AWS Partner Network (APN) Blog

From weeks to hours: How a UK energy retailer transformed residential pricebooks with Gorilla on AWS

John Gray — Fri, 11 Sep 2026 17:34:23 +0000

By: Jack Rivers, Content Marketing Manager – Gorilla
By: John Gray, Sr. SAP Specialist Partner Solutions Architect – AWS
By: Sascha Janssen, Principal Solutions Architect – AWS
By: Simon Cunningham, Principal ERP Specialist Solutions Architect – AWS

Gorilla

In this post, you will learn how a major UK energy retailer modernized its residential pricebook process using the Gorilla Energy Margin Intelligence application, built on Amazon Web Services (AWS). Facing intense market volatility, the retailer transformed their error-prone, manual process into an automated, auditable workflow that completes in under 4 hours. We detail the industry challenge, the technical solution using Amazon Simple Storage Service (Amazon S3), AWS Glue, and Amazon Elastic Compute Cloud (Amazon EC2), and the major results, including a 95% reduction in pricebook creation time and full Market-wide Half Hourly Settlement (MHHS) compliance (Pricing Manager, UK Energy Retailer).

To stay competitive, you need to move now, not days later

As energy markets have shifted from a state of relative calm to near constant volatility, the pricing team has faced a slew of new challenges. We need to remain competitive across numerous brokers and other third-party intermediaries (TPIs) while verifying that each new deal is going to make money. A slight delay and we lose to a competitor; a mistake and we potentially lose even more.

For years our processes have been manual. An analyst would export billing data from SAP, rebuild the pricing model in Excel, wait 2–5 days for calculations to be complete, then route everything through finance and commercial sign-off before anyone could touch the SAP billing system. By the time we had a number we trusted, the market had moved again.

We weren’t slow because our people weren’t good. We were slow because the tools weren’t built for the speed the market now demands. That’s why we partnered with Gorilla, an AWS Partner and AWS Marketplace Seller, to rebuild this workflow from the ground up on AWS.

The industry-wide problem: Adjusting at pace to a volatile market

Energy retailers across Europe and North America face the same structural challenge. Reacting quickly enough to a chaotic market requires new capabilities. Changes in one or more of the following areas can trigger a wave of pricebook updates:

Wholesale market volatility – Spot and forward price movements that can shift margins overnight
Network and distribution charge updates – Typically annual but increasingly frequent
Government levies and tax changes – Requiring rapid pass-through recalculation across products

In the UK, pricing has been further complicated by the introduction of Market-wide Half Hourly Settlement (MHHS), which mandates that energy usage (domestic and non-domestic) be settled at half-hourly granularity. Aside from the operational challenge, this has introduced a vast amount of new data into every calculation. Similar changes to settlement times have occurred in other energy markets, with 5-minute settlement in Australia and 15-minute settlement across the EU.

The traditional approach to updating a pricebook—with spreadsheets, manual SAP exports, and siloed teams—creates three compounding risks:

Speed risk – Slow quotation means losing out or taking a risk with errors
Accuracy risk – Manual processes introduce errors across millions of contract lines
Capacity risk – Peak demand for pricing analysis reaches exactly when market volatility is highest

For our customer, a major UK retailer, this meant they could update their pricebooks only once a month, with five levels of business sign-off to bring a new product to market and no ability to model scenarios before committing to a price.

What good looks like: Rapid, automated, auditable pricebooks

The target state isn’t only faster spreadsheets. It’s a fundamentally different operating model:

A pricing manager receives an alert that wholesale costs have shifted
Within minutes, an automated workflow recalculates tariffs across products and customer segments
Pricebook creation has gone from taking days to completing within 30–45 minutes
The approved book is written back to SAP with a detailed audit trail
The entire cycle, from market signal to updated billing system, is designed to be complete in one to two hours

This is what Gorilla’s Energy Margin Intelligence application, built on AWS, is designed to deliver.

The solution: Gorilla on AWS

Gorilla and the energy retailer began to work on an implementation that can cover their needs without disrupting business operations.

Architecture overview

The following diagram illustrates the end-to-end pricing-update pipeline, showing how SAP S/4HANA pricing data is extracted, transformed, and delivered to the Gorilla Pricing Engine, with results captured back into an analytics layer for reporting.

Figure 1: Solution architecture

The application connects three layers that previously operated in silos:

Data foundation – SAP IS-U (Industry Solution for Utilities) and S/4HANA remain the system of record for billing and contract data. SAP Energy Data Management (EDM) provides consumption data. AWS Glue extracts this data into Amazon S3, which serves as the central data lake. There is no rip-and-replace of existing SAP infrastructure.
Automated orchestration – AWS Step Functions coordinates the end-to-end workflow. AWS Lambda handles event-driven triggers and lightweight processing. Amazon API Gateway manages external integrations. Amazon DynamoDB stores workflow state and intermediate results.
Calculation and analytics – Gorilla’s Python-based pricing engine runs on Amazon ECS, processing tariff recalculations in parallel across the full portfolio. Amazon Athena and Amazon Redshift power portfolio-level analysis. Amazon Quick delivers scenario dashboards to pricing managers and commercial directors and allows business users to query portfolio data in plain English with no SQL required.

The result is a closed-loop system: SAP data flows into AWS, Gorilla calculates, and results flow back to SAP through the AWS Glue SAP OData connector. The process is automatic, can scale, and is auditable.

Why we built on AWS – A note from Gorilla’s CTO Joris Van Genechten

When we evaluated cloud providers for our calculation engine, three things drove our decision toward AWS:

Elastic compute at portfolio scale – Energy retailers range from 50,000 to 50 million contracts. Amazon ECS enables us to scale our parallel processing engine to match portfolio size without pre-provisioning infrastructure. A retailer with 500,000 contracts and one with 5 million contracts run the same code base and the application platform scales to fit.
Native SAP integration – Most energy retailers run SAP. The AWS Glue SAP OData connector meant we can build a production-grade data pipeline without custom middleware. This dramatically reduced implementation time and ongoing maintenance burden for our customers.
The analytics layer – Our customers don’t just need fast calculations: they need to make decisions from the results. Amazon Quick gave us a business-ready analytics and natural language interface we can embed directly into our solution without building it ourselves.

A day in the life: Before and after

To illustrate the operational impact of this solution, the following tables walk through a typical pricing-update cycle, first as it exists today using manual processes, and then as it runs with Gorilla on AWS.

Before Gorilla on AWS

Figure 2: A typical pricing-update cycle using manual processes

Before Gorilla on AWS, the process took a total of 10–14 business days. The process was lengthy, error prone, and required high manual effort. There was no scenario modeling.

After Gorilla on AWS

Figure 3: A typical pricing-update cycle with Gorilla on AWS

After Gorilla on AWS, the process took less than 4 hours. The new process is scenario modeled, auditable, and requires minimal manual intervention.

Results: What changed for the UK retailer

After Gorilla on AWS, the UK energy retailer saw the following improvements:

Pricebook creation time – Reduced from 2–5 business days to under an hour, a 95% reduction
Full-time equivalent (FTE) hours per cycle – From 3 analyst-days to 2 hours of review time
MHHS compliance – Previously impossible; now fully MHHS ready
Error rate – 75% reduction in pricing errors reaching SAP billing
Market responsiveness – Ability to respond to intraday wholesale movements for the first time

“It’s been a huge gain to take any existing process and transform it into something automated and modern” – Pricing Manager, UK energy retailer

How this Fits the SAP + AWS joint go-to-market

For energy retailers running SAP IS-U or S/4HANA, this solution is additive and doesn’t require major changes in SAP. Gorilla’s solution extends SAP’s data without replacing it. AWS Glue handles extraction and enriched pricing data writes back to SAP through standard interfaces. There is no core system migration required.

This makes Gorilla on AWS a natural fit for SAP customers looking to modernize their analytics and pricing capabilities without a multi-year transformation program. AWS and SAP’s existing partnership means joint customers can use existing commercial agreements, certified integration patterns, and joint support structures.

For AWS Partners and SAP resellers, this represents a concrete, deployable solution for a pain point that exists in every energy retail SAP environment.

Getting started

Gorilla’s Energy Margin Intelligence solution is available on AWS Marketplace, supporting procurement through existing AWS commercial agreements. The solution is compatible with SAP IS-U and S/4HANA environments and can be deployed incrementally; starting with a single market or product line before scaling to the full portfolio.

To learn more or request a proof-of-concept scoping session, visit the Gorilla AWS Marketplace listing or contact your AWS Energy & Utilities Industry Specialist.

Conclusion

In this post, we showed you how a major UK energy retailer transformed its residential pricebook process from a 10–14-day manual workflow into an automated, auditable cycle that completes in under 4 hours. Using the Gorilla Energy Margin Intelligence application built on AWS, the retailer used AWS Glue for SAP data extraction, Amazon ECS for parallel tariff recalculation at portfolio scale, and Amazon Quick for scenario analysis and decision support. The results speak for themselves: a 95% reduction in pricebook creation time, a 75% decrease in pricing errors, full MHHS compliance, and the ability to respond to intraday market movements for the first time. For energy retailers running SAP IS-U or S/4HANA, this solution demonstrates that modernizing pricing operations doesn’t require replacing core systems, it means extending them with automation built for the cloud that delivers speed, accuracy, and auditability where it matters most. To explore how Gorilla on AWS can accelerate your pricing workflows, visit the Gorilla AWS Marketplace listing or contact your AWS Energy & Utilities Industry Specialist.

Gorilla – AWS Partner Spotlight

Gorilla is an AWS Differentiated (Software) Partner and AWS Energy & Utilities Software Competency Partner that provides Energy Margin Intelligence, unifying pricing, forecasting, hedging, billing, and finance into a single source of margin truth so energy retailers can see, steer, protect, and grow their margins with confidence.

Contact Gorilla | Partner Overview | AWS Marketplace

How Nubank saved $15M on Amazon DynamoDB costs with PointFive

Amir Hazoom — Wed, 09 Sep 2026 14:36:32 +0000

By: Amir Hazoom, Partner Solutions Architect – AWS
By: Rob McCauley, Specialist Solutions Architect – AWS
By: Mike Rosenberg, Director of Cloud Financial Management – Nubank
By: Amir Hozez, Co-Founder & CTO – PointFive

PointFive

Nubank saved over $15 million on Amazon DynamoDB costs by partnering with PointFive while scaling from 99 million to 119 million customers in 16 months. This post describes how Nubank and PointFive achieved measurable savings while continuing to scale by building on Amazon Web Services (AWS). Nubank uses DynamoDB to handle billions of real-time financial transactions with consistent, single-digit millisecond performance. PointFive’s agentic optimization analyzed thousands of DynamoDB tables, and Nubank turned the findings into verified annualized savings.

Nubank partnered with PointFive to manage cloud efficiency and maintain its low cost-to-serve. Running on AWS, they uncovered and remediated inefficiencies across thousands of DynamoDB tables. This drove measurable savings and reinforced the value of financial operations (FinOps) maturity for teams running on AWS.

The following diagram illustrates how DynamoDB infrastructure, PointFive’s agentic optimization, and Nubank’s FinOps discipline work together on AWS to deliver verified savings at scale:

Figure 1 – How DynamoDB infrastructure, agentic optimization, and FinOps discipline work together on AWS to deliver verified savings at scale

The urgency of cloud optimization

Cloud spending continues to accelerate. The FinOps Foundation’s State of FinOps 2026 report finds that 78% of FinOps practices now report into the CTO or CIO organization, signaling that cloud cost management has become a boardroom priority. The next challenge is operationalizing it at enterprise scale. At the same time, enterprises are adopting AI workloads on AWS. For Nubank, optimizing cloud spend on existing services freed budget to reinvest in AI services such as Amazon Bedrock and Amazon SageMaker AI.

The DynamoDB 2024 pricing update reduced on-demand throughput costs by up to 50%, giving customers a strong reason to revisit their database configurations. Combined with AI-driven optimization, this is the right time to act.

DynamoDB as Nubank’s foundation

DynamoDB provides the backbone for Nubank’s real-time financial systems. As a fully managed, serverless database, it delivers the performance, security, and resilience that real-time financial transactions require at scale.

DynamoDB capabilities that supported Nubank’s success include single-digit millisecond performance at high scale and multi-Region strong consistency for resilience. The 2024 pricing updates further reduced on-demand throughput costs by up to 50%.

“It’s a bulletproof database that grows as fast as we do.”
– Mike Rosenberg, Nubank

The challenge: Visibility and waste at scale

With thousands of DynamoDB tables spread across engineering teams, identifying unused or inefficient resources manually was unfeasible. Even marginal inefficiencies could add up to significant costs at Nubank’s scale.

“No one raindrop believes it’s responsible for the flood. PointFive helped us see each table, the raindrops, that added up to costs without business value.”
– Mike Rosenberg, Nubank

The following screenshot shows how PointFive surfaces DynamoDB optimization opportunities, with specific savings estimates and recommended actions for each table:

Figure 2 – PointFive displaying DynamoDB optimization opportunities for Nubank, including inactive table detection, storage class recommendations, and capacity right-sizing, each with estimated savings and a direct remediation path

The solution: A three-way partnership in action

PointFive deploys from AWS Marketplace with no infrastructure changes required. Within 24 hours of onboarding, PointFive identified actionable optimization opportunities for Nubank’s DynamoDB environment. Its agentic, architecture-level analysis found inefficiencies that rule-based tools missed.

Three categories drove the majority of Nubank’s savings:

Inactive table cleanup – Tables no longer in active use were identified and removed, leading to immediate savings.
Storage class shifts – Low-access tables were moved to the DynamoDB Standard-Infrequent Access (Standard-IA) table class, cutting storage costs by up to 60% on affected workloads according to Nubank.
Capacity right-sizing – Each remaining table was matched to the most cost-efficient throughput model for its actual usage pattern.

Each recommendation flowed directly into Nubank’s existing engineering workflow through a Jira integration. Findings became finished work, not tickets in a backlog.

“For banks and financial services customers, disaster recovery and data durability are required. DynamoDB capabilities like multi-Region strong consistency and point-in-time recovery give customers like Nubank essential resilience while freeing budget to reinvest in further innovation.”
– Rob McCauley, Amazon DynamoDB

Measurable results

The Nubank and PointFive collaboration delivered the following outcomes:

Over $15 million in verified annualized savings while scaling by 20 million new customers over 16 months, as reported by Nubank
Ten-day return on investment (ROI) from initial deployment to first realized savings, based on Nubank’s data
Reinvestment in resilience: A portion of recovered spend went toward DynamoDB point-in-time recovery, strengthening Nubank’s durability posture

The following graphic summarizes the measurable outcomes Nubank achieved over 16 months:

Figure 3 – Nubank’s measurable outcomes from the AWS and PointFive collaboration include over $15 million in verified annualized savings, 119 million customers served, and ROI achieved within 10 days of deployment

“Optimization isn’t just a one-time fix. It’s a posture. Our solution continuously learns from DynamoDB telemetry to keep customers efficient as they grow.”
– Amir Hozez, Co-founder and CTO, PointFive

The takeaway: Better together

This collaboration demonstrated that enterprises can optimize cost and strengthen resilience simultaneously. DynamoDB provided the technical foundation, PointFive’s agentic analysis surfaced the opportunities, and Nubank’s FinOps discipline turned them into outcomes. The result is more than savings—it’s headroom to reinvest in resilience and in the AI workloads that will define the next wave of cloud innovation. This pattern is repeatable: Find the waste, fund the future.

Related resources

- Accelerate vendor evaluation with AWS specializations – APN Blog
- Best practices for cost optimization – AWS Well-Architected Framework

About PointFive

PointFive is an AWS Advanced Tier Independent Software Vendor (ISV) Partner with the AWS Cloud Operations Competency and Cloud Financial Management designation. PointFive helps enterprises identify and eliminate cloud waste across every layer of their stack, from cloud infrastructure to AI workloads, through agentic optimization available in AWS Marketplace.

Contact PointFive | Partner Overview | AWS Marketplace

Run Apache Spark up to 10x faster with DataPelago on Amazon EKS

Nikhil Marrapu — Thu, 03 Sep 2026 19:46:13 +0000

By: John Janakiraman, VP of Engineering – DataPelago Inc.
By: Hany Mostafa, Senior Solutions Architect – AWS
By: Nikhil Marrapu, Senior Solutions Architect – AWS

datapelago

Spark infrastructure costs are a significant bottleneck in modern AI and analytics pipelines, which is a direct consequence of running today’s data workloads on compute frameworks designed for earlier CPU-only architectures.

As AI workloads grow, teams need faster, more efficient ways to process data without rewriting their existing applications. Enterprises across social media, AI-powered analytics, ecommerce, and financial services have adopted DataPelago Accelerator for Spark (DPA-S) to address this challenge.

As an AWS ISV Partner, DataPelago accelerates Apache Spark on Amazon Elastic Kubernetes Service (Amazon EKS) for these customers, which means they deliver up to 10 times faster execution and up to 80% cost reduction without changes to their existing applications, security configurations, or data pipelines.

In this post, you’ll learn how customers accelerate Apache Spark workloads on Amazon EKS with DataPelago, review production performance results, and find out how to get started with a proof of concept on your own infrastructure.

Why Spark acceleration has been hard

Spark was designed for CPU-only environments. Data centers today look different. CPUs sit alongside GPUs, FPGAs, and custom accelerators. The processing power is there, but Spark can’t reach it.

The barrier is a programming model gap. Spark is built to run JVM tasks on legacy CPUs. Getting workloads onto GPUs or vectorized CPUs means rewriting application logic for a different execution model. Data engineers focus on data movement and orchestration rather than low-level processor-specific optimization. Infrastructure teams can provision GPU-enabled Amazon Elastic Compute Cloud (Amazon EC2) instances but they can’t change the Spark runtime to use them. Organizations pay for heterogeneous compute and run Spark as if the only option is a CPU.

Customers use DataPelago to close this gap with no application rewrites and no retooling needed. The system accelerates workloads without manual intervention.

How DPA-S works

DPA-S runs on DataPelago Nucleus, a universal data processing engine designed to accelerate structured and unstructured data on supported hardware. It places a domain-specific instruction set architecture between the Spark physical plan and the underlying hardware. This architecture means Spark workloads can run across CPUs and GPUs without the application knowing which processor handles which operation.

The following diagram shows the DataPelago Nucleus architecture, a single processing engine that sits between data workloads—analytics and generative AI—and the underlying hardware, supporting structured and unstructured data across CPUs, GPUs, and FPGAs:

Figure 1: DataPelago Nucleus architecture

The Spark Catalyst optimizer (the query planner that converts SQL and DataFrame operations into an executable plan) produces a physical plan as it normally does. DataPelago changes none of it. Nucleus intercepts at the physical plan stage. It evaluates every operation for acceleration, including scans, filters, joins, aggregations, and sorts. For each operation, Nucleus determines at runtime which processor will be fastest based on the data. Some operations route to GPU; others stay on CPU with vectorized execution. If a stage can’t be accelerated, Nucleus falls back to standard Spark automatically with no errors. Cluster topology, data formats, security, and monitoring remain untouched. The following diagram illustrates this architecture:

Figure 2: CPU and GPU infrastructure

Performance beyond cuDF

As Jensen Huang noted at COMPUTEX, “Data processing consumes the vast majority of cloud spend today. All of it should be accelerated.” When benchmarked against NVIDIA cuDF, the GPU-accelerated library powering the Spark RAPIDS Accelerator, DataPelago Nucleus demonstrated measurable performance gains across key operation types.

The DataPelago team ran the benchmark comparison on an AWS P5.48xlarge instance (192 vCPUs, 2 TB RAM, and 8x NVIDIA H100 GPUs). The team conducted measurements using DataPelago Nucleus v3.0 and cuDF v25.04.00. The benchmark covered a suite of physical operators that form the building blocks of AI and analytics workloads. Here are four of the key results:

Projection and filtering – With 3.7–10.5 times higher throughput than cuDF. Nucleus fuses multiple Spark operations into single GPU kernels, reducing the extra kernel launches and memory copies that limit cuDF on integer-heavy workloads.
Aggregation – 3.3–4.5 times higher throughput across the tested data types, including float32 and float64 operations common in financial and scientific workloads.
Memory-intensive operations – Up to 4.5 times faster on hash joins and aggregations. Nucleus manages GPU high-bandwidth memory dynamically, avoiding the spill to CPU cycles that degrade cuDF on large datasets.
Variable length string processing – Up to 38.6 times faster for hash joins on text data. This performance gap is particularly relevant for generative AI pipelines, where unstructured text is the dominant data type. Nucleus uses purpose-built string hashing that keeps performance GPU in-house in cases where cuDF might fall back to slower execution paths.

For AWS customers running GPU instances, these gains translate to significantly more useful work from the same hardware.

Deploying on AWS

Customers run DataPelago on AWS for self-managed Apache Spark on Amazon EKS. DataPelago is deployed as a Spark plugin during cluster setup, requiring no data migration, application rewrites, or application recertification. For deployment instructions, see the DataPelago deployment guide for Amazon EKS.

The integration works at the executor level. DataPelago adds a pre-execution hook that decides which stages to accelerate. Spark drivers, resource managers, monitoring, and scheduling continue as before. The only change: Jobs finish faster on fewer Amazon EC2 resources.

Data stays in Amazon Simple Storage Service (Amazon S3) in Parquet, Delta, ORC, or other standard formats, fully compatible with Spark’s built-in authentication and encryption. According to DataPelago, the solution is SOC 2 Type 2 and ISO 27001 certified. DataPelago doesn’t access, copy, or move customer data, and the solution avoids vendor lock-in.

You can procure DataPelago in AWS Marketplace for streamlined billing. For guidance on running Spark workloads on Amazon EKS, refer to this Containers Blog post: Best practices for running Spark on Amazon EKS.

