AWS Partner Network (APN) Blog

Continuous AI security with F5 AI Guardrails and AWS Bedrock

Vlad Tyshkov — Thu, 01 Oct 2026 17:50:24 +0000

By: Vlad Tyshkov, Partner Solutions Architect – AWS
By: Mark Toler, Product Marketing Manager – F5
By: Daniel Salzedo, Sr. Solutions Architect – AWS

Threats to AI applications evolve faster than manual defenses can match. According to Gartner^®, enterprise generative AI application infrastructure experienced security events at 29 percent of organizations in the last 12 months. Together, pre-deployment evaluation, continuous testing, and adaptive protection compress the gap-to-fix cycle from weeks to minutes.

Encoded inputs, rephrased queries, and multi-turn prompt chaining bypass static rules and keyword filters. To defend AI applications, you need protection that understands intent, not patterns alone.

F5 AI Guardrails and F5 AI Red Team run with AWS Bedrock and deliver continuous adaptive security for AI applications in production. In this post, we introduce three capabilities your enterprise AI security program needs and explain how F5 addresses them on AWS Bedrock: pre-deployment model evaluation, adversarial testing at scale, and adaptive runtime protection that stays ahead of emerging threats.

Three capabilities for your AI security program

AI application security requires more than content filtering. You need a continuous cycle of evaluation, testing, and adaptation. Here’s why each capability matters.

Evaluate foundation models before deployment

Before you commit to a foundation model (FM), you need visibility into its security profile. Different models respond differently to adversarial inputs. A model that resists prompt injection in one category might be vulnerable in another. Without pre-deployment assessment, you’re committing to guardrail configurations based on assumptions rather than data.

The F5 Comprehensive AI Security Index (CASI) Leaderboard ranks leading AI models based on their resistance to real-world attacks. You can use the leaderboards to compare foundation models available through AWS Bedrock. CASI evaluates models against a database of more than 100,000 test patterns, with more than 10,000 new prompts added monthly. It provides security scores and detailed profiles so you can make model selection decisions based on each model’s actual response to specific test types. Results pinpoint which runtime guardrails to enforce before deployment.

Test at adversarial scale

Manual security reviews cover dozens of scenarios. Automated adversarial testing generates thousands of test variations in hours. The gap matters because sophisticated prompt techniques (encoded inputs, multi-turn chaining, rephrased queries) bypass pattern-matching filters that catch obvious threats. You need testing that adapts like a real threat actor: revising prompts based on responses, backtracking when blocked, and strategizing dynamically.

F5 AI Red Team complements AWS Bedrock by testing your AI applications at this scale. It generates more than 10,000 test variations in 48 hours, conducting multi-turn tests that adapt strategies based on your application’s responses. According to F5, this approach discovers 3–5 times more security gaps than manual reviews. You can trace how each gap was discovered using Agentic Fingerprints, a visualization that maps the full prompt-and-response sequence across every turn of the test. You can use the visualization to understand precisely how security gaps manifest in multistep scenarios.

Evolve defenses faster than threats

Static guardrails degrade over time. New bypass techniques emerge daily. You need runtime protection that blocks known patterns in real time and a mechanism to discover and deploy defenses for new patterns faster than threats evolve. The critical metric is the time from gap discovery to rule deployment in production.

F5 AI Guardrails operates as an inspection layer between your applications and AWS Bedrock, evaluating prompts before they reach the foundation model and responses before they return to your application. Input and output policies operate as separate rule sets, so you can enforce different criteria for each direction. F5 AI Guardrails runs within your own AWS account, so your data doesn’t leave your environment.

When F5 AI Red Team discovers a new gap, its companion capability, AI Remediate, generates a guardrail configuration for your team to review and apply in a single step. You can tailor defenses through a natural language interface without writing code. Production monitoring feeds findings back into red teaming campaigns, creating a continuous improvement cycle.

How F5 and AWS Bedrock Guardrails work together

Both AWS Bedrock Guardrails and F5 AI Guardrails enforce content policies at runtime. AWS Bedrock Guardrails provides strong foundational protection, with capabilities that include content filters, denied topics, word filters, sensitive information filters for personal identifiable information (PII) detection and masking, contextual grounding checks, and Automated Reasoning checks. These address a broad range of known risks and form a solid security baseline for your AI deployments.

Together, AWS Bedrock Guardrails and F5 deliver layered protection: foundational enforcement plus continuous discovery and adaptation. F5 AI Guardrails evaluates prompts and responses in context of the full interaction history, maintaining awareness across the entire conversation. F5 AI Red Team probes your application to surface scenarios that emerge as threats evolve. You set the testing objective in natural language, such as “extract restricted financial data.” The AI agent then determines how to reach that goal across multiple conversation turns. The agent revises its approach when blocked and backtracks to try new paths. You can trace each decision the agent made to reach its goal, giving you the context to evaluate what to change in your defenses. Each test cycle feeds the next, so your protection improves continuously rather than eroding between reviews.

An illustrative scenario in a regulated industry

An organization in a regulated industry, such as financial services or healthcare, might deploy AI models that process sensitive domain-specific information. These organizations need to prevent their AI systems from generating or disclosing restricted content while still providing useful responses to legitimate queries.A common initial approach is keyword filtering to block specific query terms before they reach the model. However, adversarial testing quickly reveals edge cases where rephrased queries bypass these filters. Security teams need protection that understands query intent rather than matching specific prompt terms.

Your AI governance team can create custom guardrails through F5’s natural language interface, blocking both inputs and outputs related to restricted content without AI engineering resources or custom code. According to key findings from F5, F5 AI Guardrails achieved 99.3 percent efficacy against direct prompt injection, 98.7 percent against excessive agency, and 99.0 percent against sensitive data leakage across approximately 20,000 adversarial test cases.

What this means for your organization

When you combine pre-deployment evaluation, adversarial testing at scale, and adaptive runtime protection, you create a security posture that evolves continuously. Data informs your model selection decisions. Security gaps are discovered proactively and defenses updated before they reach production. This lifecycle runs within your existing AWS infrastructure, keeping your security team in control at every step.

Conclusion

AI security requires three continuous capabilities: pre-deployment model evaluation, adversarial testing at scale, and adaptive runtime protection that evolves faster than threats. Organizations that implement all three can reduce the gap between a threat being discovered and deploying a defense from weeks to minutes.To get started:

Review foundation model security profiles using the CASI Leaderboard before you make procurement decisions.
Adopt automated adversarial testing to identify multistep threat sequences that manual reviews miss.
Configure runtime guardrails that block known patterns in real time. When Red Team discovers a new gap, apply updated rules in a single step.

To get started with F5 AI Guardrails and AI Red Team for your AWS Bedrock deployments, contact F5 or explore F5 in AWS Marketplace.

Gartner Press Release, Gartner Survey Reveals GenAI Attacks Are on the Rise, September 22, 2025 GARTNER is a trademark of Gartner, Inc. and/or its affiliates.

F5 – AWS Partner Spotlight

F5 is an AWS Advanced Technology Partner and AWS Security Partner that gives the world’s largest businesses, service providers, governments, and consumer brands the freedom to securely deliver every app, anywhere, with confidence. F5 delivers cloud and security application services that help organizations embrace the infrastructure they choose without sacrificing speed and control. For more information, go to f5.com.

The F5 Application Delivery and Security Platform (ADSP) delivers adaptive security for AI applications, APIs, and data across hybrid multi-cloud environments. F5 AI Red Team, F5 AI Guardrails, and F5 AI Remediate together provide a comprehensive AI security lifecycle, from pre-deployment model evaluation through runtime protection.

Contact F5 | Partner Overview | AWS Marketplace

New FDE Pathways For AWS Partners: Get Ready for Production Agentic AI Delivery

Karthik Sonti — Thu, 01 Oct 2026 15:45:37 +0000

By: Karthik Sonti. Head of Agentic AI, Consulting Partners Growth & Strategy – AWS
By: Erik Farr, Director of Solution Architecture, Consulting Partners Growth & Strategy – AWS
By: Priya Bains, Head of Partner Brand and Content Strategy – AWS

Production agentic AI requires engineering depth that most organizations are still building. On June 30, AWS announced the Forward Deployed Engineering (FDE) organization, backed by a $1 billion investment, and extended this hands-on delivery approach to AWS Partners through the Partner-Led FDE motion. Now, AWS Partners have a structured way to build and validate that depth with three new Partner FDE pathways and credentials that recognize the applied proficiency required to deliver production agentic AI.

Starting today, AWS Partners can access the three FDE pathways at no cost through AWS Skill Builder: Ground, Orchestrate, and Prove. Two credentials, FDE Validated and FDE Advanced, recognize different levels of technical depth. They are earned through hands-on validation in AWS-provisioned environments, not solely through course completion or multiple-choice tests.

Why this matters

Moving agentic AI from demonstration to production requires both a measurable business outcome and the engineering depth to deliver it. The system must connect to authoritative business data, coordinate workflows reliably, recover from failures, and meet enterprise security and governance requirements. These demands span different disciplines, and expecting every engineer to be equally deep in all of them doesn’t scale. Partners who build this depth now will be positioned to meet the demand FDE is designed to serve.

The pathways give partner organizations a structured way to build, assess, and scale this depth. As builders earn credentials and apply these capabilities, reusable connectors, domain ontologies, agent patterns, and operations tooling compound into a stronger delivery practice. That depth matters to customers. Partner FDE credentials provide evidence of what individual builders have demonstrated, and customers can choose the delivery model that fits: first-party AWS FDE, an AWS-led engagement with partner specialists, or Partner-Led FDE.

Three capabilities required for production

A demonstration can show that an agent works once. A production system must do more. Ground, Orchestrate, and Prove divide the production problem into complementary areas of engineering depth:

Pathway	Focus	Production question
Ground	Trusted enterprise data, systems, domain ontologies, and business context	Does the system understand the business and use reliable information?
Orchestrate	Dependable agents, tools, workflows, identity, and recovery	Can the system perform real work reliably?
Prove	Evaluation, observability, security, policy, and human control	Can the customer trust it in production?

These are technical capability pathways, not separate delivery models or fixed job titles. Builders can develop depth in one or more pathways. For customer delivery, partners bring the necessary capabilities together around the problem being solved.

How Partner FDE readiness works

Credential attainment is based on what builders can demonstrate, not what courses they’ve completed. Preparation resources are available but separate from validation. Builders can use them for additional context or proceed directly when ready.

Four steps to earn a credential:

Meet the AWS Certification prerequisite. An active AWS Certification is required for the credential being pursued.
Choose a pathway in AWS Skill Builder. Begin with Ground, Orchestrate, or Prove based on your existing skills and where you want to demonstrate depth.
Complete the required validation. Finish the published validation activities and point requirements in AWS Skill Builder. Activities can include assessments, SimuLearn, microcredentials, and other hands-on work in AWS-provisioned environments.
Accept your badge. A badge is automatically issued upon completion.

The credentials recognize two levels of demonstrated depth:

FDE Validated: Hold an active Associate- or Professional-level AWS Certification, complete every required validation activity in at least one pathway, and earn the required total points across Ground, Orchestrate, and Prove.
FDE Advanced: Hold an active AWS Certified Generative AI Developer – Professional certification and complete the published validation requirements across all three pathways.

Get Started: Access the Partner FDE Technical pathways in AWS Skill Builder to confirm pre-requisites, choose your pathway and begin validation. The live Skill Builder experience is the source of truth for current requirements, recognized prior completions, and credential policies.

Say Hello to 156 New AWS Competency, Service Delivery, and MSP Partners Added in September

Nick Paris — Thu, 01 Oct 2026 15:44:59 +0000

By Nick Paris, APN Marketing Manager – AWS Partner Network

The AWS Partner Network (APN) is a global community that leverages Amazon Web Services (AWS) technologies, programs, expertise, and tools to build solutions and provide services for customers.

The APN has more than 130,000 partners from over 200 countries, with 70% headquartered outside of the United States. Together, partners and AWS provide innovative solutions, solve technical challenges, win deals, and deliver greater customer value.

To achieve APN specializations such as AWS Competency, AWS Service Delivery, AWS Service Ready, and AWS Managed Service Provider (MSP), organizations must undergo rigorous technical validation and assessment of their AWS solutions and practices.

NEW! AWS Competency Partners

To succeed with cloud adoption in today’s complex IT environment and continue to advance in the future, customers can team up with an AWS Competency Partner.

The AWS Competency Program validates and promotes AWS Partners with demonstrated technical expertise and proven customer success in specialized areas across industries, use cases, and workloads. Guidance from these skilled professionals can lead to better business and bigger results.

Team up with our newest AWS Competency Partners:

AWS AI Competency

ABRA CLOUD SOLUTIONS | EMEA | Generative AI Consulting Services
Apex.IT | EMEA | Generative AI Consulting Services
Applying Consulting | LATAM | Generative AI Consulting Services
Birlasoft (India) | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
BRIGHT DIGITAL | EMEA | Generative AI Consulting Services
Business Compass | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Caleidos | LATAM | Generative AI Consulting Services
Changhong IT Information Products | China | Generative AI Consulting Services
Cheppers | EMEA | Generative AI Consulting Services
CitiusTech | NAMER | Agentic AI Consulting Services
Cloudcentrix Technologies | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Commencis | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
DataSleek (Alanco Technologies) | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Devertix | EMEA | Generative AI Consulting Services
DiUS | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
EFFITECH SOLUTIONS | EMEA | Generative AI Consulting Services
ENREAP | APAC | Generative AI Consulting Services
Enreap Systems | EMEA | Generative AI Consulting Services
EPAM Systems | NAMER | Agentic AI Consulting Services
G-ABLE | APAC | Agentic AI Consulting Services
GENEXTECH SOLUTIONS | APAC | Generative AI Consulting Services
Grey Bracket Devops Automation | APAC | Generative AI Consulting Services
Gulf Kloud | EMEA | Generative AI Consulting Services
Habilelabs | APAC | Agentic AI Consulting Services
i2k2 Networks | APAC | Agentic AI Consulting Services
ILIOS DIGITAL | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
In Motion | LATAM | Agentic AI Consulting Services
Infynation | APAC | Agentic AI Consulting Services
Ingenious Tech World | APAC | Generative AI Consulting Services
Keyrus | NAMER | Generative AI Consulting Services
Kitsilano Technologies | EMEA | Generative AI Consulting Services
KTM ONE | EMEA | Generative AI Consulting Services
Kyobo DTS (Digital Technology Service) | APAC | Agentic AI Consulting Services
Loop8 – AI and Cloud Transformation Services | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Matellio | NAMER | Generative AI Consulting Services
MHP | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
NCLOUD THREE (MAURITIUS) | EMEA | Generative AI Consulting Services
Netrix Global | NAMER | Agentic AI Consulting Services
NorthBay Solutions | NAMER | Agentic AI Consulting Services
Nuvme | LATAM | Generative AI Consulting Services
Onepoint | EMEA | Agentic AI Consulting Services
Pace Wisdom Solutions | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
PROTOS Technologie | EMEA | Generative AI Consulting Services
QyrosCloud | NAMER | Agentic AI Consulting Services
RD Paytech | APAC | Generative AI Consulting Services
Rebizo Cloud Tech | APAC | Generative AI Consulting Services
Redington | APAC | Generative AI Consulting Services
SaasNova | NAMER | Generative AI Consulting Services
Sanrish Technologies | APAC | Generative AI Consulting Services
SCSK Corporation | Japan | Generative AI Consulting Services
Seesec Infotech | APAC | Generative AI Consulting Services
Silicon Power Solutions | APAC | Agentic AI Consulting Services
Solvixe Technologies | APAC | Generative AI Consulting Services
Solvixe Technologies | APAC | Agentic AI Consulting Services
StableLogic | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Tech-5 UG | EMEA | Generative AI Consulting Services
Telefonica Cybersecurity and Cloud Tech | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Terasky | EMEA | Generative AI Consulting Services
Wipro | NAMER | Agentic AI Consulting Services
Xebia | EMEA | Agentic AI Consulting Services
Zensar Technologies | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
深圳市帝盟网络科技有限公司 | China | Generative AI Applications
Darktrace | NAMER | Generative AI Applications
Devops TechLab | APAC | Agentic AI Applications
EDT&Partners | EMEA | Generative AI Applications
Entrephy | NAMER | Agentic AI Applications
Eon | NAMER | Agentic AI Tools
experienz | EMEA | Agentic AI Applications
Guance.com | China | Generative AI Applications
Jellyfish | NAMER | Generative AI Applications
Kaamel Technology | China | Agentic AI Applications; Generative AI Applications
KnowBe4 | NAMER | Agentic AI Applications
Meetsocial | China | Generative AI Applications
PIYTECH SOLUTIONS | APAC | Generative AI Applications
PIYTECH SOLUTIONS | APAC | Agentic AI Applications
Pokee AI | China | Generative AI Applications
Prana Tree | NAMER | Agentic AI Applications
Precisely | NAMER | Agentic AI Applications; Generative AI Applications
Salesflo | APAC | Generative AI Applications
UHOMES | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
WPS金山办公 | China | Generative AI Applications
XBOW | Autonomous Pentesting Platform | NAMER | Agentic AI Applications

Amazon Connect Customer Services Competency

Caylent | NAMER | AI-Powered Customer Experience
ScaleCapacity | NAMER | Contact Center Transformation

AWS Business Value Realization Competency

A3Data | LATAM | Business Value Realization
allOps Solutions | EMEA | Business Value Realization
Caylent | NAMER | Business Value Realization
KXC | LATAM | Business Value Realization

AWS Cloud Operations Competency

Descasio | EMEA | Cloud Governance
Ghaim | EMEA | Operations Management
Scale Factory | EMEA | Cloud Governance
upd8 | LATAM | Cloud Governance

AWS Data & Analytics Competency

DataEconomy | NAMER | Analytics
Pentagon System and Services | APAC | Analytics

AWS DevOps Competency

AmaliTech Services | EMEA | Consulting Services
B8 ICT Solutions | APAC | Consulting Services
Ci&T Software | LATAM | Consulting Services
Clerion | EMEA | Consulting Services
IT Visionary | EMEA | Consulting Services
KPI Partners | NAMER | Consulting Services
Mayhive | EMEA | Consulting Services
One Cloud Utopia | NAMER | Consulting Services
Sigmoid | NAMER | Consulting Services
UDS | LATAM | Consulting Services

AWS Education Competency

TranSnet Cloud | EMEA | Consulting Services

Energy & Utilities Competency

OpsGuru, a Carbon60 Company | NAMER | Consulting Services

AWS Financial Competency

Denodo | NAMER | Banking; Capital Markets; General Financial Services; Insurance

AWS Government Competency

NordHero | EMEA | Citizen Services

AWS Healthcare Competency

BeCloud | NAMER | Consulting Services
EPAM Systems | NAMER | Consulting Services
Leapfrog Technology | NAMER | Consulting Services
Presidio Inc | NAMER | Consulting Services

AWS IoT Competency

Tiger Data | NAMER | Technology for Platform Providers

AWS Life Sciences Competency

Qumulo | NAMER

AWS Machine Learning Competency

Automat-it | EMEA | Consulting Services

AWS Manufacturing and Industrial Competency

Spectro Cloud | NAMER | Enterprise Solutions; Operational Technology; Smart Manufacturing

AWS Microsoft Workloads Competency

KXC | LATAM | Application Modernization; Database Solutions; Productivity Solutions

AWS Migration and Modernization Competency

allOps Solutions | EMEA | Migration Services
TKTL INFORMATICA LTDA (Alest). | LATAM | Migration Services
UDS | LATAM | Migration Services; Modernization Services
VeUP | NAMER | Migration Services

AWS MSSP Services Competency

PT Mastersystem Infotama Tbk | APAC | Infrastructure Security

AWS Resilience Competency

Atyos | EMEA | Resilience Design
FluidCloud | NAMER | Resilience Recovery
Temporal Technologies | NAMER | Resilience Design

AWS Security Competency

RevStar | NAMER | Application Security; Data Protection; Identity and Access Management; Threat Detection and Response
Cato Networks | EMEA | AI Security

AWS Resilience Competency

Native | NAMER | Identity and Access Management

AWS Security Competency

Sentra | NAMER | AI Security

AWS Small and Medium Business (SMB) Competency

Cloud Family AB | EMEA | Small and Medium Business
Hexadia | LATAM | Small and Medium Business
Hostersi | EMEA | Small and Medium Business
Tribe Networks | EMEA | Small and Medium Business
Jefferson Frank | NAMER | Small and Medium Business

AWS Storage Competency

EPAM Systems | NAMER | Consulting Services
Network Techlab India | APAC | Consulting Services

AWS Supply Chain Competency

Sigmoid | NAMER | Enable; Make; Move; Plan; Source

NEW! AWS Managed Service Providers (MSPs)

The AWS Managed Service Provider (MSP) Program validates AWS Partners with a proven track record and experience providing end-to-end AWS solutions to customers at any stage of the cloud journey, including planning and design, building and migration, operations and support, and automation and optimization.

