.png)
Key takeaways
1
AgentCore Payments entered preview on May 7 agents can now autonomously pay for APIs, MCP servers, web content, and other agents through Coinbase or Stripe wallets, creating a spend surface that settles outside the AWS bill and that most FinOps teams have not budgeted for.
2
Claude Platform on AWS reached GA on May 11 Anthropic's native APIs, console, and early-access beta features now run through an existing AWS account under consolidated AWS billing.
3
Q Developer IDE plugins and paid subscriptions end support on April 30, 2027 new signups closed on May 15, 2026, but existing subscriptions can still add seats, so migration to Kiro can be phased rather than forced.
4
Six new EC2 instance families are generally available M8in, M8ib, R8in, R8ib, C8ine, and M8ine change Savings Plan sizing math for network-intensive and EBS-intensive workloads.
5
AWS Interconnect added Oracle Cloud Infrastructure in preview in US East (N. Virginia) private Layer 3 connectivity between AWS VPCs and OCI resources without traffic traversing the public internet.
The updates below cover what changed, what it costs, and what to do before the deadlines hit.
This page covers AWS announcements made from April 27 through May 29, 2026. All pricing figures in this document require verification at aws.amazon.com before acting on them.
This page covers AWS announcements made from April 27 through May 29, 2026. All pricing figures in this document require verification at aws.amazon.com before acting on them.
AI and Agents: Payments, Claude Platform, Optimization
AgentCore Payments: Agents Now Spend Money
The single most consequential AWS launch of May 2026 for FinOps teams: Amazon Bedrock AgentCore previewed managed payment capabilities on May 7, 2026, enabling AI agents to autonomously access and pay for external APIs, MCP servers, web content, and other agents.
Built in partnership with Coinbase and Stripe, the feature removes the need for custom billing, credential management, and compliance infrastructure in agent pipelines. AWS covers the design in a deep dive on the Machine Learning Blog, with implementation detail in the AgentCore payments documentation.
How it works:
Supported payment targets at launch are APIs, MCP servers, web content, and other agents. The Coinbase x402 Bazaar MCP server is also available through AgentCore Gateway, exposing over 10,000 x402 endpoints that agents can search, discover, and pay for autonomously.
AgentCore Payments is available in preview in US East (N. Virginia), US West (Oregon), Europe (Frankfurt), and Asia Pacific (Sydney).
FinOps action required: this feature creates a new, autonomous spend surface. Agents running in production can incur external charges without a human approval step. Because AgentCore Payments is a preview-stage feature, spending limits and APIs may change before GA. Treat any agent workload touching paid APIs or MCP servers as a new, unbudgeted spend channel settled outside the AWS bill starting now, the full pre-deployment checklist is in the FinOps section below.
Built in partnership with Coinbase and Stripe, the feature removes the need for custom billing, credential management, and compliance infrastructure in agent pipelines. AWS covers the design in a deep dive on the Machine Learning Blog, with implementation detail in the AgentCore payments documentation.
How it works:
- Developers connect a Coinbase CDP wallet or Stripe Privy wallet to AgentCore as a payment connection, and set session-level spending limits.
- When an agent encounters a paid resource and receives an HTTP 402 response, AgentCore handles the x402 protocol negotiation, wallet authentication, stablecoin payment, and proof delivery back to the endpoint.
Supported payment targets at launch are APIs, MCP servers, web content, and other agents. The Coinbase x402 Bazaar MCP server is also available through AgentCore Gateway, exposing over 10,000 x402 endpoints that agents can search, discover, and pay for autonomously.
AgentCore Payments is available in preview in US East (N. Virginia), US West (Oregon), Europe (Frankfurt), and Asia Pacific (Sydney).
FinOps action required: this feature creates a new, autonomous spend surface. Agents running in production can incur external charges without a human approval step. Because AgentCore Payments is a preview-stage feature, spending limits and APIs may change before GA. Treat any agent workload touching paid APIs or MCP servers as a new, unbudgeted spend channel settled outside the AWS bill starting now, the full pre-deployment checklist is in the FinOps section below.
