
SoftwareOne | EMEA | Agentic AI Consulting Services
Tennex | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Version 1 | EMEA | Generative AI Consulting Services
Vertical Relevance | NAMER | Generative AI Consulting Services
VeUP Limited | NAMER | Agentic AI Consulting Services
脉络洞察 | China | Generative AI Applications
侠客行传媒（智耘贰零） | China | Generative AI Applications
福州领克狐科技有限公司 | China | Agentic AI Applications
杭州分叉智能科技有限公司 | China | Generative AI Applications
成都潜在人工智能科技有限公司 | China | Generative AI Applications
4MindsAI | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
BMC SOFTWARE | NAMER | Agentic AI Applications
CloudHound | APAC | Generative AI Applications
DevRev | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
Kaltura | NAMER | Generative AI Applications
LaunchDarkly | NAMER | Agentic AI Tools
Mechanized AI | NAMER | Generative AI Applications
Mechanized AI | NAMER | Agentic AI Applications
Postman | NAMER | Agentic AI Tools
Rescale | NAMER | Agentic AI Applications
Safe Securities Inc. | NAMER | Agentic AI Applications; Generative AI Applications
Sembix | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications
SensorsData | China | Generative AI Applications
SHAREit-PayerMax | China | Generative AI Applications
SmartBear Software | NAMER | Agentic AI Applications
Solodev | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
SUPER 8 Studio | Japan | Agentic AI Applications
TextQL | NAMER | Agentic AI Applications
Thinking Data Information Technology (Shanghai) | NAMER | Generative AI Applications
Wiv | NAMER | Agentic AI Applications
Zixun Info Tech | China | Agentic AI Applications

Amazon Connect Customer Services Competency

Accenture | NAMER | Contact Center Transformation
Caylent | NAMER | Contact Center Transformation
Deloitte | EMEA | Contact Center Transformation
Genpact | NAMER | Contact Center Transformation
Infosys | APAC | Contact Center Transformation
NeuraFlash | NAMER | Contact Center Transformation
NTT DATA | EMEA | Contact Center Transformation
PricewaterhouseCoopers | NAMER | Contact Center Transformation
Salesforce | NAMER | Contact Center Transformation
TTEC Digital | NAMER | Contact Center Transformation
USAN | NAMER | Contact Center Transformation
Zendesk | NAMER | Contact Center Transformation

AWS Automotive Competency

o9 Solutions | NAMER | Supply Chain

AWS Business Value Realization Competency

Boston Consulting Group | NAMER | Business Value Realization
Compass UOL | NAMER | Business Value Realization
Deloitte | EMEA | Business Value Realization
DoiT | NAMER | Business Value Realization
Persistent Systems | NAMER | Business Value Realization
Quantiphi | NAMER | Business Value Realization
Reply | EMEA | Business Value Realization
SoftwareOne | EMEA | Business Value Realization
tecRacer | EMEA | Business Value Realization

AWS Cloud Operations Competency

Arvato Systems | EMEA | Operations Management
Digitspot Solutions | EMEA | Cloud Governance
Digitspot Solutions | EMEA | Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
Meyi Cloud | APAC | Operations Management
QyrosCloud | NAMER | Compliance & Auditing
ScaleCapacity | NAMER | Operations Management
SkyGRID Global Technologies | EMEA | Cloud Governance
World Wide Technology | NAMER | Cloud Financial Management; Cloud Governance; Monitoring & Observability
ClickHouse | NAMER | Monitoring & Observability
Cloudchipr | NAMER | Cloud Financial Management

Consumer Goods Competency

Orange Logic | NAMER | Marketing

AWS Data & Analytics Competency

Codex | APAC | Consulting Services
MadeinWeb | LATAM | Consulting Services
NuVista AI | NAMER | Consulting Services
OpsGuru, a Carbon60 Company | NAMER | Consulting Services
Aklivity | NAMER | Data Integration and Preparation
Hydrolix | NAMER | Data Analytics Platforms

AWS DevOps Competency

Cybage | APAC | Consulting Services
Digitspot Solutions | EMEA | Consulting Services
SoftGEM Global Technologies | EMEA | Consulting Services

AWS Digital Sovereignty Competency

Atomic Computing | EMEA | Consulting Services
N-iX | EMEA | Consulting Services
SoftServe | NAMER | Consulting Services

AWS Education Competency

Blend | NAMER | Consulting Services
CloudZone | EMEA | Consulting Services

AWS Financial Competency

Anthropic | NAMER | Banking; Capital Markets; General Financial Services; Insurance
Camunda Services | EMEA | Banking; Capital Markets; General Financial Services; Insurance; Payments
Feedzai | NAMER | Banking; General Financial Services; Payments

AWS Healthcare Competency

Process Street | NAMER | Compliance Services
Proximie | EMEA | Clinical Information Systems

AWS High Performance Computing Competency

Invisibl Cloud Solutions | NAMER | HPC Management

AWS Life Sciences Competency

UsefulBI Corporation | NAMER | Consulting Services

AWS Mainframe Modernization Competency

Fujitsu | Japan | Mainframe Workload

AWS Media & Entertainment Competency

Cloudfirst.io | NAMER | Archive; Media Supply Chain and Archive
Cloudmates | EMEA | Broadcast
Flatiron Software Corporation | NAMER | Publishing
Tape Ark | APAC | Archive
Wizeline | LATAM | Data Science and Analytics

AWS Migration and Modernization Competency

Mechanized AI | NAMER | Business Case Analysis; Discovery, Planning, and Recommendation; Infrastructure Automation
Skylift Solutions | EMEA | Data Mobility
奇墨科技（广州）有限公司 – Qimo Technology (Guangzhou) | China | Migration Services
adesso | EMEA | Migration Services; Modernization Services
Aivar Innovations | APAC | Migration Services; Modernization Services
apser | EMEA | Migration Services; Modernization Services
msg group | EMEA | Migration Services
Orion Innovation | NAMER | Migration Services
SEIDOR | LATAM | Migration Services
slashTEC | EMEA | Migration Services; Modernization Services
Tactical Edge | NAMER | Migration Services

AWS MSSP Services Competency

zeb | NAMER | Application Security; Cyber Recovery; Data Protection; Identity and Access Management; Incident Response; Infrastructure Security; Workload Security

AWS Resilience Competency

Applogika | NAMER | Resilience Design
SnapSoft | EMEA | Resilience Design
N2W Software | NAMER | Resilience Recovery

AWS Retail Competency

XalDigital | NAMER | Consulting Services

AWS SAP Competency

SHINRAI TECHNOLOGIES | EMEA | Consulting Services

AWS Security Competency

F6S Advisors | EMEA | Identity and Access Management
Netrix Global | NAMER | Identity and Access Management
Docker | NAMER | Application Security
DTEX.AI | NAMER | Data Protection
Elastic | NAMER | AI Security
Varonis | NAMER | Compliance and Privacy; Data Protection
XBOW | Autonomous Pentesting Platform | NAMER | Application Security

AWS Small and Medium Business (SMB) Competency

Fuama Technologies | EMEA | Small and Medium Business
gabia | APAC | Small and Medium Business
Lightedge | NAMER | Small and Medium Business
Teleglobal International | APAC | Small and Medium Business
Trek2Summit | EMEA | Small and Medium Business
V2G Systems | EMEA | Small and Medium Business
Verycloud | China | Small and Medium Business
WH1 Cloud | LATAM | Small and Medium Business
Arctic Wolf | NAMER | Small and Medium Business
ClickHouse | NAMER | Small and Medium Business
Cyber Security Cloud | Japan | Small and Medium Business
Grafana Labs | NAMER | Small and Medium Business

AWS Storage Competency

Maximyz Cloud | APAC | Consulting Services
Applied Cloud Computing | APAC | Archive; Backup and Restore; Business Continuity/Disaster Recovery; Primary Storage

AWS Telecom Competency

Infosys | APAC | Business Support Systems (BSS); Operation Support Systems (OSS)

NEW! AWS Managed Service Providers (MSPs)

NEW! AWS Service Delivery Partners

The AWS Service Delivery Program validates AWS Partners that have deep technical knowledge, experience, and proven success in delivering specific AWS services to customers.

To achieve this specialization, AWS Partners must undergo service-specific technical validation by AWS Partner Solutions Architects, including review of architecture, customer documentation, and customer case study details to ensure they follow AWS best practices for each AWS service.

Work with our newest AWS Service Delivery Partners:

AWS Database Migration Service (DMS) Delivery Partners

Info Services | NAMER

AWS Lambda Delivery Partners

Sumitomo Electric System Solutions | Japan

More Value, Greater Profitability for AWS Partners

How InterWiz reduced AI costs by 90% with Amazon Bedrock

Ore Okebukola — Thu, 02 Jul 2026 22:45:43 +0000

By: Syed Sabih ur Rehman, Pre-Sales Solutions Architect – Emumba
By: Ore Okebukola, Partner Solutions Architect – AWS

Emumba

If you’re building an AI-powered software as a service (SaaS) product, you’ve likely watched your AI infrastructure costs grow faster than your revenue. What starts at $500 per month during prototyping can reach $50,000 per month in production. In this post, you’ll learn how Emumba, an AWS Advanced Tier Services Partner, helped InterWiz cut AI costs by 90%, improve response times by 55%, and maintain 99.9% uptime with no service disruption by migrating their AI workloads to Amazon Bedrock.

When you’re locked into a single AI provider, rising costs limit growth and compress margins. You lose the ability to evaluate better-performing models. You can’t tune costs independently per workload. When competitors adopt newer models, you’re left waiting on your provider’s release schedule. The result is a difficult tradeoff: raise prices and risk losing customers or absorb costs and sacrifice profitability. Migrating to Amazon Bedrock resolved that tradeoff for InterWiz. InterWiz is an AI-powered recruitment company conducting more than 1,000 interviews monthly. Rising AI costs were blocking their path to profitable growth, and they had a tight window to address it.

The InterWiz story: From cost crisis to competitive advantage

InterWiz automates candidate screening through structured, AI-driven interviews at scale, so recruiters can focus on higher-value work. The system asks contextual follow-up questions, probes for deeper insights, and generates comprehensive candidate evaluations. InterWiz was gaining strong customer traction but faced two business constraints, a cost constraint and an architecture limitation, that limited their growth. At $0.25 per interview using GPT-4 Turbo, AI expenses consumed 40% of per-interview revenue. This made aggressive growth unprofitable. InterWiz was losing deals to competitors with lower AI costs who offered better pricing. They needed to scale to achieve venture-backed growth targets, but their infrastructure costs made scaling unsustainable. Different interview functions have different requirements. Question generation needs strong reasoning and creativity. Real-time interviews require low latency and reliable adherence to instructions. Candidate evaluation demands consistency and cost efficiency at scale. With access to only one model family, InterWiz couldn’t tune each function independently. Response latency averaging 850 milliseconds created noticeable pauses during live interviews, affecting candidate experience.

Why Emumba

InterWiz chose to work with an AWS Partner Network member rather than attempting direct implementation, a decision that proved valuable. InterWiz engaged Emumba, an AWS Advanced Tier Services Partner with the AWS Generative AI Services Competency, to lead the migration. Three factors drove this decision:

AWS Partner Network benefits – As an AWS Advanced Tier Services Partner, Emumba unlocked direct access to AWS funding programs, including proof-of-concept (POC) credits and Well-Architected reviews, plus dedicated support from AWS technical account teams and solutions architects. This reduced migration risk, kept the work aligned with AWS best practices, and lowered upfront costs.
Proven migration framework – Emumba’s systematic seven-phase methodology covered assessment, model evaluation, prompt optimization, progressive rollout, and multi-provider redundancy. Each phase included defined checkpoints and rollback controls, so InterWiz had a structured path to production with minimal disruption risk.
Amazon Bedrock expertise – Emumba’s deep experience with Amazon Bedrock helped InterWiz run a comprehensive evaluation of Claude by Anthropic in Amazon Bedrock and Meta’s LLama in Amazon Bedrock, identifying the most suitable fit for each interview function.

The migration approach

The goal was clear: reduce AI costs by at least 60%, improve response times to under 500 milliseconds, and maintain or improve interview quality while conducting thousands of live interviews without service disruption. Emumba’s seven-phase migration framework guided the transition from model assessment through full production deployment:

Collect information
Select candidate models
Prompt optimization
Model evaluation
Compare and select model
Migrate
Optimize

The following diagram illustrates this framework.

Figure 1: Emumba’s systematic seven-phase migration framework

Emumba conducted comprehensive model assessments using Amazon Bedrock, which provides access to high-performing foundation models (FMs) through a single API, with built-in capabilities for building generative AI applications with security, privacy, and responsible AI. Emumba’s team evaluated Anthropic’s Claude and Meta’s LLama models against InterWiz’s specific requirements.

Emumba designed a specialized architecture that assigned each interview function to the FM best suited for it. Anthropic’s Claude 3.5 Sonnet, a reasoning-focused FM, powered intelligent question generation. Meta’s LLama 3.3 70B, a cost-efficient FM optimized for speed, handled real-time interviews, contextual follow-ups, and candidate evaluation.

Migrating from GPT-4 Turbo introduced prompt compatibility challenges. Because Anthropic’s Claude and Meta’s LLama follow different instruction patterns, Emumba’s team rewrote and tested prompts for each model using Amazon Bedrock prompt optimization tooling, including prompt caching (which can reduce costs by up to 90% and latency by up to 85%) and Amazon Bedrock Intelligent Prompt Routing (which can reduce costs by up to 30% by automatically directing requests to the most cost-effective FM). To validate quality, Emumba’s team applied a large language model (LLM)-as-a-judge evaluation approach, using an FM to score outputs against a defined quality rubric and confirming that outputs met or exceeded baseline standards before each module moved to production.

