project

Terraform

Open-source infrastructure-as-code tool from HashiCorp that defines and provisions cloud and on-prem resources via declarative HCL configs.

Known aliases

awscc provider
HashiCorp Terraform
Terraform
terraform 1.8.5
terraform apply
Terraform CLI
Terraform Enterprise
Terraform modules
Terraform Registry
terraform.tfstate
vault_kv_secret_v2
vault provider

Relationships

No evidence-backed relationships are recorded.

Current stories

build2 publishers

AWS's Well-Architected Agent reviews live accounts across 65+ services against goals teams declare

AWS opened a preview of Well-Architected Agent, a service that reads live accounts across 65+ services and ranks fixes against goals each team declares. The review becomes a job run against the real environment, and every fix comes back as code or commands for the team to apply.

Publishers:aws.amazon.comdevops.com

Reality

Evidence50
Adoption: Insufficient
Hype gap+30
Incentives75
Confidence65

build1 publisher

Private edge layers set a $1,730 monthly floor under a $20-to-$140 .NET API on Container Apps

Front Door, API Management and private networking cost about $1,730 a month in West Europe in a dev.to Container Apps reference stack for .NET. With the .NET compute at $20 to $140 a month, the risk sits in the hand-offs between its layers.

Publishers:dev.to

Reality

Evidence45
Adoption: Insufficient
Hype gap0
Incentives: Insufficient
Confidence40

product1 publisher

env zero lets platform teams decide how much infrastructure drift its agents fix alone

env zero's EZ Control lets agents repair infrastructure drift across nearly 2,300 resource types, at an autonomy level each platform team picks. How much autonomy a team grants will depend on how far it trusts the product's map of who owns each resource.

Publishers:devops.com

Reality

Evidence35
Adoption: Insufficient
Hype gap+30
Incentives70
Confidence40

build1 publisher

One GCP VM runs an ML team's Airflow for under $150 a month against Composer's $350 estimate

One ML team moved Airflow off on-prem boxes onto a single GCP VM estimated at under $150 a month, against about $350 for Cloud Composer 3. Its published repo gives other teams a working build to price against their own Composer quote.

Publishers:dev.to

Reality

Evidence35
Adoption10
Hype gap+15
Incentives: Insufficient
Confidence40

build1 publisher

EKS Pod Identity swaps per-cluster OIDC trust for one service principal shared by every role

EKS Pod Identity, launched at re:Invent 2023, replaces IRSA's per-cluster OIDC trust with one pods.eks.amazonaws.com principal on every IAM role. A dev.to migration guide has each role trust both paths during cutover, so teams can move and verify one workload at a time.

Publishers:dev.to

Reality

Evidence45
Adoption: Insufficient
Hype gap+15
Incentives: Insufficient
Confidence50

build2 publishers

Shai-Hulud spreads by bumping a version number your dependency range already accepts

September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.

Publishers:dev.tothenewstack.io

Reality

Evidence62
Adoption: Insufficient
Hype gap+15
Incentives: Insufficient
Confidence58

security2 publishers

AI agents ran more than 50 ATT&CK techniques through one enterprise in under 10 hours

Unit 42 worked a ransomware intrusion where the operator handed tactical execution to frontier AI agents, and the chain from a public API endpoint to stolen cloud AI keys closed inside a single working day with no zero-day.

Publishers:scworld.comunit42.paloaltonetworks.com

Reality

Evidence50
Adoption20
Hype gap+25
Incentives60
Confidence55

security2 publishers

Rogue IPs added to Coder's Cloudflare pool served credential-stealing Terraform modules for 14 hours

Coder says an unidentified actor reached its Cloudflare infrastructure and pointed part of registry.coder.com at servers it controlled. Because those servers are unreachable, nobody can enumerate who downloaded what.

Publishers:bleepingcomputer.comscworld.com

Reality

Evidence60
Adoption: Insufficient
Hype gap+5
Incentives45
Confidence65

security2 publishers

Cursor launched Jade Sleet's macOS backdoors seconds after a DevOps engineer opened a workspace

SentinelOne has documented North Korea's Jade Sleet inside a small Indian IT services provider, using Rust backdoors built for Apple Silicon and a Terraform lock file that points developers at a fake HashiCorp registry.

Publishers:scworld.comthehackernews.com

Reality

Evidence55
Adoption: Insufficient
Hype gap+15
Incentives40
Confidence55

security1 publisher

A DPRK-linked package campaign has started publishing to HashiCorp's Terraform Registry

Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.

