.png)
Executive Summary
May 2026 was the month agentic AI on AWS crossed from infrastructure into financial plumbing. Three things headline the month:
- Amazon Bedrock AgentCore gained managed payment capabilities in preview – built with Coinbase and Stripe – enabling AI agents to autonomously pay for APIs, MCP servers, web content, and other agents. This is a new cost surface that most FinOps teams have not budgeted for.
- Claude Platform on AWS reached general availability on May 14. Teams can now access Anthropic’s native Claude Platform APIs, console, and early-access beta features directly through their existing AWS account. One login, one bill, consolidated cost visibility.
- Amazon Q Developer announced end-of-support for IDE plugins and paid subscriptions on April 30, 2027. New signups are blocked starting May 15, 2026. All current Q Developer Pro customers should start transition planning to Kiro now.
For FinOps teams, two additional changes carry cost implications: four new EC2 instance families reached GA (M8in, M8ib, R8in, R8ib, C8ine, M8ine), and AWS Interconnect expanded multicloud connectivity to Oracle Cloud Infrastructure in preview. The new EC2 families change the Savings Plan sizing math for network-intensive workloads.
All pricing figures in this document require verification at aws.amazon.com/pricing before acting on them.
AI and Agents: AgentCore Payments, Claude Platform GA, and Bedrock AgentCore Optimization
Amazon Bedrock AgentCore Payments: Agents Can Now Spend Money Autonomously
The single most consequential AWS launch of May 2026 for FinOps teams: Amazon Bedrock AgentCore previewed managed payment capabilities that enable AI agents to autonomously access and pay for external APIs, MCP servers, web content, and other agents. Built in partnership with Coinbase and Stripe, the feature removes the need for custom billing, credential management, and compliance infrastructure in agent pipelines.
How it works: agents connect a Coinbase wallet or Stripe account to AgentCore. When an agent needs to pay for a service, AgentCore handles the transaction on its behalf within defined authorization policies. Supported payment types at launch include pay-per-call APIs, metered MCP servers, and agent-to-agent service payments.
FinOps action required: this feature creates a new, autonomous spend surface. Agents running in production can incur external charges without human approval if authorization policies are not scoped correctly. Before enabling AgentCore Payments in production: define per-agent spend limits, audit which external services each agent is permitted to call, set up AWS Budgets alerts for AgentCore billing line items, and ensure IAM policies restrict payment authorization to specific agent identities. Verify current AgentCore pricing at aws.amazon.com/bedrock – rates change.
Claude Platform on AWS: Generally Available from May 14, 2026
Claude Platform on AWS reached general availability on May 14, 2026. Teams can now access Anthropic’s native Claude Platform experience – including APIs, the Claude console, and early-access beta features – directly through their existing AWS account, without creating a separate Anthropic account.
The practical implications:
- Single AWS login covers both AWS services and Claude Platform access.
- Claude Platform usage appears on the AWS bill alongside other services, enabling unified cost visibility and tagging.
- Enterprise teams on AWS Organizations can extend billing scope to cover Claude Platform usage across linked accounts.
- Early-access Anthropic features are available without separate Anthropic enterprise contracts.
Cost consideration: Claude Platform on AWS uses the same per-token pricing as direct Anthropic API access but consolidates billing under AWS Cost and Usage Reports. Teams already running Claude models via Amazon Bedrock should compare per-token rates between Bedrock Claude and direct Claude Platform access before splitting their workload across both. Verify pricing at aws.amazon.com/pricing – rates change.
For a breakdown of Bedrock per-token costs across all Claude models and how commitment discounts apply to AI inference workloads, see the Usage.ai guide on AWS Cost Optimization.
Amazon Q Developer: End-of-Support Announced, Migration to Kiro Required
Amazon Q Developer IDE plugins and paid subscriptions will reach end-of-support on April 30, 2027. Key dates:
| Date | Event | Action Required |
|---|---|---|
| May 15, 2026 | New Q Developer signups blocked | No new seats can be added to existing subscriptions |
| May 29, 2026 | Opus 4.6 removed from Q Developer Pro | Verify model availability before migrating prompts |
| April 30, 2027 | Q Developer IDE plugins and paid subs end-of-support | All teams must be on Kiro by this date |
Amazon Q Developer in the AWS Management Console and first-party AWS experiences (documentation, mobile app, Slack, Microsoft Teams) are not affected by this retirement. Only IDE plugins and paid subscription tiers are being sunset.