Production results across industries

Customers across social media, AI-powered analytics, ecommerce, and financial services have adopted DataPelago to accelerate their Spark workloads. In production, customers have achieved 2–10 times faster performance and 50–80% lower costs. In micro-benchmarks, Nucleus reaches up to 60 times faster speedup on memory- and compute-intensive operations such as joins, aggregations, and sorts.Four outcomes are consistent across these deployments:

Performance gains 2–4 times faster in production – DataPelago accelerates compute- or memory-intensive operations such as joins, aggregations, and sorts by routing them to optimized execution paths on CPUs or GPUs. Customers running daily extract, transform, and load (ETL), enrichment, and model validation pipelines have reduced the number of vCPU hours needed to complete these jobs on the same cluster configurations.
Cost reduction of 50–80% – Faster job completion means fewer compute hours consumed per workload. Because DataPelago reduces the active runtime of Spark jobs without changing cluster size, customers pay for less compute time on the same EC2 instances. Some customers have also been able to downsize their clusters while maintaining equivalent or better performance, further reducing costs.
Seamless deployment at scale – In enterprise environments with diverse workloads where legacy approaches caused Spark jobs to fail during runs, DataPelago’s Smart Acceleration helped prevent job failures by intelligently reverting individual queries and stages to built-in Spark when acceleration is not possible. This alleviated the all-or-nothing risk of full job
acceleration and confirmed teams depending on these jobs had data available on schedule
Production deployment in hours to days – DataPelago deploys as a Spark plugin (JAR file) with no code changes, no data migration, and only minimal configuration settings. Most customers complete a proof of concept in 3–4 weeks and move to production shortly after.

Getting started

DataPelago Accelerator for Spark is available now in AWS Marketplace.

You can deploy DataPelago into your existing Spark on Amazon EKS environments. You select the workloads, complete benchmarks with and without DataPelago’s accelerator, and measure the difference. Most customers finish a proof of concept in 3–4 weeks. Deployment itself takes hours to days.

To get started, explore DataPelago in AWS Marketplace or contact the team to discuss a proof of concept and measure your Spark acceleration on your own workloads.

Visit DataPelago to explore how DataPelago can accelerate your Spark workloads and how to request a proof of concept.

DataPelago – AWS Partner Spotlight

DataPelago is an AWS Advanced Partner and AWS Data & Analytics Competency Partner that that accelerates Apache Spark and other open source frameworks for generative AI and analytics workloads. DataPelago Accelerator for Spark deploys as a plugin into existing Spark environments with zero code changes, no data migration, and no disruption to security policies, delivering up to 10x faster execution and up to 80% lower compute costs across CPUs and GPUs.

Contact DataPelago | Partner Overview | AWS Marketplace

Say Hello to 158 New AWS Competency and MSP Partners Added in August

Nick Paris — Tue, 01 Sep 2026 16:24:17 +0000

By Nick Paris, APN Marketing Manager – AWS Partner Network

The AWS Partner Network (APN) is a global community that leverages Amazon Web Services (AWS) technologies, programs, expertise, and tools to build solutions and provide services for customers.

The APN has more than 130,000 partners from over 200 countries, with 70% headquartered outside of the United States. Together, partners and AWS provide innovative solutions, solve technical challenges, win deals, and deliver greater customer value.

To achieve APN specializations such as AWS Competency, AWS Service Delivery, AWS Service Ready, and AWS Managed Service Provider (MSP), organizations must undergo rigorous technical validation and assessment of their AWS solutions and practices.

NEW! AWS Competency Partners

To succeed with cloud adoption in today’s complex IT environment and continue to advance in the future, customers can team up with an AWS Competency Partner.

The AWS Competency Program validates and promotes AWS Partners with demonstrated technical expertise and proven customer success in specialized areas across industries, use cases, and workloads. Guidance from these skilled professionals can lead to better business and bigger results.

Team up with our newest AWS Competency Partners:

AWS AI Competency

10Pearls | NAMER | Generative AI Consulting Services
AH2 | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Algotery | EMEA | Generative AI Consulting Services
Anjana Cloud9 Solutions | NAMER | Generative AI Consulting Services
Aquarela Cloud Solutions | LATAM | Agentic AI Consulting Services
BizCloud Experts | NAMER | Agentic AI Consulting Services
Bounteous | NAMER | Generative AI Consulting Services
Brillio | NAMER | Generative AI Consulting Services
CADD Emirates Computer Trading | EMEA | Generative AI Consulting Services
Capspedia | APAC | Generative AI Consulting Services
Cloud Mile | China | Generative AI Consulting Services
Cloud202 | EMEA | Agentic AI Consulting Services
Cloudhight Consulting | EMEA | Agentic AI Consulting Services
CloudJournee | APAC | Agentic AI Consulting Services
Cloudojo | EMEA | Generative AI Consulting Services
Cloudpiles | LATAM | Agentic AI Consulting Services; Generative AI Consulting Services
CloudThat | APAC | Agentic AI Consulting Services
Cloudtry Infotech | APAC | Generative AI Consulting Services
CoderPush | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Credence Management Solutions | NAMER | Generative AI Consulting Services
D3Clarity | NAMER | Agentic AI Consulting Services
DailiTech | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Darede | LATAM | Agentic AI Consulting Services
Datamellon | EMEA | Generative AI Consulting Services
Digiclarity | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Digital Alpha Platforms | NAMER | Agentic AI Consulting Services
Diversus | APAC | Generative AI Consulting Services
Dualboot Partners | NAMER | Generative AI Consulting Services
ECC Technologies (ASCP GPUonCLOUD) | APAC | Generative AI Consulting Services
Enreap India | APAC | Generative AI Consulting Services
FivexL Consulting Services | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Ganit Business Solutions | APAC | Agentic AI Consulting Services
GlobalTask | NAMER | Agentic AI Consulting Services
Go Digit | APAC | Generative AI Consulting Services
Happiest Minds Technologies | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Karnovation | NAMER | Agentic AI Consulting Services
LADERA TECHNOLOGY | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Minutus Computing | APAC | Generative AI Consulting Services
Minutus Computing | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
NDS Corporation | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Necko Technologies | EMEA | Agentic AI Consulting Services
Nexusgrid Technologies | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
NWN Corporation | NAMER | Agentic AI Consulting Services
NxtCloud | APAC | Generative AI Consulting Services
OneByZero Pte | APAC | Agentic AI Consulting Services
OneData Software Solutions | NAMER | Agentic AI Consulting Services
OneData Software Solutions | NAMER | Generative AI Consulting Services
PEARL CLOUD SOFTWARE DESIGN | EMEA | Generative AI Consulting Services
Perficient | NAMER | Generative AI Consulting Services
Pronix Inc | NAMER | Generative AI Consulting Services
RECKLABS INC | NAMER | Generative AI Consulting Services
Relevantz Technology Services | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Revolutions.ai | APAC | Generative AI Consulting Services
RSNA Cloud Connect | NAMER | Agentic AI Consulting Services
safeINIT | EMEA | Generative AI Consulting Services
Searce | APAC | Generative AI Consulting Services
Shri Sai Tech | NAMER | Generative AI Consulting Services
Silicon Overdrive | EMEA | Generative AI Consulting Services
Silicon Power Solutions | APAC | Generative AI Consulting Services
SKY IQ TRADING AND SERVICES | EMEA | Generative AI Consulting Services
Tactical Edge | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
The Server Labs | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
TranSnet Cloud | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
UST | NAMER | Generative AI Consulting Services
Vcloudmaster | EMEA | Agentic AI Consulting Services
Webby Group | APAC | Generative AI Consulting Services
Wedgewoodservices | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Wizeline | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Xtremax | APAC | Generative AI Consulting Services
Zimetrics | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
网易 NetEase | China | Generative AI Applications
北京七麦科技股份有限公司 | China | Generative AI Applications
Artemis Global Technologies | NAMER | Generative AI Applications
ASCENDING | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications
Cloud Scal3 | NAMER | Generative AI Applications
Cloud202 Limited | EMEA | Agentic AI Tools
Devops TechLab | APAC | Generative AI Applications
Duco | NAMER | Agentic AI Applications
HighByte | NAMER | Infrastructure and Data
Horizon3.ai | NAMER | Agentic AI Applications
JINGdigital | China | Generative AI Applications
KG Data | China | Agentic AI Applications
PingCAP | NAMER | Agentic AI Tools
UnifyApps | NAMER | Generative AI Applications

AWS Business Value Realization Competency

Flexa Cloud Brasil | LATAM | Business Value Realization
RAMBUNCT CONSULTING | EMEA | Business Value Realization

AWS Cloud Operations Competency

Nerdshub | EMEA | Cloud Financial Management; Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
Opinov8 | EMEA | Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
Sotatek | APAC | Cloud Governance; Monitoring & Observability
SquareOps Technologies | APAC | Cloud Financial Management; Cloud Governance; Monitoring & Observability; Operations Management
The Software Works | NAMER | Cloud Financial Management; Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
Omnistrate | NAMER | Cloud Financial Management; Monitoring & Observability; Operations Management

AWS Data & Analytics Competency

Celebal Technologies Americas | NAMER | Consulting Services

AWS DevOps Competency

Commerce Architects | NAMER | Consulting Services
Dedalus | LATAM | Consulting Services
Devopsity | EMEA | Consulting Services
Fission Labs | NAMER | Consulting Services
Pyxis Tech | LATAM | Consulting Services
Registfy | EMEA | Consulting Services
Codvo.AI (TalentKloud) | NAMER | Consulting Services

AWS Digital Sovereignty Competency

dataRain Consulting | LATAM | Consulting Services
Nextlink Technology | APAC | Consulting Services

AWS Education Competency

The Burgundy Group | NAMER | Consulting Services
impress.ai | APAC | Administrative and Operations

AWS Financial Competency

Oneture Technologies | APAC | General Financial Services

AWS Government Competency

AppSquadz Software | NAMER | Citizen Services
ITG Solutions SAC | LATAM | Citizen Services
impress.ai | APAC | Citizen Services

AWS High Performance Computing Competency

RONIN | APAC | HPC Management

AWS IoT Competency

56k.Cloud | EMEA | Consulting Services

AWS Machine Learning Competency

A3Data | LATAM | Consulting Services
DataMax | EMEA | Consulting Services

AWS Microsoft Workloads Competency

Al Hilal Publishing And Marketing | EMEA | Database Solutions

AWS Migration and Modernization Competency

AGATEVERSE | NAMER | Migration Services
Ancrew Global Services | APAC | Migration Services; Modernization Services
Blue Pearl | APAC | Migration Services
CreateFuture | EMEA | Migration Services; Modernization Services
Digiclarity | NAMER | Migration Services
Hyundai Autoever | APAC | Migration Services
i2k2 Networks | APAC | Migration Services; Modernization Services
Ibexlabs / Labra | NAMER | Migration Services; Modernization Services
Novare Technologies | China | Migration Services
Pureplay Cloud | APAC | Migration Services
Teleglobal International | APAC | Migration Services

AWS MSSP Services Competency

Innovation Cloud Services – ICS Compute | APAC | Infrastructure Security; Workload Security

AWS Networking Competency

Vcloudmaster | EMEA | Consulting Services

AWS Resilience Competency

IBM | NAMER | Core Resilience; Resilience Design; Resilience Operations; Resilience Recovery
Honeycomb | NAMER | Resilience Operations

AWS Retail Competency

upd8 | LATAM | Consulting Services

AWS Security Competency

LCM Go Cloud | EMEA | Governance, Risk and Compliance; Threat Detection and Response
MegazoneCloud | APAC | Identity and Access Management
SK shieldus | APAC | Threat Detection and Response
Zetta Systems | EMEA | Identity and Access Management; Infrastructure Protection
Aikido Security | EMEA | Application Security

AWS Small and Medium Business (SMB) Competency

allOps Solutions | EMEA | Small and Medium Business
Axiom Digital | EMEA | Small and Medium Business
Cogniv Technologies | APAC | Small and Medium Business
Craftech | LATAM | Small and Medium Business
Insight Enterprises | NAMER | Small and Medium Business
IT Era | LATAM | Small and Medium Business
Loop8 – AI and Cloud Transformation Services | NAMER | Small and Medium Business
Nerdshub | EMEA | Small and Medium Business
NETRON INFORMATION TECHNOLOGY | APAC | Small and Medium Business

AWS Storage Competency

Automat-it | EMEA | Consulting Services
Cognetiks Consulting | EMEA | Consulting Services

AWS Travel and Hospitality Competency

HEXAWARE TECHNOLOGIES | NAMER | Data360; Digital Customer Engagement; Technology Migration and Modernization

NEW! AWS Managed Service Providers (MSPs)

The AWS Managed Service Provider (MSP) Program validates AWS Partners with a proven track record and experience providing end-to-end AWS solutions to customers at any stage of the cloud journey, including planning and design, building and migration, operations and support, and automation and optimization.

To achieve this level of specialization, AWS MSP Partners must complete an extensive independent audit to ensure business health and technical capabilities meet a high bar, and they must maintain this status through annual audits.

Say hello to our newest AWS MSP Partners:

AWS Managed Service Provider Program

Cloudvisor | EMEA
Cognetiks Consulting | EMEA
Flentas Technologies | APAC
GoCloud | EMEA
Honne Services | LATAM
Intuitive.ai | NAMER
Lauren Group | NAMER
RealCloud | LATAM
Saltware | APAC
Searce | APAC
TechConnect IT Solutions | APAC
Tenesys | EMEA

More Value, Greater Profitability for AWS Partners

Our mission is to make the AWS Partner Network (APN) with AWS Marketplace your preferred route to market and empower partners to deliver differentiated value to millions of AWS customers, helping you to win more, win bigger, and win faster.

We’re aligning the AWS Partner experience—including programs, incentives, and enablement—around AWS services and the partner business models: business outcome solutions, technology solutions, managed services, services, and resell.

These enhancements provide you with more relevant and prescriptive guidance, where you need it, and in a consistent and predictable manner. Your profitability, along with helping you drive new business, is our number one goal.

In 2026, we’ll continue to ensure that AWS Marketplace and our AWS Partner programs provide demonstrated pathways to success—helping you drive greater customer value and profitability. There’s an exciting journey ahead, and we’re thrilled to be on it together!

Learn how AWS is transforming the partner experience >>

Solution Matching Engine: Your Gateway to AWS Sellers

Akshay Menon — Mon, 31 Aug 2026 21:00:24 +0000

By: Akshay Menon, Principal Product Manager – AWS
By: Krystle DuBeau, Sr. Manager of Technical Business Development – AWS
By: Priya Bains, Head of Partner Brand and Content Strategy – AWS

When customers come to AWS with a business challenge, they rely on their AWS seller to point them toward the right solution and partner—fast. That often means identifying partner listings in AWS Marketplace that match the customer’s specific needs. The easier it is for a seller to understand what you offer, who you serve, and what results you deliver, the more likely your solution gets in front of the right customer at the right time.

We’re continuing to expand the ways sellers can access detailed information about your listings directly within the workflows they use to match solutions to customer needs. This includes your capabilities, customer outcomes, and differentiators. In 2025, we introduced the Solution Matching Engine, a machine learning system that helps sellers identify the most relevant partners for each account and opportunity. For foundational guidance on what sellers look for, see Improving Your Visibility to AWS Sales: A Practical Guide for Partners.

In this post, we outline three actions you can take in AWS Partner Central and AWS Marketplace to strengthen how your listings show up to sellers, so they can recommend your solutions to the right customers.

What is the Solution Matching Engine?
The Solution Matching Engine is your gateway to AWS sellers, helping them identify the partners and listings most relevant to a customer opportunity. It brings together information about your AWS Marketplace listings, whether software products or professional services offered by Consulting Partners, along with your AWS expertise and customer engagements, to give sellers a fuller view of the problems you can help solve.

The engine does more than surface a partner that may be a fit. It also helps sellers understand the specific listing you can bring to a customer. Within account-planning and co-sell motions, sellers use Solution Matching Engine to discover, compare, and evaluate relevant partners and listings. To make that discovery useful, the engine draws on:

Listing details: customer problems addressed, use cases, and AWS services integrated
Verified capabilities: AWS Specializations, and Certifications
Customer engagement signals: opportunity stages and outcomes

Together, these details help sellers understand both your offering and the context within which it may be relevant.

If you’re a Global Startup Program Partner, the new Startups You Should Know view in the Solution Matching Engine gives sellers a dedicated way to discover startup partners and solutions, even before you’ve built an extensive performance history.

The inputs that power these recommendations to sellers are within your control. Start here.

1: Keep opportunity data current

APN Customer Engagements (ACE) should be part of your operating rhythm. When opportunity data is complete and current, sellers can see the full picture of your customer engagement: what you’re delivering, what co-sell motions you are engaged with, and what outcomes you’ve driven.

Use CRM integration and internal data-quality processes to ensure the information you share with AWS stays accurate and up to date:

Customer context, use cases, and delivery details
Opportunity stages, next steps, and revenue information
Associated AWS Marketplace listings and AWS services
Launched and closed outcomes

The more complete your ACE records, the more context the Solution Matching Engine has to match your experience to the right customer opportunities.

2: Make your expertise easy to verify

AWS sellers look for signals that a Partner has proven experience with specific workloads, industries, and use cases. AWS Specializations and Certifications provide those signals, but only when they’re current and supported by evidence.

Keep your AWS Specializations and Certifications up to date
Document the work behind them through case studies and customer evidence that highlight the industries, workloads, and use cases where you’ve delivered results

Think of verified capabilities as your credibility layer. They give sellers confidence that your listing is backed by demonstrated experience.

3: Create complete AWS Marketplace listings

Your AWS Marketplace listing, whether for a software product or a professional service, is often the first thing a seller reads when evaluating your solution for a customer.

Your listing title matters, make it count. A strong listing clearly communicates:

The customer problem it solves and the primary use cases it addresses
Expected customer outcomes and the AWS services it works with
The industries and workloads where it’s most relevant
Supporting evidence: technical documentation, case studies, and customer references
Current product, pricing, and support information

Use consistent language across your AWS Marketplace listings, AWS Partner Central profile, and ACE opportunity records. When these align, sellers build a coherent understanding of your offering across every touchpoint.

Getting started or refreshing existing listings? Eligible ISVs and Consulting Partners can use AI-assisted product listing in AWS Partner Central to generate or refine listing content from existing assets: website URLs, PDFs, case studies, and product documentation. Review generated content before publishing to ensure it accurately represents your offering.

Conclusion

These three actions reinforce each other. Complete opportunity data makes your verified capabilities more meaningful. Strong listings give sellers the context to act on a recommendation. And monitoring your results helps you see which areas to sharpen next.

Review your ACE integration and data-quality processes to ensure opportunity information flows consistently
Audit your AWS Marketplace listings: do they clearly describe what you solve, for whom, and with what results?
Use Partner Analytics and Insights to monitor how your listing is performing in Solution Matching Engine and prioritize improvements.

Login to AWS Marketplace or AWS Partner Central to strengthen how your listings show up to sellers, so they can recommend your listing to the right customers.

The information you provide shapes how sellers understand your business. Keep it clear, current, and aligned across every surface, and you make it easier for AWS to connect you to the customers you’re best positioned to serve.

How OceanBase unifies transactions analytics and AI on AWS

Haibo Huang — Thu, 27 Aug 2026 20:52:23 +0000

By: Ye Dai, Ecosystem Solutions Architect – OceanBase
By: Haibo Huang, Senior Partner Solutions Architect – AWS

OceanBase

Modern data architectures often rely on separate databases for transactions, analytics, and AI, leading to extract, transform, and load (ETL) latency; data inconsistency; and rising costs. OceanBase addresses these challenges with a unified multimodel architecture that converges online transaction processing (OLTP), online analytical processing (OLAP), and vector retrieval within a single engine on Amazon Web Services (AWS).

By eliminating data movement between systems, enterprises can reduce operational complexity, lower total cost of ownership (TCO), and provide real-time data fresh for AI applications. Integrated with AWS services such as Amazon Elastic Compute Cloud (Amazon EC2), Amazon Bedrock, and AWS Key Management Service (AWS KMS), OceanBase delivers a streamlined, more secure, high-performance data foundation for intelligent workloads.

Modern data architectures such as OceanBase are redefining how organizations handle the tension between real-time transactions and analytics. Traditional ETL-dependent systems require data teams to wait hours for ETL pipelines to complete before AI applications can access transactional data from minutes ago, undermining your intelligence transformation progress.

At the time of writing, many enterprises use MySQL for transactions, a data warehouse for analytics, and a separate vector database for AI retrieval, which is regarded as a type of federated architecture. This federated architecture addresses individual use cases, but it also introduces challenges, such as difficulties in maintaining data consistency, high operational complexity, significant ETL latency, and rising TCO.

This post explains how to use the built-in capabilities of OceanBase on AWS to build a unified data foundation by converging online transaction processing (OLTP), real-time analytics (OLAP), and multimodal retrieval within a single system. This approach supports enterprises in streamlining their cloud architecture, alleviating cumbersome ETL processes, and providing a consistent real-time data foundation for AI applications.

Industry pain points: Why traditional heterogeneous architectures struggle in the AI era

Enterprises typically adopt a dedicated database per workload strategy in early stages, using separate databases for transactional, analytical, and AI workloads. However, as digitalization advances and intelligence requirements deepen, organizations encounter new challenges, such as:

Operational complexity and technology stack redundancy

Managing multiple database technology stacks in the cloud requires enterprises to master diverse technologies. This can cause increasing operational costs and architectural adaptation challenges.

Data consistency and latency issues

Relying on ETL/ELT tools to transform data among services not only creates storage redundancy, but also inevitably introduces synchronization delays. Such a data gap can significantly impact real-time risk control and personalized recommendation scenarios, which require millisecond-level responses.

High overall TCO

Multiple database license fees, storage overhead fees, network traffic expenses from data migration, and ongoing development and maintenance expenses combine to continuously drive up total costs.

Lack of a real-time data foundation for AI

AI scenarios such as large language models (LLMs) and intelligent recommendations require low-latency, high-quality unified data sources. The real-time context retrieval required by agent applications is extremely difficult to achieve. In heterogeneous architectures, data is scattered across different systems, making processing pipelines lengthy and complex.

The solution: OceanBase’s unified multimodel architecture on AWS

OceanBase takes a different approach with its built-in unified multimodel architecture. Rather than stitching together multiple databases through middleware integration, the approach provided by OceanBase fuses transaction processing, analytical processing, and intelligent processing capabilities into a single system at the kernel level. Through a unified storage engine, query optimizer, and execution framework, it achieves efficient coordination of different workload types.