To achieve this level of specialization, AWS MSP Partners must complete an extensive independent audit to ensure business health and technical capabilities meet a high bar, and they must maintain this status through annual audits.

Say hello to our newest AWS MSP Partners:

AWS Managed Service Provider Program

Andersen | NAMER
Commencis | EMEA
Exabytes | APAC
Fairwinds Ops | NAMER
Graaho Technologies | NAMER
Innovation Cloud Services – ICS Compute | APAC
Nextgen Distribution | APAC
OpsTeam | LATAM
PolarSeven | APAC
Pump | NAMER
Qucoon | EMEA
SEC AND DEVOPS AI | APAC
Sedmi Odjel | EMEA
Sonata Software | NAMER
StarOne IT Solutions | APAC
upd8 | LATAM
VArrow Technologies | EMEA

NEW! AWS Service Delivery Products

The AWS Service Delivery Program validates AWS Partners that have deep technical knowledge, experience, and proven success in delivering specific AWS services to customers.

To achieve this specialization, AWS Partners must undergo service-specific technical validation by AWS Partner Solutions Architects, including review of architecture, customer documentation, and customer case study details to ensure they follow AWS best practices for each AWS service.

Work with our newest AWS Service Delivery Partners:

Amazon EC2 for Microsoft Windows Server Delivery Partners

Coforge | APAC

Amazon EKS Delivery Partners

Cygnet.One | APAC

More Value, Greater Profitability for AWS Partners

Our mission is to make the AWS Partner Network (APN) with AWS Marketplace your preferred route to market and empower partners to deliver differentiated value to millions of AWS customers, helping you to win more, win bigger, and win faster.

We’re aligning the AWS Partner experience—including programs, incentives, and enablement—around AWS services and the partner business models: business outcome solutions, technology solutions, managed services, services, and resell.

These enhancements provide you with more relevant and prescriptive guidance, where you need it, and in a consistent and predictable manner. Your profitability, along with helping you drive new business, is our number one goal.

In 2026, we’ll continue to ensure that AWS Marketplace and our AWS Partner programs provide demonstrated pathways to success—helping you drive greater customer value and profitability. There’s an exciting journey ahead, and we’re thrilled to be on it together!

Learn how AWS is transforming the partner experience >>

Unlock revenue insights in the Attributed Revenue Dashboard

Jahnai Bilovsky — Wed, 30 Sep 2026 10:25:34 +0000

This post has been updated to reflect the latest Partner Revenue Measurement capabilities.

By Jahnai Bilovsky, Kelly Bornholdt, and Chris Xu – APN/MP Tech Business Development, AWS

As the cloud industry evolves, Partners have asked for more ways to demonstrate the business impact and return on investment of their solutions. Yet many lack visibility into the actual revenue impact their AWS solutions drive, making it difficult to optimize their go-to-market strategies.

To support this need, we launched Partner Revenue Measurement—a set of capabilities that help Partners measure attributed revenue, demonstrate impact, and unlock mutual growth opportunities.

Partner Revenue Measurement is now how we measure partnership success across Partner programs and benefits, creating a direct line between Partner impact and AWS investment. It provides transparent, data-driven measurement that recognizes Partners based on actual AWS service consumption across Partner and customer accounts.

The Attributed Revenue Dashboard in AWS Partner Central brings Partner Revenue Measurement insights to life with automated revenue data by Partner product, AWS service, and billing period.

In this blog, we’ll cover the benefits of Partner Revenue Measurement, how the Attributed Revenue Dashboard works, and how to get started.

Benefits

Partner Revenue Measurement delivers precise, automated measurement of the AWS consumption you’re driving—eliminating guesswork and ensuring your full impact is recognized. This enables faster funding decisions with higher investment levels.

This data-driven approach transforms how Partners and AWS collaborate. Here’s what that means for your business:

Revenue impact visibility: See exactly which products and services are driving AWS consumption, with monthly data by Partner product and AWS service to inform strategic decisions.
Smarter co-selling: Demonstrate solution value with quantifiable metrics to AWS sales teams, helping you identify high-performing co-sell areas to focus your resources and drive growth.
Strategic partnership growth: Use performance data to drive business reviews with AWS, optimize your product and go-to-market strategies, and unlock more targeted investment and recognition based on actual impact.
Automation and faster payments: Reduce administrative burden and get the proof points you need to grow your AWS business—eliminating manual reporting, reconciliation, and tracking across multiple programs.
Customer cost management visibility:  Enable customers to identify Partner-provisioned resources and map costs for spend management.

How it works

The Attributed Revenue Dashboard, accessible through Partner Analytics in AWS Partner Central in the AWS Console, provides visibility into the revenue impact your solutions generate.

Figure 1 – Attributed Revenue Dashboard in AWS Partner Central.

The dashboard displays monthly attributed revenue by Partner product, AWS service, and billing period. View consumption patterns, workload-level performance metrics, and growth opportunities—all in one place.

Figure 2 – AWS attributed revenue by AWS service.

Partners can get started with Partner Revenue Measurement using one of three implementation capabilities: Resource Tagging, User Agent string, and AWS Marketplace Metering—providing flexibility to choose the one that works best for their solution architecture.

Resource Tagging: Apply standardized tags to AWS resources using the product code from your AWS Marketplace listing. Resource Tagging now supports multi-Partner attribution, allowing multiple Partners to receive revenue attribution on the same customer resource.
User Agent string: Measure the AWS revenue impact of your solution across supported services by embedding a unique product code as a user agent—with options to update application code directly or set an environment variable. The User Agent string now extends across applicable AWS services that log control plane activity in AWS CloudTrail, increasing your visibility into the revenue your solutions drive. Partners who have already embedded the user agent string automatically benefit from expanded coverage with no additional implementation or rework required.
AWS Marketplace Metering: Automatically measures Amazon EC2 and Amazon SageMaker AI service consumption across customer-managed environments when customers purchase and use Amazon Machine Image (AMI) and machine learning (ML) products via AWS Marketplace. No additional implementation effort required.

See the dashboard in action: watch demo →

Figure 3 – Partner product onboarding status by source.

What Partners are saying

Feedback from Partners played a key role in helping us develop the dashboard and Partner Revenue Measurement capabilities. Partners tell us that Partner Revenue Measurement represents a fundamental shift in how AWS recognizes Partner value.

“PRM has become a true growth mechanism for BASIS, not simply an attribution tool,” says Landon Meserve, Vice President of BD & Partnerships at BASIS. “We’ve built a coordinated engineering and sales motion around it to re-engage customers from prior AWS engagements, validate the long-term consumption we helped create, and reopen strategic conversations around what comes next. That gives AWS greater visibility into the value BASIS has delivered, while helping us turn trusted customer relationships into new migration, modernization, and expansion opportunities. For us, PRM is creating measurable value on both sides of the partnership.”

That theme—visibility into shared value—is one we hear consistently, especially as AI accelerates the pace of cloud innovation.

Prabhakar Appana, SVP and Global Head of AWS Business Unit at HCLTech says, “The future of strategic partnerships will increasingly be built on measurable business outcomes. As cloud adoption accelerates and AI becomes mainstream, both AWS and its partners need greater visibility into the value being created together. PRM provides that common foundation.” Watch how HCLTech turns PRM data into smarter investments →

The impact also shows up in the numbers—revealing consumption that was previously going unrecognized.

Jan Keromnes, Sales Engineer and Cloud Alliances Lead at EngFlow shares: “We implemented PRM across our portfolio because we knew we were driving significantly more AWS consumption than we were recognized for in Enterprise customer environments. PRM validated that at scale—we’re seeing more than 10x the attributed revenue compared we could previously demonstrate, and reporting is automatic. That visibility changes the partnership: AWS can now see the full value we bring to joint customers, which strengthens co-sell investment and helps both sides prioritize the right opportunities.”

For Partners operating at a global scale, the value comes from replacing manual reporting with data—freeing them to focus on the customer.

“The strongest partnerships are built on shared customer outcomes and measurable impact,” says Chris Stewart, VP Global Technology, Marketplace and Cloud Alliances at CrowdStrike. “Partner Revenue Measurement gives us a clear view into the AWS consumption our solutions drive, helping us demonstrate value with data instead of manual reporting. With greater visibility and automation, we can focus on what matters most: helping customers innovate securely on AWS while continuing to scale our business together.” Watch how Crowdstrike put all three PRM capabilities to work across its portfolio →

Get started

Starting in 2027, PRM Attributed Revenue will be used to determine AWS Partner funding benefits, with new PRM requirements rolled out by program throughout the year. Now is the time to expand your PRM coverage across your portfolio, starting with your most utilized products or service delivery engagements.

To access the Attributed Revenue Dashboard, log in to AWS Partner Central in the Console.

To get started with Partner Revenue Measurement:

Have a public listing in AWS Marketplace;
Link your AWS account to your AWS Partner Central account;
Implement Resource Tagging, User Agent String and/or AWS Marketplace Metering capabilities.

Partners with multiple AWS Marketplace seller accounts can use Subsidiary Account Connections to gain visibility of their entire solution portfolio across all seller accounts.

Learn more about the dashboard’s functionality and the latest Partner Revenue Measurement updates in the Onboarding Guide.

New categories and benefits for AWS Data Competency Partners

Chris Dally — Tue, 29 Sep 2026 10:36:52 +0000

By Chris Dally, WW Data & AI Specialization Lead — AWS
By Vitor Freitas, Senior WW Data & AI PSA — AWS
By Kelly Lucas, AWS Specializations Partner Program Lead — AWS

Every AI opportunity is a data opportunity. Customers racing to build agentic AI systems need data that flows seamlessly between operational systems and analytical workloads, but most aren’t set up to get there.

According to Gartner, Inc., over 75% of organizations are prioritizing AI-ready data investments, yet 90% of Chief Data and Analytics Officers say their current data architecture needs an overhaul.

To help organizations accelerate AI innovation, we’re expanding the AWS Data Competency (previously AWS Data and Analytics Competency) with new categories and benefits. This AWS Specialization recognizes both Services Partners and Software Partners with deep expertise building unified data solutions on Amazon Web Services (AWS), from migrating legacy databases to cloud-native architectures to building AI-ready data foundations that power agentic AI.

This expansion aligns with a fundamental shift in how organizations approach AI.

“Data is the key differentiator for AI—it’s the combination of enterprise data, customer knowledge, and embedded institutional context that allows organizations to build truly unique experiences,” said Mark Relph, Director, Data & AI Partners at AWS. “Building a governed data foundation where agents can access trusted context in real time is a data problem first and an AI problem second. That’s exactly why we launched the expanded AWS Data Competency—to help customers find Partners who can build the data solutions that make agentic AI possible.”

The expanded categories help customers identify Partners that span the full data lifecycle, including:

Databases (Services Partners): Migrate, modernize, and manage production database workloads on AWS—spanning relational engines (Amazon RDS, Amazon Aurora), NoSQL and purpose-built databases (Amazon DynamoDB, Amazon DocumentDB, Amazon Neptune, Amazon ElastiCache, Amazon MemoryDB), and the full spectrum of operational disciplines from HA/DR architecture to performance optimization and security hardening.
Relational Databases (Software Partners): Deliver relational database engines on AWS, migration, performance, and governance tooling for relational DB adoption, and business applications built on Amazon RDS and Amazon Aurora; supporting the full adoption lifecycle from migration to governance.

This AWS Specialization recognizes Services Partners and Software Partners with deep expertise building unified data solutions on AWS whether migrating customers from legacy databases to cloud-native architectures or building AI-ready data foundations that power the next generation of agentic AI.

New benefits for AWS Data Competency Partners

The AWS Data Competency introduces new performance-based Signature benefits for Partners delivering data architectures at scale:

Additional marketing and deal funding in 2027 (Production Ready, AI Assessment, and Database Migration Accelerator) to help Partners stand out to customers and move their data workloads into production with AWS.
Access to the AWS Data and AI Workshop, a facilitated 1–2 day session that takes customers from use case to MVP architecture, with Partners positioned to capture the delivery work that comes next.
Partner recognition opportunities (e.g., case study features, “Partner of the Year” award), specialized sales play training, and opportunities to participate in executive briefings and roundtables.

For the full list of benefits available to AWS Data Competency Partners, review the AWS Specialization Program Benefits Guide in Partner Central (login required).

Success stories

Organizations with successful AI initiatives invest up to four times more in data and analytics foundations compared to those that experience poor outcomes from AI (Gartner, Inc., 2026). Partners like Deloitte and Caylent are already helping customers build AI-ready data foundations on AWS.

“A strong data foundation is the differentiator in the agentic era,” says Parth Patwari, AI & Engineering Leader at Deloitte. “The AWS Data Competency marks an evolution of our collaboration, helping enterprises like Toyota Motor North America move beyond experimentation to a more governed, scalable data platform that allows AI to deliver measurable business value at a faster pace.”

Toyota is seeing that value firsthand. “In supply chain, the value of data shows up in the decisions people make every day,” says Jason Ballard, Vice President of Digital Innovations at Toyota Motor North America. “Working with Deloitte and AWS, we’ve modernized our data platforms across the order-to-delivery workflow, and work that used to take our team members days now takes hours. That’s the real payoff: our people spend their time solving problems instead of chasing data.”

For Caylent, every durable AI initiative starts with the data underneath it: “Over the past years we’ve helped customers in financial services, insurance, and government replace fragmented legacy systems with governed, AI-ready lakehouses on AWS, accelerating platform delivery from years to weeks,” explains Randall Hunt, Chief Technology Officer at Caylent. “We’re not just modernizing data platforms, we’re building the foundation their next generation of AI use cases will run on.”

Customers: Work with an AWS Data Competency Partner

AWS Data Competency Partners help you build the data foundation your AI initiatives need to succeed.

Discover solutions and connect with validated AWS Data Competency Partners or explore solutions listed in AWS Marketplace.

Partners: Become an AWS Data Competency Partner

AWS Partners with data solutions can learn more about becoming an AWS Specialization Partner. The AWS Data Competency is open to both Services and Software Partners.

To get started, review the Program Guide in AWS Partner Central (login required).

Grow your services business through AWS Marketplace

Vincent Petit — Tue, 22 Sep 2026 18:46:30 +0000

by: Steven Matz, Partner Growth and Strategy Lead – AWS
By: Vincent Petit, AWS Marketplace Business Development – AWS

The consulting services business is undergoing a structural shift. The line between services and software is blurring. AI is reshaping how customers discover and evaluate providers. Traditional coverage models don’t scale to reach new customers, new geographies, or new segments without proportional headcount investment. Partners that invest in digital channels alongside traditional sales motions can reach buyers they’d never have found otherwise. AWS Marketplace is becoming central to this shift.

AWS Marketplace gives consulting partners a go-to-market channel that operates alongside their traditional sales motions, accelerating deals, reducing cost of sale, and reaching new customers without proportional headcount investment. The infrastructure is now in place to make AWS Marketplace work for how consulting partners sell and deliver. Partners now benefit from a reduction in the professional services listing fee from 2.5 percent to 0.5 percent, which means you retain a higher margin on service deals through AWS Marketplace.

The economic tipping point

The professional services listing fee is now 0.5 percent, a flat fee applied to private offer transactions for professional services listings. Partners with existing listings benefit automatically, with the reduced fee applying to new private offers going forward. To make it even more streamlined and economical for partners who package and deliver complete solutions, we’re also now offering a 0 percent listing fee on professional services when they’re purchased as part of a multi-product solution. This new fee structure reflects the tighter margin profile of consulting partners relative to software companies, making it rational to invest in AWS Marketplace as a growth channel at scale.

Drive discovery of your services through AWS Marketplace

It starts with how customers find you. The new AI-assisted product listing experience is available through Partner Assistant in AWS Partner Central. You can create listings optimized for customer discovery while eliminating time-consuming manual data entry and guesswork around meeting AWS Marketplace requirements. Generate optimized listings using existing digital assets such as your website, PDFs, case studies, and product documentation. Partner Assistant then validates that content against AWS Marketplace requirements and provides a quality score with field-level recommendations to improve discovery. Optimized listings help you get more value from your demand generation investments, driving higher conversion when buyers land on your product pages.

After your listing is published, customers can discover your services through search engines, AWS Marketplace search, and agent mode, our new conversational discovery experience. With agent mode, customers describe what they need and receive personalized recommendations matched to their use case. Your offerings reach buyers based on relevance rather than brand recognition.

You can also showcase your full portfolio of solutions and services with AWS Marketplace Storefront, a branded destination you control. Configure a fully branded storefront with no code required. Import listings from AWS Marketplace, organize by industry or use case, and go live in hours. You control what customers see, how they discover products, and how deals flow. Transactions for AWS Marketplace products flow through AWS Marketplace and appear automatically on customers’ Amazon Web Services (AWS) invoices. You get built-in billing infrastructure without building or maintaining separate payment systems.

“We’ve been active in AWS Marketplace for years, but the opportunity ahead looks fundamentally different. We’re building products alongside services, creating new commercial models around agents, and engaging segments historically out of reach. AWS Marketplace is central to that ambition—a branded Accenture storefront, offerings built for how these buyers evaluate, and a real path to joint growth with AWS.”

— Satish Lakshmanan, Managing Director, Accenture Industry Products

The following screenshot shows the Accenture Edge storefront.

Figure 1: Accenture Edge storefront leveraging AWS Marketplace

A channel built for services

Professional services in AWS Marketplace have grown steadily, with hundreds of consulting partners already transacting through it. Your customers get streamlined procurement and consolidated billing without onboarding new vendors. To support this growth, AWS Marketplace has evolved over the past year to match how consulting engagements are scoped and billed.

As services and software converge, the way consulting engagements are sold and delivered is changing too. With multi-product solutions, you can package services with software into a single procurement experience. Combine your own advisory, proprietary IP, and third-party products you’re authorized to resell. The result is complete offerings tailored to specific industries and use cases. Customers purchase multi-product solutions through a simplified procurement flow with a single partner as a point of contact. The partner has resale authorization for products and services included in the solution, eliminating the need to coordinate offers across other partners involved. Because packaged solutions often include professional services, pricing needs to match how you deliver. With variable payments, you can set contract caps and create payment requests throughout project delivery. Now, you can bill as milestones are completed or as time and materials are consumed.

“Multi-product solutions help Smarsh deliver our Enterprise Platform, data migration, and implementation services in a single AWS Marketplace offer set. Previously, we transacted professional services directly with customers as there was no mechanism for variable payments in AWS Marketplace. We managed separate invoicing and reconciliation alongside our software deals. This new capability significantly improves our customers’ purchasing experience while reducing the operational overhead on the Smarsh A/R team.”

— Tom Lynch, Director, Strategic Partnerships, Smarsh

Why consulting partners are investing in AWS Marketplace

Consulting partners are already building on these capabilities. Read on to learn why they’re investing in AWS Marketplace.