Publishers:thehackernews.com

Reality

Evidence66
Adoption21
Hype gap+14
Incentives72
Confidence58

build1 publisher

Graphalgo malware in a Terraform provider stays inert until two variables hash to one digest

Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.

Publishers:aikido.dev

Reality

Evidence68
Adoption: Insufficient
Hype gap+12
Incentives62
Confidence61

build1 publisher

Eleven variants of one shell script launched years-old images into a FedRAMP cluster

The fix was a single new image tag, and it had to land on hundreds of laptops with no channel back to them. That requirement is what pushed a platform team off bash and onto a self-updating Go binary.

Publishers:dev.to

Reality

Evidence34
Adoption22
Hype gap+8
Incentives26
Confidence44

build1 publisher

An 8-minute dashboard heartbeat held a Databricks serverless warehouse open all weekend

A dev.to account puts one weekend of Databricks serverless compute at $14,000 and traces it to a Tableau connection that polled information_schema every eight minutes, restarting a 10-minute auto-stop timer it never let expire.

Publishers:dev.to

Reality

Evidence20
Adoption12
Hype gap+30
Incentives40
Confidence35

build1 publisher

A second scaling policy set this ASG flapping between five and six instances

An operator writing on dev.to describes a CPU target-tracking policy and a per-instance free-slot step policy taking turns on the same Auto Scaling Group, with tripling the alarm window only slowing the oscillation to six minutes.

Publishers:dev.to

Reality

Evidence55
Adoption20
Hype gap+12
Incentives25
Confidence55

build1 publisher

ConfigDirector rejects a schema tightening while staging still holds a value that would fail

Remote config edits skip CI entirely, so the case for validating values where they are saved is easy. The check worth copying refuses a new JSON schema while any environment still holds a value it would reject.

Publishers:dev.to

Reality

Evidence37
Adoption: Insufficient
Hype gap+18
Incentives86
Confidence44

build1 publisher

A 429 retry that swaps base_url sends production prompts to the drafting host

A dev.to checklist treats the model endpoint as a promotion surface with six gates, each requiring an artifact. Its enforcement is a grep over deploy manifests, so a base URL injected at runtime slips past.

Publishers:dev.to

Reality

Evidence31
Adoption: Insufficient
Hype gap+24
Incentives19
Confidence61

build1 publisher

A missing gp3 StorageClass made Storm's init containers blame Nimbus for two days

Apache Storm ships no maintained Helm chart and no migration guide, so one team wrote its own templates for EKS. The first thing that broke was a StorageClass name, and the only symptom was an init container log line.

Publishers:dev.to

Reality

Evidence58
Adoption18
Hype gap0
Incentives32
Confidence52

build1 publisher

The UAE is reportedly splitting a 5GW AI campus into a network of sites across the country

A dev.to post citing Reuters says the single 26-square-kilometer Abu Dhabi concept is giving way to dispersed data centers after drone and missile damage to AWS facilities, with air defenses and underground construction under consideration.

Publishers:dev.to

Reality

Evidence24
Adoption17
Hype gap+45
Incentives62
Confidence28

build1 publisher

The App Runner exit starts with two IAM roles you write yourself

A dev.to walkthrough says AWS App Runner no longer accepts new services, and the Amazon ECS Express Mode path it demonstrates opens with an execution role, an infrastructure role, and a public container image.

Publishers:dev.to

Reality

Evidence45
Adoption12
Hype gap+25
Incentives22
Confidence48

build1 publisher

The default MCP deployment buys a Kubernetes operational surface for request/response traffic

A dev.to writeup makes the case for trying Bedrock Agents or AgentCore Runtime before containers, and for putting real limits on the gateway, because a looping agent spends money without ever raising an error.