The results

The migration followed a structured 3-month timeline. Month 1 focused on model assessment and architecture design. Month 2 prioritized progressive rollout of low-risk modules. Month 3 completed full migration with optimization. Emumba measured these outcomes over a 90-day post-migration period across production interview workflows:

90% cost reduction – AI expenses dropped from $0.25 to $0.025 per interview. As InterWiz scales from 1,000 to a projected 10,000 monthly interviews by year-end 2026, this migration will save $27,000 annually, transforming the cost-to-revenue ratio from barely sustainable to highly profitable at scale.
55% latency improvement – Response times decreased from 850 ms to 450 ms. Candidate feedback improved noticeably, with interviewees specifically mentioning the conversation felt “more natural” and “less robotic.”
99.9% uptime – The multi-provider architecture with automatic fallback maintained continuous service availability, even when primary or secondary providers experienced regional issues.

The following graphic summarizes the measurable business outcomes InterWiz achieved.

Figure 2: Business outcomes from InterWiz’s migration to Amazon Bedrock (measured over 90-day post-migration period)

“Migrating our AI stack from Azure OpenAI to Amazon Bedrock was a complex undertaking, but AWS CoE at Emumba handled it with precision and engineering depth. They built the abstraction layers, tuned our prompts, and managed rollout risks so thoroughly that we experienced no disruption, only improvement. The new setup is faster, cheaper, and far more scalable. We couldn’t have asked for a smoother transition.”

— Zishan Iqbal, CEO, InterWiz AI

The competitive impact

Beyond immediate cost savings, the migration created measurable strategic advantages. InterWiz can now profitably serve market segments previously off-limits due to pricing constraints and can invest in advanced features such as role-specific question strategies and industry-tailored evaluation criteria.As AWS adds new FMs to Amazon Bedrock, InterWiz can evaluate and integrate them within days, not months, without waiting on a provider’s roadmap. This architectural flexibility compounds as model innovation accelerates.

Three strategic takeaways for AI-powered SaaS leaders

Architectural decisions made during prototyping often become strategic liabilities at scale, and this post highlights three beneficial outcomes of the InterWiz migration:

Cost predictability at scale – The transparent pricing and multi-model flexibility of Amazon Bedrock provide a path to managing FM costs as you grow. By systematically evaluating which models deliver the most suitable cost-performance balance for specific functions, InterWiz reduced AI costs by 90% without sacrificing quality. You can apply the same approach to your own workloads.
Model choice as strategic advantage – Amazon Bedrock provides access to multiple leading FMs, including Anthropic’s Claude, Cohere Command in Amazon Bedrock, Meta’s LLama, Amazon Nova, and Amazon Titan, through a single API, so you can select the most suitable model for each job. When new FMs emerge, you can adopt them immediately.
AWS Partner Network benefits for regulated industries – For companies in regulated industries, Amazon Bedrock is in scope for System and Organization Controls 1, 2, and 3 reports and is a Health Insurance Portability and Accountability Act (HIPAA) eligible service. AWS also supports customers’ General Data Protection Regulation (GDPR) compliance efforts through data residency controls and contractual commitments.

Under the AWS Shared Responsibility Model, your organization is responsible for implementing the controls required to meet your specific compliance obligations. Working with an AWS Advanced Tier Services Partner such as Emumba provides validated expertise backed by AWS quality assurance, access to funding programs that lower financial barriers, and a path to continuous model innovation through the expanding FM catalog of Amazon Bedrock.

Looking forward

InterWiz’s journey demonstrates what is possible when an AWS Partner Network member guides a production generative AI migration: 90% cost reduction, 55% latency improvement, and a zero-downtime transition completed in 3 months. Building for multi-model flexibility from the start is one of the most consequential infrastructure decisions you can make as an AI-powered SaaS company.Companies that migrate to Amazon Bedrock are positioned to take advantage of FM innovation as it happens. Those locked into single-provider architectures carry higher switching costs as the model landscape evolves. A migration assessment is a practical first step to understanding your potential savings and risk profile.

To learn more about Emumba, refer to Emumba in AWS Partner Network. To contact Emumba, visit the Emumba AWS Partner contact page.

Emumba – AWS Partner spotlight

When you work with Emumba, you gain access to production-grade generative AI implementations, cloud migration and modernization expertise, and data strategy capabilities, backed by more than 300 certified engineers across the Bay Area, Islamabad, and Dubai. Emumba is an AWS Advanced Tier Services Partner with the AWS Generative AI Services Competency, helping companies in healthcare, travel, and software industries build AI infrastructure that scales profitably.

Contact Emumba | Partner Overview | AWS Marketplace

Reimagining legacy applications with Pega and AWS through AI-driven approach

Ujwal Bukka — Thu, 02 Jul 2026 22:20:47 +0000

By: Andre Boaventura, Principal AI Solutions Consultant, Applied AI – Pegasystems Inc.
By: Surender Kumar, Mainframe Modernization Architect – Pegasystems Inc.
By: Sourav Sarkar, Senior Worldwide Specialist Solutions Architect – AWS
By: Ujwal Bukka, Senior Partner Solutions Architect – AWS

For most large enterprises, AI-driven legacy application modernization presents a clear imperative, but acting on it without disrupting the critical business processes that depend on those systems every day remains the core challenge. For decades, legacy applications have served as the operational bedrock of global enterprises. Yet these very systems, often built on tightly coupled, monolithic architectures, can make it difficult for organizations to move with the speed and agility that today’s business demands. Organizations face mounting pressures: high maintenance costs consuming IT budgets, immense technical debt accumulated over decades, scarcity of skilled talent familiar with legacy languages such as COBOL, and the inherent risk of big bang migration projects that frequently overrun budget and timeline.

These challenges drive many organizations to seek a structured approach that delivers business value incrementally. This post shows you how the AI-Driven App Modernization Platform from Pega and Amazon Web Services (AWS) provides a structured, low-risk methodology to transform legacy systems into intelligent, automated workflows.

The AI-Driven App Modernization Platform with Pega and AWS

The AI-Driven App Modernization Platform from Pega and AWS represents a fundamentally different approach. Instead of replatforming or refactoring legacy applications to like-for-like replacements, this solution fundamentally reimagines the business processes they support.

This solution combines the AWS Global Infrastructure and artificial intelligence and machine learning (AI/ML) services with Pega’s low-code platform for AI-powered decisioning and workflow automation. Together, they transform complex legacy architectures into a portfolio of intelligent, agentic workflows that are built for the cloud, automated, and designed around the customer experience and optimized for business agility.

This is not a like-for-like replacement. It’s an opportunity to reimagine existing processes onto an agentic platform, transforming core operations into intelligent, automated workflows.

Target use cases

The platform provides tailored, AI-accelerated paths for multiple complex legacy application estates. Each path addresses a specific modernization challenge:

Mainframe systems – The platform provides a low-risk, phased approach to deterministically extract business rules, requirements, and process flows from mainframe applications with full traceability from every extracted artifact back to the original source code, transforming monolithic COBOL or PL/I systems into agile, Pega workflows built for the cloud. Common industry use cases include insurance claims processing, banking loan origination, customer onboarding, and supply chain orchestration.
Legacy BPM platforms – Organizations running legacy business process management (BPM) suites can use a direct-to-Blueprint import of Business Process Model and Notation (BPMN) diagrams, allowing rapid reimagining of existing processes into intelligent, automated Pega workflows.
Legacy Java and .NET applications – Custom-built applications on established frameworks are analyzed to identify and untangle business logic, allowing strategic migration to a modern, microservices-based architecture on the Pega platform.
Legacy document-centric workflow applications – A specialized import path (to Blueprint) enables rapid analysis and transformation of form-based applications and embedded business logic directly into the Pega platform.
Legacy ERP transformation – The platform acts as the workflow orchestration layer, building new workflows on Pega while ringfencing the legacy enterprise resource planning (ERP) tool, reducing expensive customizations without disrupting the core system of record.
Application consolidation – A common use case is consolidation. Rather than treating each legacy application as a separate one-to-one modernization project, the platform provides a unified foundation to converge functionality across multiple legacy estates. As organizations modernize from mainframe, Notes, and legacy Java, they identify and remove redundant processes, creating a single, cohesive set of agentic workflows. The result is a simplified architecture and a significantly lower total cost of ownership (TCO).

Applications with embedded business rules and process flow can be Pega candidates. The following guidelines offer a starting point.

Banking and financial services:

Loan origination, credit assessment, and fulfillment
Loan servicing and product lifecycle management
Account management, such as onboarding, changes, and offboarding

Insurance:

Policy changes, endorsements, and renewal management
Claims first notice of loss (FNOL), adjudication, and settlement orchestration
Underwriting, such as submission intake, appetite, and risk decisioning

Communications and telecom:

Order management, including validation, decomposition, and orchestration
Enterprise trouble-to-resolve and fault management
Billing dispute management and adjustments

Healthcare and health plans:

Prior authorization, including intake, clinical review, and determination
Member grievances, clinical appeals, and independent dispute resolution (IDR) management
Provider credentialing, contracting, and network management

Government:

Citizen service delivery, including case intake, tracking, and resolution
Benefits eligibility determination and administration
Grant management, including application, review, approval, and monitoring

Manufacturing:

Engineering change orchestration and approval workflows
Warranty claims processing and recovery and recall management
Supplier onboarding, performance management, and risk assessment

Composable platform architecture

The platform is built on a composable architecture combining two vertical pillars with a central engine of four horizontal processing layers. The anatomy of the core modernization engine is as follows:

Discovery, analysis and preprocessing – Uses specialized AWS services and tools such as AWS Transform and Kiro to perform deep analysis of legacy source code. A specialized Pega Blueprint Agent processes these insights through Amazon Bedrock AgentCore using agent-to-agent (A2A) and Model Context Protocol (MCP) integration capabilities to create enriched artifacts for the design layer.
AI-powered application design and generation – This layer functions as the architect. It ingests the enriched artifacts from discovery and uses generative AI to create a comprehensive application design, including case type hierarchies, workflow models, data objects, and persona-based UI layouts. The output is a high-fidelity Blueprint: a validated, editable design document that defines what the modernized application should look like and how it should behave.
Pega Platform – This layer acts as the builder. It takes the validated Blueprint design and automatically generates a functional, running application on the Pega Platform. Developers can then refine and extend the generated application using the low-code App Studio, with the full power of Pega’s decisioning and workflow automation engine underneath.
Data and integration services – Provides broad connectivity, including microservices integration built for the cloud, legacy application connectivity, data modernization paths, and unified identity and security.

The foundation of the platform relies on AWS Cloud and AI infrastructure and the Pega Cloud Platform. AWS Cloud and AI infrastructure provides global scale, scalable compute, and a rich AI/ML portfolio that includes Amazon Bedrock and Amazon SageMaker AI.

Pega Cloud Platform delivers a fully managed platform as a service (PaaS) with always-on architecture, security with SOC 2 and ISO 27001 compliance with around-the-clock SOC monitoring, integrated DevOps through Pega Deployment Manager, and proactive global support.

The following diagram illustrates the platform anatomy.

Figure 1: Anatomy of the AI-Driven App Modernization Platform

The three-phase modernization methodology: Anything to Blueprint to cloud

The platform follows an anything-to-Blueprint-to-cloud (ABC) methodology that guides organizations from legacy complexity to a modernized future on Pega Cloud. The methodology follows three phases:

Reverse engineering and discovery
AI-powered forward engineering
Deployable architecture on Pega Cloud

The next sections explain these phases.

Phase 1: Reverse engineering and discovery

Goal: Transform the mystery of undocumented legacy functionality into a structured, queryable knowledge base.

The platform ingests legacy technologies including COBOL, Programming Language One (PL/I), Java, .NET, legacy ERPs, and legacy forms and workflows. These assets are processed using the powerful analysis engines of AWS Transform, Kiro, and other specialized partner tools. For example, for legacy mainframe COBOL code, AWS Transform deterministically discovers business functions and generates verified, implementation-ready requirements. The output delivers following key capabilities:

Discovery Business Functions – Discovers business functions from the codebase to produce a catalog of logical modernization boundaries. This gives both business and technical stakeholders a shared language for scoping transformation with evidence from the code itself.

1. Code Analysis – Ingests source code, classifies artifacts, builds dependency graphs across programs, entry points, and data stores, and measures code complexity.
2. Data Analysis – Maps Db2 tables and VSAM files, traces data lineage across programs and JCL jobs, and catalogs field-level metadata in a generated data dictionary.
3. Discover Data Paths – Identifies distinct execution paths from entry point triggers through to specific outputs, traced deterministically across the codebase.
4. Discover Business Functions – Groups data paths into business functions (online, batch, or mixed), producing a catalog organized by business process and mapping dependencies to inform wave planning.

Reimagine – Produces formal functional requirements that are technology-agnostic and include testable acceptance criteria, replacing undocumented business logic in applications with a verified, traceable starting point for forward engineering with Pega Blueprint.

1. Extract Business Logic – Performs deterministic static analysis to extract business rules from actual execution logic, with each rule carrying a natural language description, acceptance criteria, and exact source line traceability.
2. Generate Requirements – Produces user stories with structured business rules in EARS (Easy Approach to Requirements Syntax) format, with full traceability from requirements to rules to source code

Phase 2: AI-powered forward engineering

Goal: Use agentic AI to accelerate application design and reimagine legacy processes.

The Pega Blueprint Agent ingests phase 1 artifacts and generates a comprehensive starter application design enriched with Pega’s industry best practices. This facilitates a collaborative AI-assisted design cycle where stakeholders can rearchitect customer journeys, introduce intelligent automation and AI decisioning, simplify data structures, and design modern user interfaces.

The modernized application automatically inherits Pega Platform capabilities including case management, predictive AI and decisioning agents, Center-out architecture, and built-in reporting and process optimization.

