Version 3.402.5

• Aws\ - Fixed an issue in NonSeekableStreamDecodingEventStreamIterator where the final event was dropped when reading it reached the end of the stream.
• Aws\BedrockAgentRuntime - Adds the CodeExecution step and codeExecution action to AgenticRetrieveStream trace events, showing when the agent runs code and which documents it reads.
• Aws\PrometheusService - Managed Prometheus collectors now support Amazon MSK consumer-group metrics for Amazon Managed Service for Prometheus and CloudWatch.
• Aws\Connect - Amazon Connect adds tag-based access control for Contact Lens rules. ListRealtimeContactAnalysisSegmentsV2 adds a ListFilter to return only category segments whose rules match given tags. PreEvaluationFilter now supports contact evaluation resources for OnContactEvaluationSubmit rules.
• Aws\DocDB - Amazon DocumentDB now returns ServerlessV2PlatformVersion in DBCluster API responses and adds the DescribeServerlessV2PlatformVersions API to discover available platform versions and their capabilities.
• Aws\Omics - Adds the outputUriPrefixMode parameter to StartRun and GetRun. You can now write run outputs directly under outputUri, without the prefixes the service adds by default. When you opt in, outputs overwrite existing objects at the same keys.
• Aws\SageMaker - Create endpoints with AcceleratorPartitionLayouts on ProductionVariant and deploy inference components with AcceleratorPartitionType in ComputeResourceRequirements to divide accelerators into hardware-isolated NVIDIA MIG partitions, running multiple models per GPU. P4d, P5, G7, G7e.
• Aws\CloudWatchLogs - Adds support for account-level retention policies in Amazon CloudWatch Logs. Customers can now use PutAccountPolicy with the new RETENTION POLICY type to set default log retention across all log groups in an account. Includes dry-run mode to preview the impact of policy changes before applying them.
• Aws\Lambda - Adds ConsumptionMode to SelfManagedKafkaEventSourceConfig, letting Lambda event source mappings consume self-managed Apache Kafka topics as a queue. Set ConsumptionMode to Queue when creating an event source mapping.
• Aws\CustomerProfiles - Adds support for template ingestion controls in the GetProfileObjectTypeTemplate API response.
• Aws\TimestreamInfluxDB - Add DeploymentConfiguration field to CreateDbCluster and UpdateDbCluster APIs to support creation of heterogenous InfluxDB v3 Enterprise clusters.

Version 3.402.4

• Aws\S3 - The default S3 Express identity provider now creates sessions with the requesting client's credentials and caches them per bucket and per identity.
• Aws\imagebuilder - This release adds support for on-demand AMI scanning with Amazon Inspector.
• Aws\Lightsail - This release adds support for instance health status checks and system status checks.
• Aws\BedrockAgentCore - Adds AgentCore Runtime session endpoint support, including sessionEndpointUrl on the InvokeAgentRuntime response
• Aws\WAFV2 - AWS WAF customers using Targeted Bot Control, ATP, or ACFP managed rule groups can now enable automatic Challenge JavaScript SDK injection. When enabled, Amazon CloudFront injects the script tag into HTML responses on your behalf, removing the need for manual integration.
• Aws\BedrockAgentCoreControl - Adds Session Endpoint Feature on AgentCore Runtime
• Aws\CleanRooms - Adds support for the PySpark 2.0 analysis template format and for choosing the file format (CSV or Parquet) of protected job results written to Amazon S3, including in a membership's default job result configuration.