1. A single engine for multi-workload collaboration – A single database engine simultaneously supports transaction processing, real-time analytics, and AI real-time workloads. After business data is written, it immediately enters the analysis and AI retrieval pipeline, meeting the stringent data freshness requirements of agent and real-time decision-making scenarios.
2. Built-in multimodal engine – OceanBase supports unified storage of structured, semi-structured, and vector data, and allows direct invocation of built-in model capabilities such as embedding generation, reranking, and text summarization within SQL. This means developers can perform AI computation preprocessing without moving data out of the database. By integrating with the foundation model (FM) capabilities of Amazon Bedrock, OceanBase can directly provide high-quality context retrieval for generative AI applications, building an end-to-end closed loop from data to inference.
3. AI-based hybrid search – OceanBase implements Hybrid Search, supporting combined queries of vector similarity, full-text relevance, and structured filtering conditions. It supports transactional consistency while delivering millisecond-level recall for large-scale vector data. This capability complements Amazon OpenSearch Serverless. OceanBase serves as the core data engine, handling both transactional consistency and vector retrieval, while Amazon OpenSearch Serverless can take on larger-scale unstructured log analytics scenarios, giving enterprises flexible data stack choices.

The following figure compares a traditional federated database architecture with OceanBase’s unified approach, showing how consolidating multiple database engines into a single solution reduces complexity and cost:

Figure 1: Traditional federated architecture compared to OceanBase unified multimodel architecture

Deeply integrated with AWS Cloud infrastructure, this solution builds a high-performance, highly elastic, more secure unified data foundation.

High performance – Deploy OceanBase on Amazon EC2 memory-optimized instances, fully using OceanBase’s optimizations for in-memory computing and massive parallel processing to achieve high-throughput, low-latency handling of transactional and analytical workloads.
Data security – OceanBase uses AWS PrivateLink to establish dedicated connections and integrates with AWS KMS to facilitate more secure control and management of key lifecycles and permissions to safeguard customer data.

The following figure shows the deployment architecture of OceanBase on AWS, illustrating how customer applications connect to OceanBase clusters through AWS PrivateLink, with multi-Availability Zone (AZ) distribution for high availability and integration with AWS services for security, storage, and AI capabilities:

Figure 2: OceanBase multi-AZ deployment architecture on AWS with integrated cloud services

Customer value: From architecture streamlining to business acceleration

By avoiding data silos through unification, OceanBase enables transactional data to be instantly transformed into analytical insights, which in turn drive business value through AI applications. If customers adopt OceanBase’s unified multimodel architecture on AWS, they could realize the following benefits:

Cost reduction and efficiency gains – Consolidating multiple databases into a single system reduces operational complexity, infrastructure costs, and maintenance overhead. Organizations typically see improvements in resource utilization and IT team productivity after architecture streamlining.
Accelerated AI innovation – By avoiding data movement, the latency from data generation to AI-ready inference drops from hours to seconds. One retail customer significantly shortened the development cycle for its real-time recommendation feature by 30% after adopting OceanBase’s unified architecture.
Enhanced decision agility – The fusion of real-time analytics and intelligent decision-making means businesses can make accurate judgments based on the latest data rather than relying on outdated reports.

Conclusion

Facing an AI-driven future, the streamlined and real-time nature of data architecture becomes a core competitive advantage. A deeply integrated unified data architecture is one of the most optimal technological paths to tackle multimodal data processing challenges and adapt to business intelligence upgrades.

As a member of the AWS Partner Network (APN), OceanBase provides unified capabilities on AWS that converge OLTP, OLAP, vector retrieval, and full-text search so enterprises can support both mission-critical business transactions and advanced intelligent applications with a single system.

If you’re evaluating a database architecture upgrade on the cloud and seeking to build a unified real-time data foundation for your AI applications, you can get started by visiting OceanBase in AWS Marketplace to experience the streamlined efficiency of the unified architecture approach. You can also contact the OceanBase technical team to obtain reference architecture design consultations tailored to your business scenarios.

OceanBase – AWS Partner Spotlight

OceanBase is an AWS Advanced Technology Partner with the AWS Data Analytics Competency. As a unified distributed database built for the AI era, it powers demanding workloads across financial services, ecommerce, and telecommunications, delivering the real-time consistency and scale required by mission-critical applications. With OceanBase, organizations can build a resilient, scalable data foundation that unifies OLTP, OLAP, and AI workloads, avoiding data silos while maintaining consistency and performance as demands grow.

Contact OceanBase | Partner Overview | AWS Marketplace

SailPoint Agent Identity Security for AI agents on Amazon Bedrock AgentCore

Imaan Tariq — Wed, 26 Aug 2026 15:08:17 +0000

By: Kirby Fitch, Lead Product Manager – SailPoint
By: Michael Conti, Product Marketing Manager – SailPoint
By: Imaan Tariq, Customer Solutions Manager – AWS
By: Nabil Ezzarhouni, Specialist Solutions Architect, GenAI – AWS

SailPoint

If you’re deploying AI agents across your organization, you’ve likely hit a familiar wall: How do you govern autonomous systems that can access sensitive data, dynamically request permissions, and take actions without direct human oversight?

Recent research shows that 80% of organizations report AI agents performing unintended actions, and 96% of technology professionals identify security concerns about AI agents (SailPoint, AI Agents: The New Attack Surface, 2025). Traditional identity and access management approaches, which were designed for human users and service accounts, fall short when applied to AI agents that interact with multiple systems and operate autonomously.

In this post, we explore how SailPoint’s Agent Identity Security (AIS) solution, built on Amazon Web Services (AWS), addresses these challenges through centralized identity governance for AI agents, and how your organization can get started securing your AI agents.

AIS in action

SailPoint’s AIS extends proven identity principles to autonomous AI. With AIS, you can gain centralized visibility and help maintain control over AI agents in your environment regardless of where they’re deployed on AWS.

The solution addresses the core challenges security teams face today: AI agents operating without oversight, over-permissioned agents with excessive access rights, and the lack of clear ownership and accountability for agent actions.

With AIS, you can automatically discover AI agents across your cloud environments, assign clear ownership to each agent, conduct regular access reviews and permission revocation, and gain visibility into both direct and indirect access pathways. This means you can apply the same governance rigor to AI agents that you’ve long applied to human identities so that every agent has the right level of access, your team regularly reviews it, and you can quickly revoke an agent’s access if needed.

The innovative solution

SailPoint’s journey to AIS began with a realization that AI agents represent a fundamentally new type of identity, one that requires purpose-built identity governance and security capabilities. Working closely with AWS since early 2025, SailPoint developed AIS as a cloud-based solution that integrates deeply with Amazon Bedrock AgentCore, the AWS agentic solution for hosting, connecting, and managing AI agents at scale.

This collaboration reflects a shared vision: making AI adoption more secure and scalable for enterprises. While AWS provides the infrastructure and tools for building powerful AI agents through Amazon Bedrock AgentCore, SailPoint assures those agents operate within proper governance guardrails. With this solution, organizations can confidently deploy AI agents knowing they have the same level of identity security and compliance they expect from their human workforce.

A collaborative story

The collaboration between SailPoint and AWS meant AIS could integrate directly with Amazon Bedrock AgentCore Identity, giving customers a unified way to discover and govern AI agents across their AWS environment. AWS experts worked alongside SailPoint’s product and engineering teams to design an architecture that scales to support the rapid growth of AI agents that enterprises are experiencing today.

AWS experts continue to work alongside SailPoint’s product and engineering teams to design an architecture that uses the full power of AWS services while integrating with Amazon Bedrock AgentCore Identity. This co-development approach helped verify that AIS would not only meet current enterprise security requirements but also scale to support the explosive growth of AI agents expected in the coming years.

Powering the solution with AWS services

SailPoint AIS is built on AWS, using a combination of managed services for compute, data, messaging, and identity to deliver a scalable, highly available governance solution for AI agents. The following diagram shows how these services integrate to deliver the AIS solution:

Figure #1 – AWS architecture supporting AIS

Technical architecture: Building AIS on AWS

SailPoint AIS demonstrates how to build a reliable, more secure system for managing AI agent identities using AWS services. The architecture uses cloud-based services to deliver real-time identity aggregation, governance, and lifecycle management for AI agents across Amazon Bedrock AgentCore.

Architecture overview

The solution runs entirely within AWS while using an Amazon Virtual Private Cloud (Amazon VPC) for network isolation and security. You access SailPoint Identity Security Cloud (ISC) through an Application Load Balancer, which provides high availability and efficient request distribution across the infrastructure.

Container orchestration with Amazon EKS

At the core of the architecture, Amazon Elastic Kubernetes Service (Amazon EKS) orchestrates containerized microservices, allowing independent scaling of components based on demand. This approach provides the flexibility to handle varying workloads while maintaining operational efficiency.

Within the Amazon EKS clusters, three specialized services work together to deliver comprehensive AI agent identity management:

Task Management Service handles the orchestration of AI agent identity aggregation workflows. It manages task definitions, executes aggregation jobs, and provides real-time status updates to end users. The service also maintains historical records of previous aggregations for audit trails and compliance reporting.
Non-Human Identity (NHI) Service serves as the central authority for non-human identities and accounts within the system. This service manages machine account classification, exposes APIs for retrieving defined machine accounts and identities, and handles the full lifecycle of AI agent identities, including creation, updates, and deletion during aggregation processes.
Connectivity Services bridge SailPoint’s system with AWS identity sources. These services retrieve data from configured SailPoint Connectors and stream it to downstream consumers. For AI agent identity management, the AWS Service Management Connector specifically targets Amazon Bedrock AgentCore, extracting agent metadata and streaming it to the NHI Service for identity management within ISC.

Data layer architecture

The architecture employs purpose-built data stores optimized for specific use cases:

Amazon ElastiCache for Redis provides low-latency tracking of rapidly changing aggregation status. During active identity aggregation, Redis maintains real-time state information. After an aggregation reaches a terminal state (Complete, Errored, Canceled, or Terminated), the Task Management Service updates the persistent task status record.
Amazon Relational Database Service (Amazon RDS) for PostgreSQL serves as the durable data store for the NHI Service, maintaining the authoritative record of non-human identities, their attributes, and relationships.
Amazon Managed Streaming for Apache Kafka (Amazon MSK) supports event-driven communication between services. Amazon MSK streams AI agent data from Connectivity Services to the NHI Service and distributes various event types to ISC microservices for asynchronous processing, such as audit events, workflow triggers, and entity change notifications.

Integration with Amazon Bedrock

The architecture’s integration with Amazon Bedrock represents a key capability in AI agent governance. The AWS Service Management Connector continuously discovers AI agents from Amazon Bedrock AgentCore, extracting critical identity attributes such as agent names, roles, permissions, and associated resources. This data flows through the Connectivity Services into the broader identity governance framework, which means you can apply the same governance policies to AI agents that you use for human and service identities.

Scalability and resilience

The architecture’s cloud-based design delivers both horizontal and vertical scalability. Amazon EKS automatically scales container instances based on workload demands, while Amazon MSK partitions allow parallel processing of identity events. The Application Load Balancer distributes traffic across multiple Availability Zones, providing high availability even during infrastructure failures.

This architecture demonstrates how AWS services can be composed to build enterprise-grade identity governance solutions that extend traditional identity management into the emerging domain of AI agent security.

Unlocking business value and future vision

The business impact of AIS spans multiple teams across your organization. Built on SailPoint’s unified identity control plane, AIS expands governance to AI agents without adding new silos or operational complexity. Identity teams can apply consistent access controls as agents emerge, while AI and automation leaders gain clear guardrails around how agents are created, authenticated, and scaled.

AIS provides a centralized console where security teams can view all discovered AI agents, their ownership, and assigned entitlements in one place:

Figure #2 – A single, unified view of identities gives administrators granular control over non-human identity permissions, cutting through the complexity of modern IT environments

Security teams benefit from deeper visibility into agent activity by enabling faster detection of risky behavior. Compliance teams can demonstrate to auditors that AI agents are governed with the same rigor as human identities.

Organizations can run periodic access certification campaigns for AI agents so permissions remain appropriate and compliant over time.

Figure #3 – The application provides a clear, comprehensive view of compliance where every entitlement has a clear owner and purpose during access certification

Before AIS, organizations faced a binary choice: Slow down AI agent deployment to manually govern each agent, or accept ungoverned risk as agents proliferated across their environment. There was no way to apply identity governance to AI agents at the same scale and rigor as human identities. AIS eliminates that trade-off. Organizations can now run access certification campaigns across their entire AI agent population, enforce least-privilege policies as agents scale, and maintain a complete audit trail of agent permissions—capabilities that were previously only available for human users.

The result is that teams can confidently deploy AI agents at scale without choosing between speed and security. The business impact of AIS spans multiple teams across your organization. Built on SailPoint’s unified identity control plane, AIS expands governance to AI agents without adding new silos or operational complexity. Identity teams can apply consistent access controls as agents emerge, while AI and automation leaders gain clear guardrails around how agents are created, authenticated, and scaled.

Looking ahead, SailPoint and AWS are committed to continued innovation in AI agent governance. As AI capabilities evolve from rudimentary task automation to complex multi-agent systems, the identity security framework must evolve in parallel. On SailPoint’s product roadmap, planned enhancements to AIS intend to address emerging challenges such as agent-to-agent authentication, dynamic permission adjustment based on context, and integration with AI observability applications for sophisticated agent lifecycle management.

The following Identity Graph provides a visual map of an agent’s entitlements and relationships, making it effortless to understand and audit what each agent can access:

Figure #4 – With deep observability, the Identity Graph visualizes how an agent integrates, providing crucial context and insight into its relationships and access

The collaboration between SailPoint and AWS demonstrates how established security principles can be adapted for the AI era. By extending proven identity security capabilities to AI agents and building on AWS cloud infrastructure, you can embrace the transformative potential of AI while maintaining the security and compliance standards your business demands.

Get started today

Ready to bring enterprise-grade identity security to your AI agents?

Explore SailPoint Agentic AI capabilities and the AWS alliance
Explore Amazon Bedrock and Amazon Bedrock AgentCore
Learn more about Agent Identity Security in action

SailPoint Technologies – AWS Partner Spotlight

SailPoint Technologies is an AWS Advanced Technology Partner and AWS Competency Partner that provides identity security solutions. With SailPoint, you can manage and govern identities, access, and entitlements with precision while automating security operations and maintaining compliance across your digital environment.

Contact SailPoint Technologies | Partner Overview | AWS Marketplace

Building intelligent data foundations: The Grubhub and Vody partnership on AWS

Nneoma Okoroafor — Mon, 17 Aug 2026 19:16:16 +0000

By: Dr. Yubin Kim, Chief Scientist – Vody
By: Nneoma Okoroafor, Partner Solutions Architect – AWS
By: Swagat Kulkarni, Sr. Solutions Architect – AWS
By: Siraj Gadne, Sr. Mgr, CSM, US SWIM – AWS

Vody

This post was co-written with Grubhub and Vody, an AWS Partner, for data engineers, ML platform teams, and retail technology leaders. Familiarity with Amazon EKS, Amazon Bedrock, and data pipeline concepts is helpful but not required.

Retailers are racing to adopt AI, but the companies that pull ahead won’t win because they shipped a single breakthrough feature. They’ll win because they invested early in the data foundations that can make AI initiatives faster, smarter, and more effective. At Amazon Web Services (AWS), we see this pattern across the most innovative customers: the shift from fragmented data projects to unified, intelligent data layers built on top of cloud-centered infrastructure.

Grubhub and Vody are taking that shift directly. Together, they’re modernizing the core building blocks of catalog, content, and behavioral data using AWS services and building the durable foundation required for the next era of AI-powered commerce. The early results are promising:

More than 400 thousand merchants and tens of millions of menu items cataloged and updated regularly; ensuring fresh, structured data flows reliably into downstream systems
Delivered results from initial model deployment in only 6-10 weeks, proving that major retailers can move quickly when the foundation is right
Improved search recall, with initial tests showing improved relevance of candidates retrieved
Higher conversion and click-through rates for dietary-intent searches, showing how enriched data directly improves customer experience

What’s emerging isn’t just better search and recommendations. It’s a future where structured, AI-ready data enables personalization that feels intuitive, discovery that understands intent, and merchandising that keeps pace with fast-moving cultural and consumer trends. Grubhub and Vody’s work on AWS is a blueprint for retailers preparing for what comes next: a world where the companies with the strongest data foundations will lead every wave of AI innovation.

Why the data foundation matters now

Three forces are rewriting how retailers think about data:

Generative AI everywhere: Large language models (LLMs) can analyze, recommend, and create, but they perform best when sitting on top of structured, consistent, buyer-relevant data. AI can’t invent signals retailers never stored. AWS customers across commerce, marketplaces, and delivery are recognizing this opportunity and investing in their data foundations.

Demand signals live outside the organization: Trends start on TikTok, Instagram, and community spaces long before they show up in dashboards. Modern catalog enrichment workflows need to operate at this velocity-updating in hours, not quarters, and syncing internal datasets with emerging external demand.

The opportunity for unified data: When search teams, merchandising, CRM, and marketing build on a shared source of truth, experimentation accelerates and AI projects scale more effectively across functions. Retailers are moving toward unified data platforms that all systems and teams can build on.

Establishing the foundation: Clean, structured, buyer-relevant data

Grubhub, with more than 400,000 merchants and tens of millions of menu items, recognized the opportunity to build a data layer that could support AI workloads at scale. Built on AWS, Vody transforms massive volumes of unstructured merchant content into clean, structured, AI-ready data.

Figure 1: Vody AWS architecture

The architecture, shown in Figure 1, implements network segmentation with public and private subnets. Customer traffic enters through an application load balancer, while outbound connectivity from the Amazon Elastic Kubernetes Service (Amazon EKS) cluster (such as calls to Amazon Bedrock) routes through a NAT gateway, maintaining security isolation for compute resources.

The platform uses Amazon EKS for container orchestration and integrates with Amazon Bedrock for generative AI capabilities. Amazon Relational Database Service (Amazon RDS) provides relational data storage, while Amazon ElastiCache serves dual purposes: as a queuing backend for background job processing and as a caching layer for API endpoints, optimizing overall system performance. AWS IAM Identity Center provides secure access management across the platform.

Using the diverse model portfolio provided by Amazon Bedrock (Claude, Nova, and Llama families), Vody generates customer-aligned search queries that enrich even low-data SKUs, ensuring consistent discoverability across the entire catalog.

The Vody platform operates as a software as a service (SaaS) solution hosted by Vody, providing merchants with a fully managed catalog enrichment service. With this managed approach, retailers can benefit from continuous AI improvements and scale without infrastructure overhead.

The platform delivers:

Normalized, enriched product and item attributes aligned to real-world buyer behavior
Labels that reflect how people discover restaurants and food
Structured metadata that feeds both traditional ranking systems and modern generative models
Frequent updates as restaurants, menus, and items change

This work represents the first key milestone toward establishing a future-looking data foundation at Grubhub and delivers measurable value from day one: better search recall, higher search conversion, and more intuitive product discovery-all without replacing existing search engines.

“Developing this in-house may have shifted focus away from our core product. After evaluating the resources required, we decided a third-party solution was the more efficient path”
– Jayesh Kataria, Sr. Director of Engineering, Grubhub

Results: Measurable impact across the business

The AWS-powered Vody platform now processes merchant data at impressive scale:

Daily processing: Over 500,000 items enriched daily
Weekly throughput: 2-5 million items processed

Business impact and ROI

The 12-week deployment to full production demonstrates that major retailers can move quickly when building on the right foundation. Key business outcomes include:

Enhanced search recall: More candidate merchants retrieved and more results matching actual customer intent during preliminary analyses
Higher conversion rates: Particularly for dietary and food characteristic searches
Faster time-to-market: Teams can now ship campaigns, taxonomies, and product updates in days instead of weeks
Optimized resource allocation: Strategic investment in data infrastructure versus building custom solutions

“We’re running enrichment across millions of items in our catalog across multiple facets, effectively reshaping and simplifying how our search and discovery systems operate”
– Jayesh Kataria, Sr. Director of Engineering, Grubhub

Towards an intelligent data platform on AWS

Consistent, structured product data is just the beginning. Vody envisions a roadmap toward what we call an intelligent data platform (IDP): a cloud-centered, AI-ready layer that unifies signals and supports every downstream experience.

An IDP on AWS brings three capabilities together:

Unified signals: Catalog, clickstream, availability, and fulfillment data live alongside external trends, search behavior, and micro-signals from social platforms. AWS services such as Amazon Simple Storage Service (Amazon S3), AWS Glue, Amazon OpenSearch Service, and Amazon Redshift make this unification possible at scale.
Adaptive metadata: As buyer language shifts, attributes evolve without breaking pipelines. Merchants and brands can introduce new concepts-aesthetics, dietary signals, styles, emerging themes-as needed.
Shared context and memory: Every A/B test, campaign, and model output feeds back into a shared knowledge layer. Teams stop re-creating their own one-off datasets and instead build on a common foundation. This is how retailers move from large amounts of unstructured data to a true AI data strategy.

After an IDP is in place, the business impact compounds:

Better search and discovery: Search engines unlock new relevance opportunities. Queries map to buyer intent, not just keywords.
Personalization that feels human: LLMs and ranking models operate on rich contextual signals rather than sparse metadata.
Faster experimentation: Teams ship campaigns, taxonomies, and product updates in days instead of weeks.
New AI surfaces: A structured foundation on AWS unlocks next-generation acquisition and engagement channels-from Generative Engine Optimization (GEO) to conversational shopping to agent-driven merchandising.

Retailers choose AWS for this work because AWS services provide:

Scalability: Ingestion of millions of SKUs, items, documents, and user behaviors
Security and governance: Essential for enterprise-grade catalog and customer data
AI/ML integration: Seamless use of Amazon Bedrock, Amazon SageMaker, and OpenSearch for retrieval and inference

Grubhub’s deployment demonstrates how quickly retailers can reach scale. Within 6-10 weeks, the joint AWS-Vody solution enriched millions of items, and pushed cleaner structured data into downstream systems while keeping merchant updates current, creating enormous potential to lift search performance.

