project
AWS infrastructure-as-code service that provisions and manages cloud resources from declarative JSON or YAML templates.
No evidence-backed relationships are recorded.
AWS opened a preview of Well-Architected Agent, a service that reads live accounts across 65+ services and ranks fixes against goals each team declares. The review becomes a job run against the real environment, and every fix comes back as code or commands for the team to apply.
Reality
A dev.to account of two AccessDenied failures shows CloudFormation resource providers making supporting calls into adjacent services, so an execution role scoped to the template's service namespaces is incomplete by construction.
Reality
AWS's walkthrough for the pattern wires GitHub and GitLab activity feeds through Step Functions into QuickSight on a schedule you set in CloudFormation, with a detector Lambda that skips the whole cycle when nothing has changed.
Reality
AWS's landing zone guidance for the European Sovereign Cloud starts at the partition boundary. Credentials in aws-eusc cannot reach resources in aws, so the centralisation an operator already runs gets built a second time inside the new partition.
Reality
IAM Access Analyzer already names the unused permissions and writes the tightened policy. A new AWS pattern sorts each finding by how the role was created and files the fix as a pull request or an issue.
Reality
IMDSv1 handed an instance role's credentials to a plain server-side request, and the actor spent them on Amazon Bedrock in a Region the account was not watching. AI consumption is now a detection line.
Reality
A native AutoScalingInstanceRefresh update policy makes the stack the single source of truth for AMI rollouts, which also puts Instance Refresh's abort-and-rollback behaviour on the critical path of every stack update.
Reality
AgenticRetrieveStream splits a question into sub-queries and retrieves until it is satisfied, and the agent above it can run that whole tool call again, so reads per question stop being a number you set.
Reality
AWS now ships a first-party catalog for agents, tools, skills and MCP servers, moving the hard part off building them and onto whoever keeps the records current and clears the approval queue, a staffing question as much as a platform one.
Reality
Express Mode turns a container image and two role ARNs into an HTTPS service on Fargate. The engineering question it leaves behind is which of its inherited defaults match your workload and which will quietly fight it.
Reality
AWS Professional Services scopes its migration agents so discovery cannot deploy. The load-bearing engineering sits in the manifest, the log fields, and a loop nobody bounded.
Reality
Scaling policies on ECS, ASG, VMSS and MIG are separate API objects with last-writer-wins semantics. That is why inherited scaling behavior stays wrong, and why nobody gets told when it changes.
Reality
A walkthrough of bolting semantic search onto an existing serverless recipes API shows the sync pipeline is now optional. The infrastructure-as-code story has not caught up yet.
Reality
The default rule set ships on in warning mode from aws-cdk-lib v2.261.0. Strict mode is one context key away, and the exit-code change on declined prompts is the quieter risk.
Reality
epilot's monitoring caught an AI coding agent deploying straight into production. Nothing broke, and the company still moved all human production access behind a broker.
Reality