Version 3.402.3

• Aws\ - Fixed AssumeRoleCredentialProvider throwing a TypeError and losing the original exception when the STS request fails with an exception that does not extend RuntimeException.
• Aws\Neptunedata - Get Storage API analyzes storage usage to identify database bloat and your storage footprint. Index Rebuild API triggers on-demand index reconstruction to eliminate bloat and restore query performance.
• Aws\MediaLive - AWS Elemental MediaLive now supports SMPTE 2022-7 seamless protection switching for multicast inputs on MediaLive Anywhere. Support for MulticastSettings sources to add a redundant copy of the stream received on a second network interface.
• Aws\Artifact - Update support mode for Assurance Assistance
• Aws\KafkaConnect - Amazon MSK Connect now supports updating a connector's custom plugin and worker configuration via the UpdateConnector API. MSK Connect checks connector and task health after the update and rolls back on failure. Each call returns an operation ARN to track with DescribeConnectorOperation.
• Aws\SecurityAgent - Adds support for attaching client certificates for mutual TLS (mTLS) authentication to penetration test target endpoints via the new ClientCertificates field on Assets, enabling pentesting of endpoints that require client certificate authentication.
• Aws\ACM - AWS Certificate Manager now supports the Automatic Certificate Management Environment (ACME) protocol in the AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions.
• Aws\IVS - InsertAdBreak now allows setting a customized adBreakId on a request and also adds a new field targetStartAt for a delayed ad insertion
• Aws\OpenSearchService - This release adds APIs to simplify setting up a replication relationship between OpenSearch clusters. The APIs include new Switchover and Failover actions for planned switchovers and unplanned failovers to ensure high availability for OpenSearch in the event of disaster in a single region.
• Aws\EC2 - Amazon EC2 Capacity Manager adds supportability checks and capacity fulfillment metrics. Use GetCapacityManagerSupportabilityScores to score how well instance types and Availability Zones can support a capacity request, and GetCapacityManagerMetricData to retrieve fulfillment metrics.
• Aws\Connect - Amazon Connect APIs - CreateTaskTemplate and UpdateTaskTemplate accept a new ContactHooks parameter called WrapUpFlowId to identify the flow module that runs when an agent attempts to disconnect from a task created with the template. Use this to verify an agent's work or update external case repos.
• Aws\ConnectParticipant - Amazon Connect Participant Service now supports the optional UrlContentDisposition parameter on GetAttachment, which returns a pre-signed URL that renders a chat attachment inline in the browser instead of forcing a download.

Version 3.402.2

• Aws\Credentials - Parse shared configuration values without rejecting unquoted equals signs in credential_process commands, and resolve the canonical default config profile in the default credential chain.
• Aws\EC2 - EC2 AMIs can now show vulnerability data and be targeted directly for scanning.
• Aws\Lightsail - Added the attributeUpdates parameter to the Lightsail StartInstance API, which allows customers to update the attributes of a stopped instance when starting it.
• Aws\Inspector2 - Adding support for Machine Image scan
• Aws\BedrockAgentCoreControl - Adds the ResetTokenVaultKeyMaterial API, which restores a token vault whose customer managed key was deleted by moving it to an AWS owned key. The reset permanently deletes the stored OAuth 2.0 tokens, users must consent again. Adds on-behalf-of token exchange client authentication override option.
• Aws\ECS - ECS now supports GPU sharing via NVIDIA Multi-Process Service (MPS) on ECS Managed Instances and ECS EC2, allowing multiple ECS tasks to share a single Nvidia GPU for improved utilization.
• Aws\LicenseManager - AWS License Manager now supports delegate grants for read-only visibility into license distributions. CreateGrant accepts a new GrantType (BuyerGrant or DelegateGrant) and a desired status at distribution time.