Claude Platform Hits GA on AWS
Claude Platform on AWS reached general availability on May 11, 2026. Teams can now access Anthropic’s native Claude Platform experience including APIs, the Claude console, and early-access beta features directly through their existing AWS account, without creating a separate Anthropic account. AWS published a deep dive on the Machine Learning Blog covering setup and architecture.
The practical implications:
Claude Platform on AWS is available in 17 Regions, including US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), South America (São Paulo), seven European Regions, and five Asia Pacific Regions.
Important caveat: Claude Platform on AWS is operated by Anthropic, and customer data is processed outside the AWS security boundary. AWS positions it for development teams and enterprises that do not have specific regional data residency requirements. Teams with residency obligations should evaluate Amazon Bedrock instead.
Cost consideration: consolidating Claude Platform usage under AWS billing removes the need for a separate Anthropic billing account. Teams already running Claude models via Amazon Bedrock should compare rates between Bedrock Claude and direct Claude Platform access before splitting their workload across both.
For a breakdown of Bedrock per-token costs across all Claude models and how commitment discounts apply to AI inference workloads, see the Usage.ai guide on AWS Cost Optimization.
The practical implications:
- Single AWS login covers both AWS services and Claude Platform access.
- Existing IAM credentials and access controls continue to apply, alongside consolidated AWS billing and CloudTrail audit logging for security visibility.
- Early-access Anthropic features are available without separate Anthropic enterprise contracts.
Claude Platform on AWS is available in 17 Regions, including US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), South America (São Paulo), seven European Regions, and five Asia Pacific Regions.
Important caveat: Claude Platform on AWS is operated by Anthropic, and customer data is processed outside the AWS security boundary. AWS positions it for development teams and enterprises that do not have specific regional data residency requirements. Teams with residency obligations should evaluate Amazon Bedrock instead.
Cost consideration: consolidating Claude Platform usage under AWS billing removes the need for a separate Anthropic billing account. Teams already running Claude models via Amazon Bedrock should compare rates between Bedrock Claude and direct Claude Platform access before splitting their workload across both.
For a breakdown of Bedrock per-token costs across all Claude models and how commitment discounts apply to AI inference workloads, see the Usage.ai guide on AWS Cost Optimization.
Q Developer Sunset: Migrate to Kiro
Amazon Q Developer IDE plugins and paid subscriptions will reach end-of-support on April 30, 2027. AWS announced the sunset on April 30, 2026, with the first changes taking effect in May.
| Date | Event | What it means |
|---|---|---|
| May 15, 2026 | New Q Developer signups blocked | New Free Tier accounts and new subscriptions can no longer be created. Existing subscriptions can still add users. |
| May 29, 2026 | Opus 4.6 removed from Q Developer Pro | Opus 4.5 and all other existing models remain available. Verify model availability before migrating prompts. |
| April 30, 2027 | IDE plugins and paid subscriptions end support | Includes Java language upgrades and .NET porting delivered through the plugins. Complete in-progress transformations before this date. |
Source for all three rows: Amazon Q Developer end-of-support announcement.
What is not affected: Q Developer in the AWS Management Console and first-party AWS experiences, the AWS marketing website, the AWS documentation site, the AWS Console Mobile App, and Q Developer for Chat Apps in Slack and Microsoft Teams. Customers using Q Developers in these products retain their current subscription benefits and capabilities.
What is being sunset: the IDE plugins across VS Code, JetBrains, Eclipse, and Visual Studio, plus the paid subscription tiers. Plugin listings stay published on all four marketplaces with a deprecation notice pointing to Kiro, and critical bugfixes continue through the transition window.
The designated successor is Kiro, AWS’s agentic development environment spanning an IDE, a CLI, and a web interface. Kiro reached general availability in November 2025 and is built on a VS Code base with spec-driven development at its core.
Where Q Developer responded to prompts and completed code inline, Kiro works from structured specifications to plan, implement, and verify changes across a codebase producing requirements.md, design.md, and tasks.md documents that guide the agent through implementation.