“We’ve been investing in growing in AWS Marketplace for years, and what we’re seeing from customers now is different than even 12 months ago. They’re doing their homework before they engage, and increasingly, they’re sourcing AI agents and the teams who build them in the same motion. What AWS is building to expand SI partner reach, combined with a fee that makes sense for services, gives us confidence to make AWS Marketplace a core part of how we grow together.”

— Jim Keller, CEO, Quantiphi

“Slalom is turning our decades of consulting expertise into products customers can discover, evaluate, and purchase on their own terms. We like working with AWS Marketplace because it’s a trusted, frictionless channel for innovators to find what they need and act fast.”

— WD Land, Sr. Managing Director, AWS Cloud Team, Slalom

Start building your presence today

The economics now work. The infrastructure is built. AWS Marketplace for professional services is open for business. Get started with these resources:

For new AWS Marketplace sellers, start selling in AWS Marketplace with agentic capabilities in AWS Partner Central that take you from registration to ready-to-sell quickly.
For existing AWS Marketplace sellers, create and optimize your service or multi-product solution listing using the Partner Assistant chat in AWS Marketplace Management Portal.
Route your next deal through AWS Marketplace. At 0.5 percent, the listing fees works within services margins.
Launch your AWS Marketplace Storefront.

Continuous model adaptation with 4MINDS on AWS

Eric Yuen — Wed, 16 Sep 2026 20:07:09 +0000

By: Haresh Vaishnav, WW GenAI Category Manager – AWS
by: Savannah Meredith, AMER Startup Growth PDM – AWS
by: Eric Yuen, Sr. Partner Solution Architect – AWS
by: Michael Kneip, Sr. Director AI Partnerships – 4MINDS
by: Robert Ray, VP of Solutions Engineering – 4MINDS

4MINDS

In this post, we discuss continuous model adaptation solution from 4MINDS on Amazon Web Services (AWS). You’ll learn how this solution overcomes the limitations of the existing Retrieval Augmented Generation (RAG) approach to fine-tuning the model at enterprise scale.

If you’ve deployed RAG in production, you’ve seen it work. When you connect a foundation model (FM) to your enterprise data, teams are getting answers grounded in real documents. The initial results achieved from this implementation show significant improvement.

Then somewhere between pilot and enterprise-wide rollout, something shifts. It’s not a failure, more like a plateau. The model handles direct lookups well, but it struggles when reasoning across multiple knowledge domains. Retrieval results become noisier as your knowledge base grows, and despite processing thousands of queries, the model itself doesn’t get any better at understanding your business. Left unaddressed, this plateau becomes an obstacle to achieving meaningful results. Production timelines slip. Stakeholder confidence erodes. What began as a promising AI initiative risks joining the many enterprise AI projects that never make it past pilot. The 4MINDS solution adopts continuous model adaptation, allowing the model to learn and improve from the user interaction and additional knowledge base.

Understanding the RAG ceiling

RAG solves the critical problem of providing general-purpose model access to proprietary information without the cost and complexity of fine-tuning. For use cases like document Q&A, policy lookup, and customer-facing search, RAG might be the appropriate approach. However, RAG has an inherent architectural limitation. Because RAG-based architecture is stateless, every query starts from zero, which means that using RAG doesn’t help models learn your business. The model generates a response from retrieved context but doesn’t retain the knowledge provided through RAG. The next query on the same topic goes through the same retrieval-and-forget cycle. At enterprise scale, this design creates several challenges. This stateless architecture approach results in the nonlinear degradation of retrieval quality as the number of documents fed to the model during RAG increases. A RAG system with 10,000 documents retrieves with high precision. At 10 million documents, results fail to achieve the precise context. They’re similar semantically but not precisely relevant. The model then reasons over imperfect inputs, compounding error with each hop. Meanwhile, context windows force invisible trade-offs. Today’s larger context windows help, but a model can only reason over limited data effectively due to resource constraint and cognitive bottleneck. The retrieval system must decide what to include and what to leave out, and those decisions happen silently without the user’s knowledge. A confident-sounding answer can be grounded in an incomplete picture.As a result, domain reasoning remains shallow. A model that retrieves information about your industry’s terminology can repeat it correctly. However, it won’t learn how concepts relate to each other, how your organization handles exceptions, or what good judgment looks like in context. That requires something beyond retrieval. It requires the model to learn. These challenges are the result of architecture limitations where the model remains static and knowledge resides outside it.

Knowledge built into the model with 4MINDS

4MINDS, an AWS Advanced Technology Partner, has introduced a new architectural pattern called continuous model adaptation. With this pattern, enterprise knowledge isn’t retrieved at query time but is learned and built directly into model parameters. This approach addresses the RAG limitations by changing what the model fundamentally knows rather than what it can look up. Instead of maintaining a separate knowledge system that feeds context to a static model, 4MINDS can improve its understanding of your business continuously as explained in the next paragraph. This alleviates downtime and removes the traditional costs of fine-tuning. This unique architectural choice brings additional value to traditional fine-tuning approach. 4MINDS represents the knowledge in structured fashion. Instead of treating enterprise data as flat text to be chunked and embedded, they organize knowledge hierarchically, capturing facts as well as relationships between concepts, organizational structures, and reasoning patterns specific to your domain. 4MINDS doesn’t require retraining the entire model. They modify a small fraction of parameters (typically less than 5%). In this way, they internalize new knowledge while preserving general capabilities. Teams can fully reverse changes and roll back in minutes if a new adaptation underperforms. The solution learns from every interaction in production during inference. As your business evolves with new products, new regulations and new terminology, they adapt in near real time rather than requiring periodic, expensive retraining cycles. This new architectural paradigm allows AI to improve its understanding of your business over time, without the operational burden that traditional fine-tuning imposes.

4MINDS implementation on AWS

4MINDS implements continuous model adaptation with the solution built on AWS services as shown in the following figure. This integration makes it straightforward for customers to deploy the solution on AWS without having to worry about additional integration. The solution uses Amazon Bedrock or Amazon SageMaker AI for foundation model access, and Amazon Simple Storage Service (Amazon S3) for enterprise data pipelines. For governance, they rely on services you already run. AWS Key Management Service (AWS KMS) handles encryption, AWS PrivateLink provides private connectivity, and AWS Identity and Access Management (AWS IAM) manages access control.

For teams already on AWS, getting started involves adding capability to the infrastructure you already run. You subscribe to the 4MINDS solution through AWS Marketplace. AWS Marketplace supports provisioning and billing through your existing AWS agreement.

Upon deploying the solution, 4MINDS connects to your enterprise data where it already lives. Teams select a foundation model in Amazon Bedrock or Amazon SageMaker AI, and 4MINDS adapts on top of it rather than replacing it. Amazon Bedrock models receive reasoning grounded in your data, and Amazon SageMaker AI models receive rapid, continuously improving fine-tuning in addition to that same grounded reasoning.

From that point, adaptation begins. 4MINDS builds a structured representation of your domain and starts internalizing it into the model, with changes that are fully reversible and an adaptation loop that continues as your business evolves. Most teams go from subscription to a domain-adapted model without requiring new infrastructure project. The following diagram shows the architecture deployed in a software as a service (SaaS) environment.

Figure 1: 4MIND intelligence pipeline architecture

Organizations adopting 4MINDS can expect outcomes associated with a more direct, domain-informed approach to enterprise AI. 4MINDS enables models to learn from structured business context resulting in accelerated deployment, improved reliability and relevance of outputs, and reduced operational complexity associated with maintaining extensive retrieval infrastructure. In a typical deployment, 4MINDS targets outcomes such as faster time to production, fewer unsupported or inaccurate responses on business-critical tasks, lower ongoing infrastructure and maintenance requirements, and improved ability to scale AI across enterprise workflows. actual results are dependent on the underlying use case, data readiness, implementation scope or application.

When to consider 4MINDS alongside RAG

RAG performs better at breadth and real-time information access, whereas continuous model adaptation is preferred for depth and domain mastery. Many enterprises will likely use both approaches. The decision comes down to whether your workload needs the model to know something or find it. Start with 4MINDS on workloads where retrieval is visibly struggling, evaluate in parallel, and expand incrementally. Consider 4MINDS when:

Your AI needs domain reasoning, not just document lookup – If users are asking questions that require synthesizing knowledge across multiple sources, understanding implicit context, or applying business judgment, retrieval alone will hit a ceiling.
Your knowledge base has crossed a complexity threshold – When retrieval quality degrades because your corpus is too large, too interconnected, or too nuanced for embedding-based search to handle reliably.
Consistency matters more than recency – For use cases where the model needs to apply stable enterprise knowledge and expertise (such as compliance interpretation, technical standards, or organizational processes), building that knowledge into the model using 4MINDS produces more reliable outputs than retrieving it fresh each time.
You’re spending more on RAG maintenance than on innovation – When your team’s time is going into chunking, embedding selection, and retrieval tuning, adding continuous adaptation can let the model carry more of that domain knowledge directly.

The bigger picture

Enterprise AI is maturing beyond a single architectural pattern. RAG proved that AI could be grounded in proprietary knowledge without enormous upfront investment. But as organizations push toward production workloads that demand deeper domain understanding, the limitations of retrieval-only architecture become apparent.4MINDS represents the next layer of the enterprise AI stack. In addition to accessing your knowledge, they genuinely understand the context behind it. 4MINDS is built on AWS to make this pattern more accessible, combining continuous adaptation with the security, scale, and services enterprises already trust. For organizations that have already invested in AI on AWS and are ready for what comes next, this is a pattern worth exploring.

Next steps

If the challenges described earlier sound familiar, explore the 4MINDS listing in AWS Marketplace to understand how continuous model adaptation integrates with existing AWS infrastructure. You can also contact your AWS account team and 4MINDS to schedule an exclusive workshop and demo of the solution..

4MINDS – AWS Partner spotlight

4MINDS is an enterprise AI software company focused on the layer between foundation models and production business workflows. Its platform connects structured and unstructured enterprise data into a continuously updated context layer, adapts models to customer-specific terminology and decision patterns, and governs how agents reason, use tools, verify evidence, and take or recommend action.

Contact 4MINDS | Partner Overview | AWS Marketplace

From weeks to hours: How a UK energy retailer transformed residential pricebooks with Gorilla on AWS

John Gray — Fri, 11 Sep 2026 17:34:23 +0000

By: Jack Rivers, Content Marketing Manager – Gorilla
By: John Gray, Sr. SAP Specialist Partner Solutions Architect – AWS
By: Sascha Janssen, Principal Solutions Architect – AWS
By: Simon Cunningham, Principal ERP Specialist Solutions Architect – AWS

Gorilla

In this post, you will learn how a major UK energy retailer modernized its residential pricebook process using the Gorilla Energy Margin Intelligence application, built on Amazon Web Services (AWS). Facing intense market volatility, the retailer transformed their error-prone, manual process into an automated, auditable workflow that completes in under 4 hours. We detail the industry challenge, the technical solution using Amazon Simple Storage Service (Amazon S3), AWS Glue, and Amazon Elastic Compute Cloud (Amazon EC2), and the major results, including a 95% reduction in pricebook creation time and full Market-wide Half Hourly Settlement (MHHS) compliance (Pricing Manager, UK Energy Retailer).

To stay competitive, you need to move now, not days later

As energy markets have shifted from a state of relative calm to near constant volatility, the pricing team has faced a slew of new challenges. We need to remain competitive across numerous brokers and other third-party intermediaries (TPIs) while verifying that each new deal is going to make money. A slight delay and we lose to a competitor; a mistake and we potentially lose even more.

For years our processes have been manual. An analyst would export billing data from SAP, rebuild the pricing model in Excel, wait 2–5 days for calculations to be complete, then route everything through finance and commercial sign-off before anyone could touch the SAP billing system. By the time we had a number we trusted, the market had moved again.

We weren’t slow because our people weren’t good. We were slow because the tools weren’t built for the speed the market now demands. That’s why we partnered with Gorilla, an AWS Partner and AWS Marketplace Seller, to rebuild this workflow from the ground up on AWS.

The industry-wide problem: Adjusting at pace to a volatile market

Energy retailers across Europe and North America face the same structural challenge. Reacting quickly enough to a chaotic market requires new capabilities. Changes in one or more of the following areas can trigger a wave of pricebook updates:

Wholesale market volatility – Spot and forward price movements that can shift margins overnight
Network and distribution charge updates – Typically annual but increasingly frequent
Government levies and tax changes – Requiring rapid pass-through recalculation across products

In the UK, pricing has been further complicated by the introduction of Market-wide Half Hourly Settlement (MHHS), which mandates that energy usage (domestic and non-domestic) be settled at half-hourly granularity. Aside from the operational challenge, this has introduced a vast amount of new data into every calculation. Similar changes to settlement times have occurred in other energy markets, with 5-minute settlement in Australia and 15-minute settlement across the EU.

The traditional approach to updating a pricebook—with spreadsheets, manual SAP exports, and siloed teams—creates three compounding risks:

Speed risk – Slow quotation means losing out or taking a risk with errors
Accuracy risk – Manual processes introduce errors across millions of contract lines
Capacity risk – Peak demand for pricing analysis reaches exactly when market volatility is highest

For our customer, a major UK retailer, this meant they could update their pricebooks only once a month, with five levels of business sign-off to bring a new product to market and no ability to model scenarios before committing to a price.

What good looks like: Rapid, automated, auditable pricebooks

The target state isn’t only faster spreadsheets. It’s a fundamentally different operating model:

A pricing manager receives an alert that wholesale costs have shifted
Within minutes, an automated workflow recalculates tariffs across products and customer segments
Pricebook creation has gone from taking days to completing within 30–45 minutes
The approved book is written back to SAP with a detailed audit trail
The entire cycle, from market signal to updated billing system, is designed to be complete in one to two hours

This is what Gorilla’s Energy Margin Intelligence application, built on AWS, is designed to deliver.

The solution: Gorilla on AWS

Gorilla and the energy retailer began to work on an implementation that can cover their needs without disrupting business operations.

Architecture overview

The following diagram illustrates the end-to-end pricing-update pipeline, showing how SAP S/4HANA pricing data is extracted, transformed, and delivered to the Gorilla Pricing Engine, with results captured back into an analytics layer for reporting.

Figure 1: Solution architecture

The application connects three layers that previously operated in silos:

Data foundation – SAP IS-U (Industry Solution for Utilities) and S/4HANA remain the system of record for billing and contract data. SAP Energy Data Management (EDM) provides consumption data. AWS Glue extracts this data into Amazon S3, which serves as the central data lake. There is no rip-and-replace of existing SAP infrastructure.
Automated orchestration – AWS Step Functions coordinates the end-to-end workflow. AWS Lambda handles event-driven triggers and lightweight processing. Amazon API Gateway manages external integrations. Amazon DynamoDB stores workflow state and intermediate results.
Calculation and analytics – Gorilla’s Python-based pricing engine runs on Amazon ECS, processing tariff recalculations in parallel across the full portfolio. Amazon Athena and Amazon Redshift power portfolio-level analysis. Amazon Quick delivers scenario dashboards to pricing managers and commercial directors and allows business users to query portfolio data in plain English with no SQL required.

The result is a closed-loop system: SAP data flows into AWS, Gorilla calculates, and results flow back to SAP through the AWS Glue SAP OData connector. The process is automatic, can scale, and is auditable.

Why we built on AWS – A note from Gorilla’s CTO Joris Van Genechten

When we evaluated cloud providers for our calculation engine, three things drove our decision toward AWS:

Elastic compute at portfolio scale – Energy retailers range from 50,000 to 50 million contracts. Amazon ECS enables us to scale our parallel processing engine to match portfolio size without pre-provisioning infrastructure. A retailer with 500,000 contracts and one with 5 million contracts run the same code base and the application platform scales to fit.
Native SAP integration – Most energy retailers run SAP. The AWS Glue SAP OData connector meant we can build a production-grade data pipeline without custom middleware. This dramatically reduced implementation time and ongoing maintenance burden for our customers.
The analytics layer – Our customers don’t just need fast calculations: they need to make decisions from the results. Amazon Quick gave us a business-ready analytics and natural language interface we can embed directly into our solution without building it ourselves.

A day in the life: Before and after

To illustrate the operational impact of this solution, the following tables walk through a typical pricing-update cycle, first as it exists today using manual processes, and then as it runs with Gorilla on AWS.

Before Gorilla on AWS

Figure 2: A typical pricing-update cycle using manual processes

Before Gorilla on AWS, the process took a total of 10–14 business days. The process was lengthy, error prone, and required high manual effort. There was no scenario modeling.

After Gorilla on AWS

Figure 3: A typical pricing-update cycle with Gorilla on AWS

After Gorilla on AWS, the process took less than 4 hours. The new process is scenario modeled, auditable, and requires minimal manual intervention.

Results: What changed for the UK retailer

After Gorilla on AWS, the UK energy retailer saw the following improvements:

Pricebook creation time – Reduced from 2–5 business days to under an hour, a 95% reduction
Full-time equivalent (FTE) hours per cycle – From 3 analyst-days to 2 hours of review time
MHHS compliance – Previously impossible; now fully MHHS ready
Error rate – 75% reduction in pricing errors reaching SAP billing
Market responsiveness – Ability to respond to intraday wholesale movements for the first time

“It’s been a huge gain to take any existing process and transform it into something automated and modern” – Pricing Manager, UK energy retailer

How this Fits the SAP + AWS joint go-to-market

For energy retailers running SAP IS-U or S/4HANA, this solution is additive and doesn’t require major changes in SAP. Gorilla’s solution extends SAP’s data without replacing it. AWS Glue handles extraction and enriched pricing data writes back to SAP through standard interfaces. There is no core system migration required.

This makes Gorilla on AWS a natural fit for SAP customers looking to modernize their analytics and pricing capabilities without a multi-year transformation program. AWS and SAP’s existing partnership means joint customers can use existing commercial agreements, certified integration patterns, and joint support structures.

For AWS Partners and SAP resellers, this represents a concrete, deployable solution for a pain point that exists in every energy retail SAP environment.

Getting started

Gorilla’s Energy Margin Intelligence solution is available on AWS Marketplace, supporting procurement through existing AWS commercial agreements. The solution is compatible with SAP IS-U and S/4HANA environments and can be deployed incrementally; starting with a single market or product line before scaling to the full portfolio.

To learn more or request a proof-of-concept scoping session, visit the Gorilla AWS Marketplace listing or contact your AWS Energy & Utilities Industry Specialist.

Conclusion

In this post, we showed you how a major UK energy retailer transformed its residential pricebook process from a 10–14-day manual workflow into an automated, auditable cycle that completes in under 4 hours. Using the Gorilla Energy Margin Intelligence application built on AWS, the retailer used AWS Glue for SAP data extraction, Amazon ECS for parallel tariff recalculation at portfolio scale, and Amazon Quick for scenario analysis and decision support. The results speak for themselves: a 95% reduction in pricebook creation time, a 75% decrease in pricing errors, full MHHS compliance, and the ability to respond to intraday market movements for the first time. For energy retailers running SAP IS-U or S/4HANA, this solution demonstrates that modernizing pricing operations doesn’t require replacing core systems, it means extending them with automation built for the cloud that delivers speed, accuracy, and auditability where it matters most. To explore how Gorilla on AWS can accelerate your pricing workflows, visit the Gorilla AWS Marketplace listing or contact your AWS Energy & Utilities Industry Specialist.

Gorilla – AWS Partner Spotlight

Gorilla is an AWS Differentiated (Software) Partner and AWS Energy & Utilities Software Competency Partner that provides Energy Margin Intelligence, unifying pricing, forecasting, hedging, billing, and finance into a single source of margin truth so energy retailers can see, steer, protect, and grow their margins with confidence.