Version 3.402.1

• Aws\ - Fixed an issue in NonSeekableStreamDecodingEventStreamIterator where a message checksum returned across multiple partial reads caused a checksum mismatch.
• Aws\Api - Caches compiled AWS Query and EC2 Query serialization plans on model shapes, reducing per-request parameter building overhead. Serialized parameters are unchanged, and plans are invalidated when a shape is mutated. The internal QueryParamBuilder and Ec2ParamBuilder no longer expose their protected format_*, queryName() and isFlat() methods.
• Aws\KMS - This release adds support for ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) keys in AWS KMS. ML-KEM, as specified in NIST FIPS 203, is a post-quantum key encapsulation mechanism that can be used to establish a shared secret between two parties.
• Aws\SageMaker - Amazon SageMaker HyperPod adds the MultiNodeTrainingValidation deep health check for clusters orchestrated by Amazon EKS. It validates NVIDIA GPU instances by running a short multi-node training workload and flags instances that produce numerical errors or fall behind expected training time.
• Aws\IVS - The release adds failover slate configurations, which show viewers a slate during temporary broadcaster network disruptions to reduce viewer drop-off and refresh storms.
• Aws\Odb - Adds support for Exascale storage with Oracle Exadata Database Service on Dedicated Infrastructure
• Aws\Signin - Adds support for the OAuth 2.0 Token Exchange grant (RFC 8693), enabling applications to exchange identity provider issued JSON Web Tokens (JWTs) for short-lived OAuth access tokens to access supported AWS services without managing separate AWS credentials.
• Aws\MediaConnect - This release adds support for managing and sharing endpoint across accounts in AWS Elemental MediaConnect. You can now register endpoints to represent external or service-managed sources and destinations, and share them across AWS accounts.
• Aws\ECR - Add support for ECR replication backfill
• Aws\TaxSettings - Add Mexico Additional Info changes
• Aws\Billing - Adds support for managing private pricing contracts and contractual investments including listing and associating contracts, retrieving contractual investments and their summaries, and creating, listing, and canceling contractual investment attestations
• Aws\MediaLive - AWS Elemental MediaLive now lets you control whether explicit weighted prediction is applied to H.264 outputs. It also introduces Perceptual Filter, a new noise reduction filter designed to improve video quality by increasing VMAF scores, now with Auto, None, and strength options.
• Aws\SSOAdmin - Added support for the RegionScope parameter on ListInstances, allowing you to list IAM Identity Center instances in the current Region or across all Regions.
• Aws\EKS - This release adds support for EKS management of Gateway API CRDs (Custom Resource Definitions)
• Aws\MarketplaceCatalog - This release adds support for the SubsidiaryAuthorization entity type in the ListEntities operation, including entity-type filters with partial name search, sort options, and a summary returned for each subsidiary authorization.
• Aws\Lightsail - This release adds Web Application Firewall (WAF) support for Lightsail distribution.
• Aws\AppStream - Add Windows 11 to PlatformType enum
• Aws\Deadline - fix the sdk documenation issue only
• Aws\Connect - Amazon Connect now automatically saves agents' in-progress email drafts preserving the message, recipients, and subject during browser or network interruptions so agents can return to the mail and continue instead of starting over.

Version 3.402.0

• Aws\ - Updates the minimum required PHP version to 8.2, following the disclosure of CVE-2026-109618 and CVE-2026-109619.
• Aws\IVSRealTime - Adds RevokeConnectionToken operation for Amazon IVS Real-Time Streaming.
• Aws\Lambda - AWS Lambda durable functions now supports payloads up to 1 MB for checkpoints, callback completion, and error details.
• Aws\KafkaConnect - Amazon MSK Connect now supports pausing and resuming connectors via the asynchronous PauseConnector and ResumeConnector APIs. Paused connectors keep their configuration and committed offsets and resume where they left off. Each call returns an operation ARN to track with DescribeConnectorOperation.
• Aws\Glue - Add support for large worker types in AWS Glue
• Aws\ElementalInference - Elemental Inference now supports feed scheduling, letting you apply feed configuration changes at a time you choose instead of building your own automation.
• Aws\BedrockAgentCoreControl - Adds model-based routing and fallback to AgentCore Gateway rules. Rules can match the requested model, route to a specific model, and fall back across inference targets with an optional circuit breaker. Adds multi-dimensional rating scales for AgentCore Evaluations LLM-as-a-Judge evaluators.
• Aws\NetworkManager - AWS Cloud WAN now provides managed one-to-one NAT directly on it's core network attachments, through integration with Regional Private NAT Gateway. Use UpdateAttachmentNatConfiguration to enable NAT and configure NAT rules, and ListAttachmentNatConfigurations to view them.
• Aws\BedrockAgentCore - Adds the dimension name to evaluation results and batch evaluation summaries. For multi-dimensional LLM-as-a-Judge evaluators, each result and summary now identifies which dimension it corresponds to.
• Aws\EC2 - AWS Transit Gateway now provides managed one-to-one NAT directly on its attachments, through integration with Regional Private NAT Gateway. Use ModifyTransitGatewayAttachmentNatConfiguration to enable NAT and configure NAT rules, and GetTransitGatewayAttachmentNatConfiguration to view them.
• Aws\Connect - Adds support for customer queryable replication errors.
• Aws\Continuum - Releasing Continuum for Code Vulnerabilities APIs for SDKs
• Aws\OpenSearchServerless - Adds APIs to create, get, list, and cancel ingestion jobs, and to create, get, list, and delete ingestion streams, for ingesting data from Amazon S3 into OpenSearch Serverless collections.

