The most significant announcements from AWS last week centered on expanding what agents can access rather than raw model capability. AWS Step Functions, which manages orchestration across more than 220 AWS services, can now function as a callable tool for AI agents through Amazon Bedrock AgentCore Gateway. This approach lets teams leverage workflows they already depend on without requiring architectural changes. A parallel development saw another platform expose roughly 400 internal API operations to agents in the same manner. Both moves share a common theme: describing existing infrastructure and letting agents discover it, rather than forcing teams to rebuild systems from scratch.

Cost considerations shaped the week's other major narrative. OpenAI's newest Terra model arrived on Amazon Bedrock with pricing substantially below comparable offerings, while two post-quantum cryptography launches addressed security concerns with no firm timeline attached. Here's what moved the needle this week.

Headlines

OpenAI GPT-6.1 Terra reached general availability on Amazon Bedrock, and its positioning within the model lineup matters more than its performance ceiling. Terra represents the everyday-workload tier of the GPT-6 family. According to OpenAI's Agents' Last Exam evaluation, it outperformed GPT-5.6 Terra by 15 percentage points, matched GPT-6 Astra's capabilities, and completed tasks more than three times faster than both models. These measurements come from OpenAI's own testing rather than independent validation. The pricing advantage stands out most sharply: input and output tokens cost at least 50% less than GPT-6.1 Sol and GPT-5.6 Terra. The model accepts up to 1 million input tokens combining text and image data, and developers can reach it through Bedrock APIs, ChatGPT Work, and Codex.

AWS Step Functions workflows became available as AI agent tools via Amazon Bedrock AgentCore Gateway, which connects agents to tools using the Model Context Protocol (MCP). The design separates concerns: agents determine when to execute a workflow and what parameters to supply, while Step Functions executes each step exactly as defined. A support agent might initiate a refund, but the eligibility verification, manager sign-off, and credit processing occur in that fixed sequence every time, because the model never controls the ordering. Both Standard and Express workflows qualify as connector targets, and agents can retrieve execution history. The capability is available across all Regions supporting AgentCore Gateway at standard pricing.

Last week's launches

Several launches and updates from the past week merit attention:

AWS Key Management Service now supports ML-KEM for post-quantum key encapsulation – Developers can establish a shared secret using post-quantum algorithms with AWS KMS keys, with private keys stored in FIPS 140-3 Level 3 validated HSMs. All three NIST FIPS 203 parameter sets are supported through Encapsulate, which generates a random 32-byte shared secret and its ciphertext, and Decapsulate, which recovers it. The underlying threat model addresses harvest now, decrypt later scenarios, where adversaries record today's key exchanges and decrypt them once quantum computers reach sufficient power. The service is available everywhere KMS operates except the Middle East (UAE and Bahrain) and China Regions. Amazon Aurora PostgreSQL added post-quantum TLS key exchange support in the same period, on versions 18 and higher.

AWS IAM Identity Center now supports cross-Region trusted identity propagation – User identities now travel with requests to AWS services in different Regions. This removes a significant architectural limitation: trusted identity propagation previously required all services accessing that identity to operate in the same Region, forcing teams toward either overly permissive IAM roles that cannot distinguish between users or consolidating services into a single Region. Now identity propagates automatically with the request, enabling access control by user and group membership with full audit trails. The feature is available at no additional cost wherever IAM Identity Center operates.

Amazon ECS now supports GPU sharing with NVIDIA Multi-Process Service (MPS) – Multiple Amazon ECS tasks can run concurrently on a single NVIDIA GPU, addressing workloads that consume only a fraction of one GPU, such as small-model inference and multi-model serving. Developers declare the GPU memory each container requires and can optionally limit its GPU compute allocation, while ECS places tasks on GPUs with available capacity as services scale, without code modifications. The feature works on ECS Managed Instances and ECS on Amazon EC2, with Managed Instances monitoring the MPS control daemon and replacing instances if it becomes unhealthy. It's available across all commercial and AWS GovCloud (US) Regions.

AWS Lambda supports Seekable OCI (SOCI) lazy loading for Lambda Managed Instances – AWS Lambda can now fetch only the files needed at each startup stage instead of pulling entire container images upfront, which AWS reports can reduce container startup time by up to 70%. Developers create a SOCI index, push it to Amazon ECR, point the image URI at the indexed tag, and Lambda detects it automatically. The technique also reached Amazon SageMaker AI training and processing jobs, with benchmarks showing lazy loading maintained 3 to 11 seconds regardless of image size, compared to a median 3 minutes 42 seconds for a 13.2 GB image, representing 8x to 46x improvements.

Amazon EKS Auto Mode now supports Kubernetes Gateway API – Developers can declare traffic routing to applications using Gateway and HTTPRoute resources on Amazon EKS without installing separate controllers, while EKS Auto Mode provisions and manages the underlying AWS load balancing infrastructure. The implementation includes HTTP and gRPC routing, cross-namespace routing, weighted traffic splitting, header-based routing, and automatic TLS certificate discovery through AWS Certificate Manager. Existing Ingress workloads continue functioning alongside them, making this an additive enhancement rather than a migration requirement. Gateway API support comes included with EKS Auto Mode, though standard load balancing charges apply.

Other AWS news

Several additional posts and resources warrant consideration:

How Nubank automated disaster recovery with the AWS DevOps Agent – Nubank operates across Brazil, Mexico, and Colombia serving more than 140 million customers, with over 300 business flows classified as critical and tested on regulatory schedules. The company reports that delegating evidence collection and report generation to the AWS DevOps Agent reduced test cycles from approximately 4.3 hours to roughly 40 minutes, while quadrupling flow coverage in 2026 to more than 160. A single execution terminated more than 900 EKS instances under synthetic traffic using AWS Fault Injection Service, generating the evidence regulators required.

How MoEngage turned over 400 APIs into agent tools with AgentCore Gateway – Roughly 400 internal REST API operations built by 25 teams, distributed across private VPCs in seven Regions, with tenant identity that could never become a model-controllable parameter. MoEngage estimates the managed approach saved approximately six months of platform engineering effort. A notable implementation detail: a complete tool listing would have consumed more than 20,000 tokens per connection, so agents search for tools by describing tasks rather than receiving the full catalog.

Reducing petabyte-scale S3 storage costs with evidence-based lifecycle rules – The challenge lies not in deciding to take action but in identifying which data has become dormant and where it can safely reside. This approach uses S3 Storage Lens groups and Storage Class Analysis to validate access patterns before moving data. In the described engagement, 5.8 PB of logs in Amazon S3 Standard costing approximately $241,000 monthly showed access ratios below 0.1% after 90 days, and transitioning to Glacier Instant Retrieval on a 90-day schedule reduced costs by roughly 70%, a savings the author attributes to that specific workload.

Upcoming AWS events

Mark your calendar for these upcoming AWS events:

  • AWS re:Invent – re:Invent returns to Las Vegas from November 30 to December 4, featuring more than 2,200 sessions. The event catalog is live and reserved seating is open, so register and secure your spots before availability fills.
  • AWS Community Days – Community-led conferences organized and delivered by community leaders. The 2026 season is concluding as re:Invent approaches, so check the hub for remaining events.
  • Join the AWS Builder Center to connect with builders, share solutions, and access development-supporting content. Browse for upcoming AWS-led in-person and virtual events plus developer-focused programming.