The successor is Kiro – AWS’s new IDE with native agent support. AWS Transform agents are now available in Kiro, along with Claude, Cursor, and Codex. Teams on Q Developer Pro should begin piloting Kiro now given the 12-month runway. If you have large teams on Q Developer Pro annual contracts, verify renewal terms before May 15, 2026 – new signups are already blocked. Verify Kiro pricing at aws.amazon.com/kiro – rates change.
Bedrock AgentCore: Optimization, Agent Toolkit, and Production Loop
AgentCore received two significant updates in May beyond payments:
- AgentCore optimization capabilities (Preview) – recommendations, batch evaluations, and A/B tests that complete the observe-evaluate-improve loop for agents in production. Recommendations analyze production traffic to surface optimization opportunities. Batch evaluations let teams test changes at scale before deploying. A/B tests compare agent versions live.
- Agent Toolkit for AWS – a production-ready suite of tools and guidance available at no additional charge, helping AI coding agents build on AWS with fewer errors, lower token costs, and enterprise-grade security controls. The Agent Toolkit is the successor to the MCP servers, plugins, and skills previously on AWS Labs.
The optimization capabilities are directly relevant to cost: agents running without optimization often use more tokens per task than necessary. AgentCore recommendations can identify prompt patterns generating excessive output tokens or model calls, which translates to measurable inference cost reduction. No additional charge for the optimization feature during preview. Verify at aws.amazon.com/bedrock – availability may vary by region.
Compute: Six New EC2 Instance Families GA, M3 Ultra Mac, and Interconnect Expands to Oracle Cloud
EC2 M8in, M8ib, R8in, R8ib, C8ine, M8ine: All Generally Available in May
Six EC2 instance families reached general availability across the first two weeks of May 2026, all powered by 6th-generation Intel Xeon Scalable processors and 6th-generation AWS Nitro cards.
| Instance Family | Optimized For | Network BW | EBS BW | vs Prior Gen | Regions at Launch |
|---|---|---|---|---|---|
| M8in | General purpose + network-intensive | 600 Gbps | Standard | +43% compute vs M6in | US-E1, US-W2, AP-TYO, EU-ESP |
| M8ib | General purpose + EBS-intensive | Standard | 300 Gbps | +43% compute vs M6ib | US-E1, US-W2, AP-TYO, EU-ESP |
| R8in | Memory-optimized + network-intensive | 600 Gbps | Standard | +43% compute vs R6in | US-E1, US-W2, AP-TYO |
| R8ib | Memory-optimized + EBS-intensive | Standard | 300 Gbps | +43% compute vs R6ib | US-E1, US-W2, AP-TYO |
| C8ine | Network virtual appliances, 5G UPF | 2.5x pkt perf vs C6in | 2x throughput vs C6in | Security appliances, firewalls | US-E1, US-W2, AP-TYO |
| M8ine | Network-optimized general purpose | 2.5x pkt perf vs M6in | 2x throughput vs M6in | Load balancers, 5G | US-E1, US-W2 |
For FinOps teams with Compute Savings Plans or EC2 Instance Savings Plans covering current-generation M7in, R7in, or C7i instances: these new families are not automatically covered by existing plans. Savings Plans cover based on instance family flexibility rules. If you plan to migrate workloads to any of these six families, verify your Savings Plan coverage scope before migrating to avoid unexpected on-demand charges. Verify pricing at aws.amazon.com/ec2/pricing – rates change.
The Usage.ai guide on AWS Savings Plans vs Reserved Instances covers how Compute Savings Plans apply across instance families and how to check coverage scope before migrating to new families.
EC2 M3 Ultra Mac Instances: Now Generally Available
Amazon EC2 M3 Ultra Mac instances are generally available. Powered by Apple M3 Ultra chips, these are the highest-performance Mac instances available on EC2. Use cases include Xcode builds, iOS and macOS CI/CD pipelines, and enterprise macOS application development at scale.
Billing note: Mac instances require a dedicated host and have a minimum 24-hour allocation period. A team that starts an M3 Ultra Mac instance and terminates it after 2 hours is still billed for 24 hours. Plan usage in batches or use auto-scaling policies that align with the minimum billing window. Verify M3 Ultra Mac pricing at aws.amazon.com/ec2/pricing – rates change.
