Amazon Elastic Container Service (Amazon ECS) now supports AWS CloudTrail data events, providing detailed visibility into Amazon ECS Agent API activities. This new capability enables customers to monitor, audit, and troubleshoot container instance operations.
With CloudTrail data event support, security and operations teams can now maintain comprehensive audit trails of ECS Agent API activities, detect unusual access patterns, and troubleshoot agent communication issues more effectively. Customers can opt in to receive detailed logging through the new data event resource type AWS::ECS::ContainerInstance for ECS agent activities, including when the ECS agent polls for work (ecs:Poll), starts telemetry sessions (ecs:StartTelemetrySession), and submits ECS Managed Instances logs (ecs:PutSystemLogEvents). This enhanced visibility enables teams to better understand how container instance roles are utilized, meet compliance requirements for API activity monitoring, and quickly diagnose operational issues related to agent communications.
This new feature is available for Amazon ECS on EC2 in all AWS Regions and ECS Managed Instances in select regions. Standard CloudTrail data event charges apply. To learn more, visit the Developer Guide.
Amazon Elastic Container Service (Amazon ECS) now supports AWS CloudTrail data events, providing detailed visibility into Amazon ECS Agent API activities. This new capability enables customers to monitor, audit, and troubleshoot container instance operations. With CloudTrail data event support, security and operations teams can now maintain comprehensive audit trails of ECS Agent API activities, detect unusual access patterns, and troubleshoot agent communication issues more effectively. Customers can opt in to receive detailed logging through the new data event resource type AWS::ECS::ContainerInstance for ECS agent activities, including when the ECS agent polls for work (ecs:Poll), starts telemetry sessions (ecs:StartTelemetrySession), and submits ECS Managed Instances logs (ecs:PutSystemLogEvents). This enhanced visibility enables teams to better understand how container instance roles are utilized, meet compliance requirements for API activity monitoring, and quickly diagnose operational issues related to agent communications. This new feature is available for Amazon ECS on EC2 in all AWS Regions and ECS Managed Instances in select regions. Standard CloudTrail data event charges apply. To learn more, visit the Developer Guide.
Nuevos patrones y prácticas de Microsoft Secure Future Initiative (SFI): Guías prácticas para fortalecer la seguridad
Por: Hammad Rajjoub, director, marketing de seguridad.
Al aprovechar el impulso de nuestro lanzamiento inicial de los patrones y prácticas de Microsoft Secure Future Initiative (SFI), esta segunda entrega continúa nuestro compromiso de hacer que la implementación de seguridad sea práctica y escalable. La primera versión introdujo una biblioteca fundamental de orientación procesable basada en arquitecturas probadas como Zero Trust. Ahora, ampliamos esa guía con nuevos ejemplos que reflejan nuestros aprendizajes continuos, para ayudar a los clientes y socios a comprender nuestro enfoque estratégico de manera más profunda y aplicarlo de manera efectiva en sus propios entornos.
El siguiente conjunto de artículos sobre patrones y prácticas de SFI incluye una guía práctica y procesable creada por profesionales, para profesionales, en las áreas de redes, sistemas de ingeniería y respuesta de seguridad. Cada uno de los seis artículos incluye detalles sobre cómo Microsoft ha mejorado nuestra posición de seguridad en cada área para que los clientes, los socios y la comunidad de seguridad en general puedan hacer lo mismo.
Contener infracciones de forma predeterminada. Segmenten y aíslen su red (a través de ACL por servicio, redes virtuales aisladas y más) para evitar el movimiento lateral y limitar los ciberatacantes si ingresan.
Ayuden a eliminar los inquilinos «en la sombra». Apliquen directivas de seguridad de línea base, como la autenticación multifactor (MFA, por sus siglas en inglés), el acceso condicional y más, a cada inquilino de la nube y retiren los que no se usan, para que los ciberatacantes no puedan aprovechar los entornos olvidados y poco protegidos.
Cierren las puertas traseras de identidad. Apliquen altos estándares de seguridad para todas las aplicaciones de Microsoft Entra ID (Azure AD) (quitar aplicaciones no utilizadas, restringir permisos y requerir una autorización segura) para bloquear errores de configuración comunes de los que abusan los ciberatacantes para ataques entre inquilinos.
Protejan la canalización de desarrollo. Requerir MFA de prueba de presencia para confirmaciones y fusiones de código crítico para ayudar a garantizar que solo los desarrolladores verificados puedan insertar código y evitar que los ciberatacantes inyecten cambios de manera subrepticia.