Publishers:dev.to

Reality

Evidence28
Adoption: Insufficient
Hype gap+18
Incentives32
Confidence36

Earlier coverage

Failing the deploy on a DNS zone diff catches the record someone edited outside the repo
Build · September 17, 2026 · 1 publisher
Forty-eight hours of load balancer forensics ended at a module-level requests.Session
Build · September 17, 2026 · 1 publisher
LocalStack's March image ties every CI run to a registered account's auth token
Build · September 16, 2026 · 1 publisher
Every cross-account role in an AWS landing zone stops at the aws-eusc partition line
Build · September 16, 2026 · 1 publisher
Branch protection stopped the Terraform edits in Unit 42's ten-hour agent intrusion
Build · September 16, 2026 · 1 publisher
A ten-gate checklist for agent code places nine of its checks at build time or later
Build · September 16, 2026 · 1 publisher
Mass scanners are pulling AWS keys and Terraform state from Vite dev servers exposed with --host
Security · September 15, 2026 · 3 publishers
Voss rests the case against license-level charging on three reversals and one buyout between 2017 and 2025
Build · September 15, 2026 · 1 publisher
The nested OU format AFT documents fails on the three accounts Control Tower owns
Build · September 15, 2026 · 1 publisher
Twenty Firestore posts cost forty reads until the author name lives in the post document
Build · September 15, 2026 · 1 publisher
The bare Todo API's list route calls table.scan() and returns every user's rows to an anonymous caller
Build · September 14, 2026 · 1 publisher
A nine-agent pipeline injects canonical API examples because its agents can skip the MCP lookup
Build · September 14, 2026 · 1 publisher
The drift job that catches a console fix needs write access to the state lock
Build · September 14, 2026 · 1 publisher
A committed .github/copilot-instructions.md prepends a repository's invariants to every Copilot request
Build · September 11, 2026 · 1 publisher
Kubernetes v1.37 turns scale-to-zero autoscaling on by default
Build · September 11, 2026 · 1 publisher
Hybrid DR puts an always-warm inference stub in a cluster scaled to near-zero
Build · September 10, 2026 · 1 publisher
Locking the EKS API to one IP left the worker node with no route to the control plane
Build · September 10, 2026 · 1 publisher
Unit 42 timed an agentic intrusion at fifty ATT&CK techniques in under ten hours
Science · September 5, 2026 · 2 publishers
Unit 42's ten-hour intrusion forces a choice about who may disable an account without asking
Leadership · September 5, 2026 · 1 publisher
HCP Terraform charges rent on every security group rule in your state file
Product · September 4, 2026 · 1 publisher
HCP Terraform issues the agent a cloud credential that dies with the run
Build · September 1, 2026 · 1 publisher
A .find() on a symbol name is how an agent ends up editing the wrong handler
Build · September 1, 2026 · 1 publisher
Curator approval gates every record AWS Agent Registry shows a consumer
Build · August 31, 2026 · 1 publisher
Someone else's encryption fix rides your Postgres bump into a database replacement
Build · August 29, 2026 · 1 publisher
ECS Express Mode bakes 5% of traffic for three minutes before it shifts the rest
Build · August 29, 2026 · 1 publisher
One company holding the copyright is the trait that predicts the next relicensing
Build · August 29, 2026 · 1 publisher
Pulumi points a security agent at its context graph to hunt cloud attack paths
Product · August 28, 2026 · 1 publisher
Start every VPC at /16 because renumbering later becomes a migration project
Build · August 27, 2026 · 1 publisher
Portainer 2.45 LTS makes UI-installed Helm add-ons a production option, with one item on the menu
Product · August 27, 2026 · 1 publisher
AI writes the Dockerfile, and the pipeline is still checking the app code
Product · August 26, 2026 · 1 publisher
One provider block and an AMI filter: testing Terraform portability against on-prem hardware
Build · August 26, 2026 · 1 publisher
Cursor cloud agents can mint their own Vault login, and the static token goes away
Build · August 25, 2026 · 1 publisher
Four agents, five stages, one manifest row: AWS's migration pipeline is a handoff problem
Build · August 24, 2026 · 1 publisher
Partial batch failures: the handler is fine, the mapping decides
Build · August 24, 2026 · 1 publisher
Thirteen times more releases, the same manual disk resize
Build · August 24, 2026 · 1 publisher
The pre-migration subnet plan is an audit against reality, not a diagram
Build · August 23, 2026 · 1 publisher
Express Mode builds the ALB you skipped, and owns the knobs you used to write
Build · August 23, 2026 · 1 publisher
Velocity was stable because the work was: 31, 34, 32, then 14
Build · August 23, 2026 · 1 publisher
ALB validates the JWT, Keycloak decides what is in it: the Terraform for the matching realm
Build · August 22, 2026 · 1 publisher
A 30-to-45-second timeout change, four approvals, no merge: the cost of a two-person gate
Build · August 22, 2026 · 1 publisher