AWS Interconnect Expands to Oracle Cloud Infrastructure (Preview)
AWS Interconnect – the private multicloud connectivity product that reached GA in April with Google Cloud – now supports Oracle Cloud Infrastructure in preview. The expansion uses the same Apache 2.0 specification published on GitHub, meaning any cloud provider can implement it as an Interconnect partner.
For teams running workloads split between AWS and OCI – common in Oracle Database and Exadata deployments – this creates a private Layer 3 connection between AWS VPCs and OCI resources without traffic traversing the public internet. MACsec encryption, multi-facility resiliency, and CloudWatch monitoring apply to the OCI connection as they do to the Google Cloud connection. Verify Interconnect pricing at aws.amazon.com/interconnect – rates change.
AWS Local Zones: Istanbul Now Open
AWS launched a Local Zone in Istanbul, Turkey on May 22, 2026. Teams serving users in Turkey can now run latency-sensitive workloads within Turkish borders while connecting to the nearest AWS Region for non-latency-sensitive services. The Istanbul Local Zone supports data residency requirements under Turkish data protection regulation.
Available services at launch: EC2, EBS, VPC, and ELB. Verify Local Zone pricing at aws.amazon.com/about-aws/global-infrastructure/localzones/pricing – rates change.
Developer Tools: AWS Transform Turns One, Kiro Web, ExtendDB Open-Sourced, and Security Agent
AWS Transform One-Year Milestone: 4.5 Billion Lines of Code Processed
AWS Transform celebrated its one-year anniversary in May 2026 with a milestone report: thousands of customers migrated hundreds of thousands of servers, saved 1.6 million plus hours of engineering work, and processed 4.5 billion plus lines of code through the agentic transformation service in 12 months.
New capabilities released at the anniversary:
- Transform agents now available in Kiro, Claude, Cursor, and Codex – expanding from AWS-native tooling to the development environments engineering teams already use.
- Agent builder toolkit Kiro power – teams can now build customized transformation agents for their own modernization patterns.
- Full-stack Windows modernization capabilities and automated testing for mainframe workloads continue expanding coverage.
Transform is priced per line of code processed (verify at aws.amazon.com/transform – rates change). For teams running annual modernization programs, Transform can replace significant manual engineering hours at a predictable per-LOC cost.
Kiro Web: Browser-Based IDE Now Available
Kiro Web launched in May 2026, bringing the full Kiro IDE experience to a web browser without requiring a local installation. Teams can now use Kiro’s agent-assisted development, spec-driven workflows, and AWS Transform integrations from any device with a browser.
Kiro is the designated successor for Amazon Q Developer IDE users. With Q Developer new signups blocked from May 15 and end-of-support set for April 30, 2027, Kiro Web lowers the migration friction significantly – teams can pilot Kiro without requiring a software deployment across developer machines. Verify Kiro pricing at aws.amazon.com/kiro – rates change.
ExtendDB Open-Sourced by AWS
AWS open-sourced ExtendDB under an Apache 2.0 license in May 2026. ExtendDB is a database extension framework that allows developers to build custom database capabilities directly into existing database engines without forking the engine or running a separate service. Early contributors are building vector search extensions, custom indexing strategies, and domain-specific query operators on top of PostgreSQL and MySQL-compatible engines.
Cost implication for teams using managed database services: ExtendDB extensions running inside existing RDS or Aurora instances add compute load to existing instance sizes. Model the CPU and memory overhead of any ExtendDB extension against your current instance utilization before deploying to production. Verify at github.com/aws/extenddb.
AWS Security Agent: Full Repository Code Scanning in Preview
AWS Security Agent added full repository code scanning in preview at no additional charge for existing customers. The capability performs deep, context-aware security analysis of an entire codebase – not just individual files or pull requests. When vulnerabilities are found, the scanner generates code remediation: specific fixes tied to the exact file and line. Teams can remediate security vulnerabilities faster without requiring a separate SAST tool. Available at no additional charge for existing AWS Security Agent customers during preview. Verify at aws.amazon.com/q/developer – terms change.