Phase 3: Deployable architecture on Pega Cloud

Goal: Transform the blueprint into a deployable application using an incremental deployment strategy.

The core deployment strategy is the strangler fig pattern, an incremental approach that gradually replaces legacy functionality without disrupting the business. Think of the legacy application as the host tree and the new Pega application as the vine that grows around it until the old system can be safely decommissioned. This pattern relies on two critical components:

The strangler façade – This layer acts as the single, intelligent entry point for all application traffic, dynamically routing requests between legacy and modern endpoints based on configurable policies. As each business domain is modernized, the façade is reconfigured to direct traffic to the new Pega application, with zero changes required on the client side.
The anti-corruption layer (ACL) – This layer is a sophisticated translator that protects the new Pega application from legacy complexity, allowing it to communicate with legacy applications using modern REST APIs across supported legacy technologies, including COBOL, PL/I, Java, and .NET. In a mainframe modernization scenario, for example, OpenLegacy(a 3rd party Legacy-to-API integration platform) serves as the ACL, allowing Pega to interact with COBOL systems without needing to understand COBOL data structures, Extended Binary Coded Decimal Interchange Code (EBCDIC) character sets, or mainframe protocols.

Applications are modernized in logical phases called “migration waves.” Each delivers a complete business domain and its associated data. The façade begins by routing traffic to the legacy application and is progressively reconfigured with each wave, until the legacy system is fully replaced and can be safely decommissioned. This incremental modernization is illustrated in the following graphic.

Figure 2: The strangler fig pattern – Mainframe modernization scenario

This strategy is underpinned by a powerful, automated toolchain. Validated case types, data objects, and UI designs from the Blueprint are used as direct inputs to automatically generate the core Pega application structure, minimizing manual effort. Pre-built infrastructure as code (IaC) templates deploy the entire supporting AWS architecture, including networking, security, and data services needed to connect Pega Cloud to the legacy environment. A holistic, layered security model protects the solution at every level: infrastructure-level security enforces least-privilege access through AWS Identity and Access Management (IAM) roles and policies, and application-level security is managed within Pega using role-based access control (RBAC) and single sign-on integration.

The following graphic illustrates this three-phase modernization methodology.

Figure 3: The three-phase modernization methodology

Key benefits

The three-phase modernization methodology offers several benefits:

Accelerated time to value – AI-driven discovery and design can reduce modernization timelines, cutting projects from years to months.
Reduced risk – Automated logic extraction prevents loss of critical functionality; iterative validation removes costly rework.
Lower TCO – This methodology removes expensive licensing and million instructions per second (MIPS) costs, technical debt, and frees IT resources.
Business agility – Low-code platform empowers rapid adaptation without long IT cycles.
Enhanced experience – Modern, intelligent applications drive higher satisfaction and productivity.

Getting started

To begin your modernization journey, follow these steps:

Schedule a personalized demo – Contact Pega to see the platform in action, tailored to your specific systems and business goals.
Book a discovery workshop – Engage with the Pega and AWS team for a guided assessment of your legacy application estate and a preliminary modernization roadmap.
Learn more online – For a deeper technical dive into this joint solution including architecture deep-dives and use-case guidance, refer to our joint technical whitepaper, The AI-Driven App Modernization Platform.
Engage with a certified delivery partner – The ecosystem of certified global system integrators including TCS, Infosys, and Accenture brings deep industry expertise and proven delivery capacity to accelerate your transformation.

Conclusion

The AI-Driven App Modernization Platform from Pega and AWS offers you a fundamentally new approach to legacy application transformation. By combining the AWS Cloud infrastructure and AI-powered analysis tools with Pega’s generative AI design capabilities and workflow automation, you can modernize targeted workloads incrementally, safely, and with confidence. Beyond modernization, this platform helps you reimagine your business processes on an agentic platform designed for the AI era.

Pega – AWS Partner spotlight

Pega is an AWS ISV Partner that delivers AI-powered decisioning and workflow automation to major global enterprises. With solutions spanning customer engagement, intelligent automation, and AI-driven application modernization, Pega helps organizations accelerate their digital transformation on AWS. Learn more at pega.com

Contact Pega | Partner Overview | AWS Marketplace

Designing enterprise AI agents with DevRev guardrails powered by Amazon Nova

Len Gomes — Thu, 02 Jul 2026 17:53:02 +0000

By: Len Gomes, Partner Solutions Architect – AWS
By: Ruhisar Tikoo, Technical Account Manager – AWS
By: Writom Guha Roy, Sr. Startup SA – AWS
By: Prateek Chaudhury, AI Engineer – DevRev

DevRev

Enterprises are embedding AI agents across workflows from customer support to IT service management but face the critical challenge of facilitating responsible behavior at scale. As enterprise AI agents gain autonomy and access to sensitive customer and product data, the demand for robust AI guardrails has increased significantly. With robust AI guardrails in place, organizations gain the confidence to scale AI agents across sensitive workflows knowing that personally identifiable information (PII) is filtered before it surfaces in responses, content stays on policy, business insights remain grounded in verified data, and safety controls hold firm against adversarial inputs. Responsible AI is an operational requirement for enterprises deploying AI agents powered by Amazon Nova or other foundation models (FMs) in production.

The business value is clear. Effective guardrails strengthen regulatory posture, reinforce customer trust, and reduce remediation overhead. For enterprises in regulated industries like financial services, healthcare, or telecommunications, these advantages compound quickly. Organizations that implement custom, domain-specific policies reflecting internal compliance rules gain a measurable operational edge: consistent enforcement around roadmap details, confidential integrations, and regulated industry language. Modern enterprise AI systems that enforce AI safety at the infrastructure level unlock greater agent autonomy with confidence.

DevRev guardrails: Built-in AI safety for every agent

DevRev has addressed this challenge directly by building real-time AI guardrails into its enterprise agent system, powered by Amazon Nova 2 Lite through Amazon Bedrock, a fully managed service from Amazon Web Services (AWS) for building and scaling generative AI applications with foundation models. Agents deployed on DevRev’s system come with a unified guardrail layer that evaluates user inputs before a response is generated, supporting reliable, adherent behavior across enterprise workflows right from the start. Teams can also author custom policies in natural language, making policy enforcement accessible without requiring code.

Amazon Nova is the AWS portfolio of AI offerings delivering frontier intelligence with competitive price performance. Nova is built on AI technologies originally developed for internal Amazon applications, including Alexa+, Amazon Ads, and Amazon Stores. Amazon Nova 2 Lite is a fast, cost-effective reasoning model featuring extended thinking with step-by-step reasoning (at three configurable levels: low, medium, or high), multimodal support (text, image, video, and documents as input), a one million-token context window for expanded reasoning, and built-in tools including web grounding with citations and code interpreter.

Early adopters report significant results: Siemens achieved a 300% improvement in search speed, Trellix saw a 39% accuracy boost in threat classification, and AWS Transform improved tool-calling efficiency by 60%.

Measured impact in production deployments

Production deployments of DevRev’s AI agent system demonstrate measurable impact across enterprise deployments where Computer agents handle support, operations, and knowledge management at scale, as shown in the following table.

Operational metric	Production result
Support ticket automation	85% (compared to 40% industry average)
Support cost reduction	50% (compared to 20% industry average)
Employee time saved per week	10-plus hours per employee
Guardrail evaluation latency	247 ms average (<300ms threshold)

The DevRev guardrails solution

DevRev built AI guardrails as a built-in layer within its agent system not as a bolted-on filter, but as an integral component of the execution pipeline that evaluates every user message before a response reaches the end user. This built-in protection covers the most critical enterprise AI issues:

Prompt injection is designed to alter agent behavior through crafted inputs.
Sensitive content is evaluated, filtering PII before it surfaces in agent responses.
Toxic and off-policy responses are blocked, filtering harmful or nonadherent content before delivery.
Custom domain policies restrict topics such as internal roadmaps, confidential integrations, or regulated terminology.

Administrators configure custom policies using plain natural language rules like “Avoid discussing internal roadmap details” or “Do not reference competitor products” without writing code. After these policies are attached to an agent, they enforce consistent, auditable boundaries regardless of where the agent is accessed across the organization.

How it works: The parallel evaluation architecture

The key design principle behind DevRev’s guardrail system is concurrency. Rather than inserting a sequential safety check that adds latency to every interaction, DevRev runs guardrail evaluation in parallel with the primary agent reasoning loop, achieving near real-time responses while maintaining strict policy enforcement.

Each interaction flows through the system in five steps:

Input received – Each user message simultaneously triggers the guardrail model and the primary agent large language model (LLM).
Parallel evaluation – The lightweight guardrail model classifies the input against the active policy set default and custom while the primary model begins generating a response.
Gated output – The response stream is held until the guardrail model returns its decision.
Approved path – If the input passes evaluation, precomputed portions of the response release instantly to the user, and the remainder streams subsequently.
Violation detected – If a violation is flagged, the system aborts the pending response and streams a safe, policy-defined fallback instead. The violation is passed back to the agent reasoning loop for handling.

This concurrent evaluation architecture is what enables sub-300 ms guardrail performance without degrading the conversational experience. The flow is shown in the following graphic.

Figure 1: Parallel evaluation flow for real-time guardrails

Why Amazon Nova 2 Lite?

DevRev’s guardrail model runs on every single user message, in parallel with the primary agent LLM. This means the model must be fast, accurate, and cost-efficient at scale simultaneously. After evaluating multiple models available through Amazon Bedrock, DevRev selected Amazon Nova 2 Lite as the best fit for production-grade enterprise safety enforcement based on three deciding criteria:

Speed – Amazon Nova 2 Lite achieves a 247 ms average evaluation time, which is fast enough for real-time guardrails without disrupting user experience. This meets the critical threshold for maintaining conversational fluidity at enterprise scale.
Classification performance – Amazon Nova 2 Lite delivers strong accuracy in detecting prompt injection, flagging sensitive content, and enforcing custom natural-language policies, the exact workload DevRev’s guardrail layer requires.
Cost efficiency – Per-interaction costs remain low across thousands of concurrent agent sessions. Built-in availability on Amazon Bedrock also simplifies scaling and monitoring within DevRev’s AWS based infrastructure.

System context: Computer by DevRev

DevRev is a modern enterprise AI system that unifies fragmented enterprise data through Computer, an AI assistant designed to go beyond chatbots that merely read and summarize. Computer can create, update, and delete records across systems such as Salesforce, Jira, and Zendesk. Understanding the architecture explains why guardrails are not optional: they’re essential infrastructure for agents operating at this level of autonomy.

Computer is powered by two core technologies:

Computer Memory – DevRev’s permission-aware knowledge graph transforms structured and unstructured data from across the enterprise into a dynamic network of interconnected information, maintaining data permissions, context, and compliance requirements throughout.
Computer AirSync – A real-time synchronization engine that continuously synchronizes data bidirectionally across systems, alleviating silos and keeping connected systems aligned.

The following graphic shows DevRev at the center of an interconnected architecture that unifies enterprise data across multiple systems such as Jira and Teams.

Figure 2: Computer by DevRev unifies enterprise data across multiple systems

Computer operates as a true AI teammate across the enterprise, finding answers and reasoning across business context. It acts through AI agents that create tickets, update records, route work, and automate tasks using Computer Agent Studio, delivering enterprise-grade governance through built-in security, permission awareness, and compliance controls. DevRev’s Computer Agent Studio provides an intuitive, low-code environment for teams to design, test, and deploy AI agents. Each agent moves through a defined lifecycle (from design to simulation, validation, and finally publishing) and inherits identity and permissions like a human user, limiting access to only authorized data and operations. This is the execution environment in which guardrails operate: a deterministic, observable, permission-bounded runtime where safety enforcement is built in at the system level.

The following graphic shows Computer executing a multistep ticket reassignment in which it updates eight records, applies escalation tags, and logs changes across multiple systems, including Salesforce and Slack.

Figure 3: Computer executing a multistep ticket reassignment

The following screenshot of the Build dashboard shows the agent configuration interface for a Developer Evangelist agent, including modular sections for knowledge sources, skills, and guardrails alongside a live chat preview panel.

Figure 4: The Build dashboard showing the interface for a Developer Evangelist agent

Enabling safe agent autonomy at enterprise scale

When enterprises can trust that every interaction is evaluated against policy before reaching the user, they can confidently expand the scope of what agents are allowed to do, taking on more complex workflows, accessing more sensitive data, and operating with less human oversight. AI safety, properly implemented, makes greater autonomy possible rather than constraining it.

The production results reinforce this value. When agents resolve 85% of support tickets automatically and save employees more than 10 hours per week, efficiency gains only hold if the underlying AI operates within defined boundaries. By building real-time evaluation directly into the agent execution pipeline powered by the 247 ms average evaluation time of Amazon Nova 2 Lite, DevRev demonstrates that speed and safety can coexist without sacrificing either. For organizations exploring enterprise AI adoption, deploying AI agents is a must, and their challenge is to choose a system that can best enforce the policies, permissions, and AI safety boundaries required by production deployments.

Conclusion

DevRev’s guardrails capability powered by Amazon Nova 2 Lite through Amazon Bedrock demonstrates that enterprise AI safety and operational performance coexist comfortably. With real-time policy evaluation running at 247 ms average latency, natural-language policy authoring, and parallel execution that preserves conversational fluidity, DevRev gives enterprises the foundation to deploy AI agents confidently and at scale. The combination of Computer’s permission-aware architecture with the classification performance of Nova 2 Lite demonstrates how responsible AI and operational efficiency can scale together.

To get started, request a demo and see DevRev’s agent system and built-in guardrails in action. Visit DevRev’s homepage to learn about Computer by DevRev and check out the DevRev blogs for technical articles and updates. Watch Building safer agents at DevRev, a live session with DevRev CTO Ahmed Bashir, for a comprehensive walkthrough of guardrail implementation and real-world use cases.