Bloqueen las compilaciones y las dependencias. Controlen sus canalizaciones de integración continua y entrega continua (CI/CD, por sus siglas en inglés) y la gestión de paquetes: utilicen plantillas de compilación estandarizadas, feeds de paquetes internos y análisis automatizados para bloquear los ciberataques a la cadena de suministro antes de que lleguen a la producción.
Aceleren las investigaciones. Estandaricen y centralicen su recopilación de registros (con una retención más prolongada) para que los equipos de seguridad tengan una visibilidad unificada y puedan detectar e investigar incidentes más rápido, incluso en entornos complejos de múltiples nubes.
Más información sobre los patrones y prácticas de SFI
Al igual que los patrones de diseño de software brindan soluciones reutilizables a problemas comunes de ingeniería, los patrones y prácticas de SFI ofrecen enfoques repetibles y probados para resolver desafíos complejos de ciberseguridad. Cada patrón está diseñado para abordar un riesgo de seguridad específico (infraestructura heredada o canalizaciones de CI/CD inconsistentes) y se basa en la propia experiencia de Microsoft. Al igual que los patrones de diseño en la arquitectura de software, estos patrones de seguridad son modulares, extensibles y están diseñados para su reutilización en diversos entornos.
Además, cada patrón en la biblioteca de patrones y prácticas de SFI sigue una estructura consistente y con un propósito. Cada artículo comienza con un nombre de patrón, un identificador conciso que captura la esencia del desafío de ciberseguridad. La sección de problemas describe el riesgo de seguridad y su contexto en el mundo real, para ayudar a los lectores a comprender por qué es importante. La solución describe cómo Microsoft abordó el problema a nivel interno. La sección de orientación proporciona recomendaciones prácticas que los clientes pueden considerar aplicar en sus propios entornos. Por último, la sección de implicaciones describe los resultados y las compensaciones de implementar el patrón, para ayudar a las organizaciones a anticipar tanto los beneficios como las consideraciones operativas.
Esta estructura ofrece un marco para comprender, aplicar y evolucionar las prácticas de seguridad.
Próximos pasos con SFI
La seguridad es un recorrido y Microsoft se compromete a compartir nuestros conocimientos de SFI. Estén atentos a más consejos prácticos en los próximos meses. Los patrones y prácticas de SFI proporcionan una hoja de ruta para poner en práctica una arquitectura segura. La adopción de estos enfoques permite a las organizaciones avanzar en su postura de seguridad, minimizar los obstáculos de implementación y establecer entornos seguros por diseño, de forma predeterminada y en las operaciones.
Para obtener más información sobre las soluciones de seguridad de Microsoft, visiten nuestro sitio web. Agreguen a Favoritos el blog de Seguridad para mantenerse al día con nuestra cobertura experta en asuntos de seguridad. Además, síganos en LinkedIn (Microsoft Security) y X (@MSFTSecurity) para conocer las últimas noticias y actualizaciones sobre ciberseguridad.
The post Nuevos patrones y prácticas de Microsoft Secure Future Initiative (SFI): Guías prácticas para fortalecer la seguridad appeared first on Source LATAM.
AWS Parallel Computing Service (PCS) now supports Slurm v25.05. You can now create AWS PCS clusters running the newer Slurm v25.05.
The release of Slurm v25.05 in PCS provides new Slurm functionalities including enhanced multi-cluster sackd configuration and improved requeue behavior for instance launch failures. With this release, login nodes can now control multiple clusters without requiring sackd reconfiguration or restart. This enables administrators to pre-configure access to multiple clusters for their users. The new requeue behavior enables more resilient job scheduling by automatically retrying failed instance launches during capacity shortages, thus increasing overall cluster reliability.
AWS PCS is a managed service that makes it easier for you to run and scale your high performance computing (HPC) workloads on AWS using Slurm. To learn more about PCS, refer to the service documentation and AWS Region Table.
AWS Parallel Computing Service (PCS) now supports Slurm v25.05. You can now create AWS PCS clusters running the newer Slurm v25.05. The release of Slurm v25.05 in PCS provides new Slurm functionalities including enhanced multi-cluster sackd configuration and improved requeue behavior for instance launch failures. With this release, login nodes can now control multiple clusters without requiring sackd reconfiguration or restart. This enables administrators to pre-configure access to multiple clusters for their users. The new requeue behavior enables more resilient job scheduling by automatically retrying failed instance launches during capacity shortages, thus increasing overall cluster reliability. AWS PCS is a managed service that makes it easier for you to run and scale your high performance computing (HPC) workloads on AWS using Slurm. To learn more about PCS, refer to the service documentation and AWS Region Table.