Security: Security Hub Extended, KY3P Assessment, and AWS Security Agent
Security Hub Extended: 21 Partner Integrations Across 9 Categories
AWS Security Hub Extended expanded to 21 curated partner security solutions across 9 categories in the week of May 25, 2026. Categories include endpoint protection, network security, identity and access management, data security, threat intelligence, compliance, SIEM and SOAR, vulnerability management, and cloud security posture management.
Cost implication: Security Hub Extended partner integrations are billed through Security Hub finding ingestion rates plus the partner tool’s own licensing. Teams enabling multiple partner integrations simultaneously may see Security Hub finding volume increase significantly. Set ingestion filters before enabling all 21 integrations at once to avoid unexpected Security Hub cost spikes. Verify Security Hub pricing at aws.amazon.com/security-hub/pricing – rates change.
AWS Completes S&P Global KY3P Security Assessment
AWS completed the S&P Global Know Your Third Party (KY3P) assessment in May 2026. The KY3P assessment evaluates cloud service provider security posture against a standardized framework used by financial services organizations for vendor due diligence. AWS customers in regulated financial services industries can now use the published KY3P assessment to reduce their own supplier due diligence burden rather than conducting independent assessments. This lowers the compliance overhead cost for financial services teams running critical workloads on AWS.
FinOps and Cost Management: What May 2026 Means for AWS Spend
AgentCore Payments Is a New Unbudgeted Cost Surface
The launch of AgentCore Payments in preview is the highest-priority new cost risk from May 2026. Unlike most AWS services where costs are bounded by infrastructure provisioning, AgentCore Payments creates an autonomous spend channel: an agent can initiate external financial transactions within the bounds of its authorization policy without any human approval step.
Before enabling AgentCore Payments for any production agent: define maximum per-transaction and per-day spend limits at the IAM policy level, configure AWS Budgets alerts specifically for AgentCore billing SKUs, audit which external services each agent is authorized to pay, and assign per-agent cost allocation tags to separate payment activity by workload. Do not enable this feature in production without explicit budget controls in place. Verify at aws.amazon.com/bedrock – availability and pricing subject to change.
New EC2 Families and Savings Plan Coverage: Check Before Migrating
The six new EC2 families (M8in, M8ib, R8in, R8ib, C8ine, M8ine) are the most relevant hardware change for teams running network-intensive or EBS-intensive workloads. The 43% compute improvement per vCPU means significantly lower effective cost per unit of work on eligible workloads. The migration risk is Savings Plan coverage.
Compute Savings Plans cover EC2 usage regardless of instance family, size, OS, or region. If you hold Compute Savings Plans, migration to the new families is covered. EC2 Instance Savings Plans are family-specific – they cover a specific instance family in a specific region. If you hold EC2 Instance Savings Plans on M7in, R7in, or C7i and migrate to the new families, your existing plans may not apply. Pull your current Savings Plan scope from the AWS Cost Management console before planning any migration. Verify at aws.amazon.com/savingsplans – terms change.
Q Developer to Kiro Migration: Seat Cost Planning
Teams on Amazon Q Developer Pro need to model the Kiro transition cost before the April 30, 2027 end-of-support date. Key financial questions to answer now: What is your current Q Developer Pro seat count and annual contract value? What is the equivalent Kiro pricing for the same seat count? Is Kiro available in all regions where your development teams operate? Are there any annual contract commitments on Q Developer Pro that extend past April 2027?
New Q Developer signups are blocked from May 15, 2026. If your team was planning to add seats to Q Developer Pro, that path is closed. Those seats must go to Kiro. Verify Kiro pricing at aws.amazon.com/kiro and Q Developer pricing at aws.amazon.com/q/developer – rates change.
Claude Platform on AWS: Consolidated Billing for Anthropic Usage
Claude Platform on AWS GA means teams running Claude workloads no longer need separate Anthropic billing accounts. Consolidating Claude Platform usage under AWS billing enables: unified Cost and Usage Report coverage across all Claude API calls, cost allocation tags applied to Claude Platform usage alongside other AWS resources, and AWS Budgets alerts covering total AI spend rather than tracking Anthropic and Bedrock invoices separately.
Teams that currently split Claude usage between direct Anthropic API access and Amazon Bedrock Claude should evaluate consolidating under Claude Platform on AWS for billing simplicity, unless per-token pricing differs materially between the two access paths. Verify pricing at aws.amazon.com/pricing – rates change.