Version 3.401.5

• Aws\ - Removes the FinSpace and FinSpaceData clients, which are no longer in service.
• Aws\MediaConvert - Adds AV1 CBR rate control and scene change detection. New sliding window peak bitrate setting for all codecs. DASH adaptation set grouping update. Option to disable the AV1 perceptual quality filter. Support for vertical (portrait) AV1 encoding.
• Aws\DevOpsAgent - Adds support for Microsoft Teams as a notification service. Associations can now be created and updated with a Microsoft Teams team and channel configuration using the DevOps Agent API and SDKs.
• Aws\RedshiftDataAPIService - Add Redshift QueryUUID field to DescribeStatement response
• Aws\LexModelsV2 - Adds support for Assisted NLU - Dialog Manager mode allowing usage of LLMs as the default NLU system and dialog management
• Aws\AutoScaling - EC2 Auto Scaling now supports account settings, letting you manage account-level configuration for Auto Scaling.
• Aws\Connect - Added support for AWS-managed security profiles.
• Aws\Polly - Added support for the new voices - Kenneth (en-US), Nate (en-US), Tina (de-DE), Carlos (es-US), Carolina (pt-BR), Leo (pt-BR), Curtis (en-AU), Kiara (en-IN), Arjun (en-IN) and Hyunduk (ko-KR). They are available as a Generative voices only.
• Aws\HealthLake - Update the UpdateProfileWithAgent API to return a streaming response to provide more frequent updates on what the agent is doing.
• Aws\Lightsail - This release adds support for metrics related to system-disk performance.
• Aws\EC2 - Adds new response fields to DescribeInstanceStatus and Network Insights analysis results.
• Aws\DataZone - Added custom designations support with new CRUD APIs. The designation field in project membership and policy grant APIs supports a new enum for custom designations. These APIs also support a new field for custom designation id.
• Aws\NetworkFirewall - Adds support for Network Firewall Resolved IP validation.
• Aws\SFN - Release minor updates to API model
• Aws\QuickSight - Adds support for SharePoint and OneDrive two-legged OAuth certificate credentials and Google Workspace service account credentials when creating data sources