Contact Gorilla | Partner Overview | AWS Marketplace

How Nubank saved $15M on Amazon DynamoDB costs with PointFive

Amir Hazoom — Wed, 09 Sep 2026 14:36:32 +0000

By: Amir Hazoom, Partner Solutions Architect – AWS
By: Rob McCauley, Specialist Solutions Architect – AWS
By: Mike Rosenberg, Director of Cloud Financial Management – Nubank
By: Amir Hozez, Co-Founder & CTO – PointFive

PointFive

Nubank saved over $15 million on Amazon DynamoDB costs by partnering with PointFive while scaling from 99 million to 119 million customers in 16 months. This post describes how Nubank and PointFive achieved measurable savings while continuing to scale by building on Amazon Web Services (AWS). Nubank uses DynamoDB to handle billions of real-time financial transactions with consistent, single-digit millisecond performance. PointFive’s agentic optimization analyzed thousands of DynamoDB tables, and Nubank turned the findings into verified annualized savings.

Nubank partnered with PointFive to manage cloud efficiency and maintain its low cost-to-serve. Running on AWS, they uncovered and remediated inefficiencies across thousands of DynamoDB tables. This drove measurable savings and reinforced the value of financial operations (FinOps) maturity for teams running on AWS.

The following diagram illustrates how DynamoDB infrastructure, PointFive’s agentic optimization, and Nubank’s FinOps discipline work together on AWS to deliver verified savings at scale:

Figure 1 – How DynamoDB infrastructure, agentic optimization, and FinOps discipline work together on AWS to deliver verified savings at scale

The urgency of cloud optimization

Cloud spending continues to accelerate. The FinOps Foundation’s State of FinOps 2026 report finds that 78% of FinOps practices now report into the CTO or CIO organization, signaling that cloud cost management has become a boardroom priority. The next challenge is operationalizing it at enterprise scale. At the same time, enterprises are adopting AI workloads on AWS. For Nubank, optimizing cloud spend on existing services freed budget to reinvest in AI services such as Amazon Bedrock and Amazon SageMaker AI.

The DynamoDB 2024 pricing update reduced on-demand throughput costs by up to 50%, giving customers a strong reason to revisit their database configurations. Combined with AI-driven optimization, this is the right time to act.

DynamoDB as Nubank’s foundation

DynamoDB provides the backbone for Nubank’s real-time financial systems. As a fully managed, serverless database, it delivers the performance, security, and resilience that real-time financial transactions require at scale.

DynamoDB capabilities that supported Nubank’s success include single-digit millisecond performance at high scale and multi-Region strong consistency for resilience. The 2024 pricing updates further reduced on-demand throughput costs by up to 50%.

“It’s a bulletproof database that grows as fast as we do.”
– Mike Rosenberg, Nubank

The challenge: Visibility and waste at scale

With thousands of DynamoDB tables spread across engineering teams, identifying unused or inefficient resources manually was unfeasible. Even marginal inefficiencies could add up to significant costs at Nubank’s scale.

“No one raindrop believes it’s responsible for the flood. PointFive helped us see each table, the raindrops, that added up to costs without business value.”
– Mike Rosenberg, Nubank

The following screenshot shows how PointFive surfaces DynamoDB optimization opportunities, with specific savings estimates and recommended actions for each table:

Figure 2 – PointFive displaying DynamoDB optimization opportunities for Nubank, including inactive table detection, storage class recommendations, and capacity right-sizing, each with estimated savings and a direct remediation path

The solution: A three-way partnership in action

PointFive deploys from AWS Marketplace with no infrastructure changes required. Within 24 hours of onboarding, PointFive identified actionable optimization opportunities for Nubank’s DynamoDB environment. Its agentic, architecture-level analysis found inefficiencies that rule-based tools missed.

Three categories drove the majority of Nubank’s savings:

Inactive table cleanup – Tables no longer in active use were identified and removed, leading to immediate savings.
Storage class shifts – Low-access tables were moved to the DynamoDB Standard-Infrequent Access (Standard-IA) table class, cutting storage costs by up to 60% on affected workloads according to Nubank.
Capacity right-sizing – Each remaining table was matched to the most cost-efficient throughput model for its actual usage pattern.

Each recommendation flowed directly into Nubank’s existing engineering workflow through a Jira integration. Findings became finished work, not tickets in a backlog.

“For banks and financial services customers, disaster recovery and data durability are required. DynamoDB capabilities like multi-Region strong consistency and point-in-time recovery give customers like Nubank essential resilience while freeing budget to reinvest in further innovation.”
– Rob McCauley, Amazon DynamoDB

Measurable results

The Nubank and PointFive collaboration delivered the following outcomes:

Over $15 million in verified annualized savings while scaling by 20 million new customers over 16 months, as reported by Nubank
Ten-day return on investment (ROI) from initial deployment to first realized savings, based on Nubank’s data
Reinvestment in resilience: A portion of recovered spend went toward DynamoDB point-in-time recovery, strengthening Nubank’s durability posture

The following graphic summarizes the measurable outcomes Nubank achieved over 16 months:

Figure 3 – Nubank’s measurable outcomes from the AWS and PointFive collaboration include over $15 million in verified annualized savings, 119 million customers served, and ROI achieved within 10 days of deployment

“Optimization isn’t just a one-time fix. It’s a posture. Our solution continuously learns from DynamoDB telemetry to keep customers efficient as they grow.”
– Amir Hozez, Co-founder and CTO, PointFive

The takeaway: Better together

This collaboration demonstrated that enterprises can optimize cost and strengthen resilience simultaneously. DynamoDB provided the technical foundation, PointFive’s agentic analysis surfaced the opportunities, and Nubank’s FinOps discipline turned them into outcomes. The result is more than savings—it’s headroom to reinvest in resilience and in the AI workloads that will define the next wave of cloud innovation. This pattern is repeatable: Find the waste, fund the future.

Related resources

- Accelerate vendor evaluation with AWS specializations – APN Blog
- Best practices for cost optimization – AWS Well-Architected Framework

About PointFive

PointFive is an AWS Advanced Tier Independent Software Vendor (ISV) Partner with the AWS Cloud Operations Competency and Cloud Financial Management designation. PointFive helps enterprises identify and eliminate cloud waste across every layer of their stack, from cloud infrastructure to AI workloads, through agentic optimization available in AWS Marketplace.

Contact PointFive | Partner Overview | AWS Marketplace

Run Apache Spark up to 10x faster with DataPelago on Amazon EKS

Nikhil Marrapu — Thu, 03 Sep 2026 19:46:13 +0000

By: John Janakiraman, VP of Engineering – DataPelago Inc.
By: Hany Mostafa, Senior Solutions Architect – AWS
By: Nikhil Marrapu, Senior Solutions Architect – AWS

datapelago

Spark infrastructure costs are a significant bottleneck in modern AI and analytics pipelines, which is a direct consequence of running today’s data workloads on compute frameworks designed for earlier CPU-only architectures.

As AI workloads grow, teams need faster, more efficient ways to process data without rewriting their existing applications. Enterprises across social media, AI-powered analytics, ecommerce, and financial services have adopted DataPelago Accelerator for Spark (DPA-S) to address this challenge.

As an AWS ISV Partner, DataPelago accelerates Apache Spark on Amazon Elastic Kubernetes Service (Amazon EKS) for these customers, which means they deliver up to 10 times faster execution and up to 80% cost reduction without changes to their existing applications, security configurations, or data pipelines.

In this post, you’ll learn how customers accelerate Apache Spark workloads on Amazon EKS with DataPelago, review production performance results, and find out how to get started with a proof of concept on your own infrastructure.

Why Spark acceleration has been hard

Spark was designed for CPU-only environments. Data centers today look different. CPUs sit alongside GPUs, FPGAs, and custom accelerators. The processing power is there, but Spark can’t reach it.

The barrier is a programming model gap. Spark is built to run JVM tasks on legacy CPUs. Getting workloads onto GPUs or vectorized CPUs means rewriting application logic for a different execution model. Data engineers focus on data movement and orchestration rather than low-level processor-specific optimization. Infrastructure teams can provision GPU-enabled Amazon Elastic Compute Cloud (Amazon EC2) instances but they can’t change the Spark runtime to use them. Organizations pay for heterogeneous compute and run Spark as if the only option is a CPU.

Customers use DataPelago to close this gap with no application rewrites and no retooling needed. The system accelerates workloads without manual intervention.

How DPA-S works

DPA-S runs on DataPelago Nucleus, a universal data processing engine designed to accelerate structured and unstructured data on supported hardware. It places a domain-specific instruction set architecture between the Spark physical plan and the underlying hardware. This architecture means Spark workloads can run across CPUs and GPUs without the application knowing which processor handles which operation.

The following diagram shows the DataPelago Nucleus architecture, a single processing engine that sits between data workloads—analytics and generative AI—and the underlying hardware, supporting structured and unstructured data across CPUs, GPUs, and FPGAs:

Figure 1: DataPelago Nucleus architecture

The Spark Catalyst optimizer (the query planner that converts SQL and DataFrame operations into an executable plan) produces a physical plan as it normally does. DataPelago changes none of it. Nucleus intercepts at the physical plan stage. It evaluates every operation for acceleration, including scans, filters, joins, aggregations, and sorts. For each operation, Nucleus determines at runtime which processor will be fastest based on the data. Some operations route to GPU; others stay on CPU with vectorized execution. If a stage can’t be accelerated, Nucleus falls back to standard Spark automatically with no errors. Cluster topology, data formats, security, and monitoring remain untouched. The following diagram illustrates this architecture:

Figure 2: CPU and GPU infrastructure

Performance beyond cuDF

As Jensen Huang noted at COMPUTEX, “Data processing consumes the vast majority of cloud spend today. All of it should be accelerated.” When benchmarked against NVIDIA cuDF, the GPU-accelerated library powering the Spark RAPIDS Accelerator, DataPelago Nucleus demonstrated measurable performance gains across key operation types.

The DataPelago team ran the benchmark comparison on an AWS P5.48xlarge instance (192 vCPUs, 2 TB RAM, and 8x NVIDIA H100 GPUs). The team conducted measurements using DataPelago Nucleus v3.0 and cuDF v25.04.00. The benchmark covered a suite of physical operators that form the building blocks of AI and analytics workloads. Here are four of the key results:

Projection and filtering – With 3.7–10.5 times higher throughput than cuDF. Nucleus fuses multiple Spark operations into single GPU kernels, reducing the extra kernel launches and memory copies that limit cuDF on integer-heavy workloads.
Aggregation – 3.3–4.5 times higher throughput across the tested data types, including float32 and float64 operations common in financial and scientific workloads.
Memory-intensive operations – Up to 4.5 times faster on hash joins and aggregations. Nucleus manages GPU high-bandwidth memory dynamically, avoiding the spill to CPU cycles that degrade cuDF on large datasets.
Variable length string processing – Up to 38.6 times faster for hash joins on text data. This performance gap is particularly relevant for generative AI pipelines, where unstructured text is the dominant data type. Nucleus uses purpose-built string hashing that keeps performance GPU in-house in cases where cuDF might fall back to slower execution paths.

For AWS customers running GPU instances, these gains translate to significantly more useful work from the same hardware.

Deploying on AWS

Customers run DataPelago on AWS for self-managed Apache Spark on Amazon EKS. DataPelago is deployed as a Spark plugin during cluster setup, requiring no data migration, application rewrites, or application recertification. For deployment instructions, see the DataPelago deployment guide for Amazon EKS.

The integration works at the executor level. DataPelago adds a pre-execution hook that decides which stages to accelerate. Spark drivers, resource managers, monitoring, and scheduling continue as before. The only change: Jobs finish faster on fewer Amazon EC2 resources.

Data stays in Amazon Simple Storage Service (Amazon S3) in Parquet, Delta, ORC, or other standard formats, fully compatible with Spark’s built-in authentication and encryption. According to DataPelago, the solution is SOC 2 Type 2 and ISO 27001 certified. DataPelago doesn’t access, copy, or move customer data, and the solution avoids vendor lock-in.

You can procure DataPelago in AWS Marketplace for streamlined billing. For guidance on running Spark workloads on Amazon EKS, refer to this Containers Blog post: Best practices for running Spark on Amazon EKS.

Production results across industries

Customers across social media, AI-powered analytics, ecommerce, and financial services have adopted DataPelago to accelerate their Spark workloads. In production, customers have achieved 2–10 times faster performance and 50–80% lower costs. In micro-benchmarks, Nucleus reaches up to 60 times faster speedup on memory- and compute-intensive operations such as joins, aggregations, and sorts.Four outcomes are consistent across these deployments:

Performance gains 2–4 times faster in production – DataPelago accelerates compute- or memory-intensive operations such as joins, aggregations, and sorts by routing them to optimized execution paths on CPUs or GPUs. Customers running daily extract, transform, and load (ETL), enrichment, and model validation pipelines have reduced the number of vCPU hours needed to complete these jobs on the same cluster configurations.
Cost reduction of 50–80% – Faster job completion means fewer compute hours consumed per workload. Because DataPelago reduces the active runtime of Spark jobs without changing cluster size, customers pay for less compute time on the same EC2 instances. Some customers have also been able to downsize their clusters while maintaining equivalent or better performance, further reducing costs.
Seamless deployment at scale – In enterprise environments with diverse workloads where legacy approaches caused Spark jobs to fail during runs, DataPelago’s Smart Acceleration helped prevent job failures by intelligently reverting individual queries and stages to built-in Spark when acceleration is not possible. This alleviated the all-or-nothing risk of full job
acceleration and confirmed teams depending on these jobs had data available on schedule
Production deployment in hours to days – DataPelago deploys as a Spark plugin (JAR file) with no code changes, no data migration, and only minimal configuration settings. Most customers complete a proof of concept in 3–4 weeks and move to production shortly after.

Getting started

DataPelago Accelerator for Spark is available now in AWS Marketplace.

You can deploy DataPelago into your existing Spark on Amazon EKS environments. You select the workloads, complete benchmarks with and without DataPelago’s accelerator, and measure the difference. Most customers finish a proof of concept in 3–4 weeks. Deployment itself takes hours to days.

To get started, explore DataPelago in AWS Marketplace or contact the team to discuss a proof of concept and measure your Spark acceleration on your own workloads.

Visit DataPelago to explore how DataPelago can accelerate your Spark workloads and how to request a proof of concept.

DataPelago – AWS Partner Spotlight

DataPelago is an AWS Advanced Partner and AWS Data & Analytics Competency Partner that that accelerates Apache Spark and other open source frameworks for generative AI and analytics workloads. DataPelago Accelerator for Spark deploys as a plugin into existing Spark environments with zero code changes, no data migration, and no disruption to security policies, delivering up to 10x faster execution and up to 80% lower compute costs across CPUs and GPUs.

Contact DataPelago | Partner Overview | AWS Marketplace

Say Hello to 158 New AWS Competency and MSP Partners Added in August

Nick Paris — Tue, 01 Sep 2026 16:24:17 +0000

By Nick Paris, APN Marketing Manager – AWS Partner Network

The AWS Partner Network (APN) is a global community that leverages Amazon Web Services (AWS) technologies, programs, expertise, and tools to build solutions and provide services for customers.

NEW! AWS Competency Partners

To succeed with cloud adoption in today’s complex IT environment and continue to advance in the future, customers can team up with an AWS Competency Partner.

Team up with our newest AWS Competency Partners:

AWS AI Competency

10Pearls | NAMER | Generative AI Consulting Services
AH2 | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Algotery | EMEA | Generative AI Consulting Services
Anjana Cloud9 Solutions | NAMER | Generative AI Consulting Services
Aquarela Cloud Solutions | LATAM | Agentic AI Consulting Services
BizCloud Experts | NAMER | Agentic AI Consulting Services
Bounteous | NAMER | Generative AI Consulting Services
Brillio | NAMER | Generative AI Consulting Services
CADD Emirates Computer Trading | EMEA | Generative AI Consulting Services
Capspedia | APAC | Generative AI Consulting Services
Cloud Mile | China | Generative AI Consulting Services
Cloud202 | EMEA | Agentic AI Consulting Services
Cloudhight Consulting | EMEA | Agentic AI Consulting Services
CloudJournee | APAC | Agentic AI Consulting Services
Cloudojo | EMEA | Generative AI Consulting Services
Cloudpiles | LATAM | Agentic AI Consulting Services; Generative AI Consulting Services
CloudThat | APAC | Agentic AI Consulting Services
Cloudtry Infotech | APAC | Generative AI Consulting Services
CoderPush | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Credence Management Solutions | NAMER | Generative AI Consulting Services
D3Clarity | NAMER | Agentic AI Consulting Services
DailiTech | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Darede | LATAM | Agentic AI Consulting Services
Datamellon | EMEA | Generative AI Consulting Services
Digiclarity | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Digital Alpha Platforms | NAMER | Agentic AI Consulting Services
Diversus | APAC | Generative AI Consulting Services
Dualboot Partners | NAMER | Generative AI Consulting Services
ECC Technologies (ASCP GPUonCLOUD) | APAC | Generative AI Consulting Services
Enreap India | APAC | Generative AI Consulting Services
FivexL Consulting Services | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Ganit Business Solutions | APAC | Agentic AI Consulting Services
GlobalTask | NAMER | Agentic AI Consulting Services
Go Digit | APAC | Generative AI Consulting Services
Happiest Minds Technologies | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Karnovation | NAMER | Agentic AI Consulting Services
LADERA TECHNOLOGY | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Minutus Computing | APAC | Generative AI Consulting Services
Minutus Computing | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
NDS Corporation | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Necko Technologies | EMEA | Agentic AI Consulting Services
Nexusgrid Technologies | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
NWN Corporation | NAMER | Agentic AI Consulting Services
NxtCloud | APAC | Generative AI Consulting Services
OneByZero Pte | APAC | Agentic AI Consulting Services
OneData Software Solutions | NAMER | Agentic AI Consulting Services
OneData Software Solutions | NAMER | Generative AI Consulting Services
PEARL CLOUD SOFTWARE DESIGN | EMEA | Generative AI Consulting Services
Perficient | NAMER | Generative AI Consulting Services
Pronix Inc | NAMER | Generative AI Consulting Services
RECKLABS INC | NAMER | Generative AI Consulting Services
Relevantz Technology Services | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Revolutions.ai | APAC | Generative AI Consulting Services
RSNA Cloud Connect | NAMER | Agentic AI Consulting Services
safeINIT | EMEA | Generative AI Consulting Services
Searce | APAC | Generative AI Consulting Services
Shri Sai Tech | NAMER | Generative AI Consulting Services
Silicon Overdrive | EMEA | Generative AI Consulting Services
Silicon Power Solutions | APAC | Generative AI Consulting Services
SKY IQ TRADING AND SERVICES | EMEA | Generative AI Consulting Services
Tactical Edge | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
The Server Labs | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
TranSnet Cloud | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
UST | NAMER | Generative AI Consulting Services
Vcloudmaster | EMEA | Agentic AI Consulting Services
Webby Group | APAC | Generative AI Consulting Services
Wedgewoodservices | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Wizeline | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Xtremax | APAC | Generative AI Consulting Services
Zimetrics | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
网易 NetEase | China | Generative AI Applications
北京七麦科技股份有限公司 | China | Generative AI Applications
Artemis Global Technologies | NAMER | Generative AI Applications
ASCENDING | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications
Cloud Scal3 | NAMER | Generative AI Applications
Cloud202 Limited | EMEA | Agentic AI Tools
Devops TechLab | APAC | Generative AI Applications
Duco | NAMER | Agentic AI Applications
HighByte | NAMER | Infrastructure and Data
Horizon3.ai | NAMER | Agentic AI Applications
JINGdigital | China | Generative AI Applications
KG Data | China | Agentic AI Applications
PingCAP | NAMER | Agentic AI Tools
UnifyApps | NAMER | Generative AI Applications

AWS Business Value Realization Competency

Flexa Cloud Brasil | LATAM | Business Value Realization
RAMBUNCT CONSULTING | EMEA | Business Value Realization

AWS Cloud Operations Competency

Nerdshub | EMEA | Cloud Financial Management; Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
Opinov8 | EMEA | Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
Sotatek | APAC | Cloud Governance; Monitoring & Observability
SquareOps Technologies | APAC | Cloud Financial Management; Cloud Governance; Monitoring & Observability; Operations Management
The Software Works | NAMER | Cloud Financial Management; Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
Omnistrate | NAMER | Cloud Financial Management; Monitoring & Observability; Operations Management

