A developer detailed the architecture of production AI systems on AWS, emphasizing that the core challenge is building reliable systems around LLM API calls rather than making the calls themselves. Th…
A developer's blog post explains the differences between IAM Roles for Service Accounts (IRSA) and EKS Pod Identity in Kubernetes, detailing how each mechanism extends a pod's ServiceAccount identity …
A developer detailed a production-grade GitOps architecture on AWS that uses separate EKS clusters per environment, ECR as the registry, OIDC federation instead of static credentials, and Kargo to aut…
A developer detailed a step-by-step incident response for stopping S3 data exfiltration in real time, focusing on revoking IAM role sessions to invalidate compromised temporary credentials. The approa…
Amazon Bedrock Model Evaluation enables teams to compare foundation models with data instead of guesswork, offering automatic metrics and LLM-as-a-Judge modes. A hands-on guide demonstrates building a…
Spinifex, an open-source platform that runs AWS-compatible APIs on self-owned infrastructure, has been released under the AGPL-3.0 license, allowing software built for EC2, S3, EBS, VPC, or IAM to run…
Agentgateway, an open-source AI gateway, now supports invoice-grade cost attribution for Amazon Bedrock by passing caller identity and session tags through AWS Security Token Service (STS) AssumeRole …
Spinifex, an open-source platform licensed under AGPL-3.0, enables running AWS-compatible APIs (EC2, S3, EBS, VPC, IAM) on self-owned infrastructure without code changes, targeting sectors like defenc…
Kelsey Hightower's PlatformCon 2026 talk on solving problems once by encoding solutions into reusable artifacts is applied to security verification. The article argues that instead of using AI to spee…
A developer discovered that the IAM policy they wrote for their solar agent was not truly least privilege, granting broader access than the code required. The policy's Bedrock statement used wildcards…
CloudWise, a cloud cost optimization tool, has detailed its security model for AWS account access, emphasizing that its read-only monitoring role is scoped to specific actions and cannot make any writ…
A cloud engineer at ZopNight audited their AWS environment after frontier AI models slipped containment in live security tests, finding that the models' blast radius is determined by cloud settings li…
An engineer detailed the authentication options for Claude Code, including API keys, Amazon Bedrock, and the Claude Platform on AWS, highlighting use cases for each. The post includes a code example f…
A developer argues that cloud security tools miss the most dangerous attack paths because they check individual resources rather than the relationships between them. The post identifies intent-indepen…
Cloudrift, a read-only AWS waste scanner, is now available as a command-line tool that estimates monthly costs of wasted resources without modifying or deleting anything. The tool, installable via npm…
Stave, a security startup, introduced a new approach to prioritize cloud misconfiguration findings by evaluating compound attack paths rather than individual permissions. The system labels findings as…
A developer built Infrawise, an open-source tool that prevents AWS AccessDeniedException errors by comparing a Lambda function's code dependencies against its IAM role permissions. The tool scans code…
A developer details common failure modes in n8n Bedrock automation pipelines, including throttling, duplicate content generation, and cost blowouts. The post explains that n8n is purely an orchestrato…
A developer explains how to stop using AWS access keys and prevent leaks by switching to temporary credentials. Alternatives include AWS CLI login, OIDC for CI/CD, IAM roles for AWS resources, and IAM…
Rapid7's Incident Command team details how attackers establish persistence in AWS environments by creating IAM users and assigning credentials and permissions, emphasizing that undetected persistence …