DevRev – AWS Partner Spotlight

DevRev is an AWS Partner that provides an enterprise AI system unifying customer support, product development, and business operations through Computer, an AI agent system that executes work across enterprise systems while enforcing safety policies with built-in guardrails powered by Amazon Nova 2 Lite on Amazon Bedrock.

Contact DevRev | Partner Overview | AWS Marketplace

AWS and Elastio deliver comprehensive ransomware resilience

Stuart Lupton — Wed, 01 Jul 2026 15:17:54 +0000

By: Cecily Polonsky, Chief of Staff, GTM Strategy – Elastio
by: Stuart Lupton, Senior Specialist SA, Storage – AWS
by: Danny Johnston, Principal Storage Specialist – AWS

Elastio

As ransomware threats grow more advanced, organizations across industries are strengthening their recovery readiness alongside prevention. Forward-thinking teams recognize that a robust recovery capability is a strategic advantage, one that enables confident operations even in the most challenging cyber scenarios. By designing recovery strategies purpose-built for modern threats, organizations gain the ability to restore critical systems quickly and reliably, even when attacks move laterally across production, standby, and backup environments. The result is a resilient posture where recovery points remain trustworthy and teams stay in control.

That’s why leading organizations are building ransomware-aware recovery strategies and, crucially, maintaining continuous visibility into the integrity of their recovery points. Amazon Web Services (AWS) services, including AWS Backup and AWS Elastic Disaster Recovery, provide the foundation for scalable, resilient recovery architectures that address these modern threat scenarios. Alongside partner solutions such as the Elastio Ransomware Recovery Assurance Platform, these services bring ransomware intelligence and recovery validation into a unified approach to resilience.

In this post, we examine how to develop ransomware-aware recovery strategies that are tested, trusted, and ready for the current threat landscape. You’ll see how to use AWS services and Elastio’s ransomware intelligence to gain continuous visibility into what is protected, what is vulnerable, and what can be safely restored, giving your organization the ability to recover when it matters most.

Why ransomware demands a new approach to recovery

For over 70 years, data protection as a strategy has mainly consisted of a combination of:

High availability – In case of a local hardware failure
Business continuity or disaster recovery plan – For recovery in case of a threat event
Backup – An independent copy of the data for restoration

These data protection mechanisms remain valid and critical but haven’t kept pace with ransomware evolution. Traditional strategies assume failures are contained within data centers and won’t travel across networks. Ransomware deliberately exploits lateral connectivity between production, standby, and protection systems to eliminate all recovery avenues post-attack. This evolving risk requires a recovery strategy purpose-built to disrupt ransomware’s lateral movement, one that adds a layer of protection designed to isolate, validate, and preserve clean recovery data when it matters most.

The following graphic illustrates these three operational data protection layers with a cloud-hosted vault as the fourth layer to prevent ransomware lateral movement.

Figure 1: Traditional data protection layers plus a cloud-hosted data vault

A fourth line of data protection – Cloud-hosted data vault

A solution that resilient organizations are adopting is a cloud-hosted data vault (CHDV). A CHDV is an environment that secures mission-critical data assets in an immutable, air-gapped vault so that if ransomware attacks occur, businesses have good copies for recovery. The financial services industry (FSI) has learned how critical its interconnected systems are, and what global consequences could result if those systems fail. In response, financial services have taken a leading role in advancing data vaulting and ransomware recovery strategies.

Regulatory bodies are also driving data vault adoption in financial services. The Hong Kong Monetary Authority (HKMA) released regulatory requirements for Secure Tertiary Data Backups, and New York Department for Financial Services (NYDFS) released requirements for backups that are protected from unauthorized alterations or destruction. In the UK, the Cross Market Operational Resilience Group (CMORG) developed a reference architecture for CHDVs.

AWS and its partners have met this regulatory shift to deliver solutions that build on existing data protection to enable data vault strategies anchored on three essential pillars: immutability, air-gapping, and integrity validation.

How to get started with data vaulting on AWS

AWS has data protection mechanisms within its AWS services portfolio that can be used independently to construct resilient data platforms as needed. AWS Backup centralizes these data protection services and features into one place, using backup policies and job reporting to automate and monitor an organization’s data protection strategy.

A feature of AWS Backup is the logically air-gapped vault. A logically air-gapped vault offers additional security features compared to a standard vault that are automatically applied at creation:

Logically air-gapped vaults are automatically created with compliance mode enabled. Data stored in these vaults is immutable.
An AWS owned key manages encryption of the data. AWS Key Management Service (AWS KMS) managed keys and customer managed keys are also supported.
Restore-only copies of the backups can be shared using AWS Resource Access Manager (AWS RAM) for quick restores and testing.

For on-premises infrastructure and Amazon Elastic Compute Cloud (Amazon EC2) workloads that require near-zero Recovery Point Objectives (RPOs), Elastic Disaster Recovery provides a fast and reliable solution for ransomware recovery. It enables rapid failover by creating a cost-optimized staging area in AWS, allowing servers and applications to be restored within minutes from a designated recovery point.

AWS Backup and Elastic Disaster Recovery both provide robust tools to protect mission-critical data and applications in the event of a ransomware attack. But protection only works if the correct data and systems are included and, just as importantly, if the data that is stored is trustworthy. That’s why visibility into data integrity, actionable insights, and continuous validation are essential components of an effective ransomware resilience strategy.

Elastio Platform 360 Ransomware Resilience – Critical visibility into recovery integrity

For critical insights and visibility into recovery data, organizations are turning to the Elastio Ransomware Recovery Assurance Platform. Elastio is an AWS Partner that brings ransomware-specific intelligence into the recovery process. Elastio integrates directly with AWS Backup logically air-gapped vaults through restore testing and Elastic Disaster Recovery to deliver continuous data integrity validation and visibility into an organization’s recovery posture. In this way, the Elastio Platform addresses the integrity pillar of ransomware recovery.

With ransomware threats growing more evasive, attackers often move slowly and stealthily, encrypting data over time or staging attacks in dormant states. This type of behavior can quietly compromise recovery points, even if they are made immutable or air gapped. Elastio helps customers stay ahead of this risk by continuously validating backup and recovery data against hidden ransomware indicators, insider threats, and silent corruption. The result is a real-time understanding of the recoverability of mission-critical data—a key factor when recovery speed, regulatory compliance, and business continuity are at stake. These insights are delivered through Elastio Platform 360 Ransomware Resilience User Interface (UI), which gives AWS customers a centralized view of recovery health across five core areas:

Recovery Assurance – Confirms the presence of clean, usable recovery points across all protected assets.
Ransomware Safety – Detects ransomware behavior, before or after detonation.
Encryption Safety – Flags unauthorized encryption activity, including slow, stealthy changes indicative of insider threats.
Asset Coverage – Highlights unprotected systems or gaps in the current recovery plan.
Storage Health – Evaluates backup configurations for alignment with best practices for resilience.

The following screenshot shows the Elastio Platform 360 Ransomware Resilience UI dashboard with recovery health metrics across these five core dimensions.

Figure 2: Elastio 360 Ransomware Resilience UI dashboard

Each dimension is scored and monitored over time, offering a quantifiable view of ransomware recovery health. This level of operational visibility is especially important as organizations look for provable recovery readiness. Elastio helps meet those expectations by making recovery posture measurable and continuously verifiable. Critically, Elastio’s insights do more than live inside a dashboard. They drive real, high-impact decisions. Infrastructure teams rely on Recovery Assurance data to flag backups that fall outside the defined RPO windows. Security teams act on Ransomware Safety alerts to detect early-stage threats, pinpoint the last known clean version of compromised assets, and accelerate incident response, ensuring recovery to a verified, uncompromised state. Meanwhile, compliance teams use Asset Coverage intelligence to identify gaps in protection, such as unvalidated workloads, and proactively adjust policies to close those risks.

Elastio also provides a Model Context Protocol (MCP) server, the Elastio MCP Server, giving teams the ability to connect large language models (LLMs) such as Anthropic’s Claude directly to Elastio and use plain English prompts to ask questions, summarize findings, and identify compliance and recovery gaps in real time.

This level of visibility transforms recovery from a reactive process into a proactive discipline. In high-stakes environments like financial services, where cyber insurers, regulators, and boards demand proof of resilience, Elastio helps enterprises answer the question: Can you recover safely?

Conclusion

The data protection landscape has evolved. Where recovery strategies once focused primarily on accidental loss or localized incidents, today’s organizations are building defenses that account for deliberate, targeted attacks. As the barrier to entry for threat actors continues to lower, the most resilient organizations are staying ahead by adopting recovery architectures that assume compromise and ensure rapid, validated restoration regardless of the attack vector. In this environment, visibility, insights, and actionable data are key to understanding what good looks like, and, more importantly, what bad looks like, so it can be corrected. Combining these insights with a validated, clean copy of the data not only gives organizations the ability to recover but also limits the impact on customers and third parties. Together, AWS and Elastio offer a modern, integrated approach to ransomware-aware recovery. From immutability and air-gapping to continuous integrity validation and recovery assurance, their combined capabilities form the foundation of a resilient recovery posture—one designed to restore data as well as trust, operations, and business continuity in the event of a cyberattack.

Elastio – AWS Partner Spotlight

Elastio is the control point for cyber resiliency—because survival depends on clean recoveries. The Elastio Platform continuously validates storage and backups, detects ransomware encryption, and ensures uncompromised recovery, even from zero-days. By bridging the gap between security tools and immutable storage, Elastio removes the risk of unrecoverable data.

Contact Elastio | Partner Overview | AWS Marketplace

Introducing Forward Deployed Engineering for Partners: Winning the Future of Enterprise AI

Chandra Pinapala — Tue, 30 Jun 2026 15:06:19 +0000

By: Karthik Sonti. Head of Agentic AI, Consulting Partners – AWS
By: Erik Farr, Director, Solution Architecture, Consulting Partners – AWS
By: Chandra Pinapala, WW Director, Global Strategic Partners – AWS

Enterprise AI has outgrown the advisory model. Customers are not asking for roadmaps. They are asking who can put production agentic systems into their environment — running under real governance, on real data, in weeks. The shift is from counsel to outcomes. And the partner who delivers outcomes first wins the architecture relationship for the future.

Today, AWS announced Forward Deployed Engineering, a dedicated organization backed by a $1 billion investment to embed thousands of engineers directly with customers to co-develop and deploy agentic AI solutions at speed. FDE teams operate under actual customer constraints from day one and deliver systems structured for self-sufficiency, not ongoing dependency.

Our commitment does not stop with AWS engineers. The new Partner-Led Forward Deployed Engineering Motion extends that investment to our most strategic partners. Not as a certification. Not as a training program. As a durable, embedded delivery capability inside the consulting firms our customers already rely on — the same methodology, the same production bar, operating at the same velocity.

Why Partners, Why Now

Agentic AI has moved past strategy and proof-of-concept into execution. Demand for production-grade agentic systems has outpaced the delivery capacity of any single organization. Customers are no longer asking whether to deploy — they are asking who will build it fast enough to matter. They need to agentify IT operations, engineering workflows, supply chain decisions, and compliance monitoring across every business unit simultaneously.

Partners already hold the customer relationships, the industry context, and the delivery footprint to operate at that scale. What they have not had is a production-grade delivery methodology that compounds with every engagement.

The Agentic Process Transformation initiative gives customers and partners the right mental model for agentification: start with a business process, reimagine it for the agentic world, deploy it into production, and demonstrate measurable results. With APT, we validated both the demand signal and the delivery pattern. It also revealed that partners with deep domain expertise accelerate time-to-production when they operate under the same engineering bar.

The Partner-Led FDE motion takes that insight and makes it durable: a permanent delivery capability embedded inside our partners that holds the same production bar across all agentic work, compounds institutional knowledge with every engagement, and scales independently over time.

A Continuum of Customer Choice

The Partner-Led FDE motion is one part of the broader AWS Forward Deployed Engineering continuum. Customers choose how AWS and Partners show up: The production bar does not change regardless of the mode.

What Makes This Different: The Delivery Harness

Every Partner-Led FDE engagement builds a reusable harness the partner owns permanently: domain ontologies, evaluation frameworks, MCP servers, agent operations tooling, and a context graph that records the architecture choices, evaluation criteria, and domain patterns applied during each build.

The harness captures the knowledge that AWS and partner engineers apply together during a build, so the partner FDE team can apply it independently on subsequent engagements.

Partners also build the agents that amplify their own delivery: an architecture agent that proposes design decisions in real time, an agent-operations layer that bakes governance into everything it ships, and a reusable registry of capabilities that grows with each engagement. The delivery IP stays with the partner. The compounding advantage stays with the partner. The business outcome belongs to the customer.

How it Works

Partners will build ring-fenced, AWS-credentialed engineering teams with AWS support to deliver production agentic systems with AWS services. In early customer engagements, AWS engineers are deeply embedded with the partner to support the build journey. As more of the work moves into reusable patterns, AWS support will shift to helping the partner scale their FDE practice.

Partner AWS-credentialed engineers pass an AWS-defined technical bar before engaging with any customer. This is not a certification checkbox. It is a production-engineering standard, validated against the same methodology that AWS FDE teams use.

Getting Started

We are launching the Partner-Led FDE Motion with a limited set of partners. As we validate the delivery model, sharpen the harness, and scale it, we will extend it to the broader partner network. To get started, connect with your AWS Partner Development Manager.

Learn more about the AWS Forward Deployed Engineering announcement.

How DXC Technology upgraded Angular and .NET applications with Amazon Q Developer

Dhiraj Thakur — Mon, 29 Jun 2026 21:02:07 +0000

By: Charles Christopher, Principal Solutions Architect – DXC Technology
By: Dhiraj Thakur, Senior Solutions Architect – AWS

DXC Technology

Many enterprises adopt microservices and micro-frontend architectures to build scalable, cloud-based platforms. A customer of DXC Technology operated a large-scale, distributed enterprise platform supporting multiple business domains with high availability and continuous delivery.

