Another week, another resource control policy! I guess this is what IAM geeks do. 😹

github.com/sqlxpert/aws-rcp-s3-require-encryption-kms

is my new way to replace KMS encryption statements potentially repeated in hundreds of S3 bucket policies.

Install it in your AWS Organizations management account, with CloudFormation or native Terraform.

Tag an S3 bucket and enable attribute-based access control (ABAC) for the bucket.

security-s3-require-encryption-kms-key-arn = ARN of KMS key required in this bucket

(Two other identifiers are also supported. One is for the simplest setups, in which S3 bucket and KMS key are only ever used in one region and AWS account. The other fits KMS multi-region keys defined in a central AWS account.)

Any attempt to create an object with the wrong encryption type or wrong KMS key yields AccessDenied .


An optional service control policy locks the tag.

Between the resource control policy itself, the automated test stack (CloudFormation only, because it's temporary), and the documentation, there's lots of information about:

• New 2025–2026 S3 features (attribute-based access control, account-regional namespaces)
• IAM policy condition keys for tags, and condition operator semantics
• Secure, future-proof KMS key configurations
I really appreciate your feedback, and that's not an empty statement: I improve stuff based on user requests, and I of course acknowledge the source.

I hope this will be useful. If you give it a try, thank you!

I built CubbyDrop — encrypted file sharing where the server never sees your data.
How it works: your files are encrypted with AES-256-GCM in the browser before upload. The key stays in the link — the server literally can't access
your files.

Main features:
• End-to-end encrypted file transfers
• Password protection & download limits
• Delete-after-download for sensitive files
• Live peer-to-peer mode (no server, no size limits)
• Personal subdomains (you.cubbydrop.com)
• Team plans with admin dashboard & domain discovery
• QR code sharing for mobile
• Encrypted text/password paste
https://cubbydrop.com
Would love honest feedback — what's missing? What would make you switch from your current tool?

AI infrastructure is moving fast, and the cost of getting it wrong is rising.

Too many teams are still dealing with the same problems: surface-level conversations, fragmented market views, and uncertainty over whether the right people are even in the room.

AI Infra Summit is built to solve that.

It brings together the technical leaders, enterprises, hyperscalers, and infrastructure players driving the industry forward, so you can get practical insight, see the full ecosystem more clearly, and make connections that matter.

If you want a sharper perspective and better conversations, register your interest here: https://lnkd.in/e9HVGddr

Sam may be intentionally to stay behind Dario to avoid to be hated by engineers being laid off but maintain his business market. the hatred turning against to the 1st leader may happen in a snap, hope this wouldn’t happen

Hey 👋
DevOps / SRE here (~8y professional experience).

After constantly dealing with load testing setups, I built a tool to simplify the workflow (distributed tests, regression detection, reports, CI/CD, etc):
https://loadtester.org

Would love feedback from others engineers — happy to jump on a quick demo call if useful, otherwise feel free to register and use a free plan!

Not sure if this was shared already; @Matt Gowie shared with me https://www.youtube.com/watch?v=g1R71Wbxlkk

👋 Hi everyone!

My name is Chi, and I'm a VIP Experience Executive at Kisaco Research - a London-based B2B events company that produces high-level industry conferences and summits for some of the world's leading tech communities.

I'll be honest, I'm relatively new to the AI and infrastructure space 😄 but I'm learning fast and this community looks like exactly the right place to do that!

The reason I wanted to reach out is that we have our AI Infra Summit coming up at the Santa Clara Convention Center, 15–17 September, and it may be of interest to some of you. Here's a flavour of what's on:

🔹 6 content stages covering Compute, Data Movement, Data & Models, AI Data Centre, Physical AI, and a Main Stage
🔹 8,000+ attendees from across the AI infrastructure engineering world
🔹 Speakers include Jeff Dean (Chief Scientist, Google), Lip-Bu Tan (CEO, Intel), plus teams from Microsoft, Meta, Boeing, Lockheed Martin, eBay and 50 more announced just this week
🔹 Real-world architecture talks from teams running large-scale AI workloads in production

Complimentary tickets are available for qualifying enterprises, hyperscalers, and AI labs, which is exactly where my role comes in. I handle VIP guesting for enterprise and hyperscaler attendees, so if you're interested in attending or know a colleague who might be, feel free to drop me a message and I'll get you sorted 😁

We also have a free webinar coming up on 16 April - AI in Practice: From Innovation to Market Reality - if you'd like a taster before the main event. 👉️ https://lnkd.in/eDRCQEAY

Great to meet you all, and looking forward to getting to know this community! 🙌

Hey folks, just wanted to share a new tutorial on building a closed-loop workflow with Codex and Signadot. It covers using MCP to let agents spin up their own K8s sandboxes and self-correct based on test results. Hope it's helpful!
https://www.signadot.com/docs/tutorials/autonomous-closed-loop-codex

AI is so powerful now. I feel companies should look at flexible time sharing contractors instead of part-time or full-time ones, benefit for both sides

hi everyone
wanted to share a small project i’ve been working on.