Version 3.401.4

• Aws\ - Removes Tnb client, which is no longer in service.
• Aws\MarketplaceCatalog - Adds ListEntities filter, sort, and summary support for the ExpressPrivateOfferConfiguration entity type, including filtering by ProductId.
• Aws\ElastiCache - LiveMigration enables customers to migrate from self-hosted EC2 Redis and Valkey clusters to ElastiCache Serverless with near-zero downtime. Customers control the migration through three API-driven phases (prepare, start, complete) that handle traffic proxying, data replication, and cutover.
• Aws\WorkspacesInstances - Documentation update release for AWS service
• Aws\CleanRooms - This release allows customers and their partners to easily collaborate with data stored in Databricks, without having to move or share their underlying data among collaborators.
• Aws\S3Files - S3 Files adds support for the "Misconfigured" file system status.
• Aws\ECS - ECS Service Gateway makes it easier for developers to deploy ECS services without having to worry about complex ingress networking constructs.
• Aws\Bedrock - Amazon Bedrock Guardrails now supports a configurable tier for the contextual grounding policy via a new tier option. Select the Standard tier for grounding that better supports conversations and reasoning, with expanded language coverage.
• Aws\DynamoDB - Adds support for disassociating a replica from an Amazon DynamoDB multi-Region eventual consistency global table, so you can keep it as a single-Region table with its existing data. Also adds disassociation protection, on by default, to help prevent accidental disassociation.
• Aws\CloudWatch - Amazon CloudWatch now supports two new anomaly detector settings. AdaptationSpeed (FAST, NORMAL, SLOW) controls how fast the model adapts to baseline changes, and OutlierFilteringStrength (MINIMAL, MODERATE, STRICT) controls how aggressively outliers are filtered.
• Aws\RDS - Amazon RDS now supports On-Demand Capacity Reservations for DB instances.
• Aws\CloudWatchOmni - Updating max value for maxResults in SearchPrincipals API

Version 3.401.3

• Aws\EndpointV2 - EndpointDefinitionProvider now rejects service names and api versions that are not a single safe path segment, preventing path traversal through the version or service client options.
• Aws\IoTWireless - Documentation update release for AWS service
• Aws\WorkspacesInstances - ModifyVolume is a new public API for WorkSpaces Core Managed Instances. Customers can change the size, type, IOPS, or throughput of an existing managed volume online, with no stop required. Customers track progress by calling EC2 DescribeVolumesModifications directly.
• Aws\OpenSearchService - Amazon OpenSearch Service adds a new TLS security policy to support FIPS policy and post-quantum cryptography
• Aws\ECS - Adds support for configurable envoy application log levels. Customers can now debug network connectivity issues with their task's sidecar envoys.
• Aws\CodeStarNotifications - Documentation update release for AWS service
• Aws\CodeDeploy - Adds support for suspending Amazon EC2 Auto Scaling processes during CodeDeploy EC2 in-place deployments. Use ec2DeploymentOptions to choose which processes are suspended and resumed.
• Aws\TimestreamInfluxDB - Adds four new parameters to the InfluxDBv3Enterprise parameter group for Amazon Timestream for InfluxDB. The new parameters are upgradePachaTree, walBufferSize, snapshotSize, and snapshotDuration.
• Aws\SocialMessaging - Adding support for WhatsApp Direct Send.
• Aws\ManagedGrafana - Documentation update release for AWS service
• Aws\CloudWatchLogs - Amazon CloudWatch Logs now supports filtering DescribeDeliverySources by resourceArns, DescribeDeliveryDestinations by names, and DescribeDeliveries by deliverySourceNames.
• Aws\Connect - Amazon Connect GetAttachedFile API now supports an optional UrlContentDisposition parameter. Set it to INLINE to get a pre-signed URL that displays the file in the browser, so agents can preview email attachments without downloading them. ATTACHMENT (download) remains the default.
• Aws\WorkSpaces - Adds optional imageValidationMode enum to ImportCustomWorkspaceImageRequest. This allows customers to opt-in to having prevalidation run in the service account instead of customer account.
• Aws\ControlTower - Documentation update release for AWS service
• Aws\CodeCommit - Documentation update release for AWS service
• Aws\BedrockAgentCore - Adds the Builtin.FailureAnalysis evaluator for batch evaluations. GetBatchEvaluation now returns insightResults that group session failures into insights with root causes and suggested fixes.
• Aws\Amplify - Documentation update release for AWS service
• Aws\drs - Documentation update release for AWS service
• Aws\DataZone - Adds SDK and CLI support for the Iceberg REST catalog connection types already available in Amazon SageMaker Unified Studio - ICEBERGRESTCATALOG, SNOWFLAKEICEBERGRESTCATALOG, and DATABRICKSICEBERGRESTCATALOG.
• Aws\DynamoDB - Enable account endpoint generation for existing CN and GovCloud regions
• Aws\BedrockAgentRuntime - Adds support for applying a Retrieval Instruction, optionally by version, to AgenticRetrieveStream requests for Amazon Bedrock Knowledge Bases, and reports the applied instruction and version on the trace.
• Aws\EMRContainers - Documentation update release for AWS service
• Aws\BedrockAgent - Adds Retrieval Instructions for Amazon Bedrock Knowledge Bases. Create, get, update, delete, list, and version customer-authored instructions that guide how a knowledge base retrieves and answers, with content review before use.
• Aws\GlueDataBrew - Documentation update release for AWS service
• Aws\XRay - Adds support for encrypting the Transaction Search spans log group with a customer managed AWS KMS key. Pass the key ARN in the new CloudWatchLogsConfiguration.SpansLogGroupKmsKeyId field of UpdateTraceSegmentDestination. X-Ray applies the key when it creates the log group.
• Aws\ObservabilityAdmin - Adding support for EKS Container Insights Telemetry Rules
• Aws\CodeConnections - Documentation update release for AWS service
• Aws\CloudWatch - This release adds ActionConfiguration to PutMetricAlarm, PutCompositeAlarm and PutLogAlarm. It allows customers to include an alarm's tags in its notifications and alarm state change events
• Aws\GuardDuty - Adding a new Expected Bucket Owner optional field for GuardDuty publishing destination APIs
• Aws\DevOpsAgent - Documentation update release for AWS service
• Aws\CodePipeline - Documentation update release for AWS service