Today, AWS is announcing the general availability of Amazon EC2 Capacity Manager, a new capability that enables customers to monitor, analyze, and manage EC2 capacity across all of their accounts and regions. This new capability simplifies resource management using a single interface.
EC2 Capacity Manager offers customers a comprehensive view of On-Demand, Spot, and Capacity Reservation usage across their accounts and Regions. The new service features dashboards and charts that present high-level insights while allowing customers to drill down into specific details where needed. These details include historical usage trends to help customers gain a better understanding of their capacity patterns over time, as well as optimization opportunities to guide informed capacity decisions, complete with workflows for implementing these insights. In addition to the updated user interface and APIs, EC2 Capacity Manager allows customers to export data, enabling integration with their existing systems.
Today, AWS is announcing the general availability of Amazon EC2 Capacity Manager, a new capability that enables customers to monitor, analyze, and manage EC2 capacity across all of their accounts and regions. This new capability simplifies resource management using a single interface. EC2 Capacity Manager offers customers a comprehensive view of On-Demand, Spot, and Capacity Reservation usage across their accounts and Regions. The new service features dashboards and charts that present high-level insights while allowing customers to drill down into specific details where needed. These details include historical usage trends to help customers gain a better understanding of their capacity patterns over time, as well as optimization opportunities to guide informed capacity decisions, complete with workflows for implementing these insights. In addition to the updated user interface and APIs, EC2 Capacity Manager allows customers to export data, enabling integration with their existing systems. EC2 Capacity Manager is available in all commercial AWS Regions enabled by default at no additional cost. To learn more, visit the EC2 Capacity Manager user guide, read the AWS News Blog, or get started using EC2 Capacity Manager in the AWS console.
AWS Marketplace now supports purchase order line numbers for AWS Marketplace purchases, simplifying cost-allocation and payment processing. This launch makes it easier for customers to process and pay invoices.
AWS purchase order support allows customers to provide purchase orders per transaction, which reflect on invoices related to that purchase. Now, customers can associate transaction charges not only to purchase orders, but also to a specific PO line number for AWS Marketplace purchases. This capability is supported during procurement and, for future charges, post-procurement in the AWS Marketplace console. You can also view the purchase order and purchase order line number associated to an AWS invoice in the AWS Billing and Cost Management console. Streamline your invoice processing by accurately matching AWS invoices with your purchase order and purchase order line number.
This capability is available today in all AWS Regions where AWS Marketplace is supported.
AWS Marketplace now supports purchase order line numbers for AWS Marketplace purchases, simplifying cost-allocation and payment processing. This launch makes it easier for customers to process and pay invoices. AWS purchase order support allows customers to provide purchase orders per transaction, which reflect on invoices related to that purchase. Now, customers can associate transaction charges not only to purchase orders, but also to a specific PO line number for AWS Marketplace purchases. This capability is supported during procurement and, for future charges, post-procurement in the AWS Marketplace console. You can also view the purchase order and purchase order line number associated to an AWS invoice in the AWS Billing and Cost Management console. Streamline your invoice processing by accurately matching AWS invoices with your purchase order and purchase order line number. This capability is available today in all AWS Regions where AWS Marketplace is supported. To learn about transaction purchase orders for AWS Marketplace, view the AWS Marketplace buyer guide. For information on using blanket purchase orders with AWS, refer to the AWS Billing Documentation.
Microsoft elige Santiago para lanzar su AI Tour en Latinoamérica y debatir el futuro de la inteligencia artificial
La compañía está liderando una nueva fase de transformación digital, en la que la inteligencia artificial y la infraestructura en la nube son motores fundamentales de la competitividad y el crecimiento de las organizaciones de Chile y la región.
Santiago, Chile — Microsoft celebró en Santiago de Chile la primera parada en Latinoamérica de su evento global AI Tour, reuniendo a más de 1.200 líderes empresariales y expertos en tecnología para debatir cómo la inteligencia artificial está transformando la economía y los servicios en Chile y la región.
La jornada en Santiago, que se desarrolló en Espacio Riesco, comenzó con la apertura a cargo de Andrés Roepke, recientemente nombrado Country Manager de Microsoft Chile, quien destacó la oportunidad única que representa la IA para impulsar la economía digital del país.