KubeAgent watches your Kubernetes clusters 24/7, diagnoses issues automatically, and applies safe fixes or pings you on Slack, Discord, Teams, Telegram, or PagerDuty to approve risky ones.

would love feedback from you.
https://kubeagent.net/

I just completed the self-service microservice IDP project, built with Backstage, ArgoCD, GitHub Actions and Helm. dev fills out a form in Backstage and gets a full repo + CI/CD + k8s would really appreciate any feedback, repos: - backstage portal: https://github.com/Eweka01/backstage-app - software templates: https://github.com/Eweka01/backstage-software-templates writeup: https://medium.com/@oseweka1/i-built-a-self-service-microservice-platform-with-backstage-argocd-github-actions-2037f46a3b50 (edited)

Medium
I Built a Self-Service Microservice Platform with Backstage, ArgoCD & GitHub Actions
Tech Stack: Python · Docker · GitHub Actions · Kubernetes · Helm · ArgoCD· Backstage: From CI/CD Pipelines to an Internal Developer Portal

Next Stategraph Demo Day is April 22: https://stategraph.com/demo-day
I’ll be putting the demo gods to the test by refactoring a messy Terraform repo live using Claude Code and the Stategraph SKILL.md

['=]---

Ever stopped an RDS or Aurora database, only to be surprised by a big bill because it was re-started after 7 days?

I'm excited to share a new release of github.com/sqlxpert/step-stay-stopped-aws-rds-aurora !

It should now work beyond just the aws partition (please confirm, and I'll acknowledge you in the next ReadMe update). I've also added an optional service control policy and enabled immutable releases.

Key elements are security (IAM intricacies and optional KMS encryption — the real thing, with support for multi-region keys housed in a separate account), multi-region + multi-account deployment (CloudFormation StackSet + optional Terraform), and serverless simplicity (EventBridge→Step Function). This was inspired by a user request, so I welcome your feedback…

the hashicorp license change last year made me realize i had no idea what it would actually take to migrate off terraform if we ever needed to. turned out the answer was way more complicated than just rewriting some hcl files - we're locked into the provider sdk, the module registry, and most painfully the state file format which doesn't have any clean conversion path to other tools unless you manually import every single resource one by one.
i documented the four types of lock-in most teams don't realize they have until they try to leave, plus realistic migration timelines based on team size

https://dev.to/muskan_8abedcc7e12/terraform-lock-in-is-real-heres-how-to-get-out-4j8g

anyone going to gitex africa ?

came across this post about Trivy, https://raxe.ai/labs/advisories/RAXE-2026-045

Claude Code source codes may be leaked…

Additional fall out from the Trivy compromise: https://security.snyk.io/vuln/SNYK-JS-AXIOS-15850650

https://stategraph.com/first-principles

wdy? looks like the case for monolith terraform repos mostly

The Trivy incident is a good reminder that supply chain attacks are as much an incident response problem as a security one. You can harden your pipeline, but when something slips through, the question becomes: how fast can you reconstruct what actually happened and what was touched?

That's the problem we work on at Anyshift. I'm Valentine, ML/Data background, now Founding GTM there. We build causal reasoning over production and infra data so when things break (or get quietly compromised), you're not stitching together logs and timeline manually. https://www.anyshift.io/

Curious how people here handle post-compromise investigation, any tooling beyond the usual SIEM + log grep?

While working around non-prod environments, I kept running into one issue, lack of visibility into actual usage vs assumed usage.

We tend to keep dev/staging infra “ready,” but rarely question:
are these environments really being used at that level?

Tried building a Grafana dashboard combining workload utilization, environment-level signals and rough cost indicators.

Nothing fancy, just trying to make decisions a bit more data-backed.

Shared what I explored here:
https://dev.to/muskan_8abedcc7e12/grafana-dashboards-for-non-prod-environment-observability-cost-performance-in-one-view-40hc

Would love to know how you all handle non-prod optimization in your setups.

finally: https://opentofu.org/docs/language/meta-arguments/enabled/

it took just 12 years to land that

Interesting read on the gap between how fast AI agents can generate code and how slow enterprise teams can actually validate it. Gets into why CI pipelines are becoming the bottleneck and what infrastructure needs to change.
https://thenewstack.io/ai-agent-validation-bottleneck/

https://claude.com/contact-sales/claude-for-oss

This Trivy compromise is insane to me. I've been trying to spread the word that this is probably more widespread than people realize: https://rosesecurity.dev/2026/03/20/typosquatting-trivy.html

Hey everyone,
Just announced our upcoming Skills product and would love to hear the community’s thoughts on it.
Skills are composable, deterministic validation capabilities that platform teams govern, developers define, and agents can run autonomously against live infrastructure to close the loop and deliver validated changes in distributed systems.
Here’s the blog. Please share any feedback or ideas for which skills would be most useful to your team.
https://www.signadot.com/blog/introducing-skills-microservices-validation-superpowers-for-coding-agents/

Was digging into Kubernetes cost optimization and ended up testing Spot + Karpenter + Graviton together, it turned out more practical than I expected.
Would be interested to hear how others are handling stability and trade-offs with similar setups.
Here’s what I observed:
https://dev.to/muskan_8abedcc7e12/going-to-production-spot-instances-karpenter-and-the-graviton-advantage-4oi5

AI tools are powerful… but they keep forgetting your code.