Kiro also includes the capabilities developers rely on in Q Developer today: agentic coding, inline chat, terminal integration, and MCP support.
AWS Transform agents are available in Kiro alongside Claude, Cursor, and Codex. The latest coding models, including Claude Opus 4.7, are available exclusively on Kiro.
With new signups closed and end-of-support set for April 30, 2027, teams on Q Developer Pro annual contracts face the most exposure. Piloting Kiro now avoids a forced migration under time pressure, and because existing subscriptions can still add seats, the transition can be phased.
What is not affected: Q Developer in the AWS Management Console and first-party AWS experiences, the AWS marketing website, the AWS documentation site, the AWS Console Mobile App, and Q Developer for Chat Apps in Slack and Microsoft Teams. Customers using Q Developers in these products retain their current subscription benefits and capabilities.
What is being sunset: the IDE plugins across VS Code, JetBrains, Eclipse, and Visual Studio, plus the paid subscription tiers. Plugin listings stay published on all four marketplaces with a deprecation notice pointing to Kiro, and critical bugfixes continue through the transition window.
The designated successor is Kiro, AWS’s agentic development environment spanning an IDE, a CLI, and a web interface. Kiro reached general availability in November 2025 and is built on a VS Code base with spec-driven development at its core.
Where Q Developer responded to prompts and completed code inline, Kiro works from structured specifications to plan, implement, and verify changes across a codebase producing requirements.md, design.md, and tasks.md documents that guide the agent through implementation.
Kiro also includes the capabilities developers rely on in Q Developer today: agentic coding, inline chat, terminal integration, and MCP support.
AWS Transform agents are available in Kiro alongside Claude, Cursor, and Codex. The latest coding models, including Claude Opus 4.7, are available exclusively on Kiro.
With new signups closed and end-of-support set for April 30, 2027, teams on Q Developer Pro annual contracts face the most exposure. Piloting Kiro now avoids a forced migration under time pressure, and because existing subscriptions can still add seats, the transition can be phased.
Bedrock AgentCore: Optimization and Agent Toolkit
AgentCore gained two capabilities alongside payments, both announced at the end of April and landing in the May cycle:
The optimization capabilities carry a plausible cost angle: agents running without optimization often use more tokens per task than necessary, and optimized system prompts and tool descriptions can reduce that. AWS frames the benefit as agent quality and performance rather than cost reduction, so treat the inference-cost saving as an expected side effect rather than a stated outcome. AWS published no pricing for the optimization capabilities at preview.
Optimization is available in all Regions where AgentCore Evaluations is available.
- AgentCore optimization capabilities (Preview) recommendations, batch evaluations, and A/B tests that complete the observe-evaluate-improve loop for agents in production.
- Recommendations analyze production traces and evaluation outputs generated by AgentCore to create optimized system prompts and tool descriptions tailored to a specific workload.
- Batch evaluations validate those recommendations against pre-defined test cases.
- A/B tests validate them further against pre-defined test sets or live production traffic, with statistical significance reported before any change is promoted.
- Agent Toolkit for AWS a production-ready suite of tools and guidance available at no additional charge, helping AI coding agents build on AWS with fewer errors, lower token costs, and enterprise-grade security controls. The Agent Toolkit is the successor to the MCP servers, plugins, and skills previously on AWS Labs.
The optimization capabilities carry a plausible cost angle: agents running without optimization often use more tokens per task than necessary, and optimized system prompts and tool descriptions can reduce that. AWS frames the benefit as agent quality and performance rather than cost reduction, so treat the inference-cost saving as an expected side effect rather than a stated outcome. AWS published no pricing for the optimization capabilities at preview.
Optimization is available in all Regions where AgentCore Evaluations is available.