The platform consisted of more than 80 independently deployed backend microservices; multiple Angular-based micro-frontend applications; separate continuous integration and continuous delivery (CI/CD) pipelines per service; integrations with authentication systems, APIs, and third-party services; and mandatory static application security testing (SAST) and dynamic application security testing (DAST) security validation before production deployment.

Although the architecture was modern, the underlying technology stack had aged. Backend services ran on older .NET versions, and frontend applications used earlier Angular releases—both approaching or past end-of-support. As the platform grew, maintaining outdated frameworks introduced operational risk. Each microservice carried its own dependencies, configurations, and version constraints. Upgrading required careful coordination to avoid breaking API contracts, authentication flows, routing, shared components, and integrations.

With multiple teams owning different services, standardized upgrade patterns, synchronized release planning, and rigorous regression validation were essential. Modernization demanded structured execution across architecture, security, testing, and DevOps. However, modernizing such a large distributed system required a well-planned, automated, low-risk approach to maintain business continuity while accelerating transformation. In this post, we explore how DXC used Amazon Q Developer to successfully upgrade to a newer framework.

Business challenges

DXC’s customer faced mounting operational and security risks from their aging stack:

End-of-life risk – Several Angular and .NET versions were nearing end-of-support, limiting access to security patches and vendor support.
Security exposure – Regular SAST and DAST scans surfaced vulnerabilities from deprecated libraries and unsupported components.
Large-scale complexity – Upgrading more than 80 microservices and multiple micro-frontends required coordinated changes across distributed repositories.
Regression and integration risk – Framework changes could impact API contracts, authentication flows, and service communication, requiring extensive validation.
Cross-team coordination overhead – Multiple teams with inconsistent upgrade approaches led to extended timelines.

A traditional manual upgrade strategy was unsustainable. The customer needed a standardized, automated approach to accelerate upgrades while preserving stability and business continuity.

Proof of concept and prompt engineering approach

Before initiating the full-scale upgrade across so many microservices, DXC conducted a structured proof of concept (POC) to validate the modernization approach using Amazon Q Developer. The objective of the POC was to:

Evaluate migration accuracy to the latest supported framework versions
Identify breaking changes and dependency conflicts
Measure effort savings compared to manual upgrades
Assess security improvements
Validate build and testing stability after migration

During the POC, the team carefully selected a representative set of microservices and one Angular application. Instead of performing direct manual upgrades, developers used Amazon Q Developer with structured prompt engineering techniques.

How prompt engineering was used

The team provided clear and contextual prompts to guide the migration process, such as:

Specifying the source and target framework versions
Asking for deprecated API replacements aligned with best practices
Requesting dependency compatibility checks
Providing build errors and stack traces for troubleshooting
Asking for secure coding improvements

When migration-related build failures occurred, developers supplied configuration files and error logs to Amazon Q Developer. The tool analyzed the context and suggested corrected package versions, configuration updates, and refactored code snippets.This iterative interaction significantly reduced troubleshooting time compared to traditional debugging. The POC demonstrated that Amazon Q Developer could standardize the upgrade process, reduce manual effort, and improve consistency across services. Based on measurable time savings and successful validation, the team proceeded with full-scale modernization across the platform.

Solution design

The customer operated many backend microservices and multiple micro-frontend applications built on older framework versions. The goal was to upgrade the entire platform quickly, securely, and with minimal risk. The process followed four steps:

Developer workstation – Developers worked in Visual Studio and VS Code, connecting legacy applications (Angular 9 or 15, .NET 6 or 7) to Amazon Q Developer directly from their integrated development environments (IDEs).
AI-driven modernization – Amazon Q Developer automatically upgraded Angular 9 or 15 to Angular 20 and .NET 6 or 7 to .NET 8. It fixed deprecated APIs and resolved broken dependencies and security vulnerabilities.
CI/CD and security pipeline – After the applications are modernized, they flow through a fully automated CI/CD and security pipeline. The pipeline has the following components:
1. AWS CodeCommit – Source code repository
2. AWS CodeBuild – Build and unit testing
3. AWS CodePipeline – End-to-end pipeline orchestration
4. Code assessment – Code quality checks
5. SAST tool – Static security scanning
6. Amazon Elastic Container Registry (Amazon ECR) – Container image repository

The pipeline has the following components:

Automated build and test
Code quality validation
Security vulnerability scanning
Container image creation
Secure artifact storage

By using this design, every change is validated, secure, and production ready.

Secure cloud deployment – After successful validation, the applications are deployed to AWS. The frontend deployment consists of:
1. Uses Amazon Simple Storage Service (Amazon S3) for static web hosting
2. Hosts Angular 20 web applications
3. Can be integrated with Amazon CloudFront for global content delivery network (CDN)

The backend deployment consists of:

Amazon Elastic Kubernetes Service (Amazon EKS) for containerized microservices
Runs .NET 8 microservices
Supports auto scaling and high availability

The following high-level architecture diagram illustrates the solution design.

Figure 1: Solution design

Security validation

Before production promotion, DXC implemented multiple security validation layers. Beyond traditional SAST and DAST scans, Amazon Q Developer proactively identified security concerns during development—flagging insecure patterns, deprecated libraries, and recommending secure alternatives for authentication and configuration handling.This early AI-assisted review reduced vulnerabilities before code entered the CI/CD pipeline. Formal SAST and DAST scans then maintained compliance with enterprise security policies. Combining AI-driven review with automated scanning strengthened the platform’s security posture and production readiness.

Testing and validation

After the upgrade, DXC ran automated unit tests within the CI/CD pipeline to validate framework compatibility and functional correctness. Integration testing verified service communication, authentication flows, and API contracts, and regression testing confirmed that existing workflows remained unaffected. Amazon Q Developer helped developers quickly resolve issues from deprecated APIs or configuration changes, reducing stabilization time before deployment.

Customer benefits

By using Amazon Q Developer for application upgrades, the customer was able to modernize both frontend and backend applications faster and with much lower risk. They enjoyed several benefits:

Faster upgrades across a large platform – The customer was able to upgrade more than 80 microservices and several micro-frontend applications in a structured and consistent way. Tasks that would normally take several months using manual effort were completed much faster in few weeks, helping the team meet security and compliance timelines.
Less manual work and fewer errors – Upgrading frameworks usually involves a lot of manual changes, such as fixing deprecated APIs, updating dependencies, and resolving build issues. Amazon Q Developer handled most of this work automatically, reducing manual effort and lowering the chance of mistakes across multiple codebases.
Stronger security and compliance – Moving to supported framework versions helped resolve issues found during SAST and DAST scans. By replacing outdated and vulnerable libraries, the platform became more secure and aligned with security and compliance requirements.
Lower risk during testing and rollout – The upgrades were applied in a consistent way across services, which reduced unexpected behavior and integration issues. This helped minimize regression risks and reduced the time needed for testing and stabilization.
Cleaner and easier-to-maintain code – After the upgrades, the applications followed modern framework standards and best practices. This made the code easier to understand, maintain, and extend, simplifying future enhancements and upgrades.
Better long-term stability – By upgrading to long-term support (LTS) versions, the customer received continued access to security patches, bug fixes, and vendor support. This reduced operational risk and improved platform stability.
Higher developer productivity – With much of the upgrade work automated, developers were able to focus more on delivering business features instead of spending time on repetitive technical tasks. This improved overall team productivity.
Cross-team consistency – Amazon Q Developer enforced a common upgrade approach, reducing dependency conflicts during integration.

Productivity metrics

By using Amazon Q Developer for framework modernization, DXC significantly reduced the total upgrade effort compared to a manual approach. On average, manually upgrading a single microservice required approximately 16–24 developer hours, including dependency updates, deprecated API fixes, build issue resolution, security remediation, and testing. For more than 80 microservices, this would have required an estimated 1,600–2,000 total developer hours. With Amazon Q Developer, the average upgrade time per service was reduced to approximately 4–6 hours, bringing the total effort down to roughly 400–600 hours. This resulted in an estimated savings of 1,200–1,400 developer hours, representing a 60–75% reduction in overall upgrade effort while maintaining security and quality standards.

Key learnings

Structured POC validation reduces large-scale upgrade risk.
Prompt engineering significantly improves AI modernization accuracy.
Standardizing upgrade patterns across teams minimizes integration failures.
AI-assisted troubleshooting reduces debugging time but still requires engineering validation.
Combining AI modernization with SAST or DAST strengthens production readiness.
Upgrading to LTS versions provides long-term operational stability.

Conclusion

By combining AWS AI tooling with deep engineering expertise, DXC helped its customer transform a high-risk, long-duration modernization effort into a fast, secure, and scalable success.

DXC – AWS Partner Spotlight

DXC is an enterprise technology and innovation partner that helps global enterprises and public sector organizations run efficiently and modernize their systems. We provide end-to-end solutions across every technology domain, keeping critical systems resilient, compliant, scalable, streamlined and protected with our Business Process Services, Cloud & Infrastructure, Cybersecurity, Enterprise Applications, Infrastructure Protection, Managed Applications, Modernization as a Service and Modern Workplace solutions.

Contact DXC Technology | Partner Overview | AWS Marketplace

Securing AI-driven APIs on AWS with Wallarm

Aliaksei Ivanou — Tue, 23 Jun 2026 21:50:15 +0000

By: Craig Riddell, Global Field Chief Information Security Officer (CISO) – Wallarm
By: Aliaksei Ivanou, Worldwide Security & Identity Senior Partner Solutions Architect (PSA) – AWS

Wallarm

As organizations deploy AI-driven APIs on Amazon Web Services (AWS), security teams have an opportunity to enable rapid AI adoption while maintaining full visibility into how these workloads operate. AWS is architected to be the most secure global cloud infrastructure on which to build, migrate, and manage applications and workloads. Together, AWS and Wallarm deliver a comprehensive security architecture that combines foundational cloud controls with specialized runtime visibility for AI-driven APIs. In this post, you’ll learn why runtime visibility is essential for AI-driven APIs and what capabilities address this need.

The visibility gap in AI security

As AI applications scale in production, the API layer becomes the primary interface for AI interactions. Traditional security controls weren’t designed to provide visibility into what happens at runtime within these dynamic, stateful conversations.Every prompt, every model response, every tool invocation, and every automated decision flows through APIs. This creates a fundamentally different security surface than traditional applications. Existing controls weren’t designed to answer the following questions AI workloads raise:

What is this agent doing with the permissions it was granted?
Is this model response revealing sensitive or confidential information?
Which APIs are being called by autonomous agents and are they authorized?
How do you validate outcomes, not just inputs?

This is not about generative AI alone. As organizations move toward agentic systems, multi-service orchestration, and automated decision-making, APIs become the control plane for how everything operates. The difference between what security teams can observe and what is actually happening continues to grow.

The benefits of extending visibility to AI workloads

AWS is architected to be the most secure global cloud infrastructure on which to build, migrate, and manage applications and workloads. AI workloads introduce behaviors that require continuous visibility, and you should work to ensure that your tools and controls provide that visibility.Issues appear as normal-looking traffic. AI-related security issues often don’t trigger traditional signatures or rules. A prompt injection looks like a valid user request. An over-permissioned agent making unintended API calls appears as authorized traffic. The structure is correct; the intent is not.Continuous discovery keeps pace with deployment velocity. With runtime visibility, security teams maintain a current inventory of AI services, models, and APIs as they appear in production, confidently answering the question, “What is actually running in production?”Outcomes are not validated. Security controls have focused on inspecting inputs, validating requests, checking permissions, and filtering malicious content. But with AI, the output matters as much. Model responses can inadvertently disclose sensitive data, reveal internal logic, or provide incorrect information that drives business decisions.None of this suggests existing controls are insufficient. It means AI workloads require an additional layer of visibility that complements perimeter security with runtime awareness.

Extending AWS security with runtime visibility

The solution is extending your security architecture with capabilities designed specifically for AI workloads. AWS provides strong foundational controls, and Wallarm adds specialized runtime visibility that helps customers observe and respond to AI-specific behavior.Organizations that successfully secure AI at scale focus on three complementary capabilities:

Continuous API and AI service discovery – Maintain an accurate, real-time inventory of APIs and AI services in production, including those deployed outside formal processes. This provides the foundation for understanding your actual attack surface.
Behavioral detection beyond signatures – Identify unintended behavior even when requests appear valid. This includes detecting prompt injection attempts, identifying anomalous agent behavior, and flagging unexpected data access patterns.
Runtime output validation – Inspect model responses and API outputs before they reach users or downstream systems. This prevents data disclosure, validates response appropriateness, and verifies AI systems operate within defined boundaries.

These capabilities layer into existing AWS architectures without requiring re-architecture. They complement AWS controls by extending visibility into runtime behavior across APIs and AI workloads.

Financial services AI deployment

The following scenario is drawn from common patterns observed across multiple controlled security assessments in the financial services sector and doesn’t represent any specific customer deployment.

A regional financial institution deployed an AI-powered customer service assistant using Amazon Bedrock. The architecture followed AWS best practices, including using Amazon API Gateway for access control, AWS WAF for threat filtering, Amazon CloudFront for content delivery, and Amazon Virtual Private Cloud (Amazon VPC) isolation for network security. The team at the financial institution reviewed and approved the deployment, which met all internal security requirements.

During a proactive security assessment, the team introduced runtime visibility capabilities to evaluate the full AI ecosystem, not only the primary application but all supporting APIs, integrations, and services.The assessment identified three areas of runtime behavior that existing perimeter controls weren’t designed to surface:

Prompt injection disclosing internal logic – Carefully crafted prompts can cause the model to reveal information about internal system architecture and business rules.
Unintended API exposure – A development endpoint remained accessible from the production environment, creating an unmonitored access path.
Sensitive data in model responses – Under specific conditions, the model included customer financial information in responses that should have been redacted.