Shawn Villaron, Vicepresidente de Customer & Strategic Initiatives en Microsoft, ofreció la conferencia principal, que presentó el concepto de Frontier Firms, refiriéndose a aquellas organizaciones que lideran la adopción de IA como eje central de su estrategia.
Esta visión representa una oportunidad real para cerrar la brecha que existe actualmente entre la búsqueda por aumentar la productividad y la falta de tiempo o energía de la fuerza laboral, como muestra el Informe Anual del Índice de Tendencias Laborales 2025. De hecho, según esta investigación citada por Shawn Villaron, el 89 % de los líderes confía en que el trabajo digital ampliará la capacidad de sus equipos en los próximos 12-18 meses.
Por eso, las empresas fronteras están integrando agentes digitales en procesos clave, creando nuevos roles impulsados por IA y generando ventajas competitivas en experiencia del empleado, interacción con clientes, optimización de procesos y aceleración de la innovación. Este enfoque marca el inicio de una nueva era empresarial, donde la IA no solo complementa, sino que redefine la manera en que las compañías operan y crecen.
Posteriormente, en un panel moderado por Tito Arciniega, Presidente de Microsoft Latinoamérica, líderes del Banco de Chile y Cencosud explicaron su visión respecto al uso e impacto de la tecnología en sus organizaciones, en virtud de favorecer la innovación y competitividad de sus negocios.
En este contexto, el Banco de Chile destacó especialmente al convertirse en la primera empresa privada en el país en firmar una alianza estratégica de IA con Microsoft. La entidad fue la primera de su tipo en Chile en dar acceso a todos sus equipos —cerca de 12.000 personas— a la herramienta de IA Generativa, Copilot Chat; así, automatizó procesos clave, permitiendo a sus colaboradores agilizar tareas, analizar información y fortalecer la toma de decisiones. Junto con ello, se implementaron iniciativas para optimizar procesos, mejorar la productividad interna y fortalecer la seguridad digital.
La alianza estratégica entre ambas compañías contempla la conformación de un Comité Ejecutivo y un Comité de Seguimiento, que velarán por la correcta implementación de las iniciativas y la generación de valor sostenible en el tiempo, dándole continuidad al proceso de transformación digital, explorando nuevas tecnologías que agreguen valor a clientes y colaboradores.
“El AI Tour refleja la energía y el impulso que vive Latinoamérica en la era de los agentes. Este encuentro no solo muestra el poder transformador de la inteligencia artificial, sino también cómo nuestras empresas y gobiernos están listos para liderar esta nueva etapa con innovación y responsabilidad”, comentó Tito Arciniega, Presidente de Microsoft Latinoamérica.
Adicionalmente, representantes del Ministerio de Salud y el Ministerio de Vivienda y Urbanismo (Minvu) compartieron su visión del uso de la IA y su potencial para transformar sus operaciones y servicios, orientadas directamente en beneficio de los ciudadanos.
El Minvu destacó como pionero en impulsar iniciativas transformadoras en el sector público, en este caso con la democratización de Copilot Chat, que busca empoderar a todos los colaboradores del ministerio mediante licencias que agilizan la redacción de documentos, el análisis de información y la gestión de solicitudes. Este proceso está acompañado por un ciclo de capacitaciones y un programa de “champions” para asegurar una adopción efectiva y una gestión del cambio organizacional. Además, con la solución Customer Insights, el Ministerio mejoró la atención ciudadana y automatizó procesos internos, posicionándose como referente en transformación digital pública.
El AI Tour, que consolida el compromiso de Microsoft con la innovación y la transformación digital, así como con una IA ética y segura, recorrerá más de 40 ciudades de todo el mundo durante la temporada. A la fecha ya ha completado presentaciones en Estados Unidos, Canadá, Japón y Reino Unido, y continuará en mercados estratégicos para llevar la conversación sobre inteligencia artificial a la vanguardia de las organizaciones públicas y empresariales.
Acerca de Microsoft
Microsoft (Nasdaq «MSFT» @microsoft) crea plataformas y herramientas impulsadas por la IA para ofrecer soluciones innovadoras que satisfagan las necesidades cambiantes de nuestros clientes. La empresa de tecnología está comprometida con hacer que la IA esté ampliamente disponible, de manera responsable, con la misión de empoderar a cada persona y a cada organización en el planeta para lograr más.
The post Microsoft elige Santiago para lanzar su AI Tour en Latinoamérica y debatir el futuro de la inteligencia artificial appeared first on Source LATAM.
