AWS announced a set of platform updates spanning generative AI, workflow orchestration, cryptography, identity, containers and Kubernetes. The changes include OpenAI’s GPT-6.1 Terra becoming generally available through Amazon Bedrock and support for using AWS Step Functions workflows as tools for agents through Amazon Bedrock AgentCore Gateway.
Other additions target operational needs beyond AI: AWS Key Management Service (KMS) now supports post-quantum key encapsulation, Amazon ECS can share NVIDIA GPUs across tasks, and AWS Lambda supports lazy loading of container images on Lambda Managed Instances. AWS also added cross-Region trusted identity propagation to IAM Identity Center and Kubernetes Gateway API support to EKS Auto Mode.
GPT-6.1 Terra and Step Functions for agents
OpenAI’s GPT-6.1 Terra is generally available on Amazon Bedrock. OpenAI positions Terra as an everyday-workload model in its GPT-6 family. In OpenAI’s Agents’ Last Exam evaluation, the model scored 15 percentage points above GPT-5.6 Terra, performed on par with GPT-6 Astra and completed tasks more than three times faster than both. These are OpenAI-reported results, rather than an independent comparison.
For pricing, AWS says GPT-6.1 Terra’s input and output token rates are at least 50% lower than those of GPT-6.1 Sol and GPT-5.6 Terra. The model accepts up to 1 million input tokens and supports text and image input. It is accessible through Bedrock APIs as well as ChatGPT Work and Codex.
Separately, teams can expose existing AWS Step Functions workflows as tools through AgentCore Gateway, which connects agents to tools using the Model Context Protocol (MCP). An agent can choose when to invoke a workflow and supply its input; Step Functions carries out the defined steps. That separation lets a workflow retain its specified sequence and controls rather than leaving the agent to determine how each operation runs.
Both Standard and Express workflows can serve as connector targets. Agents can also look up workflow runs. The feature is available in the Regions where AgentCore Gateway is offered, at standard rates.
Security, identity and compute updates
AWS KMS added support for ML-KEM, a post-quantum key encapsulation mechanism, using KMS keys with private keys held in FIPS 140-3 Level 3-validated hardware security modules. The implementation supports all three parameter sets in NIST FIPS 203. Its Encapsulate operation creates a random 32-byte shared secret and ciphertext; Decapsulate recovers the secret. The availability aims to address the “harvest now, decrypt later” risk, in which encrypted exchanges captured today could be targeted if quantum computing advances enough to break current cryptography. KMS support is available in all Regions where KMS runs except the Middle East (UAE and Bahrain) and China Regions.
Amazon Aurora PostgreSQL also added post-quantum TLS key exchange for versions 18 and higher. In identity management, IAM Identity Center now supports trusted identity propagation across Regions. A user’s identity can travel with a request to AWS services in another Region, removing the previous same-Region limitation for this capability. Organizations can grant access based on users and group membership and audit which users accessed services. AWS says the feature has no additional charge and is available wherever IAM Identity Center runs.
Amazon ECS now supports NVIDIA Multi-Process Service (MPS) GPU sharing, allowing multiple ECS tasks to run concurrently on a single NVIDIA GPU. Teams can specify each container’s GPU memory requirement and optionally cap its share of GPU compute. ECS places tasks on GPUs with available capacity as services scale, without requiring code changes. Support covers ECS Managed Instances and ECS on Amazon EC2, and is available in commercial and AWS GovCloud (US) Regions.
Faster container starts and Kubernetes routing
Lambda Managed Instances now support Seekable OCI (SOCI) lazy loading. Rather than downloading a complete container image before startup, Lambda fetches files as they are needed. AWS says the approach can reduce container startup time by up to 70%. To use it, customers create a SOCI index, push it to Amazon ECR and direct the image URI to the indexed tag; Lambda detects the index automatically.
SOCI lazy loading has also been extended to Amazon SageMaker AI training and processing jobs. AWS benchmarks reported lazy-loading times of 3 to 11 seconds regardless of image size, compared with a median of 3 minutes 42 seconds for a 13.2 GB image. AWS characterized the difference as an 8x to 46x improvement in those benchmarks.
For Amazon EKS Auto Mode, Gateway API support allows teams to define application traffic using Gateway and HTTPRoute resources without installing a separate controller. EKS Auto Mode provisions and manages the underlying AWS load-balancing infrastructure. Supported capabilities include HTTP and gRPC routing, cross-namespace routing, weighted traffic splitting, header-based routing and automatic TLS certificate discovery through AWS Certificate Manager. Existing Ingress workloads can continue alongside Gateway API resources, making the feature additive rather than requiring an immediate migration. Gateway API support is included with EKS Auto Mode; standard load-balancing charges still apply.
Operational examples from AWS customers
AWS also highlighted customer and architecture examples related to its services. Nubank reported that using AWS DevOps Agent for evidence collection and report writing reduced a disaster-recovery test cycle from about 4.3 hours to roughly 40 minutes. It also reported quadrupling flow coverage in 2026 to more than 160. In one test, the company used AWS Fault Injection Service to terminate more than 900 EKS instances under synthetic traffic.
MoEngage described using AgentCore Gateway to expose roughly 400 internal REST API operations as agent tools. The APIs were built by 25 teams and operated in private VPCs across seven Regions. The design allows agents to search for tools by describing a task rather than loading a catalog that would exceed 20,000 tokens per connection. MoEngage estimated the managed approach saved about six months of platform engineering.
The announcements point to a broad platform theme: connecting agents to existing, governed systems while also improving control over security, resource use and application delivery. The updates give AWS customers new options to adopt across managed services without requiring a single redesign path.