Compute: EC2 Families, Mac, Interconnect, Local Zones
Six New EC2 Instance Families
Six EC2 instance families reached general availability in late April 2026 and carried into the May reporting cycle, appearing in the AWS Weekly Roundup for May 4, 2026. All are powered by custom 6th-generation Intel Xeon Scalable processors available only on AWS, paired with 6th-generation AWS Nitro cards.
| Instance Family | Optimized For | Bandwidth | vs Prior Gen | Regions at Launch |
|---|---|---|---|---|
| M8in | General purpose + network-intensive | Up to 600 Gbps network | Up to +43% performance vs M6in | US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), Europe (Spain) |
| M8ib | General purpose + EBS-intensive | Up to 300 Gbps EBS | Up to +43% performance vs M6ib | US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), Europe (Spain) |
| R8in | Memory-optimized + network-intensive | Up to 600 Gbps network | Up to +43% performance vs R6in | US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Spain) |
| R8ib | Memory-optimized + EBS-intensive | Up to 300 Gbps EBS | Up to +43% performance vs R6ib | US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Spain) |
| C8ine | Network virtual appliances, virtual firewalls, 5G UPF | Up to 2.5x packet performance per vCPU; up to 2x network throughput through internet gateways | vs C6in | US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo) |
| M8ine | Network-optimized general purpose, load balancers, 5G | Up to 2.5x packet performance per vCPU; up to 2x network throughput through internet gateways | vs M6in | US East (N. Virginia), US West (Oregon) |
Sources: M8in and M8ib, R8in and R8ib, C8ine and M8ine.
R8in and R8ib are also well-suited to large commercial databases, data lakes, and in-memory databases such as SAP HANA.
If you plan to migrate workloads to any of these six families, verify your Savings Plan coverage scope before migrating to avoid unexpected on-demand charges. The coverage rules differ by plan type and are covered in the FinOps section below.
The Usage.ai guide on AWS Savings Plans vs Reserved Instances covers how Compute Savings Plans apply across instance families and how to check coverage scope before migrating to new families.
May also brought a second wave of instances in the same generation: M8idn and M8idb and R8idn and R8idb, built on the same 6th-generation Intel Xeon Scalable processors and Nitro cards. These deliver up to 43% better compute performance per vCPU compared with previous-generation instances, with up to 600 Gbps network bandwidth on the M8idn and R8idn variants and up to 300 Gbps EBS bandwidth on M8idb and R8idb.
R8in and R8ib are also well-suited to large commercial databases, data lakes, and in-memory databases such as SAP HANA.
If you plan to migrate workloads to any of these six families, verify your Savings Plan coverage scope before migrating to avoid unexpected on-demand charges. The coverage rules differ by plan type and are covered in the FinOps section below.
The Usage.ai guide on AWS Savings Plans vs Reserved Instances covers how Compute Savings Plans apply across instance families and how to check coverage scope before migrating to new families.
May also brought a second wave of instances in the same generation: M8idn and M8idb and R8idn and R8idb, built on the same 6th-generation Intel Xeon Scalable processors and Nitro cards. These deliver up to 43% better compute performance per vCPU compared with previous-generation instances, with up to 600 Gbps network bandwidth on the M8idn and R8idn variants and up to 300 Gbps EBS bandwidth on M8idb and R8idb.
EC2 M3 Ultra Mac Instances
Amazon EC2 M3 Ultra Mac instances are generally available. They are built on Apple M3 Ultra Mac Studio computers featuring a 28-core CPU, 60-core GPU, 32-core Neural Engine, and 256GB of unified memory.
Compared with EC2 M4 Max Mac instances, M3 Ultra provides 2x the unified memory, 1.75x the CPU cores, 1.5x the GPU cores, and 2x the Neural Engine cores. That headroom lets Apple developers run significantly more Xcode simulators in parallel and accelerate on-device ML workflows.
Use cases include Xcode builds, iOS and macOS CI/CD pipelines, and enterprise macOS application development at scale.
Billing note: Mac instances require a dedicated host and have a minimum 24-hour allocation period. A team that starts an M3 Ultra Mac instance and terminates it after 2 hours is still billed for 24 hours. Plan usage in batches, or use auto-scaling policies that align with the minimum billing window.
Compared with EC2 M4 Max Mac instances, M3 Ultra provides 2x the unified memory, 1.75x the CPU cores, 1.5x the GPU cores, and 2x the Neural Engine cores. That headroom lets Apple developers run significantly more Xcode simulators in parallel and accelerate on-device ML workflows.