The evolution of this work

Building an intelligent data foundation isn’t a one-time effort, it’s an iterative process. With the foundation in place, the team focused on scaling, speed, and operational efficiency. Three areas stood out:

Scaling across merchant diversity: The team built modular extraction pipelines that could adapt to merchant variability without retraining entire models, enabling consistent attribute structure across hundreds of thousands of merchants.
Rapid integration impact: Enriched attributes began influencing downstream relevance signals quickly once integrated. Improvements were measurable without requiring changes to the core ranking infrastructure.
Continuous optimization: Early alignment on evaluation metrics and performance dashboards streamlined cross-team visibility and reduced iteration cycles during rollout.

Looking ahead: The shift to intelligent retail

Many retailers are somewhere on the journey from fragmented data to intelligent data foundations. Grubhub’s work with Vody on AWS shows what the next stage looks like: a flexible, adaptive data layer that keeps pace with consumers, channels, and AI systems.

The message is clear: The future of retail belongs to companies that invest in their data foundation today. After the structure is in place, new AI initiatives can be implemented faster, with less effort, and be more valuable.

AWS is committed to helping retailers make that move and to supporting partners like Vody, who are building the connections that enable the AI future of commerce.

Conclusion

The Grubhub-Vody partnership demonstrates that AI-ready data foundations deliver real outcomes fast: tens of millions of entities enriched monthly, all within 6-10 weeks on AWS-accomplished by investing in a unified data infrastructure at the start. AI initiatives that follow can be faster and more effective.

Ready to build your intelligent data foundation?

Vody – AWS Partner Spotlight

Vody is an AWS Advanced Technology Partner that transforms messy, static product catalogs into enriched, continuously updated data feeds optimized for downstream AI performance, including on-site search, generative engine optimization, advertising, and emerging agentic shopping assistants.

Contact Vody | Partner Overview | AWS Marketplace

Securing the AI development lifecycle with Aikido and Kiro

Len Gomes — Thu, 13 Aug 2026 20:32:30 +0000

By: Len Gomes, Partner Solutions Architect – AWS
By: Akram Al Sheikh, Security Partner Solutions Architect – AWS
By: Alex Llobet, Global Cloud Alliances Lead – Aikido
By: Johan de Keulenaer, Head of Partnerships – Aikido

Aikido

Aikido Security and Kiro help development teams secure the AI development lifecycle and ship AI-generated code with confidence. Kiro is an AI-powered development environment from Amazon Web Services (AWS) that helps developers build and ship production-ready applications through spec-driven development. As AI agents take on more of the development workflow, from code to infrastructure to API integrations, organizations benefit from continuous security scanning that runs alongside every change. Aikido Security strengthens this workflow and now also through Kiro Powers with automated vulnerability detection, secrets scanning, and infrastructure as code (IaC) checks that run continuously as code is written keeping security in step with development velocity.

Aikido Security is a developer-first cybersecurity company trusted by more than 50,000 organizations. Aikido’s AI-first platform secures applications from code to cloud to runtime, replacing the fragmented tooling that creates alert fatigue and slows development teams.. Built to integrate where developers already work, Aikido operates inside integrated development environments (IDEs), continuous integration and continuous delivery (CI/CD) pipelines, and AI development environments.

In this post, we explain what Kiro powers are, how the Aikido power works, and how organizations can secure AI-generated code from day one.

The opportunity: Security that matches the speed of AI development

Development teams using AI assistants report five- to sevenfold productivity gains as AI agents handle code generation, infrastructure provisioning, and documentation. This acceleration creates an opportunity to rethink how security fits into the development lifecycle.

Rather than relying on security review as a final gate before deployment, organizations now embed security directly into the development workflow. Continuous scanning that runs alongside AI agents gives teams immediate visibility into vulnerabilities, exposed secrets, and infrastructure misconfigurations as code is written, not after it ships.

This shift from end-of-pipeline review to continuous, in-workflow security delivers measurable benefits: faster release cycles, fewer post-deployment remediations, and consistent security standards across every change an AI agent produces.

What are Kiro powers?

Kiro powers are specialized bundles that add expert-level context and tools to Kiro AI agents on demand. Rather than loading all tools at the same time (which overloads the context window), powers activate dynamically based on the task at hand. For example, the Aikido power activates when your conversation involves security-related topics such as scanning, vulnerabilities, or secrets detection. Each power packages three components working together:

Model Context Protocol (MCP) server – Provides direct connectivity between the Kiro agent and external tools or services.
Steering file (POWER.md) – Contains domain-specific best practices curated by technology experts.
Optional hooks – Automatically verify code against best practices, providing immediate feedback.

This modular design means Kiro can access dozens of technologies without overwhelming the agent context. Only the relevant power loads when needed. AWS and partner teams have published powers across a growing range of domains and technologies, each bringing production-grade best practices directly into the development workflow. Browse the full catalog at Kiro powers.

Introducing the Aikido Kiro power

Aikido Security has built a Kiro power that creates a continuous security loop inside the development workflow. Every agent-generated code change is automatically analyzed for vulnerabilities, exposed secrets, and infrastructure misconfigurations, and Kiro’s agents act on Aikido’s findings to fix issues before they ship.

The Aikido Kiro power provides three categories of scanning:

Static Application Security Testing (SAST) – Detects common vulnerability patterns such as SQL injection, path traversal, and cross-site scripting.
Secrets detection – Identifies exposed API keys, tokens, and hardcoded credentials.
IaC scanning – Finds misconfigurations in Terraform, AWS CloudFormation, and similar configuration files before they reach production.

When the power detects security issues, it explains each finding clearly (including title, severity, file location, and line numbers) and Aikido’s remediation engine guides the applied fixes. After applying fixes, the power rescans automatically to verify resolution, creating a self-correcting loop that operates without developer intervention.

How the hook configuration works

The key mechanism that provides continuous security is the Aikido hook. After it’s installed, a hook named “Aikido Scan on Write” triggers automatically after a file is written or modified by the Kiro agent. The hook activates the Aikido power and runs a full scan on all files created or modified in the current session.

The scan-fix-verify cycle works as follows:

The Kiro agent writes or modifies code files.
The hook triggers automatically and collects all affected file paths.
Aikido runs SAST, secrets, and IaC scanning across those files.
If issues are found, the agent explains each finding and applies fixes guided by Aikido’s remediation.
The power rescans to verify fixes and resolve the issues without introducing new ones.

This approach means security validation runs in parallel with development, not after it. Developers avoid context switching since the Aikido Power handles security in the background. The following screenshot shows this scan-fix-verify cycle.

Figure 1: The Aikido Scan on Write hook configuration in the Kiro IDE

Business scenarios

The Aikido Kiro power addresses security challenges across different organizational contexts:

High-growth startup shipping to production – A startup using Kiro to accelerate its first product generates IaC through AI agents. The Aikido power gives teams early visibility into misconfigured AWS Identity and Access Management (IAM) policies and storage bucket permissions, enabling remediation during development rather than post-deployment.
ISV managing developer scale – An independent software vendor (ISV) with a distributed engineering team needs consistent security standards across AI-assisted development without adding headcount to a security team. The Aikido power runs on every agent-generated change, enforcing security baselines uniformly without slowing release velocity.
Enterprise meeting compliance requirements – An enterprise in a regulated industry needs to demonstrate that AI-generated code meets security and compliance standards for audits. Aikido captures evidence continuously throughout the development lifecycle, replacing manual evidence-gathering with automated reporting across SOC 2, ISO 27001, Health Insurance Portability and Accountability Act (HIPAA), NIS2, DORA, and Payment Card Industry Data Security Standard (PCI DSS). Learn more about automated compliance checks in Aikido’s plataform.

Measured results

Production deployments of Aikido demonstrate measurable impact:

90% reduction in false-positive security alerts through reachability analysis and auto-triaging, so only exploitable risks surface
Security fixes in under 30 seconds through AutoFix, which proposes and implements remediation automatically
Developer onboarding in under 5 minutes with Aikido’s developer-native integrations (IDE, CI/CD, and issue management)
Compliance coverage across SOC 2, ISO 27001, PCI DSS, DORA, NIS2, and HIPAA through automated evidence collection

Getting started with the Aikido Kiro power

Installing the Aikido Kiro power takes one click:

Open the powers panel in the Kiro IDE or visit Kiro powers.
Search for “Aikido Security” and choose Install.
Configure your Aikido API key. You can find it by visiting Aikido and then choosing Settings, Integrations, and IDE Plugins.
The power activates on demand, and the hook begins scanning automatically after every code change.

The following screenshot shows the powers panel in the Kiro IDE.

Figure 2: Installing the Aikido power from the Kiro IDE powers panel

After the Aikido Kiro power is installed, developers can also explicitly prompt Kiro to scan files (for example, “Scan my changed files for security vulnerabilities”) for on-demand assessment at any point during development. The following are some suggested prompts to use with the Aikido power.

Good for getting a baseline security posture on your whole project in one shot:

“Scan all Python files in the backend/ directory for security vulnerabilities and hardcoded secrets. Fix any issues you find and verify the fixes are clean.”

Good for a quick gate before pushing code to catch things that slipped through during development:

“Scan my staged git changes for security issues: secrets, SQL injection, path traversal, or any IaC misconfigurations. Summarize what you find with severity levels.”

Good for learning from the findings, not merely patching them blindly. This one is great for when you want to educate the team or write up security notes:

“List all open Aikido security issues for this repo, then fix the high-severity ones. For each fix, explain what the vulnerability was and why the fix resolves it.”

Source code and documentation: github.com/AikidoSec/aikido-kiro-power. Learn more about the integration at integrations.aikido.dev/integrations/kiro.

Video 1: Aikido Kiro power in action

Conclusion

AI-driven development is the new baseline for how fast-moving organizations build software. The Aikido Kiro power brings automated scanning directly into the agentic development workflow, helping teams ship securely at the pace AI development allows. Security runs continuously, findings surface in context, and fixes apply automatically, so teams ship with confidence at the pace AI enables.

Explore Aikido Security in AWS Marketplace. Activate the Aikido power in Kiro at Kiro powers. Learn more about Aikido’s compliance certifications at Aikido’s Trust Center.

Aikido Security – AWS Partner Spotlight

Aikido Security is a cybersecurity company that secures everything developers build, ship, and run. Its software security platform protects code, cloud infrastructure, devices, and runtime environments, providing real-time visibility and automatically identifying and remediating vulnerabilities. Trusted by more than 50,000 organizations, Aikido is purpose-built to integrate where developers already work: inside IDEs, CI/CD pipelines, and AI development environments. Founded in 2022, Aikido Security has grown to 300 employees, reached unicorn status faster than any other European cybersecurity company, and was among one of the first AWS Security ISVs in EMEA selected for the Kiro pilot program.

Contact Aikido | Partner Overview | AWS Marketplace

Enhance DNS protection with Palo Alto Networks on Amazon Route 53 DNS Firewall

Rizwan Mushtaq — Fri, 07 Aug 2026 21:40:00 +0000

By: Anthony Smith, Sr. Security Partner Solutions Architect – AWS
By: Rizwan Mushtaq, Principal Solutions Architect – AWS
By: Ashmeet Singh, Sr. Customer Solutions Manager – AWS
By: Adhish Bhobe, Principal Product Manager – AWS
By: Arun Kumar, Director of Product Management, CDSS – Palo Alto Networks

Palo Alto Networks

Amazon Route 53 Resolver DNS Firewall now integrates Palo Alto Networks Advanced DNS Security to protect your DNS infrastructure. Because DNS queries are fundamental to how applications communicate, protecting them at the resolver gives security teams a powerful, centralized control point for safeguarding cloud traffic. This integration delivers comprehensive DNS threat protection that is effective and operationally straightforward to deploy across your cloud environments.

Palo Alto Networks, an AWS Partner Network (APN) partner, detects DNS-based threats such as command and control and fast flux. Palo Alto Networks Advanced DNS Security integrates with Amazon Route 53 Resolver DNS Firewall, delivering these threat-intelligence categories as DNS Firewall rules so you can enforce them with the availability and low latency of Amazon Web Services (AWS). By integrating Palo Alto Networks Advanced DNS Security with Route 53 Resolver DNS Firewall, security administrators can enforce trusted DNS threat protections across their Amazon Virtual Private Cloud (Amazon VPC) resources without deploying or managing additional infrastructure.

This post explores how the integration works, the threat coverage it adds on top of built-in DNS Firewall protections, and how security teams can extend that coverage across accounts, virtual private clouds (VPCs), and hybrid environments. Whether you’re securing a multi-account cloud environment or extending protections to hybrid-cloud traffic, this integration helps security teams deploy comprehensive DNS threat coverage faster and at scale.

Solution overview

Palo Alto Networks Advanced DNS Security is available directly from the Route 53 DNS Firewall console under the Advanced rule tier, with usage-based pricing and activation completing within 2 minutes—requiring no additional infrastructure. The integration operates through DNS Firewall rule groups, which are containers of one or more rules that can be associated with multiple VPCs and shared across accounts.

Each rule within a group specifies a security category, query type, and enforcement action, either BLOCK to deny resolution or ALERT to log without blocking. Rules are evaluated by configurable priority ordering within a group, giving administrators fine-grained control over how different threat types are handled.

A single rule group can protect any number of VPCs, and multi-account environments benefit from three sharing mechanisms: AWS Resource Access Manager (AWS RAM) for specific accounts or organizational units, Amazon Route 53 Profiles for consistent DNS configurations, and AWS Firewall Manager for centralized policy enforcement. AWS License Manager distributes subscriptions in bulk to an entire organization, specific organizational units (OUs), or individual accounts, with automatic licensing for newly added accounts.

How Palo Alto Networks Advanced DNS Security works with Amazon Route 53 DNS Firewall

By integrating Palo Alto Networks Advanced DNS Security with Route 53 DNS Firewall, organizations can enforce DNS threat protections across multiple traffic paths. As shown in the following demo, DNS Firewall rules with Palo Alto Networks security categories govern DNS query traffic from:

Amazon VPC traffic — Protecting workloads within your cloud environment
Hybrid-cloud traffic — Forwarded through Route 53 Resolver endpoints

The integration delivers more than 30 DNS threat detections from Palo Alto Networks—including fast flux protection, DNS hijacking protection, DNS rebinding protection, domain generation algorithm (DGA) detection, and newly registered domain identification—across the following use cases.

Cloud infrastructure DNS protection

Enforce Palo Alto Networks’ DNS threat protections directly on VPCs through DNS Firewall rules, with no need to deploy separate firewalls across multiple VPCs or AWS accounts. This removes the operational overhead of per-VPC firewall configurations while keeping coverage consistent. You can subscribe one time and share that subscription across multiple accounts or your entire organization using AWS License Manager.

Hybrid-cloud security operations

For on-premises or remote environments, DNS query traffic can be forwarded using Route 53 inbound endpoints, giving security operations center (SOC) teams unified DNS filtering and centralized logging across both AWS and hybrid traffic.

Centralized observability

Gain centralized observability across VPC and hybrid environments through log delivery via Amazon S3, Amazon Data Firehose, or Amazon CloudWatch Log Groups. Combined with AWS Security Hub, teams receive consolidated alerts and findings for faster detection and response.

Compliance and threat intelligence

Palo Alto Networks automatically updates its security categories and detection models, propagating changes to DNS Firewall with no customer intervention, keeping the latest threat intelligence applied to your DNS queries and streamlining compliance reporting.

Taken together, these use cases converge on a single enforcement point for DNS threat protection. The following demo illustrates how this comes together end to end, with visibility and control centralized through Amazon CloudWatch and AWS Security Hub.

Figure 1: How DNS query traffic from VPCs and hybrid environments is enforced through DNS Firewall rules with Palo Alto Networks threat intelligence

Monitoring and insights

After the solution is deployed, monitor your DNS security posture through:

AWS Security Hub — Security findings for blocked and alerted queries
Amazon Route 53 Resolver query logs — Viewable and storable using S3 buckets, Amazon Data Firehose, or CloudWatch log groups

Cleanup and cost considerations

This solution incurs costs for the AWS and Palo Alto Networks services involved, priced as part of the existing DNS Firewall Advanced tier. You pay an hourly rate for each rule group containing one or more Palo Alto Networks rules associated with a VPC. During preview, the Palo Alto Networks subscription in AWS Marketplace is free and not charged; only DNS Firewall Advanced charges apply.

To avoid unnecessary charges:

Disassociate rule groups from VPCs and delete DNS Firewall rules containing Palo Alto Networks security categories. Charges continue until all Palo Alto Networks rules are removed, so clean up before or after unsubscribing.
Remove any license distributions configured through AWS License Manager.

Conclusion

Integrating Palo Alto Networks Advanced DNS Security with Amazon Route 53 Resolver DNS Firewall delivers comprehensive DNS threat protection without operational complexity. You’ll get streamlined deployment from the DNS Firewall console, automated threat-intelligence updates, and centralized multi-account management along with the performance you expect from Amazon Route 53 Resolver DNS Firewall, augmented with the latest threat intelligence from Palo Alto Networks.

To get started with Palo Alto Networks Advanced DNS Security, subscribe on the DNS Firewall console or in AWS Marketplace. For a step-by-step guide, visit Subscribe to Palo Alto Networks Advanced DNS Security. Use Palo Alto Networks’ documentation and the Amazon Route 53 Developer Guide to accelerate your deployment.

Palo Alto Networks – AWS Partner Spotlight

Palo Alto Networks is an AWS Security Competency Partner that helps organizations strengthen their security posture across cloud and hybrid environments—protecting against advanced threats, securing network infrastructure, and maintaining compliance to stay ahead of evolving adversaries.

Contact Palo Alto Networks | Partner Overview | AWS Marketplace

How ASCENDING’s Jarvis Registry bridges agents and developer tools

Lu Zou — Thu, 06 Aug 2026 21:21:06 +0000

By: Ryo Hang, Technical Cofounder – ASCENDING
By: Celeste Shao, AI Specialist – ASCENDING
By: Jason Zhang, CTO – Vegogarden
By: Lu Zou, Sr. Partner Solution Architect – AWS

Ascending

Your agents are deployed on Amazon Bedrock AgentCore. Now, people across your teams are wondering if they can use it with their preferred developer tool, whether that’s Claude Desktop, Visual Studio Code (VS Code), Cursor, or GitHub Copilot. That’s where the complexity starts, and you hit the last mile: making your agents reachable from an integrated development environment (IDE) safely, with the right identity, authorization, and discovery controls. This is the experience layer: the authentication, authorization, discovery, and developer UX infrastructure that sits between your deployed agents and the tools people actually work in.

In this post, we walk through the experience layer challenge, show the architecture you’d need to build yourself, and introduce an open source solution that handles it for you.

The experience layer for usability

The gap between “deployed” and “usable” comes down to a recurring set of integration problems:

Identity – The agent and downstream tools need to trust who the caller is without prompting again, which means integrating with the organization’s identity provider (IdP).
Authorization – After identity is established, the platform has to decide which agents, tools, and data each user can reach, often with policies that vary by team or environment.
Token management – Every downstream tool brings its own OAuth lifecycle: token exchange, refresh, and re-auth when an agent calls Jira, GitHub, or internal APIs.
Interactive re-auth. Tools sometimes need to pause mid-call to ask for input or fresh credentials, then resume cleanly inside the copilot.
Discovery – The right agents and tools need to surface at the right moment, filtered by context, rather than overwhelming the client with the full catalog.

This gets especially complex when you multiply it by every IDE the business cares about and every agent your team ships. The experience layer quickly becomes a larger investment than the agents themselves.

The components of an experience layer

The following are the components of the experience layer:

A protocol gateway – Supports Model Context Protocol (MCP) MCP and Agent2Agent (A2A) to clients on one side and translates to Amazon Bedrock AgentCore Runtime, Amazon Bedrock AgentCore Gateway, and downstream tools on the other. You’ll handle multiple MCP transports, such as stdio, streamable HTTP, or server-sent events (SSE), and A2A variants such as JSON-RPC, gRPC, or HTTP+JSON). Streaming introduces the most complexity: interleaved progress events, sessions resumed mid-call, and a spec that keeps moving.
A registry with resource discovery – A catalog of which agents and tools exist, who owns them, and who can reach them. Beyond cataloging, it provides the ability to surface the right things to the right user at the right moment, filtered by identity, role, and conversation context. Without this, every client is configured by hand, and every governance question becomes a manual audit.
An identity service – Integrates with your IdP (such as Okta, Microsoft Entra, Amazon Cognito, or Auth0) and issues tokens that Amazon Bedrock AgentCore Runtime trusts as a custom JSON Web Token (JWT) authorizer: asymmetric keys, a /.well-known/jwks.json endpoint, and a key rotation story that doesn’t require redeploying agents.
The OAuth lifecycle, end to end – Every downstream tool has its own OAuth requirements: token exchange, refresh, scope changes, and secure storage. When a tool returns 401 mid-call, the gateway has to detect it, kick off the right flow through MCP elicitation (where the client supports it), and deep-link the user back to their actual VS Code window or Claude Desktop session, not a generic browser tab. Done right, re-auth feels instant. Done wrong, the user hunts for their IDE every time.
End-to-end observability – A single audit trail joining the gateway, the agent runtime, and downstream tools: “user X called tool Y through agent Z and got result W.”

The following diagram shows the components and interconnections for a self-built experience layer.

Figure 1: Experience layer components

All of these are solvable individually but maintaining them together is a sustained engineering investment that grows with every new agent and copilot you add.

What ASCENDING built after the fifth time

ASCENDING is an AWS Partner that has spent nearly a decade helping customers build on AWS. Over the last 2 years, that work has focused on AI and automation: assistants, Retrieval Augmented Generation (RAG) systems, and autonomous agents deployed on Amazon Bedrock AgentCore.

After their fifth AgentCore integration, the ASCENDING team recognized a pattern: every customer needed the same experience layer, and every customer was building it from scratch. The work was similar enough to be recognizable each time, but different enough that no previous solution was directly reusable.