Amazon CloudWatch Database Insights now supports tag-based access control for database and per-query metrics powered by RDS Performance Insights. You can implement access controls across a logical grouping of database resources without managing individual resource-level permissions.
Previously, tags defined on RDS and Aurora instances did not apply to metrics powered by Performance Insights, creating significant overhead in manually configuring metric-related permissions at the database resource level. With this launch, those instance tags are now automatically evaluated to authorize metrics powered by Performance Insights. This allows you to define IAM policies using tag-based access conditions, resulting in improved governance and security consistency.
Please refer to RDS and Aurora documentation to get started with defining IAM policies with tag-based access control on database and per-query metrics. This feature is available in all AWS regions where CloudWatch Database Insights is available.
CloudWatch Database Insights delivers database health monitoring aggregated at the fleet level, as well as instance-level dashboards for detailed database and SQL query analysis. It offers vCPU-based pricing – see the pricing page for details. For further information, visit the Database Insights User Guide.
Amazon CloudWatch Database Insights now supports tag-based access control for database and per-query metrics powered by RDS Performance Insights. You can implement access controls across a logical grouping of database resources without managing individual resource-level permissions. Previously, tags defined on RDS and Aurora instances did not apply to metrics powered by Performance Insights, creating significant overhead in manually configuring metric-related permissions at the database resource level. With this launch, those instance tags are now automatically evaluated to authorize metrics powered by Performance Insights. This allows you to define IAM policies using tag-based access conditions, resulting in improved governance and security consistency. Please refer to RDS and Aurora documentation to get started with defining IAM policies with tag-based access control on database and per-query metrics. This feature is available in all AWS regions where CloudWatch Database Insights is available. CloudWatch Database Insights delivers database health monitoring aggregated at the fleet level, as well as instance-level dashboards for detailed database and SQL query analysis. It offers vCPU-based pricing – see the pricing page for details. For further information, visit the Database Insights User Guide.
Starting today, Amazon Elastic Compute Cloud (Amazon EC2) C8g instances are available in AWS Europe (Milan), and AWS Asia Pacific (Hong Kong, Osaka, Melbourne) regions. These instances are powered by AWS Graviton4 processors and deliver up to 30% better performance compared to AWS Graviton3-based instances. Amazon EC2 C8g instances are built for compute-intensive workloads, such as high performance computing (HPC), batch processing, gaming, video encoding, scientific modeling, distributed analytics, CPU-based machine learning (ML) inference, and ad serving. These instances are built on the AWS Nitro System, which offloads CPU virtualization, storage, and networking functions to dedicated hardware and software to enhance the performance and security of your workloads.
AWS Graviton4-based Amazon EC2 instances deliver the best performance and energy efficiency for a broad range of workloads running on Amazon EC2. These instances offer larger instance sizes with up to 3x more vCPUs and memory compared to Graviton3-based Amazon C7g instances. AWS Graviton4 processors are up to 40% faster for databases, 30% faster for web applications, and 45% faster for large Java applications than AWS Graviton3 processors. C8g instances are available in 12 different instance sizes, including two bare metal sizes. They offer up to 50 Gbps enhanced networking bandwidth and up to 40 Gbps of bandwidth to the Amazon Elastic Block Store (Amazon EBS).
Starting today, Amazon Elastic Compute Cloud (Amazon EC2) C8g instances are available in AWS Europe (Milan), and AWS Asia Pacific (Hong Kong, Osaka, Melbourne) regions. These instances are powered by AWS Graviton4 processors and deliver up to 30% better performance compared to AWS Graviton3-based instances. Amazon EC2 C8g instances are built for compute-intensive workloads, such as high performance computing (HPC), batch processing, gaming, video encoding, scientific modeling, distributed analytics, CPU-based machine learning (ML) inference, and ad serving. These instances are built on the AWS Nitro System, which offloads CPU virtualization, storage, and networking functions to dedicated hardware and software to enhance the performance and security of your workloads. AWS Graviton4-based Amazon EC2 instances deliver the best performance and energy efficiency for a broad range of workloads running on Amazon EC2. These instances offer larger instance sizes with up to 3x more vCPUs and memory compared to Graviton3-based Amazon C7g instances. AWS Graviton4 processors are up to 40% faster for databases, 30% faster for web applications, and 45% faster for large Java applications than AWS Graviton3 processors. C8g instances are available in 12 different instance sizes, including two bare metal sizes. They offer up to 50 Gbps enhanced networking bandwidth and up to 40 Gbps of bandwidth to the Amazon Elastic Block Store (Amazon EBS). To learn more, see Amazon EC2 C8g Instances. To get started, see the AWS Management Console.