AWS Data & Analytics Competency

Celebal Technologies Americas | NAMER | Consulting Services

AWS DevOps Competency

Commerce Architects | NAMER | Consulting Services
Dedalus | LATAM | Consulting Services
Devopsity | EMEA | Consulting Services
Fission Labs | NAMER | Consulting Services
Pyxis Tech | LATAM | Consulting Services
Registfy | EMEA | Consulting Services
Codvo.AI (TalentKloud) | NAMER | Consulting Services

AWS Digital Sovereignty Competency

dataRain Consulting | LATAM | Consulting Services
Nextlink Technology | APAC | Consulting Services

AWS Education Competency

The Burgundy Group | NAMER | Consulting Services
impress.ai | APAC | Administrative and Operations

AWS Financial Competency

Oneture Technologies | APAC | General Financial Services

AWS Government Competency

AppSquadz Software | NAMER | Citizen Services
ITG Solutions SAC | LATAM | Citizen Services
impress.ai | APAC | Citizen Services

AWS High Performance Computing Competency

RONIN | APAC | HPC Management

AWS IoT Competency

56k.Cloud | EMEA | Consulting Services

AWS Machine Learning Competency

A3Data | LATAM | Consulting Services
DataMax | EMEA | Consulting Services

AWS Microsoft Workloads Competency

Al Hilal Publishing And Marketing | EMEA | Database Solutions

AWS Migration and Modernization Competency

AGATEVERSE | NAMER | Migration Services
Ancrew Global Services | APAC | Migration Services; Modernization Services
Blue Pearl | APAC | Migration Services
CreateFuture | EMEA | Migration Services; Modernization Services
Digiclarity | NAMER | Migration Services
Hyundai Autoever | APAC | Migration Services
i2k2 Networks | APAC | Migration Services; Modernization Services
Ibexlabs / Labra | NAMER | Migration Services; Modernization Services
Novare Technologies | China | Migration Services
Pureplay Cloud | APAC | Migration Services
Teleglobal International | APAC | Migration Services

AWS MSSP Services Competency

Innovation Cloud Services – ICS Compute | APAC | Infrastructure Security; Workload Security

AWS Networking Competency

Vcloudmaster | EMEA | Consulting Services

AWS Resilience Competency

IBM | NAMER | Core Resilience; Resilience Design; Resilience Operations; Resilience Recovery
Honeycomb | NAMER | Resilience Operations

AWS Retail Competency

upd8 | LATAM | Consulting Services

AWS Security Competency

LCM Go Cloud | EMEA | Governance, Risk and Compliance; Threat Detection and Response
MegazoneCloud | APAC | Identity and Access Management
SK shieldus | APAC | Threat Detection and Response
Zetta Systems | EMEA | Identity and Access Management; Infrastructure Protection
Aikido Security | EMEA | Application Security

AWS Small and Medium Business (SMB) Competency

allOps Solutions | EMEA | Small and Medium Business
Axiom Digital | EMEA | Small and Medium Business
Cogniv Technologies | APAC | Small and Medium Business
Craftech | LATAM | Small and Medium Business
Insight Enterprises | NAMER | Small and Medium Business
IT Era | LATAM | Small and Medium Business
Loop8 – AI and Cloud Transformation Services | NAMER | Small and Medium Business
Nerdshub | EMEA | Small and Medium Business
NETRON INFORMATION TECHNOLOGY | APAC | Small and Medium Business

AWS Storage Competency

Automat-it | EMEA | Consulting Services
Cognetiks Consulting | EMEA | Consulting Services

AWS Travel and Hospitality Competency

HEXAWARE TECHNOLOGIES | NAMER | Data360; Digital Customer Engagement; Technology Migration and Modernization

NEW! AWS Managed Service Providers (MSPs)

Say hello to our newest AWS MSP Partners:

AWS Managed Service Provider Program

Cloudvisor | EMEA
Cognetiks Consulting | EMEA
Flentas Technologies | APAC
GoCloud | EMEA
Honne Services | LATAM
Intuitive.ai | NAMER
Lauren Group | NAMER
RealCloud | LATAM
Saltware | APAC
Searce | APAC
TechConnect IT Solutions | APAC
Tenesys | EMEA

More Value, Greater Profitability for AWS Partners

Learn how AWS is transforming the partner experience >>

Solution Matching Engine: Your Gateway to AWS Sellers

Akshay Menon — Mon, 31 Aug 2026 21:00:24 +0000

By: Akshay Menon, Principal Product Manager – AWS
By: Krystle DuBeau, Sr. Manager of Technical Business Development – AWS
By: Priya Bains, Head of Partner Brand and Content Strategy – AWS

When customers come to AWS with a business challenge, they rely on their AWS seller to point them toward the right solution and partner—fast. That often means identifying partner listings in AWS Marketplace that match the customer’s specific needs. The easier it is for a seller to understand what you offer, who you serve, and what results you deliver, the more likely your solution gets in front of the right customer at the right time.

We’re continuing to expand the ways sellers can access detailed information about your listings directly within the workflows they use to match solutions to customer needs. This includes your capabilities, customer outcomes, and differentiators. In 2025, we introduced the Solution Matching Engine, a machine learning system that helps sellers identify the most relevant partners for each account and opportunity. For foundational guidance on what sellers look for, see Improving Your Visibility to AWS Sales: A Practical Guide for Partners.

In this post, we outline three actions you can take in AWS Partner Central and AWS Marketplace to strengthen how your listings show up to sellers, so they can recommend your solutions to the right customers.

What is the Solution Matching Engine?
The Solution Matching Engine is your gateway to AWS sellers, helping them identify the partners and listings most relevant to a customer opportunity. It brings together information about your AWS Marketplace listings, whether software products or professional services offered by Consulting Partners, along with your AWS expertise and customer engagements, to give sellers a fuller view of the problems you can help solve.

The engine does more than surface a partner that may be a fit. It also helps sellers understand the specific listing you can bring to a customer. Within account-planning and co-sell motions, sellers use Solution Matching Engine to discover, compare, and evaluate relevant partners and listings. To make that discovery useful, the engine draws on:

Listing details: customer problems addressed, use cases, and AWS services integrated
Verified capabilities: AWS Specializations, and Certifications
Customer engagement signals: opportunity stages and outcomes

Together, these details help sellers understand both your offering and the context within which it may be relevant.

If you’re a Global Startup Program Partner, the new Startups You Should Know view in the Solution Matching Engine gives sellers a dedicated way to discover startup partners and solutions, even before you’ve built an extensive performance history.

The inputs that power these recommendations to sellers are within your control. Start here.

1: Keep opportunity data current

APN Customer Engagements (ACE) should be part of your operating rhythm. When opportunity data is complete and current, sellers can see the full picture of your customer engagement: what you’re delivering, what co-sell motions you are engaged with, and what outcomes you’ve driven.

Use CRM integration and internal data-quality processes to ensure the information you share with AWS stays accurate and up to date:

Customer context, use cases, and delivery details
Opportunity stages, next steps, and revenue information
Associated AWS Marketplace listings and AWS services
Launched and closed outcomes

The more complete your ACE records, the more context the Solution Matching Engine has to match your experience to the right customer opportunities.

2: Make your expertise easy to verify

AWS sellers look for signals that a Partner has proven experience with specific workloads, industries, and use cases. AWS Specializations and Certifications provide those signals, but only when they’re current and supported by evidence.

Keep your AWS Specializations and Certifications up to date
Document the work behind them through case studies and customer evidence that highlight the industries, workloads, and use cases where you’ve delivered results

Think of verified capabilities as your credibility layer. They give sellers confidence that your listing is backed by demonstrated experience.

3: Create complete AWS Marketplace listings

Your AWS Marketplace listing, whether for a software product or a professional service, is often the first thing a seller reads when evaluating your solution for a customer.

Your listing title matters, make it count. A strong listing clearly communicates:

The customer problem it solves and the primary use cases it addresses
Expected customer outcomes and the AWS services it works with
The industries and workloads where it’s most relevant
Supporting evidence: technical documentation, case studies, and customer references
Current product, pricing, and support information

Use consistent language across your AWS Marketplace listings, AWS Partner Central profile, and ACE opportunity records. When these align, sellers build a coherent understanding of your offering across every touchpoint.

Getting started or refreshing existing listings? Eligible ISVs and Consulting Partners can use AI-assisted product listing in AWS Partner Central to generate or refine listing content from existing assets: website URLs, PDFs, case studies, and product documentation. Review generated content before publishing to ensure it accurately represents your offering.

Conclusion

These three actions reinforce each other. Complete opportunity data makes your verified capabilities more meaningful. Strong listings give sellers the context to act on a recommendation. And monitoring your results helps you see which areas to sharpen next.

Review your ACE integration and data-quality processes to ensure opportunity information flows consistently
Audit your AWS Marketplace listings: do they clearly describe what you solve, for whom, and with what results?
Use Partner Analytics and Insights to monitor how your listing is performing in Solution Matching Engine and prioritize improvements.

Login to AWS Marketplace or AWS Partner Central to strengthen how your listings show up to sellers, so they can recommend your listing to the right customers.

The information you provide shapes how sellers understand your business. Keep it clear, current, and aligned across every surface, and you make it easier for AWS to connect you to the customers you’re best positioned to serve.

How OceanBase unifies transactions analytics and AI on AWS

Haibo Huang — Thu, 27 Aug 2026 20:52:23 +0000

By: Ye Dai, Ecosystem Solutions Architect – OceanBase
By: Haibo Huang, Senior Partner Solutions Architect – AWS

OceanBase

Modern data architectures often rely on separate databases for transactions, analytics, and AI, leading to extract, transform, and load (ETL) latency; data inconsistency; and rising costs. OceanBase addresses these challenges with a unified multimodel architecture that converges online transaction processing (OLTP), online analytical processing (OLAP), and vector retrieval within a single engine on Amazon Web Services (AWS).

By eliminating data movement between systems, enterprises can reduce operational complexity, lower total cost of ownership (TCO), and provide real-time data fresh for AI applications. Integrated with AWS services such as Amazon Elastic Compute Cloud (Amazon EC2), Amazon Bedrock, and AWS Key Management Service (AWS KMS), OceanBase delivers a streamlined, more secure, high-performance data foundation for intelligent workloads.

Modern data architectures such as OceanBase are redefining how organizations handle the tension between real-time transactions and analytics. Traditional ETL-dependent systems require data teams to wait hours for ETL pipelines to complete before AI applications can access transactional data from minutes ago, undermining your intelligence transformation progress.

At the time of writing, many enterprises use MySQL for transactions, a data warehouse for analytics, and a separate vector database for AI retrieval, which is regarded as a type of federated architecture. This federated architecture addresses individual use cases, but it also introduces challenges, such as difficulties in maintaining data consistency, high operational complexity, significant ETL latency, and rising TCO.

This post explains how to use the built-in capabilities of OceanBase on AWS to build a unified data foundation by converging online transaction processing (OLTP), real-time analytics (OLAP), and multimodal retrieval within a single system. This approach supports enterprises in streamlining their cloud architecture, alleviating cumbersome ETL processes, and providing a consistent real-time data foundation for AI applications.

Industry pain points: Why traditional heterogeneous architectures struggle in the AI era

Enterprises typically adopt a dedicated database per workload strategy in early stages, using separate databases for transactional, analytical, and AI workloads. However, as digitalization advances and intelligence requirements deepen, organizations encounter new challenges, such as:

Operational complexity and technology stack redundancy

Managing multiple database technology stacks in the cloud requires enterprises to master diverse technologies. This can cause increasing operational costs and architectural adaptation challenges.

Data consistency and latency issues

Relying on ETL/ELT tools to transform data among services not only creates storage redundancy, but also inevitably introduces synchronization delays. Such a data gap can significantly impact real-time risk control and personalized recommendation scenarios, which require millisecond-level responses.

High overall TCO

Multiple database license fees, storage overhead fees, network traffic expenses from data migration, and ongoing development and maintenance expenses combine to continuously drive up total costs.

Lack of a real-time data foundation for AI

AI scenarios such as large language models (LLMs) and intelligent recommendations require low-latency, high-quality unified data sources. The real-time context retrieval required by agent applications is extremely difficult to achieve. In heterogeneous architectures, data is scattered across different systems, making processing pipelines lengthy and complex.

The solution: OceanBase’s unified multimodel architecture on AWS

OceanBase takes a different approach with its built-in unified multimodel architecture. Rather than stitching together multiple databases through middleware integration, the approach provided by OceanBase fuses transaction processing, analytical processing, and intelligent processing capabilities into a single system at the kernel level. Through a unified storage engine, query optimizer, and execution framework, it achieves efficient coordination of different workload types.

1. A single engine for multi-workload collaboration – A single database engine simultaneously supports transaction processing, real-time analytics, and AI real-time workloads. After business data is written, it immediately enters the analysis and AI retrieval pipeline, meeting the stringent data freshness requirements of agent and real-time decision-making scenarios.
2. Built-in multimodal engine – OceanBase supports unified storage of structured, semi-structured, and vector data, and allows direct invocation of built-in model capabilities such as embedding generation, reranking, and text summarization within SQL. This means developers can perform AI computation preprocessing without moving data out of the database. By integrating with the foundation model (FM) capabilities of Amazon Bedrock, OceanBase can directly provide high-quality context retrieval for generative AI applications, building an end-to-end closed loop from data to inference.
3. AI-based hybrid search – OceanBase implements Hybrid Search, supporting combined queries of vector similarity, full-text relevance, and structured filtering conditions. It supports transactional consistency while delivering millisecond-level recall for large-scale vector data. This capability complements Amazon OpenSearch Serverless. OceanBase serves as the core data engine, handling both transactional consistency and vector retrieval, while Amazon OpenSearch Serverless can take on larger-scale unstructured log analytics scenarios, giving enterprises flexible data stack choices.

The following figure compares a traditional federated database architecture with OceanBase’s unified approach, showing how consolidating multiple database engines into a single solution reduces complexity and cost:

Figure 1: Traditional federated architecture compared to OceanBase unified multimodel architecture

Deeply integrated with AWS Cloud infrastructure, this solution builds a high-performance, highly elastic, more secure unified data foundation.

High performance – Deploy OceanBase on Amazon EC2 memory-optimized instances, fully using OceanBase’s optimizations for in-memory computing and massive parallel processing to achieve high-throughput, low-latency handling of transactional and analytical workloads.
Data security – OceanBase uses AWS PrivateLink to establish dedicated connections and integrates with AWS KMS to facilitate more secure control and management of key lifecycles and permissions to safeguard customer data.

The following figure shows the deployment architecture of OceanBase on AWS, illustrating how customer applications connect to OceanBase clusters through AWS PrivateLink, with multi-Availability Zone (AZ) distribution for high availability and integration with AWS services for security, storage, and AI capabilities:

Figure 2: OceanBase multi-AZ deployment architecture on AWS with integrated cloud services

Customer value: From architecture streamlining to business acceleration

By avoiding data silos through unification, OceanBase enables transactional data to be instantly transformed into analytical insights, which in turn drive business value through AI applications. If customers adopt OceanBase’s unified multimodel architecture on AWS, they could realize the following benefits:

Cost reduction and efficiency gains – Consolidating multiple databases into a single system reduces operational complexity, infrastructure costs, and maintenance overhead. Organizations typically see improvements in resource utilization and IT team productivity after architecture streamlining.
Accelerated AI innovation – By avoiding data movement, the latency from data generation to AI-ready inference drops from hours to seconds. One retail customer significantly shortened the development cycle for its real-time recommendation feature by 30% after adopting OceanBase’s unified architecture.
Enhanced decision agility – The fusion of real-time analytics and intelligent decision-making means businesses can make accurate judgments based on the latest data rather than relying on outdated reports.

Conclusion

Facing an AI-driven future, the streamlined and real-time nature of data architecture becomes a core competitive advantage. A deeply integrated unified data architecture is one of the most optimal technological paths to tackle multimodal data processing challenges and adapt to business intelligence upgrades.

As a member of the AWS Partner Network (APN), OceanBase provides unified capabilities on AWS that converge OLTP, OLAP, vector retrieval, and full-text search so enterprises can support both mission-critical business transactions and advanced intelligent applications with a single system.

If you’re evaluating a database architecture upgrade on the cloud and seeking to build a unified real-time data foundation for your AI applications, you can get started by visiting OceanBase in AWS Marketplace to experience the streamlined efficiency of the unified architecture approach. You can also contact the OceanBase technical team to obtain reference architecture design consultations tailored to your business scenarios.

OceanBase – AWS Partner Spotlight

OceanBase is an AWS Advanced Technology Partner with the AWS Data Analytics Competency. As a unified distributed database built for the AI era, it powers demanding workloads across financial services, ecommerce, and telecommunications, delivering the real-time consistency and scale required by mission-critical applications. With OceanBase, organizations can build a resilient, scalable data foundation that unifies OLTP, OLAP, and AI workloads, avoiding data silos while maintaining consistency and performance as demands grow.

Contact OceanBase | Partner Overview | AWS Marketplace

SailPoint Agent Identity Security for AI agents on Amazon Bedrock AgentCore

Imaan Tariq — Wed, 26 Aug 2026 15:08:17 +0000

By: Kirby Fitch, Lead Product Manager – SailPoint
By: Michael Conti, Product Marketing Manager – SailPoint
By: Imaan Tariq, Customer Solutions Manager – AWS
By: Nabil Ezzarhouni, Specialist Solutions Architect, GenAI – AWS

SailPoint

If you’re deploying AI agents across your organization, you’ve likely hit a familiar wall: How do you govern autonomous systems that can access sensitive data, dynamically request permissions, and take actions without direct human oversight?

Recent research shows that 80% of organizations report AI agents performing unintended actions, and 96% of technology professionals identify security concerns about AI agents (SailPoint, AI Agents: The New Attack Surface, 2025). Traditional identity and access management approaches, which were designed for human users and service accounts, fall short when applied to AI agents that interact with multiple systems and operate autonomously.

In this post, we explore how SailPoint’s Agent Identity Security (AIS) solution, built on Amazon Web Services (AWS), addresses these challenges through centralized identity governance for AI agents, and how your organization can get started securing your AI agents.

AIS in action

SailPoint’s AIS extends proven identity principles to autonomous AI. With AIS, you can gain centralized visibility and help maintain control over AI agents in your environment regardless of where they’re deployed on AWS.

The solution addresses the core challenges security teams face today: AI agents operating without oversight, over-permissioned agents with excessive access rights, and the lack of clear ownership and accountability for agent actions.

With AIS, you can automatically discover AI agents across your cloud environments, assign clear ownership to each agent, conduct regular access reviews and permission revocation, and gain visibility into both direct and indirect access pathways. This means you can apply the same governance rigor to AI agents that you’ve long applied to human identities so that every agent has the right level of access, your team regularly reviews it, and you can quickly revoke an agent’s access if needed.

The innovative solution

SailPoint’s journey to AIS began with a realization that AI agents represent a fundamentally new type of identity, one that requires purpose-built identity governance and security capabilities. Working closely with AWS since early 2025, SailPoint developed AIS as a cloud-based solution that integrates deeply with Amazon Bedrock AgentCore, the AWS agentic solution for hosting, connecting, and managing AI agents at scale.

This collaboration reflects a shared vision: making AI adoption more secure and scalable for enterprises. While AWS provides the infrastructure and tools for building powerful AI agents through Amazon Bedrock AgentCore, SailPoint assures those agents operate within proper governance guardrails. With this solution, organizations can confidently deploy AI agents knowing they have the same level of identity security and compliance they expect from their human workforce.

A collaborative story

The collaboration between SailPoint and AWS meant AIS could integrate directly with Amazon Bedrock AgentCore Identity, giving customers a unified way to discover and govern AI agents across their AWS environment. AWS experts worked alongside SailPoint’s product and engineering teams to design an architecture that scales to support the rapid growth of AI agents that enterprises are experiencing today.