Version 3.401.2

• Aws\GuardDuty - Releasing support for Custom Detection Rule Runtime Monitoring
• Aws\Lambda - AWS Lambda now supports an optional X-Ray trace header for chained invocations in durable executions, enabling child invocations to be linked to the initiating span.
• Aws\MarketplaceMetering - Documentation update - added a Get started pointer to the AWS Marketplace AI Metering Agent Skill in the BatchMeterUsage API reference. No API or behavior change.
• Aws\BedrockAgentCoreControl - This release supports scoping Amazon Bedrock AgentCore Gateway rate limits by request header or request body field.
• Aws\Organizations - With dual-stack enabled, all requests now resolve to the endpoint in the partition's primary Region (for example, organizations.us-east-1.api.aws) and are signed for that Region. Previously, requests from other Regions resolved to a nonexistent endpoint. No API changes.
• Aws\ARCRegionSwitch - Features - Adds support for an optional payload to invoke the Lambda function with as part of the Custom action Lambda execution block
• Aws\EC2 - Adds T8i instance sizes to the InstanceType enum. T8i instances are low-cost burstable instances powered by custom sixth generation Intel Xeon 6 processors, available exclusively on AWS, and built on the latest sixth generation AWS Nitro cards
• Aws\DynamoDBStreams - Add support for a new iterator type (AT TIMESTAMP) for DynamoDB Streams GetShardIterator API that allows reading from a specific point in time from the stream.
• Aws\Transfer - AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. This gives you greater control over your server identity and helps simplify server migrations and failover.
• Aws\CloudFront - This release adds a new "IpAddressType" field to "VPCOriginEndpointConfig", allowing customers to specify whether their VPC origin accepts IPv4-only or dualstack connections.
• Aws\imagebuilder - This release adds parentInstance to infrastructure configurations, so builds can use an already-running instance from an Amazon EC2 Auto Scaling group. It also adds terminateInstanceOnCompletion, which keeps build and test instances running after image creation ends.