For Amazon Bedrock AgentCore, ASCENDING built an open source experience layer, the Jarvis Registry, which includes a protocol gateway, registry, resource discovery, identity service, OAuth orchestrator, in-session auth UX, deep-link return paths, and end-to-end observability. It’s packaged as a self-contained platform that runs inside the customer’s AWS environment and integrates with AgentCore Runtime as a first-class identity and routing target. With Jarvis Registry, customers can focus on building agents without worrying about the integration infrastructure needed to make them accessible from every IDE.

The following graphic shows the Amazon Bedrock AgentCore and Jarvis interaction layer.

Figure 2: Jarvis Registry interaction layer

What it looks like for users

Here’s what that looks like in practice. Vegogarden is a customer running two very different workloads on Amazon Bedrock AgentCore. The first is a distributed fleet of customer-support agents that look up product information and place orders on behalf of customers. The second is a cluster of data-analytics MCP servers that expose detailed sales, inventory, and operations data to internal users. Both workloads needed an experience layer, and the agents and MCP servers needed to be reachable from the tools their users actually used.With Jarvis sitting between the copilots and AgentCore, the same agents and MCP servers now serve two distinct workflows.

Business users in Claude Desktop. A regional manager asks the analytics agent to render a bar chart of last quarter’s revenue, broken down by region. Support specialists ask the support agent to summarize closed tickets for a given week, suggest responses for the email they’re writing, or surface similar past cases from the company’s historical database. No dashboards, no copy-pasting, no engineering tickets to “give me access.”

Engineers in VS Code. When something doesn’t work correctly, the on-call engineer calls the same agent from VS Code. Jarvis’s audit trail shows exactly which tools and APIs were called, and where the chain broke. Triage that used to require pulling logs from three separate systems now happens in a single conversation.

Department-scoped access. Each team only sees what they should. Sales can’t reach engineering tools, support can’t query payroll data, engineers don’t accidentally pull personally identifiable information (PII). You define these access rules one time in the registry, and Jarvis Registry enforces them uniformly across every IDE the business uses.

The impact on day-to-day work is harder to quantify but immediately noticeable. Business users began answering their own questions through the tools they already use, reducing the volume of one-time requests routed to engineering. On-call engineers saw fewer off-hours pages for issues that turned out to be business-logic questions rather than system failures. The agents Vegogarden’s team built reached the people they were built for.

Try it

In this post, we showed how Amazon Bedrock AgentCore handles production agent deployment and how the Jarvis Registry adds the experience layer that makes those agents accessible from the IDEs and copilots your team uses. Together, they provide a complete platform for building, deploying, and consuming agents across your organization.

The Jarvis Registry is available as open source. A two-minute demo shows a developer calling a production AgentCore agent from inside their IDE, encountering an upstream auth challenge, and resolving it in place—the experience layer at work. To deploy the Jarvis Registry in your own AWS environment, integrate it with your IdP, and extend it for your team’s use cases, reach out to the ASCENDING team.

ASCENDING – AWS Partner spotlight

ASCENDING is an AWS Partner focused on AI-driven solutions and cloud transformation. As an AWS Agentic AI launch partner, ASCENDING helps customers accelerate AI adoption with solutions such as Jarvis, enabling organizations to build and integrate production-ready AI agents more efficiently on AWS. We’ve also released several AI solutions as open source to support the broader community and help organizations innovate faster.

Contact ASCENDING | Partner Overview | AWS Marketplace

Accelerating software development with OpenAI ChatGPT Codex on Amazon Bedrock

Sunil Bemarkar — Tue, 04 Aug 2026 19:28:35 +0000

By: Sunil Bemarkar, Sr. Partner Solutions Architect – AWS
By: Garrett McCarthy, Partner Leader – OpenAI
By: Erik Anderson, Principal Solutions Architect – AWS

OpenAI

The pace of software development continues to accelerate, with organizations under increasing pressure to ship features faster, reduce technical debt, and do more with constrained engineering resources. According to Gartner, more than 80% of enterprises will have used generative AI APIs or deployed generative AI–enabled applications in production environments by 2026, up from less than 5% in 2023, signaling a fundamental shift in how software is built. Meanwhile, research from GitHub shows that developers using AI coding assistants complete tasks up to 55% faster while reporting significantly reduced cognitive load on repetitive work.

Yet for enterprises managing large codebases across distributed teams, merely adopting AI tools isn’t enough. Gartner predicts that by 2028, 75% of enterprise software engineers will use AI code assistants, up from less than 10% in early 2023. With the question of whether to adopt AI-assisted development resolved, the challenge becomes how to do so with security, governance, and operational controls that enterprise environments demand.

In this post, we explore how OpenAI ChatGPT Codex on Amazon Bedrock, OpenAI’s powerful coding agent for end-to-end software development, enables enterprises to adopt advanced AI-assisted development while maintaining the governance, security, and operational excellence that AWS provides. ChatGPT Codex is now available on Amazon Bedrock with OpenAI’s frontier models.

Scaling developer productivity without sacrificing quality

Enterprise software teams face a common set of challenges:

Growing complexity – Modern applications span microservices, multi-cloud environments, and diverse technology stacks, making it harder for any single developer to comprehend the full system context.
Talent constraints – The demand for experienced software engineers continues to outpace supply, and onboarding new developers to large codebases takes months.
Quality and security requirements – Enterprises can’t trade speed for safety. Every line of code must meet compliance, security, and operational standards before reaching production.
Technical debt accumulation – Teams often deprioritize refactoring and modernization under delivery pressure, creating a compounding burden that slows future development.

These challenges call for a new approach that augments human developers with AI agents capable of reasoning through complex problems at scale.

Introducing OpenAI ChatGPT Codex on Amazon Bedrock

ChatGPT Codex goes beyond straightforward code completion to work across the entire software development lifecycle (SDLC). Powered by OpenAI’s latest frontier models with advanced reasoning capabilities, Codex can:

Understand full codebase context – Codex reasons across entire repositories, understanding dependencies, architectural patterns, and business logic to produce contextually appropriate solutions.
Execute multistep coding tasks – From implementing new features to refactoring legacy code, Codex breaks down complex tasks into logical steps and executes them end to end.
Generate tests and documentation – Codex can independently write unit tests, integration tests, and documentation aligned with your team’s conventions.
Operate as a collaborative agent – Rather than replacing developers, Codex acts as a force multiplier that handles routine and complex coding tasks so engineers can focus on architecture, design, and innovation.

By making ChatGPT Codex available on Amazon Bedrock, enterprises gain access to OpenAI’s frontier reasoning models through fully managed, serverless API, thus eliminating the need to manage infrastructure while benefiting from the enterprise-grade capabilities of AWS services.

The case for AI-assisted development: What the research shows

The impact of AI coding assistants on developer productivity is well-documented by independent research:

As mentioned in the first paragraph, a controlled study by GitHub research found that developers using AI coding assistants completed tasks 55% faster, averaging 1 hour 11 minutes compared to 2 hours 41 minutes without assistance.
In an enterprise study with Accenture, GitHub found that AI-assisted developers saw an 84% increase in successful builds and a 15% rise in pull request merge rates, demonstrating improved code quality at scale.
Productivity gains are becoming more measurable; Gartner insights reveal that 90% of software engineering leaders report visible improvements, logging a net average developer productivity gain of 19.3% from AI integration.

ChatGPT Codex builds on these foundations by going beyond code suggestions to deliver full agentic reasoning, understanding multifile context, executing complex multistep tasks, and collaborating with developers as an intelligent partner rather than an autocomplete tool.

Why Amazon Bedrock for OpenAI ChatGPT Codex?

Amazon Bedrock provides the foundation for enterprises to adopt generative AI responsibly, at scale. Running ChatGPT Codex on Amazon Bedrock delivers several critical advantages, including zero operator access, enterprise security and governance, operational visibility and monitoring, and unified billing.

The next-generation inference engine of Amazon Bedrock implements a zero operator access (ZOA) design that intentionally eliminates the technical means for AWS or OpenAI operators to access customer data, including inference prompts and completions.

AWS Identity and Access Management (IAM) integration provides fine-grained access control, limiting the ability to invoke Codex capabilities to only authorized users and systems. For customers who require private connectivity, AWS PrivateLink can be configured so traffic between your virtual private cloud (VPC) and Amazon Bedrock stays on the AWS network instead of traversing the public internet.

Amazon CloudWatch provides real-time metrics on usage, latency, and error rates, so your operations teams can maintain visibility into AI-assisted development workflows. AWS CloudTrail logs every API call for compliance auditing and security investigations.

You can enjoy consolidated billing through your existing AWS account alongside other AWS workloads. Pay-per-token pricing has no seat licenses or upfront commitments. Existing Amazon Bedrock customers can access OpenAI’s latest frontier models in one place.

Business outcomes: What enterprises can expect

Organizations adopting ChatGPT Codex on Amazon Bedrock can realize measurable impact across their software development lifecycle, as outlined in the following table.

Outcome	Impact
Developer productivity	Offload repetitive coding work to Codex, so developers can redirect their time to making architectural decisions, solving engineering challenges, and exercising judgment.
Time to market	Accelerate feature delivery cycles by augmenting teams with AI-powered development agents.
Code quality	Improve consistency and reduce defects through Codex, leading to more successful builds and fewer production issues.
Developer efficiency	Achieve more output per developer without proportional headcount growth.
Onboarding speed	New team members ramp faster with an AI agent that understands full code base context and provides answers for new teammates.

Who benefits from OpenAI ChatGPT Codex on Amazon Bedrock?

ChatGPT Codex on Amazon Bedrock serves a broad spectrum of enterprise personas:

Engineering leaders and CTOs seeking to scale development capacity without proportional headcount growth while maintaining security and compliance.
Individual developers looking for an intelligent coding partner that understands their code base, reduces context-switching, and handles tedious tasks.
Executive decision-makers evaluating generative AI investments who need a solution that integrates with existing AWS infrastructure, governance, and procurement workflows.
Other technical teams (product managers, data analysts, technical writers) who work alongside engineering and want an agent that can read the code base, query documentation, and automate repetitive tasks without writing code.

Getting started

ChatGPT Codex runs locally on your machine using the command line interface (CLI), desktop app, or integrated development environment (IDE) extension and routes model requests to Amazon Bedrock using AWS authentication.

To begin using ChatGPT Codex on Amazon Bedrock, complete the following steps:

To download and install, visit Codex. You can download the Codex CLI, Codex App, or the Codex VS Code extension and get started with Amazon Bedrock for model inference. Confirm you’re on Codex CLI 0.128.0 or later, the Codex desktop app, or Visual Studio Code extension 26.429.30905 or later. Earlier builds don’t support Amazon Bedrock as a model provider.
Configure authentication. Codex supports two Amazon Bedrock authentication paths, the Amazon Bedrock API key or AWS SDK credential chain, which gives teams the flexibility to choose the approach that best fits their existing security posture and infrastructure setup. When you set a value for AWS_BEARER_TOKEN_BEDROCK, Codex uses that first. If that doesn’t exist, it falls back to the AWS SDK credential chain. You can set the bearer token in the environment as:

export AWS_BEARER_TOKEN_BEDROCK=<your-bedrock-api-key>

Set Amazon Bedrock as your provider, your preferred Region, and the model ID in the Codex configuration in ~/.codex/config.toml, which is required for Bedrock-API-key authentication as shown in the following code. Confirm that you provide models that match the model Region compatibility. As of this writing, openai.gpt-5.6 (Sol, Terra, and Luna), openai.gpt-5.5, and openai.gpt-5.4 are supported.

model = "openai.gpt-5.5"
model_provider = "amazon-bedrock"
model_reasoning_effort = "medium"
[model_providers.amazon-bedrock.aws]
region = "us-east-2"

Restart the desktop app or VS Code extension after changing ~/.codex/config.toml. For Codex CLI, type codex in the terminal to get started with Codex on Amazon Bedrock.

All model inference is routed through the Responses API on Amazon Bedrock, with pay-per-token pricing that requires no seat licenses or per-developer commitments, and data residency stays within the Amazon Bedrock Region you select.

To learn more about how to configure ChatGPT Codex to use OpenAI models on Amazon Bedrock, visit Use Codex with Amazon Bedrock.

Conclusion

The convergence of frontier AI reasoning and enterprise cloud infrastructure changes how organizations build software and perform knowledge work. With Gartner forecasting that 75% of enterprise engineers will use AI code assistants by 2028, the early adopters who invest in secure, governed AI development will be better positioned as adoption scales.ChatGPT Codex on Amazon Bedrock combines OpenAI’s advanced coding intelligence with AWS security, governance, and operational maturity. Enterprises can confidently adopt AI-assisted development that accelerates delivery, reduces technical debt, empowers developers with an AI collaborator, and still meet enterprise requirements.

To get started, explore OpenAI models on Amazon Bedrock and follow the guide to use ChatGPT Codex with Amazon Bedrock.

OpenAI – AWS Partner Spotlight

OpenAI is an AWS Advanced Technology Partner offering frontier AI models and platforms that help organizations solve complex problems. ChatGPT Codex, their agentic coding platform, brings advanced reasoning capabilities to software development workflows.

Contact OpenAI | Partner Overview

Say Hello to 149 New AWS Competency and MSP Partners Added in July

Nick Paris — Mon, 03 Aug 2026 15:54:57 +0000

By Nick Paris, APN Marketing Manager – AWS Partner Network

The AWS Partner Network (APN) is a global community that leverages Amazon Web Services (AWS) technologies, programs, expertise, and tools to build solutions and provide services for customers.

NEW! AWS Competency Partners

To succeed with cloud adoption in today’s complex IT environment and continue to advance in the future, customers can team up with an AWS Competency Partner.

Team up with our newest AWS Competency Partners:

AWS Advertising and Marketing Technology Competency

Branch Metrics | NAMER | Ad Intelligence & Measurement
Omnichat | China | Ad Intelligence & Measurement; Ad Platforms; Audience & Customer Data Management; Digital Customer Experience

AWS AI Competency

AceCloud | APAC | Agentic AI Consulting Services
act digital | LATAM | Generative AI Consulting Services
allOps Solutions | EMEA | Generative AI Consulting Services
allOps Solutions | EMEA | Agentic AI Consulting Services
Altimetrik Corp | NAMER | Generative AI Consulting Services
ARKHO | LATAM | Agentic AI Consulting Services
beSharp | EMEA | Agentic AI Consulting Services
biia Group | LATAM | Agentic AI Consulting Services; Generative AI Consulting Services
Calyza Tech | APAC | Generative AI Consulting Services
CGI Inc | NAMER | Generative AI Consulting Services
Ci&T Software | LATAM | Agentic AI Consulting Services
CloudHesive | NAMER | Agentic AI Consulting Services
Coforge | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
CONSULTEDGE GLOBAL SERVICES (OPC) | APAC | Generative AI Consulting Services
CONSULTEDGE GLOBAL SERVICES (OPC) | APAC | Agentic AI Consulting Services
Coresys Solutions Limited | EMEA | Generative AI Consulting Services
DD Consulting | APAC | Generative AI Consulting Services
Demo Account | NAMER | Generative AI Consulting Services
Descasio | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
devx labs | APAC | Generative AI Consulting Services
DIU | EMEA | Generative AI Consulting Services
EMB Global | APAC | Generative AI Consulting Services
Emumba | NAMER | Agentic AI Consulting Services
Escala24X7 | NAMER | Agentic AI Consulting Services
Euristiq | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Flatiron Software Corporation | NAMER | Generative AI Consulting Services
Future Processing | EMEA | Generative AI Consulting Services
Hong Kong Qineasy Technology Limited | China | Generative AI Consulting Services
Idexcel | NAMER | Agentic AI Consulting Services
Intelligence Cloud Sphere- (Intel CS) | EMEA | Agentic AI Consulting Services
Jacobian Engineering Inc. | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Karsun Solutions LLC. | NAMER | Generative AI Consulting Services
KIIRO | EMEA | Agentic AI Consulting Services
kloudr | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
LCM Go Cloud | EMEA | Generative AI Consulting Services
LCM Go Cloud | EMEA | Agentic AI Consulting Services
Leapfrog Technology | NAMER | Agentic AI Consulting Services
LeverX | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Metaage Corporation | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Mindware | EMEA | Agentic AI Consulting Services
Mist Avinya Technologies | APAC | Agentic AI Consulting Services
Mitra Innovation | EMEA | Generative AI Consulting Services
Motherson Technology Services | APAC | Generative AI Consulting Services
One Cloud Utopia | NAMER | Agentic AI Consulting Services
Red Oak Strategic | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Registfy | EMEA | Agentic AI Consulting Services
Samsung SDS | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
SK | APAC | Agentic AI Consulting Services
SkyGRID Global Technologies | EMEA | Agentic AI Consulting Services
Stormit | EMEA | Generative AI Consulting Services
TATA ELXSI | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Trustsoft | EMEA | Generative AI Consulting Services
Tuxpas | LATAM | Agentic AI Consulting Services
Uberfusion (part of fourtitude.asia) | APAC | Generative AI Consulting Services
V2 AI | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Vontech IT | NAMER | Generative AI Consulting Services
太美医疗科技 | China | Generative AI Applications
Abnormal AI | NAMER | Generative AI Applications
CloudHound | APAC | Agentic AI Tools
CloudHound | APAC | Agentic AI Applications
Datadog | NAMER | Generative AI Applications
HERE Technologies | NAMER | Agentic AI Applications; Agentic AI Tools; Generative AI Applications
impress.ai | APAC | Agentic AI Applications; Generative AI Applications
Pega | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
Process Street | NAMER | Agentic AI Applications
Qodo, AI Code Review & Governance Platform | NAMER | Agentic AI Applications
Shanghai Yabaiwo Software Technology | China | Generative AI Applications
ThoughtBox AI | NAMER | Generative AI Applications
Thundersoft | China | Generative AI Applications
Tianjin Hualai Technology | China | Agentic AI Tools
Zuora | NAMER | Agentic AI Applications; Agentic AI Tools; Generative AI Applications

AWS Cloud Operations Competency

A3Data | LATAM | Monitoring & Observability
allOps Solutions | EMEA | Operations Management
Cloud Capital | NAMER | Cloud Financial Management
ELEKS | EMEA | Operations Management
F6S Advisors | EMEA | Compliance & Auditing
Fuama Technologies | EMEA | Cloud Financial Management; Cloud Governance
GWCLOUD TECNOLOGIA E SERVICOS | LATAM | Operations Management
Horus Technologies | NAMER | Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
TranSnet Cloud | EMEA | Cloud Financial Management; Cloud Governance; Monitoring & Observability; Operations Management

Consumer Goods Competency

Clearscale | NAMER | IT & Digital Transformation; Manufacturing
Spectro Cloud | NAMER | IT & Digital Transformation; Manufacturing

AWS Data & Analytics Competency

Cloudwalker | EMEA | Consulting Services
Comprinno Technologies | APAC | Consulting Services
Mphasis | NAMER | Consulting Services
RYSUN LABS | NAMER | Consulting Services

AWS DevOps Competency

BASIS | NAMER | Consulting Services
DFX5 | NAMER | Consulting Services
FPT Software | APAC | Consulting Services
OneData Software Solutions | NAMER | Consulting Services
Operisoft Technologies | APAC | Consulting Services
Saudi Telecom Company | EMEA | Consulting Services
Synechron | NAMER | Consulting Services
Bitrise | NAMER | Continuous Integration & Continuous Delivery

AWS Digital Sovereignty Competency

Ankercloud | EMEA | Consulting Services
LOGIC media solutions | EMEA | Consulting Services
Redington Gulf | EMEA | Consulting Services

AWS Digital Workplace Competency

Workspot | NAMER | Application Management

AWS Financial Competency

Apexon | NAMER | Banking; Capital Markets; General Financial Services
Datamellon | EMEA | Banking; Payments
Bridgewise | EMEA | Banking; Capital Markets
Vonage | NAMER | Banking; General Financial Services; Insurance; Payments

AWS Government Competency

Innovation Process Technology (ipt) | EMEA | Citizen Services

AWS Healthcare Competency

dataRain Consulting | LATAM | Consulting Services
goML (Neuralgo) | NAMER | Consulting Services

AWS Manufacturing and Industrial Competency

Celonis SE | EMEA | Engineering and Design; Enterprise Solutions; Operational Technology; Operational Technology Security; Smart Manufacturing; Smart Products and Services; Supply Chain Management; Sustainability
Karini AI | NAMER | Enterprise Solutions; Operational Technology; Operational Technology Security; Smart Manufacturing; Smart Products and Services; Supply Chain Management

AWS Migration and Modernization Competency

BIP – Business Integration Partners | EMEA | Migration Services
CloudEQ | NAMER | Migration Services; Modernization Services
CloudJournee | APAC | Migration Services; Modernization Services
Logicalis Spain | EMEA | Migration Services
NOVOSOFT | APAC | Migration Services
SEC AND DEVOPS AI | APAC | Migration Services; Modernization Services

AWS Resilience Competency

CloudZenia | APAC | Resilience Design
Rapyder Cloud Solution | APAC | Resilience Recovery
Visionet Systems | NAMER | Resilience Design

AWS Retail Competency

Clearscale | NAMER | Consulting Services
MadeinWeb | LATAM | Consulting Services
ByteDance | China | IT and Core Applications
Grafana Labs | NAMER | Digital Commerce
Retool | NAMER | Advanced Data Insights; Customer Engagement; Digital Commerce; Intelligent Supply Chain; IT and Core Applications; Merchandising and Planning

AWS Security Competency

Atomic Computing | EMEA | AI Security; Application Security; Compliance and Privacy; Data Protection; Identity and Access Management; Infrastructure Protection; Perimeter Protection; Threat Detection and Response
DataArt | NAMER | Application Security
Quantiphi | NAMER | Identity and Access Management
SEC AND DEVOPS AI | APAC | Identity and Access Management
TranSnet Cloud | EMEA | Data Protection; Identity and Access Management; Infrastructure Protection

AWS Small and Medium Business (SMB) Competency

Cheppers Zrt. | EMEA | Small and Medium Business
Cloudtech | NAMER | Small and Medium Business
cloudvests | EMEA | Small and Medium Business
ELCORE UA | EMEA | Small and Medium Business
Pump | NAMER | Small and Medium Business
RealCloud | LATAM | Small and Medium Business
SVA (System Vertrieb Alexander) | EMEA | Small and Medium Business

AWS Storage Competency

EMB Global | APAC | Consulting Services

AWS Travel and Hospitality Competency

Matterport | NAMER | Smart Assets

NEW! AWS Managed Service Providers (MSPs)

Say hello to our newest AWS MSP Partners:

AWS Managed Service Provider Program

Cloud2 Oy | EMEA
DNX Solutions | APAC
ETEVERS | APAC
IVCISA | LATAM
MadeinWeb | LATAM
MetanetX | APAC
Orient Technologies | APAC
Pentagon System and Services | APAC
Skaylink | EMEA
SnapSoft | EMEA
Sufle | EMEA
YASH Technologies | NAMER

More Value, Greater Profitability for AWS Partners

Learn how AWS is transforming the partner experience >>

Orca just-in-time access & AWS IAM Identity Center solve permission sprawl

Merin Eralil — Tue, 28 Jul 2026 20:43:46 +0000

By: Merin Eralil, Security Partner Solutions Architect – AWS
By: Ashleigh Lee, Senior Product Marketing Manager – Orca Security

Orca Security

How can you maintain developer velocity across hundreds of accounts while enforcing least-privilege access? A contractor gets access for a 3-week engagement. A developer gets elevated privileges to debug a production issue. The continuous integration and continuous delivery (CI/CD) pipeline retains permissions from a sprint that ended months ago. How often is this type of access reviewed?