Use cases include Xcode builds, iOS and macOS CI/CD pipelines, and enterprise macOS application development at scale.
Billing note: Mac instances require a dedicated host and have a minimum 24-hour allocation period. A team that starts an M3 Ultra Mac instance and terminates it after 2 hours is still billed for 24 hours. Plan usage in batches, or use auto-scaling policies that align with the minimum billing window.
AWS Interconnect Adds Oracle Cloud (Preview)
AWS Interconnect, the private multicloud connectivity product that reached GA in April 2026 with Google Cloud as launch partner, now supports Oracle Cloud Infrastructure in preview, in the US East (N. Virginia) Region only. Microsoft Azure support is expected later in 2026.
OCI is the latest cloud service provider to adopt the open specification that powers AWS Interconnect. AWS published that specification on GitHub under the Apache 2.0 license, so any cloud provider can become an Interconnect partner by implementing the technical specification and meeting AWS operational requirements, including resiliency standards, support commitments, and service level agreements.
For teams running workloads split between AWS and OCI, common in Oracle Database and Exadata deployments, this creates a private Layer 3 connection between AWS VPCs and OCI resources without traffic traversing the public internet.
On the generally available Google Cloud path, each connection uses IEEE 802.1AE MACsec encryption on the physical links between the two providers’ edge routers, spans multiple logical links across at least two physical facilities for resiliency, and integrates with Amazon CloudWatch including a Network Synthetic Monitor. AWS describes the OCI experience as consistent with Google Cloud but has not published a feature-by-feature breakdown for the preview, so confirm parity before designing against it. Current provider status is listed on the AWS Interconnect multicloud product page.
OCI is the latest cloud service provider to adopt the open specification that powers AWS Interconnect. AWS published that specification on GitHub under the Apache 2.0 license, so any cloud provider can become an Interconnect partner by implementing the technical specification and meeting AWS operational requirements, including resiliency standards, support commitments, and service level agreements.
For teams running workloads split between AWS and OCI, common in Oracle Database and Exadata deployments, this creates a private Layer 3 connection between AWS VPCs and OCI resources without traffic traversing the public internet.
On the generally available Google Cloud path, each connection uses IEEE 802.1AE MACsec encryption on the physical links between the two providers’ edge routers, spans multiple logical links across at least two physical facilities for resiliency, and integrates with Amazon CloudWatch including a Network Synthetic Monitor. AWS describes the OCI experience as consistent with Google Cloud but has not published a feature-by-feature breakdown for the preview, so confirm parity before designing against it. Current provider status is listed on the AWS Interconnect multicloud product page.
AWS Local Zones: Istanbul Now Open
AWS opened a Local Zone in Istanbul, Türkiye on May 20, 2026 Teams serving users in Türkiye can now run latency-sensitive workloads within Turkish borders while connecting to the nearest AWS Region for non-latency-sensitive services, and can store and back up data locally to help meet data residency requirements. AWS covers regional context in the launch blog post.
Available services at launch:
Available services at launch:
- Amazon EC2 with C7i, M7i, and R7i instances
- Amazon S3 with the One Zone-Infrequent Access storage class
- Amazon EBS with Local Snapshots, and gp3, gp2, io1, sc1, and st1 volume types
- Amazon ECS and Amazon EKS
- Amazon VPC, AWS Direct Connect, and Application Load Balancer
Developer Tools: Transform, Kiro Web, ExtendDB, Security Agent
AWS Transform: 4.5 Billion Lines Processed
AWS Transform celebrated its one-year anniversary in May 2026. In 12 months through the agentic transformation service:
New at the anniversary:
- Thousands of customers migrated workloads
- Hundreds of thousands of servers migrated
- 1.6 million plus hours of engineering work saved
- 4.5 billion plus lines of code processed
New at the anniversary:
- Transform agents in Kiro, Claude, Cursor, and Codex: expanding from AWS-native tooling to the development environments engineering teams already use.
