aws sdk go v2 release 2026-10-02 - Schema Serialization and Cognito Step Up Auth

AWS shipped the aws-sdk-go-v2 tag release-2026-10-02 on October 2, 2026. The most operationally relevant change is schema based serialization turning on for the Glue and Invoicing clients, plus Cognito User Pools gaining ACR and AMR claims and step up authentication.

The full release notes and downloads are on the GitHub release page.

service/cognitoidentityprovider v1.75.0 adds two things. First, issued access and ID tokens can now carry the OIDC standard ACR (authentication context class reference) and AMR (authentication methods reference) claims. Second, User Pools support step up authentication through the existing authentication APIs, so you can demand a stronger second factor on a sensitive action without a new API surface.

If your platform uses Cognito tokens for service to service authz, ACR and AMR claims give you something you can actually key policy on, instead of sniffing scopes. The tradeoff: any claim parsing code you already wrote needs to tolerate the new fields or you may trip on unknown claim shapes in strict validators.

service/glue v1.167.0 adds the OAuth 2.0 refresh token grant type to the set Glue Connections support. That matters if you run Glue jobs against SaaS sources through stored connections: connections can now reauthenticate with a refresh token rather than short lived access tokens that a scheduler has to rotate manually. Fewer failed runs caused by expired credentials.

The same module turns on schema based serialization, which is the pattern repeated across this release.

Glue and Invoicing both enable schema based (de)serialization in this tag. This replaces the reflection heavy JSON round trip with generated code shaped by the service model. Expect lower CPU on large marshalling paths and stricter decoding, since unknown fields behave differently than the old tolerant path in some cases. If you run wide batch fanouts through the SDK, profile before and after; the wins show up on big payload serialization, not on tiny requests worth of control plane calls.

A quick pass over items that will matter to fewer readers of this site:

  • service/mediapackagev2 v1.51.0 adds Dynamic Multiview and static endpoint filter configuration, with the source cap per multiview channel raised to 50.
  • service/pinpointsmsvoicev2 v1.41.0 extends CarrierLookup with opt-in phone number cleansing, an OriginalPhoneNumber response field, and VOIP and PREPAID number type enums.
  • service/securityagent v1.22.0 adds trigger filters controlling which pull request events, target branches, and labels start an automatic code review.
  • service/lambdaweb v1.0.1 is documentation only, clarifying that the LambdaWeb APIs are experimental and not yet available to external customers. Treat the module as a placeholder.

No breaking changes are called out in the notes, so there is nothing to migrate on this tag.