AWS experts continue to work alongside SailPoint’s product and engineering teams to design an architecture that uses the full power of AWS services while integrating with Amazon Bedrock AgentCore Identity. This co-development approach helped verify that AIS would not only meet current enterprise security requirements but also scale to support the explosive growth of AI agents expected in the coming years.

Powering the solution with AWS services

SailPoint AIS is built on AWS, using a combination of managed services for compute, data, messaging, and identity to deliver a scalable, highly available governance solution for AI agents. The following diagram shows how these services integrate to deliver the AIS solution:

Figure #1 – AWS architecture supporting AIS

Technical architecture: Building AIS on AWS

SailPoint AIS demonstrates how to build a reliable, more secure system for managing AI agent identities using AWS services. The architecture uses cloud-based services to deliver real-time identity aggregation, governance, and lifecycle management for AI agents across Amazon Bedrock AgentCore.

Architecture overview

The solution runs entirely within AWS while using an Amazon Virtual Private Cloud (Amazon VPC) for network isolation and security. You access SailPoint Identity Security Cloud (ISC) through an Application Load Balancer, which provides high availability and efficient request distribution across the infrastructure.

Container orchestration with Amazon EKS

At the core of the architecture, Amazon Elastic Kubernetes Service (Amazon EKS) orchestrates containerized microservices, allowing independent scaling of components based on demand. This approach provides the flexibility to handle varying workloads while maintaining operational efficiency.

Within the Amazon EKS clusters, three specialized services work together to deliver comprehensive AI agent identity management:

Task Management Service handles the orchestration of AI agent identity aggregation workflows. It manages task definitions, executes aggregation jobs, and provides real-time status updates to end users. The service also maintains historical records of previous aggregations for audit trails and compliance reporting.
Non-Human Identity (NHI) Service serves as the central authority for non-human identities and accounts within the system. This service manages machine account classification, exposes APIs for retrieving defined machine accounts and identities, and handles the full lifecycle of AI agent identities, including creation, updates, and deletion during aggregation processes.
Connectivity Services bridge SailPoint’s system with AWS identity sources. These services retrieve data from configured SailPoint Connectors and stream it to downstream consumers. For AI agent identity management, the AWS Service Management Connector specifically targets Amazon Bedrock AgentCore, extracting agent metadata and streaming it to the NHI Service for identity management within ISC.

Data layer architecture

The architecture employs purpose-built data stores optimized for specific use cases:

Amazon ElastiCache for Redis provides low-latency tracking of rapidly changing aggregation status. During active identity aggregation, Redis maintains real-time state information. After an aggregation reaches a terminal state (Complete, Errored, Canceled, or Terminated), the Task Management Service updates the persistent task status record.
Amazon Relational Database Service (Amazon RDS) for PostgreSQL serves as the durable data store for the NHI Service, maintaining the authoritative record of non-human identities, their attributes, and relationships.
Amazon Managed Streaming for Apache Kafka (Amazon MSK) supports event-driven communication between services. Amazon MSK streams AI agent data from Connectivity Services to the NHI Service and distributes various event types to ISC microservices for asynchronous processing, such as audit events, workflow triggers, and entity change notifications.

Integration with Amazon Bedrock

The architecture’s integration with Amazon Bedrock represents a key capability in AI agent governance. The AWS Service Management Connector continuously discovers AI agents from Amazon Bedrock AgentCore, extracting critical identity attributes such as agent names, roles, permissions, and associated resources. This data flows through the Connectivity Services into the broader identity governance framework, which means you can apply the same governance policies to AI agents that you use for human and service identities.

Scalability and resilience

The architecture’s cloud-based design delivers both horizontal and vertical scalability. Amazon EKS automatically scales container instances based on workload demands, while Amazon MSK partitions allow parallel processing of identity events. The Application Load Balancer distributes traffic across multiple Availability Zones, providing high availability even during infrastructure failures.

This architecture demonstrates how AWS services can be composed to build enterprise-grade identity governance solutions that extend traditional identity management into the emerging domain of AI agent security.

Unlocking business value and future vision

The business impact of AIS spans multiple teams across your organization. Built on SailPoint’s unified identity control plane, AIS expands governance to AI agents without adding new silos or operational complexity. Identity teams can apply consistent access controls as agents emerge, while AI and automation leaders gain clear guardrails around how agents are created, authenticated, and scaled.

AIS provides a centralized console where security teams can view all discovered AI agents, their ownership, and assigned entitlements in one place:

Figure #2 – A single, unified view of identities gives administrators granular control over non-human identity permissions, cutting through the complexity of modern IT environments

Security teams benefit from deeper visibility into agent activity by enabling faster detection of risky behavior. Compliance teams can demonstrate to auditors that AI agents are governed with the same rigor as human identities.

Organizations can run periodic access certification campaigns for AI agents so permissions remain appropriate and compliant over time.

Figure #3 – The application provides a clear, comprehensive view of compliance where every entitlement has a clear owner and purpose during access certification

Before AIS, organizations faced a binary choice: Slow down AI agent deployment to manually govern each agent, or accept ungoverned risk as agents proliferated across their environment. There was no way to apply identity governance to AI agents at the same scale and rigor as human identities. AIS eliminates that trade-off. Organizations can now run access certification campaigns across their entire AI agent population, enforce least-privilege policies as agents scale, and maintain a complete audit trail of agent permissions—capabilities that were previously only available for human users.

The result is that teams can confidently deploy AI agents at scale without choosing between speed and security. The business impact of AIS spans multiple teams across your organization. Built on SailPoint’s unified identity control plane, AIS expands governance to AI agents without adding new silos or operational complexity. Identity teams can apply consistent access controls as agents emerge, while AI and automation leaders gain clear guardrails around how agents are created, authenticated, and scaled.

Looking ahead, SailPoint and AWS are committed to continued innovation in AI agent governance. As AI capabilities evolve from rudimentary task automation to complex multi-agent systems, the identity security framework must evolve in parallel. On SailPoint’s product roadmap, planned enhancements to AIS intend to address emerging challenges such as agent-to-agent authentication, dynamic permission adjustment based on context, and integration with AI observability applications for sophisticated agent lifecycle management.

The following Identity Graph provides a visual map of an agent’s entitlements and relationships, making it effortless to understand and audit what each agent can access:

Figure #4 – With deep observability, the Identity Graph visualizes how an agent integrates, providing crucial context and insight into its relationships and access

The collaboration between SailPoint and AWS demonstrates how established security principles can be adapted for the AI era. By extending proven identity security capabilities to AI agents and building on AWS cloud infrastructure, you can embrace the transformative potential of AI while maintaining the security and compliance standards your business demands.

Get started today

Ready to bring enterprise-grade identity security to your AI agents?

Explore SailPoint Agentic AI capabilities and the AWS alliance
Explore Amazon Bedrock and Amazon Bedrock AgentCore
Learn more about Agent Identity Security in action

SailPoint Technologies – AWS Partner Spotlight

SailPoint Technologies is an AWS Advanced Technology Partner and AWS Competency Partner that provides identity security solutions. With SailPoint, you can manage and govern identities, access, and entitlements with precision while automating security operations and maintaining compliance across your digital environment.

Contact SailPoint Technologies | Partner Overview | AWS Marketplace

Building intelligent data foundations: The Grubhub and Vody partnership on AWS

Nneoma Okoroafor — Mon, 17 Aug 2026 19:16:16 +0000

By: Dr. Yubin Kim, Chief Scientist – Vody
By: Nneoma Okoroafor, Partner Solutions Architect – AWS
By: Swagat Kulkarni, Sr. Solutions Architect – AWS
By: Siraj Gadne, Sr. Mgr, CSM, US SWIM – AWS

Vody

This post was co-written with Grubhub and Vody, an AWS Partner, for data engineers, ML platform teams, and retail technology leaders. Familiarity with Amazon EKS, Amazon Bedrock, and data pipeline concepts is helpful but not required.

Retailers are racing to adopt AI, but the companies that pull ahead won’t win because they shipped a single breakthrough feature. They’ll win because they invested early in the data foundations that can make AI initiatives faster, smarter, and more effective. At Amazon Web Services (AWS), we see this pattern across the most innovative customers: the shift from fragmented data projects to unified, intelligent data layers built on top of cloud-centered infrastructure.

Grubhub and Vody are taking that shift directly. Together, they’re modernizing the core building blocks of catalog, content, and behavioral data using AWS services and building the durable foundation required for the next era of AI-powered commerce. The early results are promising:

More than 400 thousand merchants and tens of millions of menu items cataloged and updated regularly; ensuring fresh, structured data flows reliably into downstream systems
Delivered results from initial model deployment in only 6-10 weeks, proving that major retailers can move quickly when the foundation is right
Improved search recall, with initial tests showing improved relevance of candidates retrieved
Higher conversion and click-through rates for dietary-intent searches, showing how enriched data directly improves customer experience

What’s emerging isn’t just better search and recommendations. It’s a future where structured, AI-ready data enables personalization that feels intuitive, discovery that understands intent, and merchandising that keeps pace with fast-moving cultural and consumer trends. Grubhub and Vody’s work on AWS is a blueprint for retailers preparing for what comes next: a world where the companies with the strongest data foundations will lead every wave of AI innovation.

Why the data foundation matters now

Three forces are rewriting how retailers think about data:

Generative AI everywhere: Large language models (LLMs) can analyze, recommend, and create, but they perform best when sitting on top of structured, consistent, buyer-relevant data. AI can’t invent signals retailers never stored. AWS customers across commerce, marketplaces, and delivery are recognizing this opportunity and investing in their data foundations.

Demand signals live outside the organization: Trends start on TikTok, Instagram, and community spaces long before they show up in dashboards. Modern catalog enrichment workflows need to operate at this velocity-updating in hours, not quarters, and syncing internal datasets with emerging external demand.

The opportunity for unified data: When search teams, merchandising, CRM, and marketing build on a shared source of truth, experimentation accelerates and AI projects scale more effectively across functions. Retailers are moving toward unified data platforms that all systems and teams can build on.

Establishing the foundation: Clean, structured, buyer-relevant data

Grubhub, with more than 400,000 merchants and tens of millions of menu items, recognized the opportunity to build a data layer that could support AI workloads at scale. Built on AWS, Vody transforms massive volumes of unstructured merchant content into clean, structured, AI-ready data.

Figure 1: Vody AWS architecture

The architecture, shown in Figure 1, implements network segmentation with public and private subnets. Customer traffic enters through an application load balancer, while outbound connectivity from the Amazon Elastic Kubernetes Service (Amazon EKS) cluster (such as calls to Amazon Bedrock) routes through a NAT gateway, maintaining security isolation for compute resources.

The platform uses Amazon EKS for container orchestration and integrates with Amazon Bedrock for generative AI capabilities. Amazon Relational Database Service (Amazon RDS) provides relational data storage, while Amazon ElastiCache serves dual purposes: as a queuing backend for background job processing and as a caching layer for API endpoints, optimizing overall system performance. AWS IAM Identity Center provides secure access management across the platform.

Using the diverse model portfolio provided by Amazon Bedrock (Claude, Nova, and Llama families), Vody generates customer-aligned search queries that enrich even low-data SKUs, ensuring consistent discoverability across the entire catalog.

The Vody platform operates as a software as a service (SaaS) solution hosted by Vody, providing merchants with a fully managed catalog enrichment service. With this managed approach, retailers can benefit from continuous AI improvements and scale without infrastructure overhead.

The platform delivers:

Normalized, enriched product and item attributes aligned to real-world buyer behavior
Labels that reflect how people discover restaurants and food
Structured metadata that feeds both traditional ranking systems and modern generative models
Frequent updates as restaurants, menus, and items change

This work represents the first key milestone toward establishing a future-looking data foundation at Grubhub and delivers measurable value from day one: better search recall, higher search conversion, and more intuitive product discovery-all without replacing existing search engines.

“Developing this in-house may have shifted focus away from our core product. After evaluating the resources required, we decided a third-party solution was the more efficient path”
– Jayesh Kataria, Sr. Director of Engineering, Grubhub

Results: Measurable impact across the business

The AWS-powered Vody platform now processes merchant data at impressive scale:

Daily processing: Over 500,000 items enriched daily
Weekly throughput: 2-5 million items processed

Business impact and ROI

The 12-week deployment to full production demonstrates that major retailers can move quickly when building on the right foundation. Key business outcomes include:

Enhanced search recall: More candidate merchants retrieved and more results matching actual customer intent during preliminary analyses
Higher conversion rates: Particularly for dietary and food characteristic searches
Faster time-to-market: Teams can now ship campaigns, taxonomies, and product updates in days instead of weeks
Optimized resource allocation: Strategic investment in data infrastructure versus building custom solutions

“We’re running enrichment across millions of items in our catalog across multiple facets, effectively reshaping and simplifying how our search and discovery systems operate”
– Jayesh Kataria, Sr. Director of Engineering, Grubhub

Towards an intelligent data platform on AWS

Consistent, structured product data is just the beginning. Vody envisions a roadmap toward what we call an intelligent data platform (IDP): a cloud-centered, AI-ready layer that unifies signals and supports every downstream experience.

An IDP on AWS brings three capabilities together:

Unified signals: Catalog, clickstream, availability, and fulfillment data live alongside external trends, search behavior, and micro-signals from social platforms. AWS services such as Amazon Simple Storage Service (Amazon S3), AWS Glue, Amazon OpenSearch Service, and Amazon Redshift make this unification possible at scale.
Adaptive metadata: As buyer language shifts, attributes evolve without breaking pipelines. Merchants and brands can introduce new concepts-aesthetics, dietary signals, styles, emerging themes-as needed.
Shared context and memory: Every A/B test, campaign, and model output feeds back into a shared knowledge layer. Teams stop re-creating their own one-off datasets and instead build on a common foundation. This is how retailers move from large amounts of unstructured data to a true AI data strategy.

After an IDP is in place, the business impact compounds:

Better search and discovery: Search engines unlock new relevance opportunities. Queries map to buyer intent, not just keywords.
Personalization that feels human: LLMs and ranking models operate on rich contextual signals rather than sparse metadata.
Faster experimentation: Teams ship campaigns, taxonomies, and product updates in days instead of weeks.
New AI surfaces: A structured foundation on AWS unlocks next-generation acquisition and engagement channels-from Generative Engine Optimization (GEO) to conversational shopping to agent-driven merchandising.

Retailers choose AWS for this work because AWS services provide:

Scalability: Ingestion of millions of SKUs, items, documents, and user behaviors
Security and governance: Essential for enterprise-grade catalog and customer data
AI/ML integration: Seamless use of Amazon Bedrock, Amazon SageMaker, and OpenSearch for retrieval and inference

Grubhub’s deployment demonstrates how quickly retailers can reach scale. Within 6-10 weeks, the joint AWS-Vody solution enriched millions of items, and pushed cleaner structured data into downstream systems while keeping merchant updates current, creating enormous potential to lift search performance.

The evolution of this work

Building an intelligent data foundation isn’t a one-time effort, it’s an iterative process. With the foundation in place, the team focused on scaling, speed, and operational efficiency. Three areas stood out:

Scaling across merchant diversity: The team built modular extraction pipelines that could adapt to merchant variability without retraining entire models, enabling consistent attribute structure across hundreds of thousands of merchants.
Rapid integration impact: Enriched attributes began influencing downstream relevance signals quickly once integrated. Improvements were measurable without requiring changes to the core ranking infrastructure.
Continuous optimization: Early alignment on evaluation metrics and performance dashboards streamlined cross-team visibility and reduced iteration cycles during rollout.

Looking ahead: The shift to intelligent retail

Many retailers are somewhere on the journey from fragmented data to intelligent data foundations. Grubhub’s work with Vody on AWS shows what the next stage looks like: a flexible, adaptive data layer that keeps pace with consumers, channels, and AI systems.

The message is clear: The future of retail belongs to companies that invest in their data foundation today. After the structure is in place, new AI initiatives can be implemented faster, with less effort, and be more valuable.

AWS is committed to helping retailers make that move and to supporting partners like Vody, who are building the connections that enable the AI future of commerce.

Conclusion

The Grubhub-Vody partnership demonstrates that AI-ready data foundations deliver real outcomes fast: tens of millions of entities enriched monthly, all within 6-10 weeks on AWS-accomplished by investing in a unified data infrastructure at the start. AI initiatives that follow can be faster and more effective.

Ready to build your intelligent data foundation?

Vody – AWS Partner Spotlight

Vody is an AWS Advanced Technology Partner that transforms messy, static product catalogs into enriched, continuously updated data feeds optimized for downstream AI performance, including on-site search, generative engine optimization, advertising, and emerging agentic shopping assistants.

Contact Vody | Partner Overview | AWS Marketplace

Securing the AI development lifecycle with Aikido and Kiro

Len Gomes — Thu, 13 Aug 2026 20:32:30 +0000

By: Len Gomes, Partner Solutions Architect – AWS
By: Akram Al Sheikh, Security Partner Solutions Architect – AWS
By: Alex Llobet, Global Cloud Alliances Lead – Aikido
By: Johan de Keulenaer, Head of Partnerships – Aikido

Aikido

Aikido Security and Kiro help development teams secure the AI development lifecycle and ship AI-generated code with confidence. Kiro is an AI-powered development environment from Amazon Web Services (AWS) that helps developers build and ship production-ready applications through spec-driven development. As AI agents take on more of the development workflow, from code to infrastructure to API integrations, organizations benefit from continuous security scanning that runs alongside every change. Aikido Security strengthens this workflow and now also through Kiro Powers with automated vulnerability detection, secrets scanning, and infrastructure as code (IaC) checks that run continuously as code is written keeping security in step with development velocity.

Aikido Security is a developer-first cybersecurity company trusted by more than 50,000 organizations. Aikido’s AI-first platform secures applications from code to cloud to runtime, replacing the fragmented tooling that creates alert fatigue and slows development teams.. Built to integrate where developers already work, Aikido operates inside integrated development environments (IDEs), continuous integration and continuous delivery (CI/CD) pipelines, and AI development environments.

In this post, we explain what Kiro powers are, how the Aikido power works, and how organizations can secure AI-generated code from day one.

The opportunity: Security that matches the speed of AI development

Development teams using AI assistants report five- to sevenfold productivity gains as AI agents handle code generation, infrastructure provisioning, and documentation. This acceleration creates an opportunity to rethink how security fits into the development lifecycle.

Rather than relying on security review as a final gate before deployment, organizations now embed security directly into the development workflow. Continuous scanning that runs alongside AI agents gives teams immediate visibility into vulnerabilities, exposed secrets, and infrastructure misconfigurations as code is written, not after it ships.

This shift from end-of-pipeline review to continuous, in-workflow security delivers measurable benefits: faster release cycles, fewer post-deployment remediations, and consistent security standards across every change an AI agent produces.

What are Kiro powers?

Kiro powers are specialized bundles that add expert-level context and tools to Kiro AI agents on demand. Rather than loading all tools at the same time (which overloads the context window), powers activate dynamically based on the task at hand. For example, the Aikido power activates when your conversation involves security-related topics such as scanning, vulnerabilities, or secrets detection. Each power packages three components working together:

Model Context Protocol (MCP) server – Provides direct connectivity between the Kiro agent and external tools or services.
Steering file (POWER.md) – Contains domain-specific best practices curated by technology experts.
Optional hooks – Automatically verify code against best practices, providing immediate feedback.

This modular design means Kiro can access dozens of technologies without overwhelming the agent context. Only the relevant power loads when needed. AWS and partner teams have published powers across a growing range of domains and technologies, each bringing production-grade best practices directly into the development workflow. Browse the full catalog at Kiro powers.

Introducing the Aikido Kiro power

Aikido Security has built a Kiro power that creates a continuous security loop inside the development workflow. Every agent-generated code change is automatically analyzed for vulnerabilities, exposed secrets, and infrastructure misconfigurations, and Kiro’s agents act on Aikido’s findings to fix issues before they ship.

