AWS Weekly Roundup: OpenAI GPT-6.1 Terra on Bedrock, Step Functions as AI Agent Tools, and Post-Quantum Security Updates

The landscape of enterprise cloud computing and artificial intelligence orchestration is experiencing a profound shift away from isolated model capability toward systemic reach, economic efficiency, and architectural integration. Rather than focusing solely on the raw intelligence benchmarks of newly released foundation models, recent developments across Amazon Web Services (AWS) highlight a concerted industry movement to bridge the gap between AI agents and existing, trusted corporate infrastructure.

This transformation was underscored by several major capability rollouts. AWS Step Functions—an orchestration service managing more than 220 distinct AWS services—can now be invoked directly by AI agents as callable tools without requiring code rewrites. Concurrently, enterprise engagement platforms have begun exposing hundreds of internal application programming interfaces (APIs) to agents using descriptive metadata rather than cumbersome, token-heavy API catalogs. Coupled with aggressive pricing structures for everyday workload models and proactive steps toward post-quantum cryptography, the ecosystem is rapidly evolving to prioritize frictionless deployment, security resilience, and predictable cost reduction.

Main Facts: Major Infrastructure and AI Launches

The headline developments of the week center on expanded artificial intelligence capabilities within Amazon Bedrock, advanced tool integration for autonomous agents, and significant cryptographic enhancements across core AWS security services.

OpenAI GPT-6.1 Terra on Amazon Bedrock

OpenAI’s GPT-6.1 Terra model is now generally available on Amazon Bedrock, marking a strategic addition to the platform’s model catalog. Positioned as the everyday-workload tier within the GPT-6 family, Terra balances high throughput with competitive economics. According to OpenAI’s internal evaluations—specifically the Agents Last Exam benchmark—GPT-6.1 Terra scored 15 percentage points higher than its predecessor, the GPT-5.6 Terra, and performed on par with the higher-tier GPT-6 Astra while executing tasks more than three times faster than both variants.

Economically, Terra introduces substantial cost reductions for enterprise builders. Input and output token pricing is at least 50% lower than both GPT-6.1 Sol and GPT-5.6 Terra. The model supports context windows of up to 1 million input tokens, accommodating extensive text and multimodal image inputs. Developers can access GPT-6.1 Terra via the native Amazon Bedrock APIs, as well as through integrated environments like ChatGPT Work and Codex, broadening its accessibility for software engineering and enterprise automation pipelines.

AWS Step Functions and Amazon Bedrock AgentCore Gateway

Addressing a critical bottleneck in autonomous agent deployment, AWS Step Functions workflows can now be utilized directly as AI agent tools via the Amazon Bedrock AgentCore Gateway. This integration leverages the Model Context Protocol (MCP) to establish secure, standardized communication between agents and underlying corporate tools.

The architecture relies on a strict division of labor: the AI agent determines when a specific workflow should be triggered and supplies the necessary input parameters, while Step Functions executes each step exactly as predefined by system administrators. For example, in a customer service automation scenario, an agent can initiate a refund workflow, but the sequence—comprising eligibility verification, managerial approval, and credit issuance—executes in an immutable order. This governance model ensures that core business logic is never improvised by the probabilistic nature of the language model. Standard and Express workflows are fully compatible as connector targets, and agents retain the ability to query historical execution runs.

Chronology and Strategic Context

The convergence of AI agent frameworks and traditional enterprise workflows represents a multi-year maturation cycle in cloud architecture. For years, the primary challenge of deploying machine learning models in production involved building bespoke middleware to translate natural language intents into secure API calls.

By mid-2024, the introduction of function calling and early agentic frameworks allowed models to interact with external systems, but these implementations often required extensive custom coding, fragile wrapper APIs, and high token overhead. The subsequent evolution toward gateway-mediated protocols throughout 2025 and 2026 standardized how agents discover and invoke enterprise capabilities.

The integration of Step Functions into Bedrock AgentCore Gateway signifies a shift from custom API wrappers to native orchestration ingestion. By leveraging pre-existing enterprise workflows that organizations have trusted for years, AWS has bypassed the need for engineering teams to rebuild backend logic solely to accommodate AI interaction. Similarly, the industry-wide adoption of descriptive tool discovery—where agents query semantic descriptions rather than ingesting thousands of lines of raw API documentation—solves fundamental token-window constraints that previously limited enterprise-scale agent deployments.

Supporting Data and Technical Enhancements

Beyond flagship AI announcements, AWS rolled out several foundational infrastructure updates designed to optimize performance, enhance security posture, and drive down storage and compute expenditures.

Post-Quantum Cryptography in AWS KMS and Amazon Aurora

To mitigate the long-term threat of "harvest now, decrypt later" cyberattacks—where malicious actors record encrypted data today with the intent of decrypting it once quantum computing technology matures—AWS Key Management Service (KMS) has added native support for ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism).

This post-quantum cryptography integration allows organizations to establish shared secrets using quantum-resistant algorithms, with private keys securely isolated within FIPS 140-3 Level 3 validated Hardware Security Modules (HSMs). The service supports all three NIST FIPS 203 parameter sets through intuitive Encapsulate and Decapsulate operations. This capability is immediately available across global KMS deployments, excluding specific regions in the Middle East and China. Simultaneously, Amazon Aurora PostgreSQL incorporated post-quantum TLS key exchange for database versions 18 and higher, ensuring end-to-end cryptographic resilience for relational data workloads.

Cross-Region Trusted Identity Propagation

AWS IAM Identity Center has eliminated a longstanding architectural limitation by introducing support for cross-Region trusted identity propagation. Historically, propagating an end-user’s verified identity alongside an API request required all participating services to reside within the exact same AWS Region. This forced architects to choose between deploying monolithic, single-Region architectures or relying on overly broad IAM roles that lacked individual user visibility.