- Agent builder toolkit Kiro power: teams can now build customized transformation agents for their own modernization patterns.
- Full-stack Windows modernization capabilities and Reimagine plus automated testing functionality for mainframe workloads were introduced at re:Invent 2025 and continue to expand coverage.
Kiro Web: Browser-Based IDE Now Available
Kiro Web launched in May 2026, bringing Kiro’s spec-driven development, AI chat, and agent capabilities to a web browser without requiring a local installation. AWS noted the launch in the Weekly Roundup for May 25, 2026
For teams evaluating the Q Developer migration, this lowers pilot friction significantly, Kiro can be trialled without deploying software across developer machines.
Kiro pricing: five tiers, starting with a perpetual Free tier at 50 credits. Paid tiers are Pro at $20/month (1,000 credits), Pro+ at $40/month (2,000), Pro Max at $100/month (5,000), and Power at $200/month (10,000). Credits beyond the included block cost $0.04 either way, but the billing mechanism differs by plan: individual paid tiers buy prepaid add-on credit packs, while team plans have administrator-controlled overages that are disabled by default. Team plans also add consolidated billing, usage analytics, and SSO through AWS IAM Identity Center. Confirm current rates on the official Kiro pricing page before modelling seat cost.
For teams evaluating the Q Developer migration, this lowers pilot friction significantly, Kiro can be trialled without deploying software across developer machines.
Kiro pricing: five tiers, starting with a perpetual Free tier at 50 credits. Paid tiers are Pro at $20/month (1,000 credits), Pro+ at $40/month (2,000), Pro Max at $100/month (5,000), and Power at $200/month (10,000). Credits beyond the included block cost $0.04 either way, but the billing mechanism differs by plan: individual paid tiers buy prepaid add-on credit packs, while team plans have administrator-controlled overages that are disabled by default. Team plans also add consolidated billing, usage analytics, and SSO through AWS IAM Identity Center. Confirm current rates on the official Kiro pricing page before modelling seat cost.
ExtendDB: Open-Source DynamoDB Adapter
AWS announced version 0.1 of ExtendDB on May 20, 2026 an open source project that implements the Amazon DynamoDB API with pluggable storage backends.
ExtendDB implements the DynamoDB control plane and data plane APIs, including operations on tables, items, and streams. The reference storage backend at launch is PostgreSQL, and the pluggable architecture allows the community to add new backends without modifying the core adapter.
What it enables: using the DynamoDB programming model in environments where the DynamoDB managed service is not available developer laptops, on-premises data centers, and disconnected edge sites without rewriting application code.
Cost implication: ExtendDB removes the need for a live AWS connection during local development and continuous integration testing, which eliminates managed-service spend from those workflows. AWS scopes v0.1 to development, testing, and experimentation, so treat that as the cost case for now. Substituting a self-hosted backing database for DynamoDB capacity on production workloads is a separate decision that requires validating functional coverage, performance, durability, security, and support first.
ExtendDB is maintained by AWS, released under the Apache 2.0 license, and developed in the open on GitHub at github.com/ExtendDB/extenddb, with a project page at extenddb.org.
ExtendDB implements the DynamoDB control plane and data plane APIs, including operations on tables, items, and streams. The reference storage backend at launch is PostgreSQL, and the pluggable architecture allows the community to add new backends without modifying the core adapter.
What it enables: using the DynamoDB programming model in environments where the DynamoDB managed service is not available developer laptops, on-premises data centers, and disconnected edge sites without rewriting application code.
Cost implication: ExtendDB removes the need for a live AWS connection during local development and continuous integration testing, which eliminates managed-service spend from those workflows. AWS scopes v0.1 to development, testing, and experimentation, so treat that as the cost case for now. Substituting a self-hosted backing database for DynamoDB capacity on production workloads is a separate decision that requires validating functional coverage, performance, durability, security, and support first.
ExtendDB is maintained by AWS, released under the Apache 2.0 license, and developed in the open on GitHub at github.com/ExtendDB/extenddb, with a project page at extenddb.org.