The Aikido Kiro power provides three categories of scanning:

Static Application Security Testing (SAST) – Detects common vulnerability patterns such as SQL injection, path traversal, and cross-site scripting.
Secrets detection – Identifies exposed API keys, tokens, and hardcoded credentials.
IaC scanning – Finds misconfigurations in Terraform, AWS CloudFormation, and similar configuration files before they reach production.

When the power detects security issues, it explains each finding clearly (including title, severity, file location, and line numbers) and Aikido’s remediation engine guides the applied fixes. After applying fixes, the power rescans automatically to verify resolution, creating a self-correcting loop that operates without developer intervention.

How the hook configuration works

The key mechanism that provides continuous security is the Aikido hook. After it’s installed, a hook named “Aikido Scan on Write” triggers automatically after a file is written or modified by the Kiro agent. The hook activates the Aikido power and runs a full scan on all files created or modified in the current session.

The scan-fix-verify cycle works as follows:

The Kiro agent writes or modifies code files.
The hook triggers automatically and collects all affected file paths.
Aikido runs SAST, secrets, and IaC scanning across those files.
If issues are found, the agent explains each finding and applies fixes guided by Aikido’s remediation.
The power rescans to verify fixes and resolve the issues without introducing new ones.

This approach means security validation runs in parallel with development, not after it. Developers avoid context switching since the Aikido Power handles security in the background. The following screenshot shows this scan-fix-verify cycle.

Figure 1: The Aikido Scan on Write hook configuration in the Kiro IDE

Business scenarios

The Aikido Kiro power addresses security challenges across different organizational contexts:

High-growth startup shipping to production – A startup using Kiro to accelerate its first product generates IaC through AI agents. The Aikido power gives teams early visibility into misconfigured AWS Identity and Access Management (IAM) policies and storage bucket permissions, enabling remediation during development rather than post-deployment.
ISV managing developer scale – An independent software vendor (ISV) with a distributed engineering team needs consistent security standards across AI-assisted development without adding headcount to a security team. The Aikido power runs on every agent-generated change, enforcing security baselines uniformly without slowing release velocity.
Enterprise meeting compliance requirements – An enterprise in a regulated industry needs to demonstrate that AI-generated code meets security and compliance standards for audits. Aikido captures evidence continuously throughout the development lifecycle, replacing manual evidence-gathering with automated reporting across SOC 2, ISO 27001, Health Insurance Portability and Accountability Act (HIPAA), NIS2, DORA, and Payment Card Industry Data Security Standard (PCI DSS). Learn more about automated compliance checks in Aikido’s plataform.

Measured results

Production deployments of Aikido demonstrate measurable impact:

90% reduction in false-positive security alerts through reachability analysis and auto-triaging, so only exploitable risks surface
Security fixes in under 30 seconds through AutoFix, which proposes and implements remediation automatically
Developer onboarding in under 5 minutes with Aikido’s developer-native integrations (IDE, CI/CD, and issue management)
Compliance coverage across SOC 2, ISO 27001, PCI DSS, DORA, NIS2, and HIPAA through automated evidence collection

Getting started with the Aikido Kiro power

Installing the Aikido Kiro power takes one click:

Open the powers panel in the Kiro IDE or visit Kiro powers.
Search for “Aikido Security” and choose Install.
Configure your Aikido API key. You can find it by visiting Aikido and then choosing Settings, Integrations, and IDE Plugins.
The power activates on demand, and the hook begins scanning automatically after every code change.

The following screenshot shows the powers panel in the Kiro IDE.

Figure 2: Installing the Aikido power from the Kiro IDE powers panel

After the Aikido Kiro power is installed, developers can also explicitly prompt Kiro to scan files (for example, “Scan my changed files for security vulnerabilities”) for on-demand assessment at any point during development. The following are some suggested prompts to use with the Aikido power.

Good for getting a baseline security posture on your whole project in one shot:

“Scan all Python files in the backend/ directory for security vulnerabilities and hardcoded secrets. Fix any issues you find and verify the fixes are clean.”

Good for a quick gate before pushing code to catch things that slipped through during development:

“Scan my staged git changes for security issues: secrets, SQL injection, path traversal, or any IaC misconfigurations. Summarize what you find with severity levels.”

Good for learning from the findings, not merely patching them blindly. This one is great for when you want to educate the team or write up security notes:

“List all open Aikido security issues for this repo, then fix the high-severity ones. For each fix, explain what the vulnerability was and why the fix resolves it.”

Source code and documentation: github.com/AikidoSec/aikido-kiro-power. Learn more about the integration at integrations.aikido.dev/integrations/kiro.

Video 1: Aikido Kiro power in action

Conclusion

AI-driven development is the new baseline for how fast-moving organizations build software. The Aikido Kiro power brings automated scanning directly into the agentic development workflow, helping teams ship securely at the pace AI development allows. Security runs continuously, findings surface in context, and fixes apply automatically, so teams ship with confidence at the pace AI enables.

Explore Aikido Security in AWS Marketplace. Activate the Aikido power in Kiro at Kiro powers. Learn more about Aikido’s compliance certifications at Aikido’s Trust Center.

Aikido Security – AWS Partner Spotlight

Aikido Security is a cybersecurity company that secures everything developers build, ship, and run. Its software security platform protects code, cloud infrastructure, devices, and runtime environments, providing real-time visibility and automatically identifying and remediating vulnerabilities. Trusted by more than 50,000 organizations, Aikido is purpose-built to integrate where developers already work: inside IDEs, CI/CD pipelines, and AI development environments. Founded in 2022, Aikido Security has grown to 300 employees, reached unicorn status faster than any other European cybersecurity company, and was among one of the first AWS Security ISVs in EMEA selected for the Kiro pilot program.

Contact Aikido | Partner Overview | AWS Marketplace

Enhance DNS protection with Palo Alto Networks on Amazon Route 53 DNS Firewall

Rizwan Mushtaq — Fri, 07 Aug 2026 21:40:00 +0000

By: Anthony Smith, Sr. Security Partner Solutions Architect – AWS
By: Rizwan Mushtaq, Principal Solutions Architect – AWS
By: Ashmeet Singh, Sr. Customer Solutions Manager – AWS
By: Adhish Bhobe, Principal Product Manager – AWS
By: Arun Kumar, Director of Product Management, CDSS – Palo Alto Networks

Palo Alto Networks

Amazon Route 53 Resolver DNS Firewall now integrates Palo Alto Networks Advanced DNS Security to protect your DNS infrastructure. Because DNS queries are fundamental to how applications communicate, protecting them at the resolver gives security teams a powerful, centralized control point for safeguarding cloud traffic. This integration delivers comprehensive DNS threat protection that is effective and operationally straightforward to deploy across your cloud environments.

Palo Alto Networks, an AWS Partner Network (APN) partner, detects DNS-based threats such as command and control and fast flux. Palo Alto Networks Advanced DNS Security integrates with Amazon Route 53 Resolver DNS Firewall, delivering these threat-intelligence categories as DNS Firewall rules so you can enforce them with the availability and low latency of Amazon Web Services (AWS). By integrating Palo Alto Networks Advanced DNS Security with Route 53 Resolver DNS Firewall, security administrators can enforce trusted DNS threat protections across their Amazon Virtual Private Cloud (Amazon VPC) resources without deploying or managing additional infrastructure.

This post explores how the integration works, the threat coverage it adds on top of built-in DNS Firewall protections, and how security teams can extend that coverage across accounts, virtual private clouds (VPCs), and hybrid environments. Whether you’re securing a multi-account cloud environment or extending protections to hybrid-cloud traffic, this integration helps security teams deploy comprehensive DNS threat coverage faster and at scale.

Solution overview

Palo Alto Networks Advanced DNS Security is available directly from the Route 53 DNS Firewall console under the Advanced rule tier, with usage-based pricing and activation completing within 2 minutes—requiring no additional infrastructure. The integration operates through DNS Firewall rule groups, which are containers of one or more rules that can be associated with multiple VPCs and shared across accounts.

Each rule within a group specifies a security category, query type, and enforcement action, either BLOCK to deny resolution or ALERT to log without blocking. Rules are evaluated by configurable priority ordering within a group, giving administrators fine-grained control over how different threat types are handled.

A single rule group can protect any number of VPCs, and multi-account environments benefit from three sharing mechanisms: AWS Resource Access Manager (AWS RAM) for specific accounts or organizational units, Amazon Route 53 Profiles for consistent DNS configurations, and AWS Firewall Manager for centralized policy enforcement. AWS License Manager distributes subscriptions in bulk to an entire organization, specific organizational units (OUs), or individual accounts, with automatic licensing for newly added accounts.

How Palo Alto Networks Advanced DNS Security works with Amazon Route 53 DNS Firewall

By integrating Palo Alto Networks Advanced DNS Security with Route 53 DNS Firewall, organizations can enforce DNS threat protections across multiple traffic paths. As shown in the following demo, DNS Firewall rules with Palo Alto Networks security categories govern DNS query traffic from:

Amazon VPC traffic — Protecting workloads within your cloud environment
Hybrid-cloud traffic — Forwarded through Route 53 Resolver endpoints

The integration delivers more than 30 DNS threat detections from Palo Alto Networks—including fast flux protection, DNS hijacking protection, DNS rebinding protection, domain generation algorithm (DGA) detection, and newly registered domain identification—across the following use cases.

Cloud infrastructure DNS protection

Enforce Palo Alto Networks’ DNS threat protections directly on VPCs through DNS Firewall rules, with no need to deploy separate firewalls across multiple VPCs or AWS accounts. This removes the operational overhead of per-VPC firewall configurations while keeping coverage consistent. You can subscribe one time and share that subscription across multiple accounts or your entire organization using AWS License Manager.

Hybrid-cloud security operations

For on-premises or remote environments, DNS query traffic can be forwarded using Route 53 inbound endpoints, giving security operations center (SOC) teams unified DNS filtering and centralized logging across both AWS and hybrid traffic.

Centralized observability

Gain centralized observability across VPC and hybrid environments through log delivery via Amazon S3, Amazon Data Firehose, or Amazon CloudWatch Log Groups. Combined with AWS Security Hub, teams receive consolidated alerts and findings for faster detection and response.

Compliance and threat intelligence

Palo Alto Networks automatically updates its security categories and detection models, propagating changes to DNS Firewall with no customer intervention, keeping the latest threat intelligence applied to your DNS queries and streamlining compliance reporting.

Taken together, these use cases converge on a single enforcement point for DNS threat protection. The following demo illustrates how this comes together end to end, with visibility and control centralized through Amazon CloudWatch and AWS Security Hub.

Figure 1: How DNS query traffic from VPCs and hybrid environments is enforced through DNS Firewall rules with Palo Alto Networks threat intelligence

Monitoring and insights

After the solution is deployed, monitor your DNS security posture through:

AWS Security Hub — Security findings for blocked and alerted queries
Amazon Route 53 Resolver query logs — Viewable and storable using S3 buckets, Amazon Data Firehose, or CloudWatch log groups

Cleanup and cost considerations

This solution incurs costs for the AWS and Palo Alto Networks services involved, priced as part of the existing DNS Firewall Advanced tier. You pay an hourly rate for each rule group containing one or more Palo Alto Networks rules associated with a VPC. During preview, the Palo Alto Networks subscription in AWS Marketplace is free and not charged; only DNS Firewall Advanced charges apply.

To avoid unnecessary charges:

Disassociate rule groups from VPCs and delete DNS Firewall rules containing Palo Alto Networks security categories. Charges continue until all Palo Alto Networks rules are removed, so clean up before or after unsubscribing.
Remove any license distributions configured through AWS License Manager.

Conclusion

Integrating Palo Alto Networks Advanced DNS Security with Amazon Route 53 Resolver DNS Firewall delivers comprehensive DNS threat protection without operational complexity. You’ll get streamlined deployment from the DNS Firewall console, automated threat-intelligence updates, and centralized multi-account management along with the performance you expect from Amazon Route 53 Resolver DNS Firewall, augmented with the latest threat intelligence from Palo Alto Networks.

To get started with Palo Alto Networks Advanced DNS Security, subscribe on the DNS Firewall console or in AWS Marketplace. For a step-by-step guide, visit Subscribe to Palo Alto Networks Advanced DNS Security. Use Palo Alto Networks’ documentation and the Amazon Route 53 Developer Guide to accelerate your deployment.

Palo Alto Networks – AWS Partner Spotlight

Palo Alto Networks is an AWS Security Competency Partner that helps organizations strengthen their security posture across cloud and hybrid environments—protecting against advanced threats, securing network infrastructure, and maintaining compliance to stay ahead of evolving adversaries.

Contact Palo Alto Networks | Partner Overview | AWS Marketplace

How ASCENDING’s Jarvis Registry bridges agents and developer tools

Lu Zou — Thu, 06 Aug 2026 21:21:06 +0000

By: Ryo Hang, Technical Cofounder – ASCENDING
By: Celeste Shao, AI Specialist – ASCENDING
By: Jason Zhang, CTO – Vegogarden
By: Lu Zou, Sr. Partner Solution Architect – AWS

Ascending

Your agents are deployed on Amazon Bedrock AgentCore. Now, people across your teams are wondering if they can use it with their preferred developer tool, whether that’s Claude Desktop, Visual Studio Code (VS Code), Cursor, or GitHub Copilot. That’s where the complexity starts, and you hit the last mile: making your agents reachable from an integrated development environment (IDE) safely, with the right identity, authorization, and discovery controls. This is the experience layer: the authentication, authorization, discovery, and developer UX infrastructure that sits between your deployed agents and the tools people actually work in.

In this post, we walk through the experience layer challenge, show the architecture you’d need to build yourself, and introduce an open source solution that handles it for you.

The experience layer for usability

The gap between “deployed” and “usable” comes down to a recurring set of integration problems:

Identity – The agent and downstream tools need to trust who the caller is without prompting again, which means integrating with the organization’s identity provider (IdP).
Authorization – After identity is established, the platform has to decide which agents, tools, and data each user can reach, often with policies that vary by team or environment.
Token management – Every downstream tool brings its own OAuth lifecycle: token exchange, refresh, and re-auth when an agent calls Jira, GitHub, or internal APIs.
Interactive re-auth. Tools sometimes need to pause mid-call to ask for input or fresh credentials, then resume cleanly inside the copilot.
Discovery – The right agents and tools need to surface at the right moment, filtered by context, rather than overwhelming the client with the full catalog.

This gets especially complex when you multiply it by every IDE the business cares about and every agent your team ships. The experience layer quickly becomes a larger investment than the agents themselves.

The components of an experience layer

The following are the components of the experience layer:

A protocol gateway – Supports Model Context Protocol (MCP) MCP and Agent2Agent (A2A) to clients on one side and translates to Amazon Bedrock AgentCore Runtime, Amazon Bedrock AgentCore Gateway, and downstream tools on the other. You’ll handle multiple MCP transports, such as stdio, streamable HTTP, or server-sent events (SSE), and A2A variants such as JSON-RPC, gRPC, or HTTP+JSON). Streaming introduces the most complexity: interleaved progress events, sessions resumed mid-call, and a spec that keeps moving.
A registry with resource discovery – A catalog of which agents and tools exist, who owns them, and who can reach them. Beyond cataloging, it provides the ability to surface the right things to the right user at the right moment, filtered by identity, role, and conversation context. Without this, every client is configured by hand, and every governance question becomes a manual audit.
An identity service – Integrates with your IdP (such as Okta, Microsoft Entra, Amazon Cognito, or Auth0) and issues tokens that Amazon Bedrock AgentCore Runtime trusts as a custom JSON Web Token (JWT) authorizer: asymmetric keys, a /.well-known/jwks.json endpoint, and a key rotation story that doesn’t require redeploying agents.
The OAuth lifecycle, end to end – Every downstream tool has its own OAuth requirements: token exchange, refresh, scope changes, and secure storage. When a tool returns 401 mid-call, the gateway has to detect it, kick off the right flow through MCP elicitation (where the client supports it), and deep-link the user back to their actual VS Code window or Claude Desktop session, not a generic browser tab. Done right, re-auth feels instant. Done wrong, the user hunts for their IDE every time.
End-to-end observability – A single audit trail joining the gateway, the agent runtime, and downstream tools: “user X called tool Y through agent Z and got result W.”

The following diagram shows the components and interconnections for a self-built experience layer.

Figure 1: Experience layer components

All of these are solvable individually but maintaining them together is a sustained engineering investment that grows with every new agent and copilot you add.

What ASCENDING built after the fifth time

ASCENDING is an AWS Partner that has spent nearly a decade helping customers build on AWS. Over the last 2 years, that work has focused on AI and automation: assistants, Retrieval Augmented Generation (RAG) systems, and autonomous agents deployed on Amazon Bedrock AgentCore.

After their fifth AgentCore integration, the ASCENDING team recognized a pattern: every customer needed the same experience layer, and every customer was building it from scratch. The work was similar enough to be recognizable each time, but different enough that no previous solution was directly reusable.

For Amazon Bedrock AgentCore, ASCENDING built an open source experience layer, the Jarvis Registry, which includes a protocol gateway, registry, resource discovery, identity service, OAuth orchestrator, in-session auth UX, deep-link return paths, and end-to-end observability. It’s packaged as a self-contained platform that runs inside the customer’s AWS environment and integrates with AgentCore Runtime as a first-class identity and routing target. With Jarvis Registry, customers can focus on building agents without worrying about the integration infrastructure needed to make them accessible from every IDE.

The following graphic shows the Amazon Bedrock AgentCore and Jarvis interaction layer.

Figure 2: Jarvis Registry interaction layer

What it looks like for users

Here’s what that looks like in practice. Vegogarden is a customer running two very different workloads on Amazon Bedrock AgentCore. The first is a distributed fleet of customer-support agents that look up product information and place orders on behalf of customers. The second is a cluster of data-analytics MCP servers that expose detailed sales, inventory, and operations data to internal users. Both workloads needed an experience layer, and the agents and MCP servers needed to be reachable from the tools their users actually used.With Jarvis sitting between the copilots and AgentCore, the same agents and MCP servers now serve two distinct workflows.

Business users in Claude Desktop. A regional manager asks the analytics agent to render a bar chart of last quarter’s revenue, broken down by region. Support specialists ask the support agent to summarize closed tickets for a given week, suggest responses for the email they’re writing, or surface similar past cases from the company’s historical database. No dashboards, no copy-pasting, no engineering tickets to “give me access.”

Engineers in VS Code. When something doesn’t work correctly, the on-call engineer calls the same agent from VS Code. Jarvis’s audit trail shows exactly which tools and APIs were called, and where the chain broke. Triage that used to require pulling logs from three separate systems now happens in a single conversation.

Department-scoped access. Each team only sees what they should. Sales can’t reach engineering tools, support can’t query payroll data, engineers don’t accidentally pull personally identifiable information (PII). You define these access rules one time in the registry, and Jarvis Registry enforces them uniformly across every IDE the business uses.

The impact on day-to-day work is harder to quantify but immediately noticeable. Business users began answering their own questions through the tools they already use, reducing the volume of one-time requests routed to engineering. On-call engineers saw fewer off-hours pages for issues that turned out to be business-logic questions rather than system failures. The agents Vegogarden’s team built reached the people they were built for.

Try it

In this post, we showed how Amazon Bedrock AgentCore handles production agent deployment and how the Jarvis Registry adds the experience layer that makes those agents accessible from the IDEs and copilots your team uses. Together, they provide a complete platform for building, deploying, and consuming agents across your organization.

The Jarvis Registry is available as open source. A two-minute demo shows a developer calling a production AgentCore agent from inside their IDE, encountering an upstream auth challenge, and resolving it in place—the experience layer at work. To deploy the Jarvis Registry in your own AWS environment, integrate it with your IdP, and extend it for your team’s use cases, reach out to the ASCENDING team.

ASCENDING – AWS Partner spotlight

ASCENDING is an AWS Partner focused on AI-driven solutions and cloud transformation. As an AWS Agentic AI launch partner, ASCENDING helps customers accelerate AI adoption with solutions such as Jarvis, enabling organizations to build and integrate production-ready AI agents more efficiently on AWS. We’ve also released several AI solutions as open source to support the broader community and help organizations innovate faster.