With the new capability, user identity automatically travels with requests across Regional boundaries. Organizations can now enforce granular access controls based on user and group memberships across distributed topologies while maintaining comprehensive audit trails of resource access at no additional cost.

GPU Sharing via NVIDIA MPS on Amazon ECS

Addressing the operational inefficiencies of allocating dedicated GPUs to lightweight workloads, Amazon ECS now supports GPU sharing via NVIDIA Multi-Process Service (MPS). Small-model inference, edge processing pipelines, and multi-model microservices frequently utilize only a fraction of a physical GPU’s compute and memory capacity.

With NVIDIA MPS integration on ECS Managed Instances and Amazon EC2, platform engineers can run multiple containerized tasks concurrently on a single physical GPU. Administrators declare precise memory requirements and optionally throttle compute shares per container. ECS automatically places tasks on available hardware as services scale, while monitoring the underlying MPS control daemon to automatically replace unhealthy instances.

Seekable OCI (SOCI) Lazy Loading for AWS Lambda and SageMaker AI

Cold-start latency for containerized serverless functions has seen a dramatic reduction with the introduction of Seekable OCI (SOCI) lazy loading for AWS Lambda Managed Instances. Instead of downloading an entire container image before initiating execution, Lambda fetches only the specific files required at each distinct stage of startup. AWS benchmarks indicate startup time reductions of up to 70%.

The workflow involves generating a SOCI index, pushing it to Amazon ECR, and referencing the indexed image URI. This optimization mirrors concurrent deployments in Amazon SageMaker AI training and processing jobs. Internal benchmarks demonstrate that SOCI-enabled lazy loading maintains consistent startup times between 3 and 11 seconds regardless of image size, contrasting sharply with median startup times of 3 minutes and 42 seconds for unoptimized 13.2 GB images—representing an efficiency gain of 8x to 46x.

Kubernetes Gateway API Support in EKS Auto Mode

Amazon EKS Auto Mode has expanded its networking capabilities with native support for the Kubernetes Gateway API. Developers can now utilize Gateway and HTTPRoute resources to manage traffic ingress without installing and maintaining disparate third-party controllers. EKS Auto Mode dynamically provisions and manages the underlying AWS load-balancing infrastructure.

The integration supports advanced routing patterns, including HTTP and gRPC traffic distribution, cross-namespace routing, weighted traffic splitting, header-based routing, and automated TLS certificate discovery via AWS Certificate Manager. Existing Ingress configurations continue to operate without disruption, providing an additive path for modern container networking.

Enterprise Case Studies and Real-World Implementation

Recent case studies published by AWS illustrate how large enterprises are translating these platform capabilities into measurable operational efficiencies.

Nubank: Automated Disaster Recovery with AWS DevOps Agent

Serving over 140 million customers across Brazil, Mexico, and Colombia, digital financial services provider Nubank manages more than 300 business-critical workflows that require rigorous regulatory testing. By deploying the AWS DevOps Agent to handle evidence collection and compliance reporting, Nubank reduced a single testing cycle from approximately 4.3 hours to roughly 40 minutes.

Furthermore, the automation enabled a fourfold increase in test flow coverage, exceeding 160 verified workflows. In a stress-testing exercise, the system executed the termination of more than 900 Amazon EKS instances under simulated peak traffic using AWS Fault Injection Service, automatically generating the precise audit evidence demanded by financial regulators.

MoEngage: Scaling Agentic Tools Across 400 REST APIs

Customer engagement platform MoEngage faced a classic scaling hurdle: exposing roughly 400 internal REST API operations—distributed across private VPCs in seven global regions and maintained by 25 distinct engineering teams—to internal AI agents without compromising tenant data isolation.

By leveraging the AgentCore Gateway, MoEngage avoided an estimated six months of bespoke platform engineering. To overcome the token-window limitation where presenting a raw catalog of 400 APIs would consume over 20,000 tokens per connection, MoEngage implemented a semantic search mechanism. Agents query tool availability by describing operational tasks in natural language, retrieving only the specific API definitions required for the immediate context.

Optimizing Petabyte-Scale S3 Storage Economics

Managing petabyte-scale data lakes often stalls due to the operational complexity of identifying cold data accurately without disrupting downstream analytics. Utilizing Amazon S3 Storage Lens groups and Storage Class Analysis, enterprise storage teams have implemented evidence-based lifecycle policies.

In a documented deployment involving 5.8 petabytes of application logs stored in S3 Standard—incurring monthly costs of approximately $241,000—access analysis revealed an access ratio of less than 0.1% for data older than 90 days. Transitioning this cold tier to S3 Glacier Instant Retrieval yielded a sustained 70% reduction in storage expenditure for the workload, proving the efficacy of data-driven lifecycle automation.

Broader Impact and Industry Implications

The compounding effect of these updates points toward a standardized, highly automated enterprise cloud ecosystem. By abstracting infrastructure provisioning through mechanisms like EKS Auto Mode and Bedrock AgentCore Gateway, AWS is shifting the developer experience from manual configuration management to declarative intent specification.

Security and compliance are no longer treated as post-deployment audit hurdles; rather, they are being embedded natively into the fabric of runtime environments, evidenced by default post-quantum cryptographic readiness and automated regulatory test generation via DevOps agents. As organizations prepare for major industry forums such as AWS re:Invent—scheduled in Las Vegas from November 30 to December 4, featuring over 2,200 technical sessions—the primary architectural focus across the industry has firmly settled on scale, operational velocity, and the seamless integration of generative intelligence into mission-critical corporate backbones.