When the team implemented runtime visibility, they gained:

Complete API inventory – Identification of services that hadn’t been formally documented, including shadow APIs deployed by development teams
Real-time behavioral detection – Ability to identify and block prompt injection attempts and anomalous agent behavior as they occurred
Output validation – Inspection of model responses before delivery, preventing data disclosure and supporting compliance with data handling policies

The outcome was enhanced security posture without re-architecting the AWS environment.

Measuring success from architecture to outcomes

Security leaders increasingly measure success by what they can observe and prevent in production. Deploying controls is necessary but insufficient—the real indicator is whether those controls reduce the time between a threat appearing and being stopped.Organizations that add runtime visibility to their AWS security architecture report improvements across three dimensions:

Coverage – Moving from partial visibility to comprehensive awareness of APIs and AI services in production, including those deployed outside formal processes
Risk reduction – Decreasing the time between deployment and security validation, reducing the window of exposure for new AI services
Mitigation effectiveness – Improving the ratio of threats detected to threats prevented, moving from logging and alerting to active prevention

These outcomes translate directly to business value: faster AI deployment with maintained security posture, reduced compliance risk, and increased confidence in AI-driven decision-making.

Moving forward

AI is accelerating how organizations build applications, how systems interact, and how quickly new risks emerge. AWS provides the strong foundation required to build secure, scalable AI workloads. The AWS Partner Network (APN) extends that foundation with specialized capabilities that help customers maintain visibility and governance as AI adoption scales.

The next step is supporting visibility into what is happening at runtime, understanding your APIs, your AI services, and how they interact in production.Consider these questions as you evaluate your AI security posture:

Inventory – Do you have complete visibility into APIs and AI services running in production, including those deployed outside formal processes?
Behavioral risk – Can you detect risky behavior, such as prompt injection, anomalous agent activity, or unexpected data access patterns?
Output validation – Are you validating AI outputs as well as inputs to prevent data disclosure and verify response appropriateness?
Outcome measurement – How do you measure whether your security controls are effective, not merely deployed, in preventing threats specific to AI workloads?

Runtime visibility helps organizations extend visibility and governance across AI workloads as they operate in production. To explore how runtime visibility can strengthen your AI security posture, visit Wallarm in AWS Marketplace.

Wallarm – AWS Partner spotlight

Wallarm is an AWS Advanced Technology Partner and independent software vendor (ISV) specializing in API security and AI runtime protection. Wallarm integrates natively with AWS services including Amazon API Gateway, Amazon CloudFront, Elastic Load Balancing (Application Load Balancer), and Amazon EKS to provide continuous API discovery, behavioral threat detection, and runtime output validation for AI workloads. Through the APN, Wallarm helps AWS customers deploy AI with confidence by extending native controls with the runtime visibility layer that modern AI applications require. Wallarm is available in AWS Marketplace, where customers can deploy using existing AWS commitments and streamline procurement.

Contact Wallarm | Partner Overview | AWS Marketplace

Automate security and observability with Elastic and Amazon Bedrock

Ganesh Ramesh Shenoy — Thu, 18 Jun 2026 17:03:22 +0000

By: Udayasimha Theepireddy, Senior Principal Solutions Architect – Elastic
By: Ganesh Ramesh Shenoy, Solutions Architect – AWS
By: Srinivas Pendyala, Senior Partner Solutions Architect – AWS

elastic

As cloud-native architectures grow in complexity, your security analysts and site reliability engineers (SREs) need faster ways to correlate events, investigate incidents, and resolve issues. The manual hand-offs between tools pivoting across consoles, copying data, deciding next steps are where response time goes. That gap widens the moment an attacker or incident moves faster than the analyst watching the screen.

Elastic’s AI-powered features, powered by Amazon Bedrock, close that gap. Instead of stopping at detection, the platform investigates and acts, so your team moves from alert to resolution faster. Analysts reclaim the hours they spent on correlation and triage and redirect them to strategic threat hunting and operational improvements that require human judgment.

In this post, you learn how these capabilities accelerate security and observability workflows through conversational agents, automated workflows, and custom AI agents and how to get started on AWS.

Elastic’s AI-powered features on Amazon Bedrock

Elastic has evolved its AI-powered capabilities from conversational assistance to full workflow automation. What started as Elastic AI Assistant, a conversational interface for querying threat intelligence and analyzing logs, has grown into a comprehensive platform that combines intelligent agents with automated workflows.Today, Elastic’s AI-powered features include three core capabilities:

Elastic AI Assistant – The conversational AI foundation that helps you query data in natural language, summarize alerts, and receive investigation guidance
Elastic Workflows – A declarative automation engine that orchestrates multi-step processes across Elasticsearch, Kibana, and external systems like Slack, Jira, and PagerDuty. You define workflows in YAML with triggers, conditional logic, and AI steps that run automatically
Elastic Agent Builder – A framework for building custom, context-driven AI agents grounded in your data. You define agent instructions, assign tools, and deploy agents that reason across your indices to provide accurate, actionable answers via chat, API, MCP, or A2A

These capabilities work together. Agents can invoke workflows when action is required. Workflows can invoke agents when investigation or reasoning is needed. Amazon Bedrock provides the scalable foundation model layer, delivering managed access to foundation models with security and compliance built in. The default chat experience in Elastic is now powered by Agent Builder, providing an agentic interface for interactive investigation and automation. AI Assistant remains available for features such as knowledge base integration, data anonymization, and chat sharing.

You can choose the foundation model that best fits your needs. Elastic handles authentication, routing, and optimization through the Elastic-managed LLM connector, which by default uses Amazon Bedrock with Claude models. As new models become available on Amazon Bedrock, you can adopt them without disrupting your existing workflows.

Accelerating security operations

With these capabilities, you automate the full lifecycle of security investigation and response. Here is how the capabilities work together in a typical security workflow. When a security alert fires, Elastic Workflows can automatically trigger an investigation. The workflow invokes an AI agent built with Agent Builder that is grounded in your security playbooks and threat intelligence. The agent analyzes the alert context, correlates signals across indices, and surfaces findings. Based on those findings, the workflow continues with structured response actions: creating a case, notifying your team through Slack, enriching the alert with context, or triggering remediation. For interactive investigation, you use Elastic AI Assistant to ask questions in natural language. For example, you can ask: “Show me all failed login attempts from unusual geographic locations in the last 48 hours that correlate with data exfiltration patterns.” The assistant analyzes event patterns and provides recommended next steps.

Key capabilities across security operations:

Attack discovery – Automatically identifies and prioritizes coordinated threats across your environment, reducing alert noise and surfacing the incidents that matter most
Automated investigation – Workflows trigger AI agents on alert, enabling immediate triage without waiting for an analyst
Alert summarization and triage – Generates natural language summaries so you can quickly understand severity and prioritize your response
Incident response automation – Workflows orchestrate response actions across Jira, Slack, PagerDuty, and internal systems based on AI findings
Custom security agents – Build agents tailored to your SOC with specific instructions, tools, and security profiles using Agent Builder

This approach shifts your SOC from reactive, manual investigation to automated, AI-driven response. Analysts focus on decisions that require human judgment while automation handles the repetitive correlation and triage work.

Optimizing application performance and observability

As a site reliability engineer, use Elastic’s AI capabilities to diagnose and respond to performance issues across complex microservices architectures. The same agent and workflow patterns apply to observability use cases. When an observability alert fires, a workflow can invoke an AI agent to correlate signals from logs, metrics, and traces. The agent identifies the likely root cause, and the workflow orchestrates next steps: notifying the on-call engineer, creating an incident ticket, or triggering a remediation runbook. For interactive troubleshooting, you ask questions in plain language. For example: “What’s causing the latency spike in our payment service over the last hour?” Elastic AI Assistant pinpoints the root cause and recommends next steps.

Key capabilities across observability:

Root cause analysis – AI agents correlate application traces, logs, and metrics to identify performance bottlenecks across distributed services
Automated remediation – Workflows run predefined response actions when specific conditions are met, closing the loop between detection and resolution
Log analysis and interpretation – Explains error messages and log patterns in natural language, reducing time spent on manual analysis
Query assistance – Helps you write ES|QL queries for specific observability use cases, accelerating data exploration

The platform analyzes logs, metrics, and traces simultaneously, providing insights that are difficult and time consuming to gather manually. With workflows automating the response path, you can resolve issues before they affect end users.

Solution architecture

The architecture on AWS combines multiple services to deliver a scalable, secure, and high-performing solution. The following diagram shows an end-to-end AI-powered threat detection and automated remediation architecture.

A compromised IAM credential triggers unusual API activity. AWS CloudTrail, VPC Flow Logs, and AWS Security Hub stream these security events into Elastic Cloud on AWS, where they are enriched with threat intelligence and correlated by Attack Discovery – powered by Amazon Bedrock through AWS PrivateLink – to surface a high-confidence threat alert. Elastic AI Assistant helps the security analyst investigate in natural language, while Agent Builder runs deeper automated analysis. Based on the findings, Elastic Workflows automatically revoke credentials, isolate affected resources, and notify the team through Slack, PagerDuty, and Jira – reducing mean time to detect and respond from hours to minutes.

Figure 1 – End-to-end AI-powered threat detection and automated remediation architecture

Core components:

Elastic Cloud on AWS – Provides the search and analytics foundation with automatic scaling
Elastic-managed LLM – Connector that by default uses Amazon Bedrock with Claude models, handling authentication and model management automatically
Amazon Bedrock – Delivers managed access to foundation models with security and compliance
Elastic Workflows – Automation engine that orchestrates actions across Elastic and external systems
Elastic Agent Builder – Framework for deploying custom AI agents grounded in your Elasticsearch data

This architecture supports data privacy and security while delivering sub-second response times. You benefit from continuous model improvements and optimizations without manual intervention, reducing time to value.

Organizations using this approach have reduced mean time to respond by up to 99% and cut critical incidents by 95%.

Conclusion

Elastic combines its search expertise with Amazon Bedrock’s foundation models to automate security and observability workflows. With AI Assistant for conversational investigation, Workflows for automated response, and Agent Builder for custom AI agents, you get a complete platform for moving from detection to resolution faster. You can get started today and grow into these capabilities as your needs evolve.

Getting started

Elastic Cloud on AWS is available through AWS Marketplace, offering a path to deployment with integrated billing. With Elastic Cloud on AWS, focus on analyzing data instead of managing infrastructure.

After deployment, enable AI Assistant for conversational investigation, create workflows for automated response, and build custom agents with Agent Builder. The Elastic-managed LLM connector comes pre-configured to use Amazon Bedrock by default, requiring minimal setup.

To learn more, explore Elastic Security and Elastic Observability. To discuss how this solution fits your environment, contact an AWS representative.

Elastic – AWS Partner Spotlight

Elastic is an AWS Advanced Technology Partner with AWS Competencies in Security, Data & Analytics, Financial Services, Government, AI Software, and Education. Elastic participates in the AWS ISV Accelerate Program and the AWS ISV Workload Migration Program. The Elastic Search AI Platform helps everyone find the answers they need in real time, using all their data, at scale. Solutions for search, observability, security, and generative AI are used by thousands of companies, including more than 50% of the Fortune 500.

Contact Elastic | Partner Overview | AWS Marketplace

Securing enterprise ready AI agents with Auth0 for AI Agents and Amazon Bedrock AgentCore

Jose Alvarez — Thu, 18 Jun 2026 16:27:52 +0000

by: Jose Alvarez, Partner Solutions Architect – AWS
by: John Walsh, Partner Solutions Architect – AWS
by: Anthony Smith, Sr. Partner Solutions Architect – AWS
by: Wayne Smiley, Principal Solutions Engineer – Auth0
by: Kapil Patil, Sr. Partner Solutions Architect – Auth0

Auth0

AI agents do more than answer questions. They read emails, book meetings, pull customer records, and take actions across systems on behalf of your users. By extending identity controls to these agents, you give each one a proper identity, scope its permissions to exactly what it needs, and gain a clear audit trail behind every action.

Auth0 for AI Agents provides the complete identity lifecycle for agents built on Amazon Bedrock AgentCore. Together, they let the agents you build, deploy, and operate share the same identity foundation as your workforce and customer applications.

In this post, we walk through how Auth0 and AgentCore come together across the areas that matter most: authenticating users to agents, securing agent-to-agent communication, governing tool access, enforcing fine-grained authorization, and preserving human-in-the-loop approvals.

Securing AI in a world without a blueprint

AI agents are a new category of software. Unlike traditional applications that follow predefined workflows, AI agents can reason about a problem, decide which tools to use, and take actions across multiple systems on their own. Consider an agent handling an IT support request. It might look up a user’s account information in one system, reset a password in another, and search internal documentation in a third. Each step involves different data, different permissions, and different levels of risk.

Gartner predicts that 40% of enterprise applications will integrate task-specific AI agents by the end of 2026, up from less than 5% in 2025. The AWS Security Reference Architecture provides prescriptive guidance on securing agentic workloads, but when teams move fast, common shortcuts create real exposure:

Shared API keys give agents broad access without awareness of which user they’re acting for.
Hard-coded credentials sit in configuration files, where they’re difficult to rotate and hard to scope to a specific user or action.
Passing tokens through a large language model (LLM) and its reasoning layer can disclose credentials in ways that are difficult to monitor with traditional application security tooling.

These shortcuts compound when the access control model itself wasn’t built for agentic workloads. Role-based access control (RBAC), for example, assigns permissions based on a user’s role at login time. AI agents discover information dynamically during a conversation and might need different permissions for each action they take. In this case, you need authorization that evaluates permissions on an ongoing basis, at the level of individual actions, and adapts in real time as roles and relationships change.