AWS Systems Manager announces the launch of security updates notification for Windows patching compliance, which helps customers identify security updates that are available but not approved by their patch baseline configuration. This feature introduces a new patch state called «AvailableSecurityUpdate» that reports security patches of all severity levels that are available to install on Windows instances but do not meet the approval rules in your patch baseline.
As organizations grow, administrators need to maintain secure systems while controlling when patches are applied. The security updates notification helps prevent situations where customers could unintentionally leave instances unpatched when using features like ApprovalDelay with large values. By default, instances with available security updates are marked as Non-Compliant, providing a clear signal that security patches require attention. Customers can also configure this behavior through their patch baseline settings to maintain existing compliance reporting if preferred.
This feature is available in all AWS Regions where AWS Systems Manager is available. To get started with security updates notification for Windows patching compliance, visit the AWS Systems Manager Patch Manager console. For more information about this feature, refer to our user documentation or update your patch baseline with the details here. There are no additional charges for using this feature beyond standard AWS Systems Manager pricing.
AWS Systems Manager announces the launch of security updates notification for Windows patching compliance, which helps customers identify security updates that are available but not approved by their patch baseline configuration. This feature introduces a new patch state called «AvailableSecurityUpdate» that reports security patches of all severity levels that are available to install on Windows instances but do not meet the approval rules in your patch baseline. As organizations grow, administrators need to maintain secure systems while controlling when patches are applied. The security updates notification helps prevent situations where customers could unintentionally leave instances unpatched when using features like ApprovalDelay with large values. By default, instances with available security updates are marked as Non-Compliant, providing a clear signal that security patches require attention. Customers can also configure this behavior through their patch baseline settings to maintain existing compliance reporting if preferred. This feature is available in all AWS Regions where AWS Systems Manager is available. To get started with security updates notification for Windows patching compliance, visit the AWS Systems Manager Patch Manager console. For more information about this feature, refer to our user documentation or update your patch baseline with the details here. There are no additional charges for using this feature beyond standard AWS Systems Manager pricing.
AWS announces support for customer managed AWS Key Management Service (KMS) keys in Automated Reasoning checks in Amazon Bedrock Guardrails. This enhancement enables you to use your own encryption keys to protect policy content and tests, giving you full control over key management. Automated Reasoning checks in Amazon Bedrock Guardrails is the first and only generative AI safeguard that helps correct factual errors from hallucinations using logically accurate and verifiable reasoning that explains why responses are correct.
This feature enables organizations in regulated industries like healthcare, financial services, and government to adopt Automated Reasoning checks while meeting compliance requirements for customer-owned encryption keys. For example, a financial institution can now use Automated Reasoning checks to validate loan processing guidelines while maintaining full control over the encryption keys protecting their policy content. When creating an Automated Reasoning policy, you can now select a customer managed KMS key to encrypt your content rather than using the default key.
Customer managed KMS key support for Automated Reasoning checks is available in all AWS Regions where Amazon Bedrock Guardrails is offered: US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Frankfurt), Europe (Ireland), and Europe (Paris).
AWS announces support for customer managed AWS Key Management Service (KMS) keys in Automated Reasoning checks in Amazon Bedrock Guardrails. This enhancement enables you to use your own encryption keys to protect policy content and tests, giving you full control over key management. Automated Reasoning checks in Amazon Bedrock Guardrails is the first and only generative AI safeguard that helps correct factual errors from hallucinations using logically accurate and verifiable reasoning that explains why responses are correct. This feature enables organizations in regulated industries like healthcare, financial services, and government to adopt Automated Reasoning checks while meeting compliance requirements for customer-owned encryption keys. For example, a financial institution can now use Automated Reasoning checks to validate loan processing guidelines while maintaining full control over the encryption keys protecting their policy content. When creating an Automated Reasoning policy, you can now select a customer managed KMS key to encrypt your content rather than using the default key. Customer managed KMS key support for Automated Reasoning checks is available in all AWS Regions where Amazon Bedrock Guardrails is offered: US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Frankfurt), Europe (Ireland), and Europe (Paris). To get started, see the following resources:
Automated Reasoning checks user guide
Amazon Bedrock Guardrails product page
AWS Key Management Service developer guide
Create an Automated Reasoning policy in the Bedrock console