Security Agent: Full Repository Scanning (Preview)
AWS Security Agent added full repository code scanning in preview. The capability performs deep, context-aware security analysis of an entire codebase, not just individual files or pull requests.
When vulnerabilities are found, the scanner generates code remediation: specific fixes tied to the exact file and line. Teams can remediate security vulnerabilities faster without requiring a separate SAST tool.
The capability is available at no additional charge for existing AWS Security Agent customers during the preview.
When vulnerabilities are found, the scanner generates code remediation: specific fixes tied to the exact file and line. Teams can remediate security vulnerabilities faster without requiring a separate SAST tool.
The capability is available at no additional charge for existing AWS Security Agent customers during the preview.
Security: Security Hub Extended and KY3P
Security Hub Extended: 21 Partners, 9 Categories
AWS Security Hub Extended expanded to 21 curated partner security solutions across 9 security categories on May 20, 2026.
The nine categories:
Security findings from all participating solutions are emitted in the Open Cybersecurity Schema Framework (OCSF) schema and automatically aggregated in AWS Security Hub, without requiring custom integrations.
Cost implication: all Extended-plan solutions have published pay-as-you-go pricing on a single AWS bill, with automatic Enterprise Discount Program (EDP) eligibility, unified Level 1 support for AWS Enterprise Support customers, and no long-term commitments. For FinOps teams, the material consequence is that partner security spend lands on the AWS bill and counts toward EDP commitment which changes both commitment planning and the build-versus-buy calculation on security tooling.
The seven new solutions are available in all AWS commercial Regions where Security Hub is available.
The nine categories:
- Endpoint
- Identity
- Network
- Data
- Browser
- Cloud
- AI
- Security operations
Security findings from all participating solutions are emitted in the Open Cybersecurity Schema Framework (OCSF) schema and automatically aggregated in AWS Security Hub, without requiring custom integrations.
Cost implication: all Extended-plan solutions have published pay-as-you-go pricing on a single AWS bill, with automatic Enterprise Discount Program (EDP) eligibility, unified Level 1 support for AWS Enterprise Support customers, and no long-term commitments. For FinOps teams, the material consequence is that partner security spend lands on the AWS bill and counts toward EDP commitment which changes both commitment planning and the build-versus-buy calculation on security tooling.
The seven new solutions are available in all AWS commercial Regions where Security Hub is available.
AWS Completes S&P Global KY3P Assessment
AWS completed its annual S&P Global Know Your Third Party (KY3P) security posture assessment in May 2026. KY3P, also known as the S&P Global Comprehensive Assessment and formerly TruSight, is a validated, evidence-based assessment designed to support regulatory compliance and standardized risk data exchange.
The methodology covers over 200 controls across 26 control categories and nine risk domains, including Privacy, Network Management, Logical Access Management, and Physical and Environmental Security. The assessment criteria were developed by a consortium of leading financial institutions, and the methodology validates the actual implementation and operation of controls rather than policies or attestations alone.
AWS customers can use the KY3P assessment to reduce their own supplier due diligence burden rather than conducting independent assessments. The report is requested directly via the KY3P website, with access details on the AWS KY3P compliance page. For teams running critical workloads on AWS, this lowers compliance overhead cost.
The methodology covers over 200 controls across 26 control categories and nine risk domains, including Privacy, Network Management, Logical Access Management, and Physical and Environmental Security. The assessment criteria were developed by a consortium of leading financial institutions, and the methodology validates the actual implementation and operation of controls rather than policies or attestations alone.
AWS customers can use the KY3P assessment to reduce their own supplier due diligence burden rather than conducting independent assessments. The report is requested directly via the KY3P website, with access details on the AWS KY3P compliance page. For teams running critical workloads on AWS, this lowers compliance overhead cost.
FinOps: What May 2026 Means for Spend
AgentCore Payments: A New Cost Surface
The launch of AgentCore Payments in preview is the highest-priority new cost risk from May 2026. Unlike most AWS services where costs are bounded by infrastructure provisioning, AgentCore Payments creates an autonomous spend channel: an agent can initiate external financial transactions within its configured limits without any human approval step.