For sensitive operations, there is also the question of when a human should still make the final call. Compliance requirements in regulated industries such as healthcare, finance, and government increasingly require that high-risk actions, like resetting a password or modifying financial records, receive explicit human approval before an agent can proceed.

These challenges point to a common need: identity and access management must sit at the center of your AI agent security strategy.

How Auth0 and Amazon Bedrock AgentCore work together

Auth0 for AI Agents and Amazon Bedrock AgentCore address different but complementary parts of this challenge. Understanding what each service is responsible for is key to seeing how they work together.

Auth0 for AI Agents gives you the enforcing function for user identity in agent workflows. It uses upstream identity providers, such as Okta or social connections, to create and maintain the user’s identity so agents operate on behalf of the authenticated and authorized user. Auth0 provides the identity context and fine-grained access control based on the user’s profile and permissions.

Amazon Bedrock AgentCore provides the runtime infrastructure for building, deploying, and operating AI agents at scale. It validates inbound requests to agents and routes outbound tool invocations through Amazon Bedrock AgentCore Gateway, acting as the execution boundary for agent interactions and applying access control across services from Amazon Web Services (AWS) and external systems.

Consistent with the AWS Shared Responsibility Model, AWS and Auth0 provide the services and controls; you’re responsible for configuring identity policies, authorization rules, and approval workflows appropriate for your workloads.

The next sections describe how Auth0 and AgentCore come together across the key areas of agent security.

Restricting access to authenticated users

Before an AI agent can respond to a request, it needs to verify who’s asking. AgentCore uses Auth0 as the identity provider through standard OpenID Connect (OIDC) discovery, so only users with the appropriate credentials and access rights can invoke an agent. Your users authenticate through the same Auth0 login experience they use across your other applications, including enterprise connections to identity providers such as Okta. That means your AI-powered workflows inherit the same multi-factor authentication (MFA) policies and session management as your traditional applications. The following screenshot shows the Auth0 dashboard with the available enterprise identity provider connections.

Figure 1: Auth0 dashboard

Delegating user identity for API calls

When an agent needs to call an external API on behalf of a user, for example to retrieve calendar events from Google or look up account information in a customer relationship management (CRM) system, it needs to act with that user’s permissions without exposing their credentials. Auth0 delegates user identity to the agent, and Auth0 Token Vault stores the access tokens from upstream identity provider connections. Agents retrieve these tokens just in time through a token exchange mechanism, scoped to the specific agent and user combination. The tokens don’t pass through the agent’s reasoning layer. This workflow is shown in the following diagram.

Figure 2: Auth0 Token Vault delegating user identity so the password reset agent can call an external API with a just-in-time federated token

Securing agent-to-agent communication

In multi-agent architectures, a supervisor agent delegates tasks to specialized subagents, and each interaction between agents needs to be authenticated. Auth0 machine-to-machine (M2M) tokens authenticate these interactions following the agent-to-agent (A2A) protocol, an open specification for how autonomous agents authenticate and exchange requests. With A2A in place, agents don’t operate on implicit trust.

Figure 3: A2A authentication flow showing how Auth0 M2M JWT tokens authenticate agent-to-agent communication between the supervisor agent and subagents.

Governing tool access through the gateway

When an AgentCore Runtime agent needs to reach external APIs or Model Context Protocol (MCP) servers, AgentCore Gateway manages and controls those outbound connections. The user’s Auth0-issued access token is included in requests to the gateway, which validates the token’s signature, expiration, audience, and custom claims before routing the invocation to downstream tools. Only requests backed by a valid, Auth0-issued identity reach downstream resources. For direct MCP integrations that bypass the gateway, authentication is handled by the MCP server’s own configuration and credential management

Figure 4: AgentCore Gateway governing tool access, with Auth0 M2M JWT validation before invoking the Lambda documentation search tool

Enforcing fine-grained authorization

Auth0 Fine-Grained Authorization (FGA) provides a framework for defining and enforcing granular permissions based on user attributes and relationships. FGA evaluates permissions at the time of each agent action and can adapt in real time as roles and relationships change, giving organizations ongoing control over what each agent can do on behalf of a given user.

Keeping humans in the loop for sensitive operations

For high-risk actions, Auth0 Client Initiated Backchannel Authentication (CIBA) lets the agent pause its workflow and send a push notification to the user’s device requesting explicit approval. AgentCore can use Auth0 CIBA actions to establish this out-of-band approval channel. The agent only proceeds after the user confirms, preserving human judgment for these operations.

Managing credentials

Both Auth0 and Amazon Bedrock AgentCore provide token vault capabilities with distinct, complementary responsibilities, and in most production deployments, you’ll use both:

Auth0 Token Vault stores tokens for upstream identity provider connections. Use it when your agent needs to act on behalf of a user against third-party APIs (such as Google, Salesforce, or Microsoft 365) without requiring repeated OAuth flows.
Amazon Bedrock AgentCore Identity token vault can initiate and run the full OAuth 2.0 approval flow needed to reach downstream resources, and it stores the resulting tokens for later noninteractive use by agents. Use it when AgentCore itself is brokering access to resources the agent depends on at runtime.

In both cases, credentials are scoped, short-lived, and aren’t exposed to the agent’s reasoning layer.

The following diagram shows the solution architecture.

Figure 5: Reference architecture showing how Auth0 for AI Agents provides OIDC login, fine-grained permissions, and async authorization for agents running on Amazon Bedrock AgentCore Runtime

Why it matters for AWS customers

If you’re already using Auth0, Amazon Bedrock AgentCore support for external identity providers gives you a straightforward path to securing AI agents with the same identity service you use to protect your existing applications. Instead of building separate identity infrastructure for AI agents, you can connect your Auth0 tenant to AgentCore and apply familiar authentication flows, user directories, and security policies to your AI-powered workflows.

This collaboration between AWS and Auth0 is designed to reduce identity overhead for your agent developers and replace fragmented security with a consistent, maintainable model. Your product teams can focus on building agent capabilities, while identity and access management is handled by services purpose-built for it.

Auth0 is offered through AWS Marketplace, making it straightforward for customers to procure and deploy on AWS.

Getting started

You can start bringing Auth0 for AI Agents and Amazon Bedrock AgentCore together in your AWS account today. Wherever you are in your agent journey, there’s a path forward.

To talk through an implementation for your workloads, contact your AWS account team or reach out through the AWS partner contact form.

Auth0 – AWS Partner Spotlight

Auth0 is an AWS Security Competency Partner that takes a modern approach to customer identity and enables organizations to provide secure access to any application, for any user. Auth0 is a highly customizable platform that is as simple as development teams want, and as flexible as they need.

Contact Auth0 | Partner Overview | AWS Marketplace

Transform enterprise visual content with Amazon Nova and Bria Fibo

William Quigley — Wed, 17 Jun 2026 16:48:11 +0000

By: William Quigley, Partner Solutions Architect – AWS
By: Gil Shefler, Partnerships – Bria

Bria

If you’ve tried using existing image models for marketing campaigns, product shots, or branding, you know the frustrations. Outputs are unpredictable. Brand representation drifts. Results can’t be reproduced. And the legality of the training data is an open question. The root problem is fundamental: traditional text-to-image models treat generation as a creative process rather than an engineering task. Ambiguous text prompts produce inconsistent results, making it nearly impossible to maintain brand consistency or achieve reproducible outcomes. For enterprises requiring precise control, auditability, and legal compliance, this unpredictability makes existing tools difficult to use effectively.

In this post, you’ll learn how the integration of Amazon Nova and Bria Fibo solves these enterprise challenges through a deterministic, legally compliant approach to visual content generation. You’ll learn about the architecture that enables precise control, the legal safety that protects your organization, real-world use cases, and how to get started.

A deterministic approach to visual generation

Bria Fibo is a deterministic visual foundation model (FM) that transforms unpredictable text-to-image generation into a precise, reproducible system. Rather than relying on ambiguous prompts, Fibo uses Visual Generation Language (VGL)—a structured JSON-based format that provides fine-grained control over more than 100 image attributes including lighting, composition, color, and camera settings.

Built on an 8-billion-parameter architecture, Fibo interprets structured JSON instructions to generate images with the precision enterprises need for marketing campaigns, ecommerce catalogs, and digital content that demands brand consistency and reproducibility.VGL provides machine-readable specifications for every visual parameter. This approach shifts image generation from a probabilistic guessing game into a deterministic engineering task. The model is trained on structured JSON captions of over 1,000 words, designed to understand and control different visual parameters with precision.

Legal safety through licensed data

Bria trains its models exclusively on licensed data through partnerships with Getty Images, Depositphotos, Envato, Freepik, and other accredited partners. This approach provides full copyright and privacy indemnity (subject to Bria’s terms), reducing the liability risks that affect many generative AI solutions.

Typical text-to-image FMs maximize creativity across entire images, but Bria focuses on predictable outputs with respect to brand data. Most multimodal models struggle to maintain brand integrity without costly fine-tuning. Bria also uses patented attribution technology that provides logs of source images used in generation, supporting proper compensation for content creators.

Bria’s solution is available in AWS Marketplace, with deployments on Amazon SageMaker AI, so your intellectual property is protected by containing image generation in Amazon Virtual Private Cloud (Amazon VPC).

Amazon Nova foundation models

Amazon Nova provides frontier intelligence and industry leading price performance for understanding and generating content. These state-of-the-art FMs excel at text generation and vision-language tasks at a fraction of the cost of comparable solutions—at least 75% less expensive than comparable models in their respective intelligence classes.

The vision-language capabilities of Amazon Nova enable it to understand and describe images with high accuracy, and its text generation capabilities produce structured, high-quality outputs including JSON formatting. The Nova family includes understanding models, Nova Lite and Nova Pro, that process text, image, and video inputs to generate text output. Nova models support over 200 languages.The multimodal capabilities of Amazon Nova encompass visual understanding (image and video), document visual understanding including handwriting and annotations, multimodal document processing and analysis, chart comprehension, and agentic interaction. The affordability and capability of Nova make it well-suited as an orchestration layer for complex AI workflows.

The Amazon Nova to Fibo integration architecture

The integration of Amazon Nova and Bria Fibo creates a precise, cost-effective pipeline for enterprise image generation and editing. The following workflow diagram illustrates how these systems work together to transform natural language into precise visual outputs.The workflow demonstrates how Amazon Nova translates creative prompts such as “two models in business attire walking on a city sidewalk in summer” into structured VGL specifications, which Fibo then uses for deterministic image generation. Note the bidirectional flow—this closed-loop system enables both initial generation and iterative refinement. The following figure shows the Amazon Nova and Bria architecture.

Figure 1: Amazon Nova and Bria architecture

The following code block is the VGL generated by Amazon Nova as input to the Bria Fibo model:

{
	"short_description": "Two models dressed in professional business attire are walking on a bustling city sidewalk during a warm summer day. The scene captures the vibrant energy of urban life with clear blue skies and a backdrop of modern buildings.",
	"objects": [
		{
			"description": "A model dressed in a tailored business suit, wearing a crisp white shirt, a dark blue blazer, and black leather dress shoes. The model has short, neatly styled hair and is carrying a sleek black leather briefcase.",
			"location": "center-left",
			"relationship": "walking alongside the other model",
			"relative_size": "medium-to-large within frame",
			"shape_and_color": "humanoid, light and dark shades of blue and black",
			"texture": "smooth",
			"appearance_details": "The model's attire is polished and professional, reflecting the summer heat with a light, breathable fabric.",
			"pose": "walking confidently",
			"expression": "calm and focused",
			"clothing": "crisp white shirt, dark blue blazer, black dress shoes",
			"action": "walking",
			"gender": "male",
			"skin_tone_and_texture": "light skin, smooth",
			"orientation": "facing forward"
		},
		{
			"description": "A model dressed in a business suit, wearing a light pink blouse, a light grey blazer, and black leather dress shoes. The model has long, straight hair tied back in a low ponytail and is carrying a small black leather handbag.",
			"location": "center-right",
			"relationship": "walking alongside the other model",
			"relative_size": "medium-to-large within frame",
			"shape_and_color": "humanoid, light shades of pink, grey, and black",
			"texture": "smooth",
			"appearance_details": "The model's attire is stylish and professional, with a light, breathable fabric suitable for the summer heat.",
			"pose": "walking confidently",
			"expression": "calm and focused",
			"clothing": "light pink blouse, light grey blazer, black dress shoes",
			"action": "walking",
			"gender": "female",
			"skin_tone_and_texture": "light skin, smooth",
			"orientation": "facing forward"
		}
	],
	"background_setting": "The background features a modern cityscape with tall glass and steel buildings, lush green trees lining the sidewalk, and a clear blue sky. The sidewalk is bustling with people, and there are street vendors and cafes adding to the lively atmosphere.",
	"lighting": {
		"conditions": "bright daylight",
		"direction": "front-lit",
		"shadows": "long, soft shadows"
	},
	"aesthetics": {
		"composition": "rule of thirds",
		"color_scheme": "cool complementary colors",
		"mood_atmosphere": "energetic and professional",
		"preference_score": "very high",
		"aesthetic_score": "very high"
	},
	"photographic_characteristics": {
		"depth_of_field": "shallow",
		"focus": "sharp focus on subjects",
		"camera_angle": "eye-level",
		"lens_focal_length": "standard lens (e.g., 35mm-50mm)"
	},
	"style_medium": "photograph",
	"context": "This is a concept for a high-fashion editorial photograph intended for a business magazine spread.",
	"artistic_style": "realistic, vibrant, detailed"
}

Amazon Nova to Fibo generation

Amazon Nova acts as the intelligent interface, translating your creative natural-language prompts into VGL—the precise JSON structure that Fibo requires. The text generation capabilities of Nova verify that lighting specifications, composition rules, color palettes, and camera parameters are formatted correctly and comprehensively. Fibo then interprets these structured JSON instructions to generate exactly the images you need, reproducibly and at large production workload scale.You can now avoid the unpredictability that affects traditional generative AI systems. Instead of ambiguous text prompts that produce inconsistent results, the Amazon Nova to Fibo integration provides complete control over every visual parameter through structured, machine-readable specifications.