This is how permission sprawl grows. Just-in-time (JIT) access is emerging as the operational answer to permission sprawl, which is the accumulation of permanently assigned permissions spread across hundreds of identities. Orca Security’s integration with Amazon Web Services (AWS) IAM Identity Center gives organizations an operational path to address this.

The problem is accelerating: A 2026 SANS survey of over 500 security professionals found that 74% of organizations are already deploying AI agents or automations that require credentials or access permissions. According to the survey, this trend is doubling or tripling non-human identity (NHI) populations inside many enterprises.

When permissions are scoped and time-bound, the impact of a credential exposure drops significantly. Organizations that remove persistent, broad access reduce their risk, including in the event that credentials are obtained by an unauthorized party. The principle of least privilege has long been the right architectural answer. What’s been missing is the infrastructure that makes it operational at scale.

To help customers implement JIT access efficiently, Orca Security provides an integration with AWS IAM Identity Center. This post explores how the integration works and what it means for security and engineering teams operating at scale in the AWS Cloud.

Permission sprawl creates security gaps

Major compliance frameworks including System and Organization Controls 2 (SOC 2), Payment Card Industry Data Security Standard (PCI-DSS), ISO/IEC 27001, Federal Risk and Authorization Management Program (FedRAMP), and the Health Insurance Portability and Accountability Act (HIPAA) require the principle of least privilege.

There’s a critical difference between documenting a policy and enforcing it. Persistent access models shift the burden to humans: Someone has to remember to remove access after a project ends or a contractor offboards. The consequences are measurable:

Over-provisioned identities become dormant access risks. Credential abuse accounts for 22% of the incidents in the Verizon 2025 Data Breach Investigations Report, showing that threat actors are logging in, not breaking in.
Incident responders have more scope to contain when accounts with inadvertent access hold persistent, broad permissions.
Auditors ask for evidence that least privilege is enforced in practice. Persistent access models produce no automatic audit trail to demonstrate this.

Modern engineering compounds this further. Infrastructure-as-code has made spinning up resources trivial, but access governance hasn’t kept pace. Developers move fast, access gets provisioned for a sprint, and those permissions remain long after the work is done. This is the predictable outcome when access management depends on manual cleanup rather than built-in expiration.

The solution: JIT access

JIT makes least privilege operational by providing temporary, scoped access by default. No one has permanently assigned permissions. Instead, a user requests specific permissions for a defined time window, provides justification, receives approval, and access is automatically revoked when the window expires. Nothing to clean up. Nothing to forget.

The following screenshot shows the JIT access request interface in the Orca platform, where teams submit, track, and manage time-bound permission requests:

Figure 1: JIT access in the Orca platform

For cloud environments built on AWS, this approach must work at the identity infrastructure layer. A bolt-on solution that approximates access control from outside the AWS environment can’t deliver the same enforcement.

AWS IAM Identity Center provides the programmatic APIs for creating and revoking account assignments, forming the foundation of JIT access patterns. Customers use these APIs, orchestrated through Orca Security, to implement temporary permission workflows. That’s the design principle behind Orca’s JIT access integration with AWS IAM Identity Center.

How it works: Orca’s AWS IAM Identity Center integration

Organizations implementing JIT access through Orca benefit from its direct integration with AWS IAM Identity Center. When Orca orchestrates a JIT request, it acts within the customer’s AWS environment.

It creates and revokes access assignments in AWS IAM Identity Center on the customer’s behalf. When a user requests access, the integration creates a time-bound assignment in AWS IAM Identity Center, then automatically revokes it when the window expires.

The following image shows how JIT access requests flow between the Orca solution and AWS IAM Identity Center:

Figure 2: Architecture diagram showing how JIT AWS permissions are requested by Orca Security

The workflow is intentionally low friction for the requester. A team member submits an access request through the Orca solution or Slack specifying the required permission set, target AWS account, and duration for which access is needed. An administrator reviews and approves or denies the request. Upon approval, the requester receives a notification from Orca and an email with approver information and access details.

Orca then manages the full permission lifecycle, creating the temporary access assignment in AWS IAM Identity Center and automatically revoking it when the time window expires. Administrators can also revoke access manually before expiration. Every action is recorded in Orca’s audit logs.

To prevent conflicts of interest, Orca prevents self-approval: No one can approve their own request. This addresses one of the most common gaps in peer-reviewed access models.

Use cases include incident responders accessing a production account, developers debugging across accounts, and contractors needing scoped access for a sprint. In all cases, access is temporary by design.

The AWS IAM Identity Center integration: Scoped by design

One of the key architectural decisions in this integration is how Orca holds its own access to the AWS environment. The integration follows least-privilege principles by scoping Orca’s AWS permissions to only those required for JIT orchestration.

To orchestrate JIT requests, customers grant Orca a specific, defined set of AWS permissions. These aren’t broad administrative rights. They’re scoped to exactly what JIT requires, including:

Creating and deleting account assignments
Checking the status of assignment operations
Listing permission sets provisioned to accounts
Listing AWS IAM Identity Center instances and permission sets
Listing users in the Identity Store
Describing permission sets

This scoped permission model reflects the same least-privilege philosophy JIT is built on. Orca doesn’t get more access to your AWS environment than it needs to do the job. This matters both as a security property and as an architecture that customers can explain to their auditors.

To set up the integration, connect your AWS organization management account to Orca, or a delegated administrator account if that’s how your AWS IAM Identity Center is configured. After prerequisites are met, the enable JIT wizard in the Orca interface walks administrators through setup. Orca then handles the operational layer, processing requests, managing approvals, creating time-bound assignments in AWS IAM Identity Center, and revoking them automatically when the window closes.

Complementing AWS security services

This JIT pattern complements AWS security services. AWS IAM Access Analyzer identifies unused permissions, and AWS CloudTrail logs all API activity. JIT access solutions complement these services by removing permanently assigned permissions. Organizations can correlate Orca’s audit logs with AWS CloudTrail events for end-to-end visibility into who accessed what, when, and why.

For teams using AWS Security Hub, JIT access means fewer findings related to over-provisioned or unused permissions because those permissions no longer exist to be flagged.

Automated compliance evidence

Compliance frameworks require least-privilege enforcement. Auditors are moving beyond policy documentation and asking for evidence. JIT access automatically generates audit trails showing the full lifecycle of each access event. This evidence supports SOC 2, ISO 27001, FedRAMP, and HIPAA certifications.

Each step in the access lifecycle is logged in Orca’s Audit Logs. For organizations pursuing or maintaining compliance certifications, that audit trail has a real value beyond the security posture improvement itself. It converts a manual attestation exercise into a queryable record.

What this means for security leaders and engineering teams

This integration delivers different value depending on your role. For CISOs and security directors, JIT access closes the gap between stated policy and actual enforcement. It makes least privilege operationally sustainable across large AWS environments without requiring a dedicated team to manually audit permissions.

For platform and DevSecOps teams, security stops being a separate step. The workflow handles scoping, approval, and revocation without changing how engineers request access. The security overhead gets absorbed by the system.

That’s the case worth making to any executive team: JIT doesn’t slow access down. It makes access defensible.

Get started

Orca Security is available through the AWS Marketplace. To explore how Orca’s JIT access integration can help your organization enforce least privilege at scale across your AWS environment, visit the AWS Marketplace listing or contact Orca Security for a demo.

Orca Security – AWS Partner spotlight

Orca Security is an AWS Specialization Partner Partner that delivers a unified cloud security experience that helps organizations identify, prioritize, and remediate risk across their cloud environments, code, and AI.
Contact Orca Security | Partner Overview | AWS Marketplace

Announcing 2026 AWS Partner Award Nominations

Andrew Somera — Fri, 10 Jul 2026 13:26:03 +0000

By Andrew Somera, Head of Partner Experiences – AWS

The 2026 AWS Partner Awards honor partners who have demonstrated outstanding results and innovation with the use of Amazon Web Services (AWS) products and solutions. These awards are an acknowledgment of exceptional partner success and innovations.

AWS Partner Awards recognizes a wide range of born-in-the-cloud and traditional services, software, and hardware partners whose business models have embraced specialization and collaboration.

Nomination-Based Award Categories

For the fifth year in a row, AWS Partners can self-nominate themselves to be considered across a select number of AWS Partner Award categories, related to partner focus areas, technologies, and the significant impact partners are making in delighting our customers.

Award submissions will be reviewed by a third-party, Canalys, and selected with special emphasis placed on customer success use cases presented in the nomination form. All winners will be informed by October 31, 2026, and will be recognized and celebrated at this year’s AWS re:Invent.

All nominations must be submitted by 11:59 PM PDT on August 14, 2026.

Nomination Categories and Forms

AWS Partners can apply to more than one award, but they may not submit multiple nominations per any given category. A list of the five categories accepting nominations with specific eligibility requirements and details is featured below. A separate application is required for each category.

We’ve also created PowerPoint versions of the nomination form to help prepare your submission. AWS Partners are encouraged to review and prepare this form alongside their Partner Development Manager (PDM) and/or Partner Marketing Manager (PMM).

Note that access to the PowerPoint version of the nomination forms requires an AWS Partner Central login.

Category Descriptions and Judging Criteria

Innovation Partner of the Year

Requirement to applying: Open to partners enrolled in the Services Partner Path.

Recognizes organizations that deliver innovative consulting, professional, managed, and value-added resale services. Recipients will have demonstrated proof in delivering outstanding customer experience via an integrated lifecycle of services, from initial assessments, architecting, developing, and deployment of cloud environments to ongoing migration and management of cloud infrastructure and applications.

Design Partner of the Year

Requirement to applying: Open to partners enrolled in the Hardware or Software Partner Path.

Recognizes organizations that develop software or hardware devices that runs on or is integrated with AWS. Recipients will have achieved a design win in either a software and/or hardware product built on or with AWS. Selected based on impact software/hardware has had on the regional market (e.g., applicability, size of audience, public status).

Social Impact Partner of the Year

Requirement to applying: Partner-nominated category covering all partner types.

Recognizes AWS Partners committed to giving back to society through their people, resources, and technology, and that are leading initiatives to change our world for the better.

Sustainability Partner of the Year

Requirement to applying: Partner nominated category covering all partner types.

Recognizes AWS Partners committed to achieving sustainability goals. Solutions may cover, but are not limited to, capabilities in Agentic AI, machine learning (ML), Internet of Things (IoT), data analytics, and computing to reach your organization’s or customer’s sustainability goals.

Collaboration Partner of the Year

Requirement to applying: Partner nominated category covering all partner types. Nomination will be submitted and distributed to the partner leading the collaborative efforts.

Recognizes situations where a partner has collaborated with one (1) or more AWS Partners in helping address customer problems. Awarded to a partner organization that collaborates with other AWS Partners to work on solving the same customer challenge with their skills and ability to deliver valuable customer solutions based on services and technology offered across multiple AWS Partners.

Don’t Miss Out!

We encourage all partners to participate in submitting a nomination to be considered for an AWS Partner Award.

View our 2025 AWS Partner Award winners, and watch the video below to see highlights from last year’s Awards Gala and Appreciation Event at re:Invent.

Video: 2025 AWS Partners of the Year Gala and Appreciation Event

Say Hello to 184 New AWS Competency, Service Delivery, and MSP Partners Added in June

Nick Paris — Mon, 06 Jul 2026 17:09:06 +0000

By Nick Paris, APN Marketing Manager – AWS Partner Network

The AWS Partner Network (APN) is a global community that leverages Amazon Web Services (AWS) technologies, programs, expertise, and tools to build solutions and provide services for customers.

NEW! AWS Competency Partners

To succeed with cloud adoption in today’s complex IT environment and continue to advance in the future, customers can team up with an AWS Competency Partner.

Team up with our newest AWS Competency Partners:

AWS Advertising and Marketing Technology Competency

ZiMetrics | APAC | Ad Intelligence & Measurement

AWS AI Competency

北京聚云立方科技有限公司 (Marshotspot) | China | Agentic AI Consulting Services
Aeonx Digital | EMEA | Agentic AI Consulting Services
Aivar Innovations | APAC | Agentic AI Consulting Services
Beijing Ultrapower Software | China | Agentic AI Consulting Services
Cambrian Technologies | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Cecure Intelligence | EMEA | Generative AI Consulting Services
Cloud TechOn | APAC | Generative AI Consulting Services
cloudvests | NAMER | Generative AI Consulting Services
cloudvests | NAMER | Agentic AI Consulting Services
Cumulus HQ | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
DataEconomy Inc. | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
dataRain Consulting | LATAM | Agentic AI Consulting Services
Dedalus | LATAM | Agentic AI Consulting Services
develeap | EMEA | Agentic AI Consulting Services
DFX5 | NAMER | Agentic AI Consulting Services
Directeam | EMEA | Agentic AI Consulting Services
DIRMOD | NAMER | Agentic AI Consulting Services
Doosan Corporation Digital Innovation | APAC | Generative AI Consulting Services
Fuama Technologies | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
G-Asiapacific | APAC | Generative AI Consulting Services
GFT Technologies SE | NAMER | Agentic AI Consulting Services
Going Cloud | APAC | Agentic AI Consulting Services
Hanjin Information Systems & Telecommunication | APAC | Generative AI Consulting Services
Inferdat | | Agentic AI Consulting Services; Generative AI Consulting Services
INIT | APAC | Agentic AI Consulting Services
Intelligence Cloud Sphere (Intel-CS) | EMEA | Generative AI Consulting Services
Intuitive.ai | NAMER | Generative AI Consulting Services
JetSweep | NAMER | Generative AI Consulting Services
KnackForge | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Logicalis Latin America | NAMER | Generative AI Consulting Services
Mindware | EMEA | Generative AI Consulting Services
NIX | NAMER | Generative AI Consulting Services
Nous Infosystems | NAMER | Agentic AI Consulting Services
Nova | NAMER | Agentic AI Consulting Services
Nuage It´s Everywhere | LATAM | Generative AI Consulting Services
Nuage It´s Everywhere | LATAM | Agentic AI Consulting Services
OMNYS | EMEA | Agentic AI Consulting Services
Openstack Business Consulting | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Rackspace Technology | NAMER | Agentic AI Consulting Services
Registfy | EMEA | Generative AI Consulting Services
SEC AND DEVOPS AI | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
SK Inc. | APAC | Generative AI Consulting Services
SoftwareOne | EMEA | Agentic AI Consulting Services
Tennex | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Version 1 | EMEA | Generative AI Consulting Services
Vertical Relevance | NAMER | Generative AI Consulting Services
VeUP Limited | NAMER | Agentic AI Consulting Services
脉络洞察 | China | Generative AI Applications
侠客行传媒（智耘贰零） | China | Generative AI Applications
福州领克狐科技有限公司 | China | Agentic AI Applications
杭州分叉智能科技有限公司 | China | Generative AI Applications
成都潜在人工智能科技有限公司 | China | Generative AI Applications
4MindsAI | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
BMC SOFTWARE | NAMER | Agentic AI Applications
CloudHound | APAC | Generative AI Applications
DevRev | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
Kaltura | NAMER | Generative AI Applications
LaunchDarkly | NAMER | Agentic AI Tools
Mechanized AI | NAMER | Generative AI Applications
Mechanized AI | NAMER | Agentic AI Applications
Postman | NAMER | Agentic AI Tools
Rescale | NAMER | Agentic AI Applications
Safe Securities Inc. | NAMER | Agentic AI Applications; Generative AI Applications
Sembix | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications
SensorsData | China | Generative AI Applications
SHAREit-PayerMax | China | Generative AI Applications
SmartBear Software | NAMER | Agentic AI Applications
Solodev | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
SUPER 8 Studio | Japan | Agentic AI Applications
TextQL | NAMER | Agentic AI Applications
Thinking Data Information Technology (Shanghai) | NAMER | Generative AI Applications
Wiv | NAMER | Agentic AI Applications
Zixun Info Tech | China | Agentic AI Applications

Amazon Connect Customer Services Competency

Accenture | NAMER | Contact Center Transformation
Caylent | NAMER | Contact Center Transformation
Deloitte | EMEA | Contact Center Transformation
Genpact | NAMER | Contact Center Transformation
Infosys | APAC | Contact Center Transformation
NeuraFlash | NAMER | Contact Center Transformation
NTT DATA | EMEA | Contact Center Transformation
PricewaterhouseCoopers | NAMER | Contact Center Transformation
Salesforce | NAMER | Contact Center Transformation
TTEC Digital | NAMER | Contact Center Transformation
USAN | NAMER | Contact Center Transformation
Zendesk | NAMER | Contact Center Transformation

AWS Automotive Competency

o9 Solutions | NAMER | Supply Chain

AWS Business Value Realization Competency

Boston Consulting Group | NAMER | Business Value Realization
Compass UOL | NAMER | Business Value Realization
Deloitte | EMEA | Business Value Realization
DoiT | NAMER | Business Value Realization
Persistent Systems | NAMER | Business Value Realization
Quantiphi | NAMER | Business Value Realization
Reply | EMEA | Business Value Realization
SoftwareOne | EMEA | Business Value Realization
tecRacer | EMEA | Business Value Realization

AWS Cloud Operations Competency

Arvato Systems | EMEA | Operations Management
Digitspot Solutions | EMEA | Cloud Governance
Digitspot Solutions | EMEA | Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
Meyi Cloud | APAC | Operations Management
QyrosCloud | NAMER | Compliance & Auditing
ScaleCapacity | NAMER | Operations Management
SkyGRID Global Technologies | EMEA | Cloud Governance
World Wide Technology | NAMER | Cloud Financial Management; Cloud Governance; Monitoring & Observability
ClickHouse | NAMER | Monitoring & Observability
Cloudchipr | NAMER | Cloud Financial Management

Consumer Goods Competency

Orange Logic | NAMER | Marketing

AWS Data & Analytics Competency

Codex | APAC | Consulting Services
MadeinWeb | LATAM | Consulting Services
NuVista AI | NAMER | Consulting Services
OpsGuru, a Carbon60 Company | NAMER | Consulting Services
Aklivity | NAMER | Data Integration and Preparation
Hydrolix | NAMER | Data Analytics Platforms

AWS DevOps Competency

Cybage | APAC | Consulting Services
Digitspot Solutions | EMEA | Consulting Services
SoftGEM Global Technologies | EMEA | Consulting Services

AWS Digital Sovereignty Competency

Atomic Computing | EMEA | Consulting Services
N-iX | EMEA | Consulting Services
SoftServe | NAMER | Consulting Services

AWS Education Competency

Blend | NAMER | Consulting Services
CloudZone | EMEA | Consulting Services

AWS Financial Competency

Anthropic | NAMER | Banking; Capital Markets; General Financial Services; Insurance
Camunda Services | EMEA | Banking; Capital Markets; General Financial Services; Insurance; Payments
Feedzai | NAMER | Banking; General Financial Services; Payments

AWS Healthcare Competency

Process Street | NAMER | Compliance Services
Proximie | EMEA | Clinical Information Systems

AWS High Performance Computing Competency

Invisibl Cloud Solutions | NAMER | HPC Management

AWS Life Sciences Competency

UsefulBI Corporation | NAMER | Consulting Services

AWS Mainframe Modernization Competency

Fujitsu | Japan | Mainframe Workload

AWS Media & Entertainment Competency

Cloudfirst.io | NAMER | Archive; Media Supply Chain and Archive
Cloudmates | EMEA | Broadcast
Flatiron Software Corporation | NAMER | Publishing
Tape Ark | APAC | Archive
Wizeline | LATAM | Data Science and Analytics

AWS Migration and Modernization Competency

Mechanized AI | NAMER | Business Case Analysis; Discovery, Planning, and Recommendation; Infrastructure Automation
Skylift Solutions | EMEA | Data Mobility
奇墨科技（广州）有限公司 – Qimo Technology (Guangzhou) | China | Migration Services
adesso | EMEA | Migration Services; Modernization Services
Aivar Innovations | APAC | Migration Services; Modernization Services
apser | EMEA | Migration Services; Modernization Services
msg group | EMEA | Migration Services
Orion Innovation | NAMER | Migration Services
SEIDOR | LATAM | Migration Services
slashTEC | EMEA | Migration Services; Modernization Services
Tactical Edge | NAMER | Migration Services

AWS MSSP Services Competency

zeb | NAMER | Application Security; Cyber Recovery; Data Protection; Identity and Access Management; Incident Response; Infrastructure Security; Workload Security

AWS Resilience Competency

Applogika | NAMER | Resilience Design
SnapSoft | EMEA | Resilience Design
N2W Software | NAMER | Resilience Recovery

AWS Retail Competency

XalDigital | NAMER | Consulting Services

AWS SAP Competency

SHINRAI TECHNOLOGIES | EMEA | Consulting Services

AWS Security Competency

F6S Advisors | EMEA | Identity and Access Management
Netrix Global | NAMER | Identity and Access Management
Docker | NAMER | Application Security
DTEX.AI | NAMER | Data Protection
Elastic | NAMER | AI Security
Varonis | NAMER | Compliance and Privacy; Data Protection
XBOW | Autonomous Pentesting Platform | NAMER | Application Security

AWS Small and Medium Business (SMB) Competency

Fuama Technologies | EMEA | Small and Medium Business
gabia | APAC | Small and Medium Business
Lightedge | NAMER | Small and Medium Business
Teleglobal International | APAC | Small and Medium Business
Trek2Summit | EMEA | Small and Medium Business
V2G Systems | EMEA | Small and Medium Business
Verycloud | China | Small and Medium Business
WH1 Cloud | LATAM | Small and Medium Business
Arctic Wolf | NAMER | Small and Medium Business
ClickHouse | NAMER | Small and Medium Business
Cyber Security Cloud | Japan | Small and Medium Business
Grafana Labs | NAMER | Small and Medium Business

AWS Storage Competency

Maximyz Cloud | APAC | Consulting Services
Applied Cloud Computing | APAC | Archive; Backup and Restore; Business Continuity/Disaster Recovery; Primary Storage

AWS Telecom Competency

Infosys | APAC | Business Support Systems (BSS); Operation Support Systems (OSS)

NEW! AWS Managed Service Providers (MSPs)

NEW! AWS Service Delivery Partners

The AWS Service Delivery Program validates AWS Partners that have deep technical knowledge, experience, and proven success in delivering specific AWS services to customers.