Before enabling AgentCore Payments for any production agent:
Note that AgentCore Payments remains preview-stage, so spending limits and APIs may change before GA.
Before enabling AgentCore Payments for any production agent:
- Set session-level spending limits on every payment connection. These are enforced deterministically at the infrastructure layer, so they are the primary control not an advisory setting. See the AgentCore payments documentation.
- Audit which external services each agent is authorized to pay, with particular attention to agents reachable through AgentCore Gateway and the 10,000-plus endpoints exposed by the x402 Bazaar MCP server.
- Configure AWS Budgets alerts covering AgentCore’s own AWS-metered usage. This catches AgentCore service consumption, not the merchant payments themselves, which settle through the connected wallet rather than the AWS bill.
- Attribute merchant spend using the payment agent name, payment-session identifiers, merchant attributes, and wallet-provider reporting, which is the authoritative record for those transactions. AWS cost allocation tags apply to eligible AWS resources and do not carry through to external x402 payments.
- Wire transaction observability into existing monitoring every payment is observable through the same AgentCore logs, metrics, and traces already in use.
Note that AgentCore Payments remains preview-stage, so spending limits and APIs may change before GA.
New EC2 Families: Check Savings Plan Coverage
The six new EC2 families: M8in, M8ib, R8in, R8ib, C8ine, and M8ine are the most relevant hardware change for teams running network-intensive or EBS-intensive workloads. AWS’s “up to 43%” figure is a performance claim, not a guaranteed cost reduction, so benchmark utilisation and effective hourly cost per workload before assuming savings.
The migration risk is Savings Plan coverage, and it differs by plan type:
The migration risk is Savings Plan coverage, and it differs by plan type:
- Compute Savings Plans cover EC2 usage regardless of instance family, size, OS, or Region. If you hold Compute Savings Plans, migration to the new families is covered.
- EC2 Instance Savings Plans are family-specific, they cover a specific instance family in a specific Region. If you hold EC2 Instance Savings Plans on the prior-generation M6in, R6in, or C6in families and migrate to the new families, your existing plans will not apply to the new usage.
Kiro Migration: Seat Cost Planning
Teams on Amazon Q Developer Pro need to model the Kiro transition cost before the April 30, 2027 end-of-support date.
Key financial questions to answer now:
Key financial questions to answer now:
- What is your current Q Developer Pro seat count and annual contract value?
- What is the equivalent Kiro cost for the same seat count, including add-on credits on individual plans or, on team plans, averaged at $0.04 per credit if administrators enable it?
- Is Kiro available in all Regions where your development teams operate?
- Are there any annual contract commitments on Q Developer Pro that extend past April 2027?
Claude Platform on AWS: Consolidated Billing
Claude Platform on AWS GA means teams running Claude workloads no longer need separate Anthropic billing accounts. Consolidating under AWS billing brings Claude Platform usage onto the AWS bill with existing IAM credentials and access controls, and CloudTrail audit logging for security visibility.
Teams that currently split Claude usage between direct Anthropic API access and Amazon Bedrock Claude should evaluate consolidating under Claude Platform on AWS for billing simplicity, weighed against the fact that Claude Platform on AWS is operated by Anthropic with customer data processed outside the AWS security boundary. Teams with regional data residency requirements should stay on Bedrock.
Teams that currently split Claude usage between direct Anthropic API access and Amazon Bedrock Claude should evaluate consolidating under Claude Platform on AWS for billing simplicity, weighed against the fact that Claude Platform on AWS is operated by Anthropic with customer data processed outside the AWS security boundary. Teams with regional data residency requirements should stay on Bedrock.
Sources
Primary AWS sources for this article, in publication order: the AWS Weekly Roundups for May 4, May 11, May 18, and May 25, 2026, plus the individual AWS What’s New announcements and AWS blog posts linked inline throughout. Pricing and preview terms change frequently, verify current rates and availability on the relevant AWS pricing page before acting on anything in this article.
Share
Facebook
X
LinkedIn
Reddit
