AWS has introduced Lambda Web Functions, which let developers run standard HTTP web applications on AWS Lambda without rewriting them as event handlers.
The launch adds a new deployment option alongside Lambda's existing event-based model and MicroVMs.
Lambda Web Functions support applications built with frameworks including Express, Hono, Fastify and Next.js, using a command-line deployment process that returns a live HTTPS endpoint. The service runs on the same Firecracker-based isolation used elsewhere in Lambda.
Each execution environment can handle up to 128 concurrent requests, according to AWS. Billing is based on CPU time used by the code rather than wall-clock time, a change that affects workloads such as server-side rendering, API backends and inference endpoints that spend significant time waiting for responses.
Developers can also replicate deployments across multiple regions with latency-based routing behind a single global URL, and split traffic between revisions for canary rollouts. The service is available in five regions, running Node.js 24 on Arm64 with VPC connectivity.
The launch also extends to other parts of the AWS stack. Amazon CloudFront can now use a Lambda Web Function endpoint as an origin with origin access control.
Control questions
Alongside the product changes, AWS highlighted a separate push on controlling autonomous software agents. It argued that as deployment becomes easier, governance becomes more important, particularly for systems that can act more independently.
AWS set out a framework built around four questions, which it described as scope, know, bound and observe. It said controls on an agent should sit outside the agent's own reasoning and be enforced through policies at the gateway in Amazon Bedrock AgentCore.
AWS also said it has used automated reasoning in production for more than a decade, including in AWS Identity and Access Management at more than 2.1 billion requests per second. It said the same approach can be applied to rules governing agents.
Broader updates
Elsewhere, AWS expanded its storage integrations with Vercel. Amazon S3 can now be provisioned through the Vercel Marketplace and v0 by Vercel, allowing users to create S3 general purpose buckets, S3 Tables and S3 Vectors from within the Vercel environment.
The integration uses short-lived OpenID Connect tokens exchanged at runtime with AWS Security Token Service for credentials scoped to the specific resource, avoiding the storage of static keys.
EC2 T8i instances are also now available in the South America region in São Paulo. AWS said the burstable instance generation delivers up to 30 per cent better price performance than T3, with up to 70 per cent higher compute performance and 2.4 times the Amazon EBS bandwidth.
In artificial intelligence infrastructure, Reflection Beam, an open-weight model for coding and long-horizon tasks, is now available through Amazon SageMaker JumpStart, AWS said. The model has 501 billion total parameters and 23 billion active parameters, and Reflection reported an effective context length of 1 million tokens.
AWS added that the model has also been ported and optimised for AWS Trainium3, and is launching in Northern Virginia and Ohio.
For developers working on workflows, the Lambda Durable Execution SDK for Go is now generally available. The software lets users write multi-step Go workflows that checkpoint progress and pause for up to a year while waiting for an external event.
The toolkit supports use cases including deployment rollouts with approval gates and pipelines that call a model and then wait for human review. AWS added that the SDK can be tested locally with the durabletest package without network access or credentials.
CloudWatch also received an update. Users can now define log routing rules in CloudWatch pipelines so events are sent to different log groups based on conditions evaluated against processed fields such as severity, source or event type.
The same update adds chained parsers, letting parsers run in sequence with later parsers using fields produced by earlier ones. AWS said this allows users, for example, to parse a JSON envelope first and then apply a Grok parser to an extracted field.
On the security side, AWS disclosed results from testing its Security Agent, now part of AWS Continuum, against 37 recently disclosed real-world CVEs packaged as live containerised targets. It said the autonomous penetration-testing agent captured 35 flags and that, after audit against canonical proofs of concept, 33 of 37 cases were verified as genuine end-to-end exploitation.
AWS said the two failed cases involved the agent taking the target down before it could read the flag, underscoring the operational risks of autonomous offensive systems.