To achieve this specialization, AWS Partners must undergo service-specific technical validation by AWS Partner Solutions Architects, including review of architecture, customer documentation, and customer case study details to ensure they follow AWS best practices for each AWS service.

Work with our newest AWS Service Delivery Partners:

AWS Database Migration Service (DMS) Delivery Partners

Info Services | NAMER

AWS Lambda Delivery Partners

Sumitomo Electric System Solutions | Japan

More Value, Greater Profitability for AWS Partners

How InterWiz reduced AI costs by 90% with Amazon Bedrock

Ore Okebukola — Thu, 02 Jul 2026 22:45:43 +0000

By: Syed Sabih ur Rehman, Pre-Sales Solutions Architect – Emumba
By: Ore Okebukola, Partner Solutions Architect – AWS

Emumba

If you’re building an AI-powered software as a service (SaaS) product, you’ve likely watched your AI infrastructure costs grow faster than your revenue. What starts at $500 per month during prototyping can reach $50,000 per month in production. In this post, you’ll learn how Emumba, an AWS Advanced Tier Services Partner, helped InterWiz cut AI costs by 90%, improve response times by 55%, and maintain 99.9% uptime with no service disruption by migrating their AI workloads to Amazon Bedrock.

When you’re locked into a single AI provider, rising costs limit growth and compress margins. You lose the ability to evaluate better-performing models. You can’t tune costs independently per workload. When competitors adopt newer models, you’re left waiting on your provider’s release schedule. The result is a difficult tradeoff: raise prices and risk losing customers or absorb costs and sacrifice profitability. Migrating to Amazon Bedrock resolved that tradeoff for InterWiz. InterWiz is an AI-powered recruitment company conducting more than 1,000 interviews monthly. Rising AI costs were blocking their path to profitable growth, and they had a tight window to address it.

The InterWiz story: From cost crisis to competitive advantage

InterWiz automates candidate screening through structured, AI-driven interviews at scale, so recruiters can focus on higher-value work. The system asks contextual follow-up questions, probes for deeper insights, and generates comprehensive candidate evaluations. InterWiz was gaining strong customer traction but faced two business constraints, a cost constraint and an architecture limitation, that limited their growth. At $0.25 per interview using GPT-4 Turbo, AI expenses consumed 40% of per-interview revenue. This made aggressive growth unprofitable. InterWiz was losing deals to competitors with lower AI costs who offered better pricing. They needed to scale to achieve venture-backed growth targets, but their infrastructure costs made scaling unsustainable. Different interview functions have different requirements. Question generation needs strong reasoning and creativity. Real-time interviews require low latency and reliable adherence to instructions. Candidate evaluation demands consistency and cost efficiency at scale. With access to only one model family, InterWiz couldn’t tune each function independently. Response latency averaging 850 milliseconds created noticeable pauses during live interviews, affecting candidate experience.

Why Emumba

InterWiz chose to work with an AWS Partner Network member rather than attempting direct implementation, a decision that proved valuable. InterWiz engaged Emumba, an AWS Advanced Tier Services Partner with the AWS Generative AI Services Competency, to lead the migration. Three factors drove this decision:

AWS Partner Network benefits – As an AWS Advanced Tier Services Partner, Emumba unlocked direct access to AWS funding programs, including proof-of-concept (POC) credits and Well-Architected reviews, plus dedicated support from AWS technical account teams and solutions architects. This reduced migration risk, kept the work aligned with AWS best practices, and lowered upfront costs.
Proven migration framework – Emumba’s systematic seven-phase methodology covered assessment, model evaluation, prompt optimization, progressive rollout, and multi-provider redundancy. Each phase included defined checkpoints and rollback controls, so InterWiz had a structured path to production with minimal disruption risk.
Amazon Bedrock expertise – Emumba’s deep experience with Amazon Bedrock helped InterWiz run a comprehensive evaluation of Claude by Anthropic in Amazon Bedrock and Meta’s LLama in Amazon Bedrock, identifying the most suitable fit for each interview function.

The migration approach

The goal was clear: reduce AI costs by at least 60%, improve response times to under 500 milliseconds, and maintain or improve interview quality while conducting thousands of live interviews without service disruption. Emumba’s seven-phase migration framework guided the transition from model assessment through full production deployment:

Collect information
Select candidate models
Prompt optimization
Model evaluation
Compare and select model
Migrate
Optimize

The following diagram illustrates this framework.

Figure 1: Emumba’s systematic seven-phase migration framework

Emumba conducted comprehensive model assessments using Amazon Bedrock, which provides access to high-performing foundation models (FMs) through a single API, with built-in capabilities for building generative AI applications with security, privacy, and responsible AI. Emumba’s team evaluated Anthropic’s Claude and Meta’s LLama models against InterWiz’s specific requirements.

Emumba designed a specialized architecture that assigned each interview function to the FM best suited for it. Anthropic’s Claude 3.5 Sonnet, a reasoning-focused FM, powered intelligent question generation. Meta’s LLama 3.3 70B, a cost-efficient FM optimized for speed, handled real-time interviews, contextual follow-ups, and candidate evaluation.

Migrating from GPT-4 Turbo introduced prompt compatibility challenges. Because Anthropic’s Claude and Meta’s LLama follow different instruction patterns, Emumba’s team rewrote and tested prompts for each model using Amazon Bedrock prompt optimization tooling, including prompt caching (which can reduce costs by up to 90% and latency by up to 85%) and Amazon Bedrock Intelligent Prompt Routing (which can reduce costs by up to 30% by automatically directing requests to the most cost-effective FM). To validate quality, Emumba’s team applied a large language model (LLM)-as-a-judge evaluation approach, using an FM to score outputs against a defined quality rubric and confirming that outputs met or exceeded baseline standards before each module moved to production.

The results

The migration followed a structured 3-month timeline. Month 1 focused on model assessment and architecture design. Month 2 prioritized progressive rollout of low-risk modules. Month 3 completed full migration with optimization. Emumba measured these outcomes over a 90-day post-migration period across production interview workflows:

90% cost reduction – AI expenses dropped from $0.25 to $0.025 per interview. As InterWiz scales from 1,000 to a projected 10,000 monthly interviews by year-end 2026, this migration will save $27,000 annually, transforming the cost-to-revenue ratio from barely sustainable to highly profitable at scale.
55% latency improvement – Response times decreased from 850 ms to 450 ms. Candidate feedback improved noticeably, with interviewees specifically mentioning the conversation felt “more natural” and “less robotic.”
99.9% uptime – The multi-provider architecture with automatic fallback maintained continuous service availability, even when primary or secondary providers experienced regional issues.

The following graphic summarizes the measurable business outcomes InterWiz achieved.

Figure 2: Business outcomes from InterWiz’s migration to Amazon Bedrock (measured over 90-day post-migration period)

“Migrating our AI stack from Azure OpenAI to Amazon Bedrock was a complex undertaking, but AWS CoE at Emumba handled it with precision and engineering depth. They built the abstraction layers, tuned our prompts, and managed rollout risks so thoroughly that we experienced no disruption, only improvement. The new setup is faster, cheaper, and far more scalable. We couldn’t have asked for a smoother transition.”

— Zishan Iqbal, CEO, InterWiz AI

The competitive impact

Beyond immediate cost savings, the migration created measurable strategic advantages. InterWiz can now profitably serve market segments previously off-limits due to pricing constraints and can invest in advanced features such as role-specific question strategies and industry-tailored evaluation criteria.As AWS adds new FMs to Amazon Bedrock, InterWiz can evaluate and integrate them within days, not months, without waiting on a provider’s roadmap. This architectural flexibility compounds as model innovation accelerates.

Three strategic takeaways for AI-powered SaaS leaders

Architectural decisions made during prototyping often become strategic liabilities at scale, and this post highlights three beneficial outcomes of the InterWiz migration:

Cost predictability at scale – The transparent pricing and multi-model flexibility of Amazon Bedrock provide a path to managing FM costs as you grow. By systematically evaluating which models deliver the most suitable cost-performance balance for specific functions, InterWiz reduced AI costs by 90% without sacrificing quality. You can apply the same approach to your own workloads.
Model choice as strategic advantage – Amazon Bedrock provides access to multiple leading FMs, including Anthropic’s Claude, Cohere Command in Amazon Bedrock, Meta’s LLama, Amazon Nova, and Amazon Titan, through a single API, so you can select the most suitable model for each job. When new FMs emerge, you can adopt them immediately.
AWS Partner Network benefits for regulated industries – For companies in regulated industries, Amazon Bedrock is in scope for System and Organization Controls 1, 2, and 3 reports and is a Health Insurance Portability and Accountability Act (HIPAA) eligible service. AWS also supports customers’ General Data Protection Regulation (GDPR) compliance efforts through data residency controls and contractual commitments.

Under the AWS Shared Responsibility Model, your organization is responsible for implementing the controls required to meet your specific compliance obligations. Working with an AWS Advanced Tier Services Partner such as Emumba provides validated expertise backed by AWS quality assurance, access to funding programs that lower financial barriers, and a path to continuous model innovation through the expanding FM catalog of Amazon Bedrock.

Looking forward

InterWiz’s journey demonstrates what is possible when an AWS Partner Network member guides a production generative AI migration: 90% cost reduction, 55% latency improvement, and a zero-downtime transition completed in 3 months. Building for multi-model flexibility from the start is one of the most consequential infrastructure decisions you can make as an AI-powered SaaS company.Companies that migrate to Amazon Bedrock are positioned to take advantage of FM innovation as it happens. Those locked into single-provider architectures carry higher switching costs as the model landscape evolves. A migration assessment is a practical first step to understanding your potential savings and risk profile.

To learn more about Emumba, refer to Emumba in AWS Partner Network. To contact Emumba, visit the Emumba AWS Partner contact page.

Emumba – AWS Partner spotlight

When you work with Emumba, you gain access to production-grade generative AI implementations, cloud migration and modernization expertise, and data strategy capabilities, backed by more than 300 certified engineers across the Bay Area, Islamabad, and Dubai. Emumba is an AWS Advanced Tier Services Partner with the AWS Generative AI Services Competency, helping companies in healthcare, travel, and software industries build AI infrastructure that scales profitably.

Contact Emumba | Partner Overview | AWS Marketplace

Reimagining legacy applications with Pega and AWS through AI-driven approach

Ujwal Bukka — Thu, 02 Jul 2026 22:20:47 +0000

By: Andre Boaventura, Principal AI Solutions Consultant, Applied AI – Pegasystems Inc.
By: Surender Kumar, Mainframe Modernization Architect – Pegasystems Inc.
By: Sourav Sarkar, Senior Worldwide Specialist Solutions Architect – AWS
By: Ujwal Bukka, Senior Partner Solutions Architect – AWS

For most large enterprises, AI-driven legacy application modernization presents a clear imperative, but acting on it without disrupting the critical business processes that depend on those systems every day remains the core challenge. For decades, legacy applications have served as the operational bedrock of global enterprises. Yet these very systems, often built on tightly coupled, monolithic architectures, can make it difficult for organizations to move with the speed and agility that today’s business demands. Organizations face mounting pressures: high maintenance costs consuming IT budgets, immense technical debt accumulated over decades, scarcity of skilled talent familiar with legacy languages such as COBOL, and the inherent risk of big bang migration projects that frequently overrun budget and timeline.

These challenges drive many organizations to seek a structured approach that delivers business value incrementally. This post shows you how the AI-Driven App Modernization Platform from Pega and Amazon Web Services (AWS) provides a structured, low-risk methodology to transform legacy systems into intelligent, automated workflows.

The AI-Driven App Modernization Platform with Pega and AWS

The AI-Driven App Modernization Platform from Pega and AWS represents a fundamentally different approach. Instead of replatforming or refactoring legacy applications to like-for-like replacements, this solution fundamentally reimagines the business processes they support.

This solution combines the AWS Global Infrastructure and artificial intelligence and machine learning (AI/ML) services with Pega’s low-code platform for AI-powered decisioning and workflow automation. Together, they transform complex legacy architectures into a portfolio of intelligent, agentic workflows that are built for the cloud, automated, and designed around the customer experience and optimized for business agility.

This is not a like-for-like replacement. It’s an opportunity to reimagine existing processes onto an agentic platform, transforming core operations into intelligent, automated workflows.

Target use cases

The platform provides tailored, AI-accelerated paths for multiple complex legacy application estates. Each path addresses a specific modernization challenge:

Mainframe systems – The platform provides a low-risk, phased approach to deterministically extract business rules, requirements, and process flows from mainframe applications with full traceability from every extracted artifact back to the original source code, transforming monolithic COBOL or PL/I systems into agile, Pega workflows built for the cloud. Common industry use cases include insurance claims processing, banking loan origination, customer onboarding, and supply chain orchestration.
Legacy BPM platforms – Organizations running legacy business process management (BPM) suites can use a direct-to-Blueprint import of Business Process Model and Notation (BPMN) diagrams, allowing rapid reimagining of existing processes into intelligent, automated Pega workflows.
Legacy Java and .NET applications – Custom-built applications on established frameworks are analyzed to identify and untangle business logic, allowing strategic migration to a modern, microservices-based architecture on the Pega platform.
Legacy document-centric workflow applications – A specialized import path (to Blueprint) enables rapid analysis and transformation of form-based applications and embedded business logic directly into the Pega platform.
Legacy ERP transformation – The platform acts as the workflow orchestration layer, building new workflows on Pega while ringfencing the legacy enterprise resource planning (ERP) tool, reducing expensive customizations without disrupting the core system of record.
Application consolidation – A common use case is consolidation. Rather than treating each legacy application as a separate one-to-one modernization project, the platform provides a unified foundation to converge functionality across multiple legacy estates. As organizations modernize from mainframe, Notes, and legacy Java, they identify and remove redundant processes, creating a single, cohesive set of agentic workflows. The result is a simplified architecture and a significantly lower total cost of ownership (TCO).

Applications with embedded business rules and process flow can be Pega candidates. The following guidelines offer a starting point.

Banking and financial services:

Loan origination, credit assessment, and fulfillment
Loan servicing and product lifecycle management
Account management, such as onboarding, changes, and offboarding

Insurance:

Policy changes, endorsements, and renewal management
Claims first notice of loss (FNOL), adjudication, and settlement orchestration
Underwriting, such as submission intake, appetite, and risk decisioning

Communications and telecom:

Order management, including validation, decomposition, and orchestration
Enterprise trouble-to-resolve and fault management
Billing dispute management and adjustments

Healthcare and health plans:

Prior authorization, including intake, clinical review, and determination
Member grievances, clinical appeals, and independent dispute resolution (IDR) management
Provider credentialing, contracting, and network management

Government:

Citizen service delivery, including case intake, tracking, and resolution
Benefits eligibility determination and administration
Grant management, including application, review, approval, and monitoring

Manufacturing:

Engineering change orchestration and approval workflows
Warranty claims processing and recovery and recall management
Supplier onboarding, performance management, and risk assessment

Composable platform architecture

The platform is built on a composable architecture combining two vertical pillars with a central engine of four horizontal processing layers. The anatomy of the core modernization engine is as follows:

Discovery, analysis and preprocessing – Uses specialized AWS services and tools such as AWS Transform and Kiro to perform deep analysis of legacy source code. A specialized Pega Blueprint Agent processes these insights through Amazon Bedrock AgentCore using agent-to-agent (A2A) and Model Context Protocol (MCP) integration capabilities to create enriched artifacts for the design layer.
AI-powered application design and generation – This layer functions as the architect. It ingests the enriched artifacts from discovery and uses generative AI to create a comprehensive application design, including case type hierarchies, workflow models, data objects, and persona-based UI layouts. The output is a high-fidelity Blueprint: a validated, editable design document that defines what the modernized application should look like and how it should behave.
Pega Platform – This layer acts as the builder. It takes the validated Blueprint design and automatically generates a functional, running application on the Pega Platform. Developers can then refine and extend the generated application using the low-code App Studio, with the full power of Pega’s decisioning and workflow automation engine underneath.
Data and integration services – Provides broad connectivity, including microservices integration built for the cloud, legacy application connectivity, data modernization paths, and unified identity and security.

The foundation of the platform relies on AWS Cloud and AI infrastructure and the Pega Cloud Platform. AWS Cloud and AI infrastructure provides global scale, scalable compute, and a rich AI/ML portfolio that includes Amazon Bedrock and Amazon SageMaker AI.

Pega Cloud Platform delivers a fully managed platform as a service (PaaS) with always-on architecture, security with SOC 2 and ISO 27001 compliance with around-the-clock SOC monitoring, integrated DevOps through Pega Deployment Manager, and proactive global support.

The following diagram illustrates the platform anatomy.

Figure 1: Anatomy of the AI-Driven App Modernization Platform

The three-phase modernization methodology: Anything to Blueprint to cloud

The platform follows an anything-to-Blueprint-to-cloud (ABC) methodology that guides organizations from legacy complexity to a modernized future on Pega Cloud. The methodology follows three phases:

Reverse engineering and discovery
AI-powered forward engineering
Deployable architecture on Pega Cloud

The next sections explain these phases.

Phase 1: Reverse engineering and discovery

Goal: Transform the mystery of undocumented legacy functionality into a structured, queryable knowledge base.

The platform ingests legacy technologies including COBOL, Programming Language One (PL/I), Java, .NET, legacy ERPs, and legacy forms and workflows. These assets are processed using the powerful analysis engines of AWS Transform, Kiro, and other specialized partner tools. For example, for legacy mainframe COBOL code, AWS Transform deterministically discovers business functions and generates verified, implementation-ready requirements. The output delivers following key capabilities:

Discovery Business Functions – Discovers business functions from the codebase to produce a catalog of logical modernization boundaries. This gives both business and technical stakeholders a shared language for scoping transformation with evidence from the code itself.

1. Code Analysis – Ingests source code, classifies artifacts, builds dependency graphs across programs, entry points, and data stores, and measures code complexity.
2. Data Analysis – Maps Db2 tables and VSAM files, traces data lineage across programs and JCL jobs, and catalogs field-level metadata in a generated data dictionary.
3. Discover Data Paths – Identifies distinct execution paths from entry point triggers through to specific outputs, traced deterministically across the codebase.
4. Discover Business Functions – Groups data paths into business functions (online, batch, or mixed), producing a catalog organized by business process and mapping dependencies to inform wave planning.

Reimagine – Produces formal functional requirements that are technology-agnostic and include testable acceptance criteria, replacing undocumented business logic in applications with a verified, traceable starting point for forward engineering with Pega Blueprint.

1. Extract Business Logic – Performs deterministic static analysis to extract business rules from actual execution logic, with each rule carrying a natural language description, acceptance criteria, and exact source line traceability.
2. Generate Requirements – Produces user stories with structured business rules in EARS (Easy Approach to Requirements Syntax) format, with full traceability from requirements to rules to source code

Phase 2: AI-powered forward engineering

Goal: Use agentic AI to accelerate application design and reimagine legacy processes.

The Pega Blueprint Agent ingests phase 1 artifacts and generates a comprehensive starter application design enriched with Pega’s industry best practices. This facilitates a collaborative AI-assisted design cycle where stakeholders can rearchitect customer journeys, introduce intelligent automation and AI decisioning, simplify data structures, and design modern user interfaces.

The modernized application automatically inherits Pega Platform capabilities including case management, predictive AI and decisioning agents, Center-out architecture, and built-in reporting and process optimization.

Phase 3: Deployable architecture on Pega Cloud

Goal: Transform the blueprint into a deployable application using an incremental deployment strategy.

The core deployment strategy is the strangler fig pattern, an incremental approach that gradually replaces legacy functionality without disrupting the business. Think of the legacy application as the host tree and the new Pega application as the vine that grows around it until the old system can be safely decommissioned. This pattern relies on two critical components:

The strangler façade – This layer acts as the single, intelligent entry point for all application traffic, dynamically routing requests between legacy and modern endpoints based on configurable policies. As each business domain is modernized, the façade is reconfigured to direct traffic to the new Pega application, with zero changes required on the client side.
The anti-corruption layer (ACL) – This layer is a sophisticated translator that protects the new Pega application from legacy complexity, allowing it to communicate with legacy applications using modern REST APIs across supported legacy technologies, including COBOL, PL/I, Java, and .NET. In a mainframe modernization scenario, for example, OpenLegacy(a 3rd party Legacy-to-API integration platform) serves as the ACL, allowing Pega to interact with COBOL systems without needing to understand COBOL data structures, Extended Binary Coded Decimal Interchange Code (EBCDIC) character sets, or mainframe protocols.

