Topic
Infrastructure as Code (IaC) is the practice of provisioning computing infrastructure via machine-readable config files instead of manual steps.
AWS opened a preview of Well-Architected Agent, a service that reads live accounts across 65+ services and ranks fixes against goals each team declares. The review becomes a job run against the real environment, and every fix comes back as code or commands for the team to apply.
Reality
env zero's EZ Control lets agents repair infrastructure drift across nearly 2,300 resource types, at an autonomy level each platform team picks. How much autonomy a team grants will depend on how far it trusts the product's map of who owns each resource.
Reality
Coder says an unidentified actor reached its Cloudflare infrastructure and pointed part of registry.coder.com at servers it controlled. Because those servers are unreachable, nobody can enumerate who downloaded what.
Reality
Pulumi snapshots its Neo agent's working directory with open source Kopia after Git-based recovery left resumed tasks with incomplete files. Teams running long agent jobs face the same storage choice, and Pulumi chose what its self-hosted customers already run.
Reality
Devops.com argues that when an agent opens 40 pull requests before lunch, plan review still blocks merges and writes audit events but stops checking anything. Its remedy automates policy checks and caps the damage, so people review intent.
Reality
Mutation testing needs a function to mutate, so the YAML and Terraform that gate production go untested. canfail edits an anchored string in those files, runs your check and reports whether it failed for the reason you declared.
Reality
A dev.to account of two AccessDenied failures shows CloudFormation resource providers making supporting calls into adjacent services, so an execution role scoped to the template's service namespaces is incomplete by construction.
Reality
Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.
Reality
Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.
Reality
A dev.to walkthrough gives a Nova Sonic voice agent and an Amplify AI Kit chat agent one long-term memory in Amazon Bedrock AgentCore Memory, where every record is filed under an actorId and a sessionId. Both channels already had short-term context.
Reality
An operator writing on dev.to describes a CPU target-tracking policy and a per-instance free-slot step policy taking turns on the same Auto Scaling Group, with tripling the alarm window only slowing the oscillation to six minutes.
Reality
A dev.to walkthrough says AWS App Runner no longer accepts new services, and the Amazon ECS Express Mode path it demonstrates opens with an execution role, an infrastructure role, and a public container image.
Reality
A dev.to writeup makes the case for trying Bedrock Agents or AgentCore Runtime before containers, and for putting real limits on the gateway, because a looping agent spends money without ever raising an error.
Reality
A dev.to walkthrough keeps stable internal hostnames in the infrastructure repository, then polls the authoritative answer for up to 60 seconds after each upsert and exits nonzero when the published set differs from the manifest.
Reality
CISA has published the after-action report for an incident its own tooling missed. A researcher who continuously scans public code repositories spotted admin and build credentials and told a reporter.
Reality
AWS's landing zone guidance for the European Sovereign Cloud starts at the partition boundary. Credentials in aws-eusc cannot reach resources in aws, so the centralisation an operator already runs gets built a second time inside the new partition.
Reality
On a self-hosted spot runner, an instance AWS reclaimed and a genuinely broken test both produce the same red X, so this pipeline reads the raw job log for four host-only strings and re-runs only the jobs the host killed.
Reality
One developer took Nx Plugin for AWS 1.0, the AWS Blocks preview and Amplify Gen 2 to the same file-portal scope, deployed all three against one FSx for ONTAP access point, then deleted everything to see what stayed behind.
Reality
DynamoDB vector search has been generally available since August 5, 2026. A walkthrough of a serverless search engine shows what a single Lambda actually buys with it, and what choosing 512 dimensions commits a catalogue to.
Reality
IAM Access Analyzer already names the unused permissions and writes the tightened policy. A new AWS pattern sorts each finding by how the role was created and files the fix as a pull request or an issue.
Reality
Build · September 15, 2026 · 1 publisher
Build · September 14, 2026 · 1 publisher
Build · September 14, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Product · September 4, 2026 · 1 publisher
Build · September 1, 2026 · 1 publisher
Build · September 1, 2026 · 1 publisher
Build · August 31, 2026 · 1 publisher
Build · August 29, 2026 · 1 publisher
Product · August 28, 2026 · 1 publisher
Build · August 26, 2026 · 1 publisher
Build · August 25, 2026 · 1 publisher
Build · August 20, 2026 · 1 publisher
Build · August 20, 2026 · 1 publisher
Product · August 15, 2026 · 1 publisher