Topic
Infrastructure as Code (IaC) is the practice of provisioning computing infrastructure via machine-readable config files instead of manual steps.
AWS put Well-Architected Agent into preview on 10/01/2026, capping each scheduled run at 30 recommendations with a 7-day cooldown. A dev.to post says that makes the triage team the bottleneck.
Reality
One revoked personal OAuth token stopped runs across 276 Terraform Enterprise workspaces, according to a dev.to write-up. Nobody was paged and the team needed two days to notice, so it moved the workspaces onto a GitHub App owned by the org.
Reality
CDK grants CloudFront only one of the two permissions a locked-down Lambda function URL needs, according to an October 2026 update to a dev.to tutorial. The update also moves new functions to Node.js 24, as nodejs20.x lost security patches on 30 April 2026.
Reality
HashiCorp's Terraform provider for Google Cloud 8.0 switches the default scheme on two load balancer resources from EXTERNAL to EXTERNAL_MANAGED. Teams still on Classic have to pin the old value before they upgrade, or the first plan may propose changes to their live load balancers.
Reality
OpenTofu 1.13 adds assume functions that let module authors declare an unknown value's shape, so null and prefix checks get answered at plan time. Plan reviews lean less on guesswork wherever shared modules wrap their outputs this way.
Reality
Terraform 1.16 lets Actions fire on before_destroy and after_destroy events, putting backups and deregistration beside the resource and in the plan. Pipelines pay for that with two-step deletions and a failure mode someone has to choose on purpose.
Reality
AWS opened a preview of Well-Architected Agent, a service that reads live accounts across 65+ services and ranks fixes against goals each team declares. The review becomes a job run against the real environment, and every fix comes back as code or commands for the team to apply.
Perspective Coverage
3 publishersReality
env zero's EZ Control lets agents repair infrastructure drift across nearly 2,300 resource types, at an autonomy level each platform team picks. How much autonomy a team grants will depend on how far it trusts the product's map of who owns each resource.
Reality
Coder says an unidentified actor reached its Cloudflare infrastructure and pointed part of registry.coder.com at servers it controlled. Because those servers are unreachable, nobody can enumerate who downloaded what.
Reality
Pulumi snapshots its Neo agent's working directory with open source Kopia after Git-based recovery left resumed tasks with incomplete files. Teams running long agent jobs face the same storage choice, and Pulumi chose what its self-hosted customers already run.
Reality
Devops.com argues that when an agent opens 40 pull requests before lunch, plan review still blocks merges and writes audit events but stops checking anything. Its remedy automates policy checks and caps the damage, so people review intent.
Reality
Mutation testing needs a function to mutate, so the YAML and Terraform that gate production go untested. canfail edits an anchored string in those files, runs your check and reports whether it failed for the reason you declared.
Reality
A dev.to account of two AccessDenied failures shows CloudFormation resource providers making supporting calls into adjacent services, so an execution role scoped to the template's service namespaces is incomplete by construction.
Reality
Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.
Reality
Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.
Reality
A dev.to walkthrough gives a Nova Sonic voice agent and an Amplify AI Kit chat agent one long-term memory in Amazon Bedrock AgentCore Memory, where every record is filed under an actorId and a sessionId. Both channels already had short-term context.
Reality
An operator writing on dev.to describes a CPU target-tracking policy and a per-instance free-slot step policy taking turns on the same Auto Scaling Group, with tripling the alarm window only slowing the oscillation to six minutes.
Reality
A dev.to walkthrough says AWS App Runner no longer accepts new services, and the Amazon ECS Express Mode path it demonstrates opens with an execution role, an infrastructure role, and a public container image.
Reality
A dev.to writeup makes the case for trying Bedrock Agents or AgentCore Runtime before containers, and for putting real limits on the gateway, because a looping agent spends money without ever raising an error.
Reality
A dev.to walkthrough keeps stable internal hostnames in the infrastructure repository, then polls the authoritative answer for up to 60 seconds after each upsert and exits nonzero when the published set differs from the manifest.
Reality
Build · September 11, 2026 · One report1 publisher