Image refinement loop

The ability to produce specific results extends beyond initial generation. When your existing images need refinement or editing, the vision-language models used by Amazon Nova analyze the current image, generating detailed text descriptions and captions that capture every visual element. Nova then converts these descriptions into VGL, which Fibo uses to make precise modifications while maintaining consistency with your original vision.This bidirectional workflow creates a closed-loop system for iterative creative development. You can start with a concept, generate initial visuals, analyze results, and refine outputs with precision that was previously unavailable in generative AI workflows. The following figure shows the result of Fibo’s “refine” function with the prompt “Same models in fall attire; change city scene to autumn.”

Figure 2: Fibo refine function

Cost and control

This workflow combines the price performance for orchestration and analysis of Amazon Nova with Fibo’s deterministic generation capabilities. You gain both economic efficiency and creative control. The cost savings are substantial: Nova models are at least 75% less expensive than comparable alternatives, and Fibo’s deterministic approach eliminates the waste associated with unpredictable generation requiring multiple attempts.

Enterprise benefits

The Amazon Nova and Bria Fibo integration addresses the fundamental challenges that have prevented widespread enterprise adoption of generative AI for visual content:

Predictability – Fibo’s deterministic architecture eliminates the randomness that makes traditional generative AI unsuitable for production workflows. Every parameter is explicit, disentangled, and reproducible.
Legal compliance – Bria’s 100% licensed training data and full indemnity coverage protect your organization from copyright and privacy infringement risks.
Brand consistency – Because the integration uses structured JSON, you can codify brand guidelines as machine-readable specifications, supporting on-brand outputs at high volume without manual review.
Cost efficiency – The industry-leading price performance of Amazon Nova combined with Fibo’s elimination of wasted generation attempts delivers return on investment (ROI) that makes enterprise deployment economically viable.
Workflow integration – Available in AWS Marketplace and SageMaker AI, the Amazon Nova to Fibo integration fits seamlessly into your existing enterprise infrastructure.

Real-world applications

The Amazon Nova to Fibo integration enables use cases across industries. You can automate campaign generation to produce brand-consistent visuals at high volume. Create product visualization for ecommerce with consistent catalog images across thousands of SKUs or deliver personalized ecommerce experiences with customized product imagery that maintains brand standards. And you can generate real-time sports broadcasting graphics with precise team colors and branding.These applications share common requirements: reproducibility, brand consistency, legal compliance, and cost efficiency. The Amazon Nova to Fibo integration delivers on all four dimensions.

Conclusion

The integration of Amazon Nova multimodal intelligence and cost efficiency with Fibo’s deterministic control and legal safety transforms generative AI from an experimental technology into a production-ready business tool. As you face mounting pressure to produce more content faster while maintaining brand consistency and legal compliance, this integration provides the technological foundation for scalable, responsible visual AI deployment.To get started:

Developers and architects – Try Bria Fibo using Bria API building blocks or deploy the Fibo Hugging Face model in your Amazon VPC or SageMaker AI environment. You can also explore Fibo’s Kiro integration for streamlined development workflows.
Business decision-makers – Explore Bria’s solutions in AWS Marketplace to understand deployment options and pricing models that fit your organization’s needs.

Bria – AWS Partner Spotlight

Bria is an AWS Advanced Partner and AWS AI Partner that offers an enterprise-grade visual generative AI platform available for deployment with source code or as APIs, SDKs, and iFrame. Bria AI’s platform is provided with full copyright and privacy indemnity.

Contact Bria | Partner Overview | AWS Marketplace

Build a complete SOC solution with Amazon Security Lake, Splunk, and Recorded Future Autonomous Threat Operations

Kunal Sharma — Wed, 17 Jun 2026 16:02:16 +0000

By: Kunal Sharma – Sr. Solutions Architect – AWS
By: Anthony Henry – Sr. Account Manager – AWS
By: Jon Hall – Principal Architect – Recorded Future
By: Robert Rossetti – Partner Engineer – Splunk

It’s 2:00 AM and you’re a SOC analyst triaging a suspicious sign-in alert, manually searching across five consoles to determine whether the activity is a real threat or a false positive. By the time the picture becomes clear, the threat actor has already moved laterally.
This detection-to-response gap is where Amazon Security Lake, Splunk Enterprise Security, and Recorded Future Autonomous Threat Operations provide a unified architecture that centralizes your security data, automates analysis, and accelerates response.

Traditional approaches use separate point solutions: a SIEM for log aggregation, threat intelligence feeds for context, and manual playbooks for response. This fragmented approach leaves gaps and creates operational inefficiencies.In this post, you learn how to solve the detection-to-response gap that leaves organizations vulnerable using Amazon Security Lake, Splunk Enterprise Security, and Recorded Future Autonomous Threat Operations. They work as a comprehensive SOC and SIEM solution that addresses the security lifecycle from detection to analysis to mitigation. Recorded Future is an AWS Partner that delivers real-time threat intelligence to help organizations defend against threat actors. Splunk is an AWS Partner that helps organizations build resilience through holistic security and observability. Specifically, you will learn:

How Amazon Security Lake centralizes and normalizes security data for consistent analysis
How Splunk Enterprise Security correlates events in real time and automates response workflows
How Recorded Future Autonomous Threat Operations enriches alerts with intelligence and standardizes threat hunting
How to implement this architecture in phases across your environment

The challenge: From detection to mitigation

Security operations teams struggle with three interconnected problems:

Disparate data resulting in incomplete visibility: Security data exists in silos across AWS services, software as a service (SaaS) applications, and on-premises systems, making comprehensive threat detection difficult.
Alert fatigue and manual inefficiency: Even when threats are detected, analysts face alert fatigue and spend hours manually correlating events and researching threat intelligence.
Response time challenges: The time between detection and response represents an operational gap that requires automation and integration to close effectively.

The solution: Unified detection, analysis, and mitigation

The integration of Amazon Security Lake, Splunk Enterprise Security, and Recorded Future Autonomous Threat Operations provides an architecture where each component directly targets one of the preceding challenges: centralizing data, automating analysis, and accelerating response. The following sections detail how each component works.

Detection: Amazon Security Lake

Amazon Security Lake automatically centralizes security data from AWS environments, SaaS providers, on-premises sources, and cloud platforms into a purpose-built data lake. The service uses the Open Cybersecurity Schema Framework (OCSF) to normalize security data from diverse sources into a consistent format.

Security Lake ingests data from AWS services such as AWS CloudTrail, Amazon GuardDuty, Amazon Inspector, VPC Flow Logs, and AWS Security Hub, along with third-party security tools. This centralized approach supports visibility across multi-account and multi-region AWS environments, reducing the gaps that threat actors target.

Analysis: Splunk Enterprise Security

Splunk Enterprise Security provides real-time analytics and AI-driven anomaly detection, and Risk-Based Alerting (RBA) on the security data flowing from Security Lake. Splunk Enterprise Security performs correlation across multiple data sources, applies User and Entity Behavior Analytics (UEBA) to detect anomalous activity, and provides interactive dashboards and advanced search capabilities for investigating events.

Splunk Enterprise Security uses RBA to accelerate the process of detecting risk in your environment. The risk analysis framework applies insights from cybersecurity frameworks such as MITRE ATT&CK, CIS 20, and NIST controls to identify the tactics and techniques observed in risky events. Doing so reduces alert volume, resulting in higher fidelity alerts.

Splunk Enterprise Security integrates with Splunk Security Orchestration, Automation, and Response (SOAR) for automated response workflows. With this integration, your security teams can define playbooks that run automatically when specific threat patterns are detected, reducing the time between detection and response.

Mitigation: Recorded Future Autonomous Threat Operations

Recorded Future Autonomous Threat Operations extends the architecture with AI-powered capabilities that autonomously hunt, detect, and prevent threats. Powered by real-time threat intelligence from 1+ million sources, the solution proactively tracks and enriches IoCs, malware, and threat actors across your environment.Autonomous Threat Operations standardizes threat hunting processes that previously required days or weeks of manual research. The solution integrates directly with Splunk, so autonomous agents operate within your existing security workflow without requiring analysts to switch between tools.

Architecture: How the components work together

The integrated architecture operates as an integrated pipeline where security data flows from detection through analysis to mitigation.

Data collection and normalization: Security Lake ingests security events from AWS services and third-party sources, normalizing them to OCSF format. With this data standardization, Splunk can analyze data consistently across supported data sources.
Real-time analysis: Splunk Enterprise Security receives normalized security data from Security Lake and performs real-time correlation, behavioral analysis, and threat detection. Splunk Enterprise Security applies machine learning models to identify anomalous patterns and generates alerts for security analysts.
Intelligence enrichment: Recorded Future automatically enriches security events with threat intelligence, providing context about indicators of compromise (IOCs), threat actor tactics, and patterns of unauthorized activity. This enrichment happens continuously without manual analyst intervention.
Automated response: When Splunk detects threats, Splunk SOAR runs automated playbooks that can isolate compromised resources, revoke credentials, block unexpected IP addresses, and initiate incident response workflows. Recorded Future Autonomous Threat Operations provides the intelligence that informs these automated decisions.

Integration benefits

This integrated solution delivers measurable improvements across your security operations.

Centralized visibility: Security Lake provides visibility across your cloud and on-premises environments, helping verify detection of security events across your configured data sources. You gain a single, normalized view of activity rather than switching between siloed tools.

Reduced analysis time: Automated threat intelligence enrichment and correlation reduce the time your analysts spend researching alerts and investigating events. If your security teams currently spend hours per alert on manual research, this integration can compress that timeline.

Faster response: Integration between Splunk SOAR and Recorded Future supports automated response to threats in seconds rather than hours. Your security teams can define playbooks that act on enriched intelligence without waiting for manual triage.

Standardized operations: Autonomous threat hunting creates consistent, repeatable processes that deliver reliable results with standard rigor and coverage every time.

Implementation approach

Organizations can implement this architecture in phases. This sequence builds each layer on the previous one, so that your team validates data flow and detection capabilities before adding automation.

Deploy Security Lake to centralize security data from AWS services and third-party sources using OCSF format.
Integrate Splunk Enterprise Security to analyze security data with real-time correlation and behavioral analytics.
Connect Recorded Future to enrich security events with threat intelligence from global sources.
Configure SOAR playbooks in Splunk to automate response actions based on threat intelligence.
Activate Autonomous Threat Operations to standardize threat hunting and proactively detect threats.

The workflow and components are shown in the following figure. You install the Recorded Future App for Splunk directly from Splunk’s app marketplace, Splunkbase. Security Lake subscribers can configure Splunk as a data consumer for real-time data flow from the centralized data lake, or search remotely with federated search. For configuration details, see the Splunk and Security Lake integration guide or Splunk Federated Search for ASL.

Figure 1: Unified SOC Solution: Detect, Analyze, Mitigate – An integrated framework for security operations powered by AWS CloudTrail, Amazon GuardDuty, Amazon Inspector, Splunk SOAR, and Recorded Future Autonomous Threat Operations

Use case: Detecting and mitigating credential misuse

A practical example demonstrates how the integrated architecture operates:

When a threat actor uses stolen credentials to access an AWS account, AWS CloudTrail logs the authentication event and Amazon GuardDuty detects the suspicious sign-in pattern. Security Lake ingests these events in OCSF format and delivers them to Splunk Enterprise Security.

Splunk Enterprise Security correlates the suspicious login with other security events, including unusual API calls and network traffic patterns. Recorded Future automatically enriches the alert with threat intelligence, identifying that the source IP address is associated with known threat actors.Based on this enriched intelligence, Splunk SOAR runs an automated playbook that suspends the affected account, revokes active sessions, isolates affected resources, and creates forensic snapshots for investigation.Following containment, an analyst can then use Autonomous Threat Operations to extend this initial investigation and run an automated threat hunt for similar activity across the analyst’s environment, surfacing additionally impacted users, assets, or persistence mechanisms that may have otherwise evaded the initial point-in-time investigation.

Transforming security from reactive to preemptive

By combining Amazon Security Lake, Splunk Enterprise Security, and Recorded Future Autonomous Threat Operations, your organization can build a complete SOC and SIEM solution that addresses the security lifecycle from detection to analysis to mitigation. Security Lake centralizes detection across your configured security data sources, Splunk Enterprise Security delivers real-time analysis with automated response capabilities, and Recorded Future provides intelligence-driven mitigation through Autonomous Threat Operations. This integrated architecture helps transform your security operations from reactive alert triage to proactive threat mitigation. By detecting threats across your environment, analyzing them with intelligence-driven context, and automating security actions, you can reduce your risk and strengthen your security posture.

Take the next step

To see this architecture in action, schedule a demo of Recorded Future Autonomous Threat Operations.

AWS Partner Spotlight

Recorded Future is an AWS Advanced Technology partner that provides real-time threat intelligence to help organizations defend against threat actors. With capabilities spanning the open web, deep web, and dark web, Recorded Future delivers actionable intelligence that security teams can use to anticipate and respond to threats.

Contact Recorded Future | Partner Overview | AWS Marketplace

Splunk is an AWS Advanced Technology Partner that helps organizations build resilience through holistic security and observability. Used by enterprises and government agencies worldwide, Splunk Enterprise Security and Splunk SOAR give security teams real-time analytics, automated response workflows, and the operational consistency needed to keep pace with evolving threats.

Contact Splunk | Partner Overview | AWS Marketplace