Contact ASCENDING | Partner Overview | AWS Marketplace

Accelerating software development with OpenAI ChatGPT Codex on Amazon Bedrock

Sunil Bemarkar — Tue, 04 Aug 2026 19:28:35 +0000

By: Sunil Bemarkar, Sr. Partner Solutions Architect – AWS
By: Garrett McCarthy, Partner Leader – OpenAI
By: Erik Anderson, Principal Solutions Architect – AWS

OpenAI

The pace of software development continues to accelerate, with organizations under increasing pressure to ship features faster, reduce technical debt, and do more with constrained engineering resources. According to Gartner, more than 80% of enterprises will have used generative AI APIs or deployed generative AI–enabled applications in production environments by 2026, up from less than 5% in 2023, signaling a fundamental shift in how software is built. Meanwhile, research from GitHub shows that developers using AI coding assistants complete tasks up to 55% faster while reporting significantly reduced cognitive load on repetitive work.

Yet for enterprises managing large codebases across distributed teams, merely adopting AI tools isn’t enough. Gartner predicts that by 2028, 75% of enterprise software engineers will use AI code assistants, up from less than 10% in early 2023. With the question of whether to adopt AI-assisted development resolved, the challenge becomes how to do so with security, governance, and operational controls that enterprise environments demand.

In this post, we explore how OpenAI ChatGPT Codex on Amazon Bedrock, OpenAI’s powerful coding agent for end-to-end software development, enables enterprises to adopt advanced AI-assisted development while maintaining the governance, security, and operational excellence that AWS provides. ChatGPT Codex is now available on Amazon Bedrock with OpenAI’s frontier models.

Scaling developer productivity without sacrificing quality

Enterprise software teams face a common set of challenges:

Growing complexity – Modern applications span microservices, multi-cloud environments, and diverse technology stacks, making it harder for any single developer to comprehend the full system context.
Talent constraints – The demand for experienced software engineers continues to outpace supply, and onboarding new developers to large codebases takes months.
Quality and security requirements – Enterprises can’t trade speed for safety. Every line of code must meet compliance, security, and operational standards before reaching production.
Technical debt accumulation – Teams often deprioritize refactoring and modernization under delivery pressure, creating a compounding burden that slows future development.

These challenges call for a new approach that augments human developers with AI agents capable of reasoning through complex problems at scale.

Introducing OpenAI ChatGPT Codex on Amazon Bedrock

ChatGPT Codex goes beyond straightforward code completion to work across the entire software development lifecycle (SDLC). Powered by OpenAI’s latest frontier models with advanced reasoning capabilities, Codex can:

Understand full codebase context – Codex reasons across entire repositories, understanding dependencies, architectural patterns, and business logic to produce contextually appropriate solutions.
Execute multistep coding tasks – From implementing new features to refactoring legacy code, Codex breaks down complex tasks into logical steps and executes them end to end.
Generate tests and documentation – Codex can independently write unit tests, integration tests, and documentation aligned with your team’s conventions.
Operate as a collaborative agent – Rather than replacing developers, Codex acts as a force multiplier that handles routine and complex coding tasks so engineers can focus on architecture, design, and innovation.

By making ChatGPT Codex available on Amazon Bedrock, enterprises gain access to OpenAI’s frontier reasoning models through fully managed, serverless API, thus eliminating the need to manage infrastructure while benefiting from the enterprise-grade capabilities of AWS services.

The case for AI-assisted development: What the research shows

The impact of AI coding assistants on developer productivity is well-documented by independent research:

As mentioned in the first paragraph, a controlled study by GitHub research found that developers using AI coding assistants completed tasks 55% faster, averaging 1 hour 11 minutes compared to 2 hours 41 minutes without assistance.
In an enterprise study with Accenture, GitHub found that AI-assisted developers saw an 84% increase in successful builds and a 15% rise in pull request merge rates, demonstrating improved code quality at scale.
Productivity gains are becoming more measurable; Gartner insights reveal that 90% of software engineering leaders report visible improvements, logging a net average developer productivity gain of 19.3% from AI integration.

ChatGPT Codex builds on these foundations by going beyond code suggestions to deliver full agentic reasoning, understanding multifile context, executing complex multistep tasks, and collaborating with developers as an intelligent partner rather than an autocomplete tool.

Why Amazon Bedrock for OpenAI ChatGPT Codex?

Amazon Bedrock provides the foundation for enterprises to adopt generative AI responsibly, at scale. Running ChatGPT Codex on Amazon Bedrock delivers several critical advantages, including zero operator access, enterprise security and governance, operational visibility and monitoring, and unified billing.

The next-generation inference engine of Amazon Bedrock implements a zero operator access (ZOA) design that intentionally eliminates the technical means for AWS or OpenAI operators to access customer data, including inference prompts and completions.

AWS Identity and Access Management (IAM) integration provides fine-grained access control, limiting the ability to invoke Codex capabilities to only authorized users and systems. For customers who require private connectivity, AWS PrivateLink can be configured so traffic between your virtual private cloud (VPC) and Amazon Bedrock stays on the AWS network instead of traversing the public internet.

Amazon CloudWatch provides real-time metrics on usage, latency, and error rates, so your operations teams can maintain visibility into AI-assisted development workflows. AWS CloudTrail logs every API call for compliance auditing and security investigations.

You can enjoy consolidated billing through your existing AWS account alongside other AWS workloads. Pay-per-token pricing has no seat licenses or upfront commitments. Existing Amazon Bedrock customers can access OpenAI’s latest frontier models in one place.

Business outcomes: What enterprises can expect

Organizations adopting ChatGPT Codex on Amazon Bedrock can realize measurable impact across their software development lifecycle, as outlined in the following table.

Outcome	Impact
Developer productivity	Offload repetitive coding work to Codex, so developers can redirect their time to making architectural decisions, solving engineering challenges, and exercising judgment.
Time to market	Accelerate feature delivery cycles by augmenting teams with AI-powered development agents.
Code quality	Improve consistency and reduce defects through Codex, leading to more successful builds and fewer production issues.
Developer efficiency	Achieve more output per developer without proportional headcount growth.
Onboarding speed	New team members ramp faster with an AI agent that understands full code base context and provides answers for new teammates.

Who benefits from OpenAI ChatGPT Codex on Amazon Bedrock?

ChatGPT Codex on Amazon Bedrock serves a broad spectrum of enterprise personas:

Engineering leaders and CTOs seeking to scale development capacity without proportional headcount growth while maintaining security and compliance.
Individual developers looking for an intelligent coding partner that understands their code base, reduces context-switching, and handles tedious tasks.
Executive decision-makers evaluating generative AI investments who need a solution that integrates with existing AWS infrastructure, governance, and procurement workflows.
Other technical teams (product managers, data analysts, technical writers) who work alongside engineering and want an agent that can read the code base, query documentation, and automate repetitive tasks without writing code.

Getting started

ChatGPT Codex runs locally on your machine using the command line interface (CLI), desktop app, or integrated development environment (IDE) extension and routes model requests to Amazon Bedrock using AWS authentication.

To begin using ChatGPT Codex on Amazon Bedrock, complete the following steps:

To download and install, visit Codex. You can download the Codex CLI, Codex App, or the Codex VS Code extension and get started with Amazon Bedrock for model inference. Confirm you’re on Codex CLI 0.128.0 or later, the Codex desktop app, or Visual Studio Code extension 26.429.30905 or later. Earlier builds don’t support Amazon Bedrock as a model provider.
Configure authentication. Codex supports two Amazon Bedrock authentication paths, the Amazon Bedrock API key or AWS SDK credential chain, which gives teams the flexibility to choose the approach that best fits their existing security posture and infrastructure setup. When you set a value for AWS_BEARER_TOKEN_BEDROCK, Codex uses that first. If that doesn’t exist, it falls back to the AWS SDK credential chain. You can set the bearer token in the environment as:

export AWS_BEARER_TOKEN_BEDROCK=<your-bedrock-api-key>

Set Amazon Bedrock as your provider, your preferred Region, and the model ID in the Codex configuration in ~/.codex/config.toml, which is required for Bedrock-API-key authentication as shown in the following code. Confirm that you provide models that match the model Region compatibility. As of this writing, openai.gpt-5.6 (Sol, Terra, and Luna), openai.gpt-5.5, and openai.gpt-5.4 are supported.

model = "openai.gpt-5.5"
model_provider = "amazon-bedrock"
model_reasoning_effort = "medium"
[model_providers.amazon-bedrock.aws]
region = "us-east-2"

Restart the desktop app or VS Code extension after changing ~/.codex/config.toml. For Codex CLI, type codex in the terminal to get started with Codex on Amazon Bedrock.

All model inference is routed through the Responses API on Amazon Bedrock, with pay-per-token pricing that requires no seat licenses or per-developer commitments, and data residency stays within the Amazon Bedrock Region you select.

To learn more about how to configure ChatGPT Codex to use OpenAI models on Amazon Bedrock, visit Use Codex with Amazon Bedrock.

Conclusion

The convergence of frontier AI reasoning and enterprise cloud infrastructure changes how organizations build software and perform knowledge work. With Gartner forecasting that 75% of enterprise engineers will use AI code assistants by 2028, the early adopters who invest in secure, governed AI development will be better positioned as adoption scales.ChatGPT Codex on Amazon Bedrock combines OpenAI’s advanced coding intelligence with AWS security, governance, and operational maturity. Enterprises can confidently adopt AI-assisted development that accelerates delivery, reduces technical debt, empowers developers with an AI collaborator, and still meet enterprise requirements.

To get started, explore OpenAI models on Amazon Bedrock and follow the guide to use ChatGPT Codex with Amazon Bedrock.

OpenAI – AWS Partner Spotlight

OpenAI is an AWS Advanced Technology Partner offering frontier AI models and platforms that help organizations solve complex problems. ChatGPT Codex, their agentic coding platform, brings advanced reasoning capabilities to software development workflows.

Contact OpenAI | Partner Overview

Say Hello to 149 New AWS Competency and MSP Partners Added in July

Nick Paris — Mon, 03 Aug 2026 15:54:57 +0000

By Nick Paris, APN Marketing Manager – AWS Partner Network

The AWS Partner Network (APN) is a global community that leverages Amazon Web Services (AWS) technologies, programs, expertise, and tools to build solutions and provide services for customers.

NEW! AWS Competency Partners

To succeed with cloud adoption in today’s complex IT environment and continue to advance in the future, customers can team up with an AWS Competency Partner.

Team up with our newest AWS Competency Partners:

AWS Advertising and Marketing Technology Competency

Branch Metrics | NAMER | Ad Intelligence & Measurement
Omnichat | China | Ad Intelligence & Measurement; Ad Platforms; Audience & Customer Data Management; Digital Customer Experience

AWS AI Competency

AceCloud | APAC | Agentic AI Consulting Services
act digital | LATAM | Generative AI Consulting Services
allOps Solutions | EMEA | Generative AI Consulting Services
allOps Solutions | EMEA | Agentic AI Consulting Services
Altimetrik Corp | NAMER | Generative AI Consulting Services
ARKHO | LATAM | Agentic AI Consulting Services
beSharp | EMEA | Agentic AI Consulting Services
biia Group | LATAM | Agentic AI Consulting Services; Generative AI Consulting Services
Calyza Tech | APAC | Generative AI Consulting Services
CGI Inc | NAMER | Generative AI Consulting Services
Ci&T Software | LATAM | Agentic AI Consulting Services
CloudHesive | NAMER | Agentic AI Consulting Services
Coforge | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
CONSULTEDGE GLOBAL SERVICES (OPC) | APAC | Generative AI Consulting Services
CONSULTEDGE GLOBAL SERVICES (OPC) | APAC | Agentic AI Consulting Services
Coresys Solutions Limited | EMEA | Generative AI Consulting Services
DD Consulting | APAC | Generative AI Consulting Services
Demo Account | NAMER | Generative AI Consulting Services
Descasio | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
devx labs | APAC | Generative AI Consulting Services
DIU | EMEA | Generative AI Consulting Services
EMB Global | APAC | Generative AI Consulting Services
Emumba | NAMER | Agentic AI Consulting Services
Escala24X7 | NAMER | Agentic AI Consulting Services
Euristiq | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Flatiron Software Corporation | NAMER | Generative AI Consulting Services
Future Processing | EMEA | Generative AI Consulting Services
Hong Kong Qineasy Technology Limited | China | Generative AI Consulting Services
Idexcel | NAMER | Agentic AI Consulting Services
Intelligence Cloud Sphere- (Intel CS) | EMEA | Agentic AI Consulting Services
Jacobian Engineering Inc. | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Karsun Solutions LLC. | NAMER | Generative AI Consulting Services
KIIRO | EMEA | Agentic AI Consulting Services
kloudr | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
LCM Go Cloud | EMEA | Generative AI Consulting Services
LCM Go Cloud | EMEA | Agentic AI Consulting Services
Leapfrog Technology | NAMER | Agentic AI Consulting Services
LeverX | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Metaage Corporation | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Mindware | EMEA | Agentic AI Consulting Services
Mist Avinya Technologies | APAC | Agentic AI Consulting Services
Mitra Innovation | EMEA | Generative AI Consulting Services
Motherson Technology Services | APAC | Generative AI Consulting Services
One Cloud Utopia | NAMER | Agentic AI Consulting Services
Red Oak Strategic | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Registfy | EMEA | Agentic AI Consulting Services
Samsung SDS | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
SK | APAC | Agentic AI Consulting Services
SkyGRID Global Technologies | EMEA | Agentic AI Consulting Services
Stormit | EMEA | Generative AI Consulting Services
TATA ELXSI | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Trustsoft | EMEA | Generative AI Consulting Services
Tuxpas | LATAM | Agentic AI Consulting Services
Uberfusion (part of fourtitude.asia) | APAC | Generative AI Consulting Services
V2 AI | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Vontech IT | NAMER | Generative AI Consulting Services
太美医疗科技 | China | Generative AI Applications
Abnormal AI | NAMER | Generative AI Applications
CloudHound | APAC | Agentic AI Tools
CloudHound | APAC | Agentic AI Applications
Datadog | NAMER | Generative AI Applications
HERE Technologies | NAMER | Agentic AI Applications; Agentic AI Tools; Generative AI Applications
impress.ai | APAC | Agentic AI Applications; Generative AI Applications
Pega | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
Process Street | NAMER | Agentic AI Applications
Qodo, AI Code Review & Governance Platform | NAMER | Agentic AI Applications
Shanghai Yabaiwo Software Technology | China | Generative AI Applications
ThoughtBox AI | NAMER | Generative AI Applications
Thundersoft | China | Generative AI Applications
Tianjin Hualai Technology | China | Agentic AI Tools
Zuora | NAMER | Agentic AI Applications; Agentic AI Tools; Generative AI Applications

AWS Cloud Operations Competency

A3Data | LATAM | Monitoring & Observability
allOps Solutions | EMEA | Operations Management
Cloud Capital | NAMER | Cloud Financial Management
ELEKS | EMEA | Operations Management
F6S Advisors | EMEA | Compliance & Auditing
Fuama Technologies | EMEA | Cloud Financial Management; Cloud Governance
GWCLOUD TECNOLOGIA E SERVICOS | LATAM | Operations Management
Horus Technologies | NAMER | Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
TranSnet Cloud | EMEA | Cloud Financial Management; Cloud Governance; Monitoring & Observability; Operations Management

Consumer Goods Competency

Clearscale | NAMER | IT & Digital Transformation; Manufacturing
Spectro Cloud | NAMER | IT & Digital Transformation; Manufacturing

AWS Data & Analytics Competency

Cloudwalker | EMEA | Consulting Services
Comprinno Technologies | APAC | Consulting Services
Mphasis | NAMER | Consulting Services
RYSUN LABS | NAMER | Consulting Services

AWS DevOps Competency

BASIS | NAMER | Consulting Services
DFX5 | NAMER | Consulting Services
FPT Software | APAC | Consulting Services
OneData Software Solutions | NAMER | Consulting Services
Operisoft Technologies | APAC | Consulting Services
Saudi Telecom Company | EMEA | Consulting Services
Synechron | NAMER | Consulting Services
Bitrise | NAMER | Continuous Integration & Continuous Delivery

AWS Digital Sovereignty Competency

Ankercloud | EMEA | Consulting Services
LOGIC media solutions | EMEA | Consulting Services
Redington Gulf | EMEA | Consulting Services

AWS Digital Workplace Competency

Workspot | NAMER | Application Management

AWS Financial Competency

Apexon | NAMER | Banking; Capital Markets; General Financial Services
Datamellon | EMEA | Banking; Payments
Bridgewise | EMEA | Banking; Capital Markets
Vonage | NAMER | Banking; General Financial Services; Insurance; Payments

AWS Government Competency

Innovation Process Technology (ipt) | EMEA | Citizen Services

AWS Healthcare Competency

dataRain Consulting | LATAM | Consulting Services
goML (Neuralgo) | NAMER | Consulting Services

AWS Manufacturing and Industrial Competency

Celonis SE | EMEA | Engineering and Design; Enterprise Solutions; Operational Technology; Operational Technology Security; Smart Manufacturing; Smart Products and Services; Supply Chain Management; Sustainability
Karini AI | NAMER | Enterprise Solutions; Operational Technology; Operational Technology Security; Smart Manufacturing; Smart Products and Services; Supply Chain Management

AWS Migration and Modernization Competency

BIP – Business Integration Partners | EMEA | Migration Services
CloudEQ | NAMER | Migration Services; Modernization Services
CloudJournee | APAC | Migration Services; Modernization Services
Logicalis Spain | EMEA | Migration Services
NOVOSOFT | APAC | Migration Services
SEC AND DEVOPS AI | APAC | Migration Services; Modernization Services

AWS Resilience Competency

CloudZenia | APAC | Resilience Design
Rapyder Cloud Solution | APAC | Resilience Recovery
Visionet Systems | NAMER | Resilience Design

AWS Retail Competency

Clearscale | NAMER | Consulting Services
MadeinWeb | LATAM | Consulting Services
ByteDance | China | IT and Core Applications
Grafana Labs | NAMER | Digital Commerce
Retool | NAMER | Advanced Data Insights; Customer Engagement; Digital Commerce; Intelligent Supply Chain; IT and Core Applications; Merchandising and Planning

AWS Security Competency

Atomic Computing | EMEA | AI Security; Application Security; Compliance and Privacy; Data Protection; Identity and Access Management; Infrastructure Protection; Perimeter Protection; Threat Detection and Response
DataArt | NAMER | Application Security
Quantiphi | NAMER | Identity and Access Management
SEC AND DEVOPS AI | APAC | Identity and Access Management
TranSnet Cloud | EMEA | Data Protection; Identity and Access Management; Infrastructure Protection

AWS Small and Medium Business (SMB) Competency

Cheppers Zrt. | EMEA | Small and Medium Business
Cloudtech | NAMER | Small and Medium Business
cloudvests | EMEA | Small and Medium Business
ELCORE UA | EMEA | Small and Medium Business
Pump | NAMER | Small and Medium Business
RealCloud | LATAM | Small and Medium Business
SVA (System Vertrieb Alexander) | EMEA | Small and Medium Business

AWS Storage Competency

EMB Global | APAC | Consulting Services

AWS Travel and Hospitality Competency

Matterport | NAMER | Smart Assets

NEW! AWS Managed Service Providers (MSPs)

Say hello to our newest AWS MSP Partners:

AWS Managed Service Provider Program

Cloud2 Oy | EMEA
DNX Solutions | APAC
ETEVERS | APAC
IVCISA | LATAM
MadeinWeb | LATAM
MetanetX | APAC
Orient Technologies | APAC
Pentagon System and Services | APAC
Skaylink | EMEA
SnapSoft | EMEA
Sufle | EMEA
YASH Technologies | NAMER

More Value, Greater Profitability for AWS Partners

Learn how AWS is transforming the partner experience >>