Applications are modernized in logical phases called “migration waves.” Each delivers a complete business domain and its associated data. The façade begins by routing traffic to the legacy application and is progressively reconfigured with each wave, until the legacy system is fully replaced and can be safely decommissioned. This incremental modernization is illustrated in the following graphic.

Figure 2: The strangler fig pattern – Mainframe modernization scenario

This strategy is underpinned by a powerful, automated toolchain. Validated case types, data objects, and UI designs from the Blueprint are used as direct inputs to automatically generate the core Pega application structure, minimizing manual effort. Pre-built infrastructure as code (IaC) templates deploy the entire supporting AWS architecture, including networking, security, and data services needed to connect Pega Cloud to the legacy environment. A holistic, layered security model protects the solution at every level: infrastructure-level security enforces least-privilege access through AWS Identity and Access Management (IAM) roles and policies, and application-level security is managed within Pega using role-based access control (RBAC) and single sign-on integration.

The following graphic illustrates this three-phase modernization methodology.

Figure 3: The three-phase modernization methodology

Key benefits

The three-phase modernization methodology offers several benefits:

Accelerated time to value – AI-driven discovery and design can reduce modernization timelines, cutting projects from years to months.
Reduced risk – Automated logic extraction prevents loss of critical functionality; iterative validation removes costly rework.
Lower TCO – This methodology removes expensive licensing and million instructions per second (MIPS) costs, technical debt, and frees IT resources.
Business agility – Low-code platform empowers rapid adaptation without long IT cycles.
Enhanced experience – Modern, intelligent applications drive higher satisfaction and productivity.

Getting started

To begin your modernization journey, follow these steps:

Schedule a personalized demo – Contact Pega to see the platform in action, tailored to your specific systems and business goals.
Book a discovery workshop – Engage with the Pega and AWS team for a guided assessment of your legacy application estate and a preliminary modernization roadmap.
Learn more online – For a deeper technical dive into this joint solution including architecture deep-dives and use-case guidance, refer to our joint technical whitepaper, The AI-Driven App Modernization Platform.
Engage with a certified delivery partner – The ecosystem of certified global system integrators including TCS, Infosys, and Accenture brings deep industry expertise and proven delivery capacity to accelerate your transformation.

Conclusion

The AI-Driven App Modernization Platform from Pega and AWS offers you a fundamentally new approach to legacy application transformation. By combining the AWS Cloud infrastructure and AI-powered analysis tools with Pega’s generative AI design capabilities and workflow automation, you can modernize targeted workloads incrementally, safely, and with confidence. Beyond modernization, this platform helps you reimagine your business processes on an agentic platform designed for the AI era.

Pega – AWS Partner spotlight

Pega is an AWS ISV Partner that delivers AI-powered decisioning and workflow automation to major global enterprises. With solutions spanning customer engagement, intelligent automation, and AI-driven application modernization, Pega helps organizations accelerate their digital transformation on AWS. Learn more at pega.com

Contact Pega | Partner Overview | AWS Marketplace

Designing enterprise AI agents with DevRev guardrails powered by Amazon Nova

Len Gomes — Thu, 02 Jul 2026 17:53:02 +0000

By: Len Gomes, Partner Solutions Architect – AWS
By: Ruhisar Tikoo, Technical Account Manager – AWS
By: Writom Guha Roy, Sr. Startup SA – AWS
By: Prateek Chaudhury, AI Engineer – DevRev

DevRev

Enterprises are embedding AI agents across workflows from customer support to IT service management but face the critical challenge of facilitating responsible behavior at scale. As enterprise AI agents gain autonomy and access to sensitive customer and product data, the demand for robust AI guardrails has increased significantly. With robust AI guardrails in place, organizations gain the confidence to scale AI agents across sensitive workflows knowing that personally identifiable information (PII) is filtered before it surfaces in responses, content stays on policy, business insights remain grounded in verified data, and safety controls hold firm against adversarial inputs. Responsible AI is an operational requirement for enterprises deploying AI agents powered by Amazon Nova or other foundation models (FMs) in production.

The business value is clear. Effective guardrails strengthen regulatory posture, reinforce customer trust, and reduce remediation overhead. For enterprises in regulated industries like financial services, healthcare, or telecommunications, these advantages compound quickly. Organizations that implement custom, domain-specific policies reflecting internal compliance rules gain a measurable operational edge: consistent enforcement around roadmap details, confidential integrations, and regulated industry language. Modern enterprise AI systems that enforce AI safety at the infrastructure level unlock greater agent autonomy with confidence.

DevRev guardrails: Built-in AI safety for every agent

DevRev has addressed this challenge directly by building real-time AI guardrails into its enterprise agent system, powered by Amazon Nova 2 Lite through Amazon Bedrock, a fully managed service from Amazon Web Services (AWS) for building and scaling generative AI applications with foundation models. Agents deployed on DevRev’s system come with a unified guardrail layer that evaluates user inputs before a response is generated, supporting reliable, adherent behavior across enterprise workflows right from the start. Teams can also author custom policies in natural language, making policy enforcement accessible without requiring code.

Amazon Nova is the AWS portfolio of AI offerings delivering frontier intelligence with competitive price performance. Nova is built on AI technologies originally developed for internal Amazon applications, including Alexa+, Amazon Ads, and Amazon Stores. Amazon Nova 2 Lite is a fast, cost-effective reasoning model featuring extended thinking with step-by-step reasoning (at three configurable levels: low, medium, or high), multimodal support (text, image, video, and documents as input), a one million-token context window for expanded reasoning, and built-in tools including web grounding with citations and code interpreter.

Early adopters report significant results: Siemens achieved a 300% improvement in search speed, Trellix saw a 39% accuracy boost in threat classification, and AWS Transform improved tool-calling efficiency by 60%.

Measured impact in production deployments

Production deployments of DevRev’s AI agent system demonstrate measurable impact across enterprise deployments where Computer agents handle support, operations, and knowledge management at scale, as shown in the following table.

Operational metric	Production result
Support ticket automation	85% (compared to 40% industry average)
Support cost reduction	50% (compared to 20% industry average)
Employee time saved per week	10-plus hours per employee
Guardrail evaluation latency	247 ms average (<300ms threshold)

The DevRev guardrails solution

DevRev built AI guardrails as a built-in layer within its agent system not as a bolted-on filter, but as an integral component of the execution pipeline that evaluates every user message before a response reaches the end user. This built-in protection covers the most critical enterprise AI issues:

Prompt injection is designed to alter agent behavior through crafted inputs.
Sensitive content is evaluated, filtering PII before it surfaces in agent responses.
Toxic and off-policy responses are blocked, filtering harmful or nonadherent content before delivery.
Custom domain policies restrict topics such as internal roadmaps, confidential integrations, or regulated terminology.

Administrators configure custom policies using plain natural language rules like “Avoid discussing internal roadmap details” or “Do not reference competitor products” without writing code. After these policies are attached to an agent, they enforce consistent, auditable boundaries regardless of where the agent is accessed across the organization.

How it works: The parallel evaluation architecture

The key design principle behind DevRev’s guardrail system is concurrency. Rather than inserting a sequential safety check that adds latency to every interaction, DevRev runs guardrail evaluation in parallel with the primary agent reasoning loop, achieving near real-time responses while maintaining strict policy enforcement.

Each interaction flows through the system in five steps:

Input received – Each user message simultaneously triggers the guardrail model and the primary agent large language model (LLM).
Parallel evaluation – The lightweight guardrail model classifies the input against the active policy set default and custom while the primary model begins generating a response.
Gated output – The response stream is held until the guardrail model returns its decision.
Approved path – If the input passes evaluation, precomputed portions of the response release instantly to the user, and the remainder streams subsequently.
Violation detected – If a violation is flagged, the system aborts the pending response and streams a safe, policy-defined fallback instead. The violation is passed back to the agent reasoning loop for handling.

This concurrent evaluation architecture is what enables sub-300 ms guardrail performance without degrading the conversational experience. The flow is shown in the following graphic.

Figure 1: Parallel evaluation flow for real-time guardrails

Why Amazon Nova 2 Lite?

DevRev’s guardrail model runs on every single user message, in parallel with the primary agent LLM. This means the model must be fast, accurate, and cost-efficient at scale simultaneously. After evaluating multiple models available through Amazon Bedrock, DevRev selected Amazon Nova 2 Lite as the best fit for production-grade enterprise safety enforcement based on three deciding criteria:

Speed – Amazon Nova 2 Lite achieves a 247 ms average evaluation time, which is fast enough for real-time guardrails without disrupting user experience. This meets the critical threshold for maintaining conversational fluidity at enterprise scale.
Classification performance – Amazon Nova 2 Lite delivers strong accuracy in detecting prompt injection, flagging sensitive content, and enforcing custom natural-language policies, the exact workload DevRev’s guardrail layer requires.
Cost efficiency – Per-interaction costs remain low across thousands of concurrent agent sessions. Built-in availability on Amazon Bedrock also simplifies scaling and monitoring within DevRev’s AWS based infrastructure.

System context: Computer by DevRev

DevRev is a modern enterprise AI system that unifies fragmented enterprise data through Computer, an AI assistant designed to go beyond chatbots that merely read and summarize. Computer can create, update, and delete records across systems such as Salesforce, Jira, and Zendesk. Understanding the architecture explains why guardrails are not optional: they’re essential infrastructure for agents operating at this level of autonomy.

Computer is powered by two core technologies:

Computer Memory – DevRev’s permission-aware knowledge graph transforms structured and unstructured data from across the enterprise into a dynamic network of interconnected information, maintaining data permissions, context, and compliance requirements throughout.
Computer AirSync – A real-time synchronization engine that continuously synchronizes data bidirectionally across systems, alleviating silos and keeping connected systems aligned.

The following graphic shows DevRev at the center of an interconnected architecture that unifies enterprise data across multiple systems such as Jira and Teams.

Figure 2: Computer by DevRev unifies enterprise data across multiple systems

Computer operates as a true AI teammate across the enterprise, finding answers and reasoning across business context. It acts through AI agents that create tickets, update records, route work, and automate tasks using Computer Agent Studio, delivering enterprise-grade governance through built-in security, permission awareness, and compliance controls. DevRev’s Computer Agent Studio provides an intuitive, low-code environment for teams to design, test, and deploy AI agents. Each agent moves through a defined lifecycle (from design to simulation, validation, and finally publishing) and inherits identity and permissions like a human user, limiting access to only authorized data and operations. This is the execution environment in which guardrails operate: a deterministic, observable, permission-bounded runtime where safety enforcement is built in at the system level.

The following graphic shows Computer executing a multistep ticket reassignment in which it updates eight records, applies escalation tags, and logs changes across multiple systems, including Salesforce and Slack.

Figure 3: Computer executing a multistep ticket reassignment

The following screenshot of the Build dashboard shows the agent configuration interface for a Developer Evangelist agent, including modular sections for knowledge sources, skills, and guardrails alongside a live chat preview panel.

Figure 4: The Build dashboard showing the interface for a Developer Evangelist agent

Enabling safe agent autonomy at enterprise scale

When enterprises can trust that every interaction is evaluated against policy before reaching the user, they can confidently expand the scope of what agents are allowed to do, taking on more complex workflows, accessing more sensitive data, and operating with less human oversight. AI safety, properly implemented, makes greater autonomy possible rather than constraining it.

The production results reinforce this value. When agents resolve 85% of support tickets automatically and save employees more than 10 hours per week, efficiency gains only hold if the underlying AI operates within defined boundaries. By building real-time evaluation directly into the agent execution pipeline powered by the 247 ms average evaluation time of Amazon Nova 2 Lite, DevRev demonstrates that speed and safety can coexist without sacrificing either. For organizations exploring enterprise AI adoption, deploying AI agents is a must, and their challenge is to choose a system that can best enforce the policies, permissions, and AI safety boundaries required by production deployments.

Conclusion

DevRev’s guardrails capability powered by Amazon Nova 2 Lite through Amazon Bedrock demonstrates that enterprise AI safety and operational performance coexist comfortably. With real-time policy evaluation running at 247 ms average latency, natural-language policy authoring, and parallel execution that preserves conversational fluidity, DevRev gives enterprises the foundation to deploy AI agents confidently and at scale. The combination of Computer’s permission-aware architecture with the classification performance of Nova 2 Lite demonstrates how responsible AI and operational efficiency can scale together.

To get started, request a demo and see DevRev’s agent system and built-in guardrails in action. Visit DevRev’s homepage to learn about Computer by DevRev and check out the DevRev blogs for technical articles and updates. Watch Building safer agents at DevRev, a live session with DevRev CTO Ahmed Bashir, for a comprehensive walkthrough of guardrail implementation and real-world use cases.

DevRev – AWS Partner Spotlight

DevRev is an AWS Partner that provides an enterprise AI system unifying customer support, product development, and business operations through Computer, an AI agent system that executes work across enterprise systems while enforcing safety policies with built-in guardrails powered by Amazon Nova 2 Lite on Amazon Bedrock.

Contact DevRev | Partner Overview | AWS Marketplace

AWS and Elastio deliver comprehensive ransomware resilience

Stuart Lupton — Wed, 01 Jul 2026 15:17:54 +0000

By: Cecily Polonsky, Chief of Staff, GTM Strategy – Elastio
by: Stuart Lupton, Senior Specialist SA, Storage – AWS
by: Danny Johnston, Principal Storage Specialist – AWS

Elastio

As ransomware threats grow more advanced, organizations across industries are strengthening their recovery readiness alongside prevention. Forward-thinking teams recognize that a robust recovery capability is a strategic advantage, one that enables confident operations even in the most challenging cyber scenarios. By designing recovery strategies purpose-built for modern threats, organizations gain the ability to restore critical systems quickly and reliably, even when attacks move laterally across production, standby, and backup environments. The result is a resilient posture where recovery points remain trustworthy and teams stay in control.

That’s why leading organizations are building ransomware-aware recovery strategies and, crucially, maintaining continuous visibility into the integrity of their recovery points. Amazon Web Services (AWS) services, including AWS Backup and AWS Elastic Disaster Recovery, provide the foundation for scalable, resilient recovery architectures that address these modern threat scenarios. Alongside partner solutions such as the Elastio Ransomware Recovery Assurance Platform, these services bring ransomware intelligence and recovery validation into a unified approach to resilience.

In this post, we examine how to develop ransomware-aware recovery strategies that are tested, trusted, and ready for the current threat landscape. You’ll see how to use AWS services and Elastio’s ransomware intelligence to gain continuous visibility into what is protected, what is vulnerable, and what can be safely restored, giving your organization the ability to recover when it matters most.

Why ransomware demands a new approach to recovery

For over 70 years, data protection as a strategy has mainly consisted of a combination of:

High availability – In case of a local hardware failure
Business continuity or disaster recovery plan – For recovery in case of a threat event
Backup – An independent copy of the data for restoration

These data protection mechanisms remain valid and critical but haven’t kept pace with ransomware evolution. Traditional strategies assume failures are contained within data centers and won’t travel across networks. Ransomware deliberately exploits lateral connectivity between production, standby, and protection systems to eliminate all recovery avenues post-attack. This evolving risk requires a recovery strategy purpose-built to disrupt ransomware’s lateral movement, one that adds a layer of protection designed to isolate, validate, and preserve clean recovery data when it matters most.

The following graphic illustrates these three operational data protection layers with a cloud-hosted vault as the fourth layer to prevent ransomware lateral movement.

Figure 1: Traditional data protection layers plus a cloud-hosted data vault

A fourth line of data protection – Cloud-hosted data vault

A solution that resilient organizations are adopting is a cloud-hosted data vault (CHDV). A CHDV is an environment that secures mission-critical data assets in an immutable, air-gapped vault so that if ransomware attacks occur, businesses have good copies for recovery. The financial services industry (FSI) has learned how critical its interconnected systems are, and what global consequences could result if those systems fail. In response, financial services have taken a leading role in advancing data vaulting and ransomware recovery strategies.

Regulatory bodies are also driving data vault adoption in financial services. The Hong Kong Monetary Authority (HKMA) released regulatory requirements for Secure Tertiary Data Backups, and New York Department for Financial Services (NYDFS) released requirements for backups that are protected from unauthorized alterations or destruction. In the UK, the Cross Market Operational Resilience Group (CMORG) developed a reference architecture for CHDVs.

AWS and its partners have met this regulatory shift to deliver solutions that build on existing data protection to enable data vault strategies anchored on three essential pillars: immutability, air-gapping, and integrity validation.

How to get started with data vaulting on AWS

AWS has data protection mechanisms within its AWS services portfolio that can be used independently to construct resilient data platforms as needed. AWS Backup centralizes these data protection services and features into one place, using backup policies and job reporting to automate and monitor an organization’s data protection strategy.

A feature of AWS Backup is the logically air-gapped vault. A logically air-gapped vault offers additional security features compared to a standard vault that are automatically applied at creation:

Logically air-gapped vaults are automatically created with compliance mode enabled. Data stored in these vaults is immutable.
An AWS owned key manages encryption of the data. AWS Key Management Service (AWS KMS) managed keys and customer managed keys are also supported.
Restore-only copies of the backups can be shared using AWS Resource Access Manager (AWS RAM) for quick restores and testing.

For on-premises infrastructure and Amazon Elastic Compute Cloud (Amazon EC2) workloads that require near-zero Recovery Point Objectives (RPOs), Elastic Disaster Recovery provides a fast and reliable solution for ransomware recovery. It enables rapid failover by creating a cost-optimized staging area in AWS, allowing servers and applications to be restored within minutes from a designated recovery point.

AWS Backup and Elastic Disaster Recovery both provide robust tools to protect mission-critical data and applications in the event of a ransomware attack. But protection only works if the correct data and systems are included and, just as importantly, if the data that is stored is trustworthy. That’s why visibility into data integrity, actionable insights, and continuous validation are essential components of an effective ransomware resilience strategy.

Elastio Platform 360 Ransomware Resilience – Critical visibility into recovery integrity

For critical insights and visibility into recovery data, organizations are turning to the Elastio Ransomware Recovery Assurance Platform. Elastio is an AWS Partner that brings ransomware-specific intelligence into the recovery process. Elastio integrates directly with AWS Backup logically air-gapped vaults through restore testing and Elastic Disaster Recovery to deliver continuous data integrity validation and visibility into an organization’s recovery posture. In this way, the Elastio Platform addresses the integrity pillar of ransomware recovery.

With ransomware threats growing more evasive, attackers often move slowly and stealthily, encrypting data over time or staging attacks in dormant states. This type of behavior can quietly compromise recovery points, even if they are made immutable or air gapped. Elastio helps customers stay ahead of this risk by continuously validating backup and recovery data against hidden ransomware indicators, insider threats, and silent corruption. The result is a real-time understanding of the recoverability of mission-critical data—a key factor when recovery speed, regulatory compliance, and business continuity are at stake. These insights are delivered through Elastio Platform 360 Ransomware Resilience User Interface (UI), which gives AWS customers a centralized view of recovery health across five core areas:

Recovery Assurance – Confirms the presence of clean, usable recovery points across all protected assets.
Ransomware Safety – Detects ransomware behavior, before or after detonation.
Encryption Safety – Flags unauthorized encryption activity, including slow, stealthy changes indicative of insider threats.
Asset Coverage – Highlights unprotected systems or gaps in the current recovery plan.
Storage Health – Evaluates backup configurations for alignment with best practices for resilience.

The following screenshot shows the Elastio Platform 360 Ransomware Resilience UI dashboard with recovery health metrics across these five core dimensions.

Figure 2: Elastio 360 Ransomware Resilience UI dashboard

Each dimension is scored and monitored over time, offering a quantifiable view of ransomware recovery health. This level of operational visibility is especially important as organizations look for provable recovery readiness. Elastio helps meet those expectations by making recovery posture measurable and continuously verifiable. Critically, Elastio’s insights do more than live inside a dashboard. They drive real, high-impact decisions. Infrastructure teams rely on Recovery Assurance data to flag backups that fall outside the defined RPO windows. Security teams act on Ransomware Safety alerts to detect early-stage threats, pinpoint the last known clean version of compromised assets, and accelerate incident response, ensuring recovery to a verified, uncompromised state. Meanwhile, compliance teams use Asset Coverage intelligence to identify gaps in protection, such as unvalidated workloads, and proactively adjust policies to close those risks.

Elastio also provides a Model Context Protocol (MCP) server, the Elastio MCP Server, giving teams the ability to connect large language models (LLMs) such as Anthropic’s Claude directly to Elastio and use plain English prompts to ask questions, summarize findings, and identify compliance and recovery gaps in real time.

This level of visibility transforms recovery from a reactive process into a proactive discipline. In high-stakes environments like financial services, where cyber insurers, regulators, and boards demand proof of resilience, Elastio helps enterprises answer the question: Can you recover safely?

Conclusion

The data protection landscape has evolved. Where recovery strategies once focused primarily on accidental loss or localized incidents, today’s organizations are building defenses that account for deliberate, targeted attacks. As the barrier to entry for threat actors continues to lower, the most resilient organizations are staying ahead by adopting recovery architectures that assume compromise and ensure rapid, validated restoration regardless of the attack vector. In this environment, visibility, insights, and actionable data are key to understanding what good looks like, and, more importantly, what bad looks like, so it can be corrected. Combining these insights with a validated, clean copy of the data not only gives organizations the ability to recover but also limits the impact on customers and third parties. Together, AWS and Elastio offer a modern, integrated approach to ransomware-aware recovery. From immutability and air-gapping to continuous integrity validation and recovery assurance, their combined capabilities form the foundation of a resilient recovery posture—one designed to restore data as well as trust, operations, and business continuity in the event of a cyberattack.

Elastio – AWS Partner Spotlight

Elastio is the control point for cyber resiliency—because survival depends on clean recoveries. The Elastio Platform continuously validates storage and backups, detects ransomware encryption, and ensures uncompromised recovery, even from zero-days. By bridging the gap between security tools and immutable storage, Elastio removes the risk of unrecoverable data.

Contact Elastio | Partner Overview | AWS Marketplace