What if context never reset?

This session on Context Engineering with Tetrix shows how AI can actually understand your codebase, retain memory across sessions, and work seamlessly across tools like Cursor & Claude.

If you’re building with AI or working on complex systems — this is a must-attend.

📅 March 24 | 7:30 PM IST

Register here: https://luma.com/gssl6616

I also thought about this incident just now, and chat with ChatGPT, a good takeaway is do not use tag but the image SHA

Here's a bit more a technical security research write up on how the compromise was introduced into the Trivy ecosystem: https://rosesecurity.dev/2026/03/20/typosquatting-trivy.html

Trivy hacked for the second time within a month: https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release

Thanks @Erik Osterman (Cloud Posse) for the opportunity to share my application. One additional area I’ve been exploring is open-source licensing. I’ve noticed that more projects are adopting the AGPL, and I’ve come to the same conclusion that it offers stronger protections compared to licenses like MIT or Apache, even though it is not as widely adopted as those more permissive options.

Stategraph will be at KubeCon Amsterdam next week.

If you want to say hello, come find our booth. Just kidding. We don't have one.

For a bootstrapped company, spending $20,000 on a booth didn’t feel like the move 🤗

But we do have a boat.

We’re doing three canal tours next Wed the 25th (13:00, 15:00, 17:00). Free drinks, infrastructure engineers, and a slow cruise through Amsterdam. This is mostly an excuse to swipe the company credit card.

If you want to join: https://stategraph.com/kubecon-set-sail

I put together a tutorial on creating end-to-end preview environments using Vercel + Signadot so teams can test multi-service changes before merging. Thought it might be useful for anyone working with preview environments or microservices workflows.
https://www.signadot.com/blog/tutorial-end-to-end-hot-reload-style-previews-with-vercel-signadot/

Many teams are struggling to see real velocity gains with AI agents because the focus is often on "risk tolerance" instead of actual capability boundaries.
This article on TNS shares a 3-Tier model for dividing work based on what can be reasoned from the codebase versus what requires external context like product strategy or platform constraints. It’s a helpful framework for anyone looking to balance AI throughput with engineering judgment.
Full blog here: https://thenewstack.io/ai-agents-software-engineering/

Recently I got the Claude Pro, now I can use Claude Code. I also tried Codex 5.2/5.3 which seems to me also an equivalent smart model. Someone even said 5.4 is better than Sonnet/Opus 4.6.

I am at the harness devops modernization summit today, it's been pretty good, the talk from the SFO airport engineer and Tailscale engineer just now was really good. https://www.harness.io/event/devops-modernization-summit free https://www.airmeet.com/e/9cc741e0-f8a2-11f0-b465-d14d8cb3ebe4. some good context for me about devops + ai

Hey! I co-organize a live weekly thing about startup failure stories - F*ckUp Night.
Builders share mistakes they made, what happened next, and what they learned in ~10 min. People ask questions, give suggestions — it's honest and lively. The kind of stuff that can save you time and money at any stage.
Someone from the last one said: "Even though people shared their failures, I was not demotivated but rather motivated by their courage and experience." — and basically that's exactly how it feels.
📆 March 5, 12, 19, 26; 17:00 CET
🔗 Live on Zoom, register: https://lab.flexus.team/events/fuckup-night

Also, if you want to share your story, let's connect in DM.

Curious how SRE teams here handle incident postmortems.
I built a small tool that reads Slack war-room threads and generates an RCA automatically.
Example output:
• Timeline reconstructed from messages
• Root cause analysis
• Evidence links to logs
• Executive summary
Example incident flow:
03:47 — incident posted in Slack
03:49 — RCA generated
03:51 — fix suggested
Would love feedback from people doing on-call / incident response.
https://www.prodrescueai.com

Hey hey! I’ve been working on this project for a couple of years, and I’m really excited (and a bit nervous) to finally share it here.

I built a game called Blind Draw. It’s a drawing game where you draw using invisible ink, so you can’t see what you’re drawing until the end. The results are often hilarious and surprisingly creative. It originally started as something I wanted to play with family and friends, just to laugh and have fun together.

Over time it slowly grew into a real game with different modes:
Free Draw where you can just experiment and create funny drawings

Copycat where you try to mimic a drawing without seeing your lines

Speed Drawing where you race against the clock to draw as fast as possible

Online play where friends draw and the others try to guess what it is

I’m currently doing a soft launch, and honestly it’s doing better than I expected, which makes me really happy after spending so much time building it.

If you enjoy silly creative games or want something fun to play with friends or family, I’d really love for you to try it and tell me what you think.

https://apps.apple.com/de/app/blind-draw-invisible-ink/id6758377109?l=en-GB

Thanks for taking a look and I would really appreciate the support since it has been a tough journey ❤️

Anthropic dropped a guide on building skills https://resources.anthropic.com/hubfs/The-Complete-Guide-to-Building-Skill-for-Claude.pdf