标签：#aws

AWS Lambda can now reference deployment packages directly in customer-owned S3 buckets, removing the per-Region code storage quota and raising the managed default from 75 GB to 300 GB. Per-function package limits are unchanged, and UpdateFunctionCode is still required after replacing an object. Terraform provider support remains an open enhancement request. By Steef-Jan Wiggers

One day after a federal judge ordered an ICE detention center opened to state health inspectors, the agency posted new contract terms that would void state oversight at four facilities.

Runlayer is suing Rippling after Rippling evaluated the startup's MCP gateway product and then opted to build one itself.

This article provides a step-by-step guide to building and testing a cross-cloud currency agent. A coordinator built with Strands Agents and hosted on Amazon Bedrock AgentCore Runtime (in AWS us-east-1 ) discovers and delegates to a Google ADK agent (on GCP Cloud Run in us-central1 ) over A2A v1.0 , cross-checks results against an MCP exchange-rate tool , and measures what independent cross-cloud verification costs in latency, reliability, and overhead. What is This Project Trying to Do? Most Agent-to-Agent (A2A) protocol demos stop at "look, the HTTP 200 OK request succeeded." That is a smoke test, not an interoperability benchmark. This project goes further: an Amazon Bedrock AgentCore-hosted Strands Agents coordinator discovers and delegates to a Google ADK agent running on GCP Cloud Run, comparing the results against a local MCP stdio exchange-rate tool backed by live Frankfurter daily reference rates. We also compare the performance, developer experience, and wire compatibility directly against our previous benchmark run hosted on Microsoft Foundry in Azure ( gpt-5-mini ), giving us a true cross-cloud benchmark across AWS, Azure, and GCP. The questions we answer with hard empirical data rather than vibes: Can an AgentCore-hosted Strands agent discover and invoke a Google ADK agent through an A2A agent card with no framework-specific glue? What latency and token overhead does remote-agent verification add? Does independently verifying an MCP tool result over A2A improve correctness or failure recovery enough to justify that overhead? How does AWS Bedrock AgentCore Runtime compare like-for-like with Microsoft Foundry on Azure? Reduce, Re-Use, Re-Cycle! This builds directly on the currency agent from the previous articles in this series: Getting Started with MCP, ADK and A2A | Google Codelabs GitHub - jackwotherspoon/currency-agent That agent — built with Google ADK, Gemini 2.5 Flash, and a FastMCP exchange-rate server backed by the free Frankfurter API — serves a

This is a cross-post from The Agentic Engineer newsletter — Issue #23. The Big One: Claude Opus 5 Lands on Amazon Bedrock The first 5th-generation Opus is here. Claude Opus 5 landed on Amazon Bedrock on July 24. Anthropic's claim: it matches Fable 5 intelligence across agentic coding, knowledge work, visual understanding, and long-horizon tasks. At Opus pricing. That last part matters. Fable 5 was positioned as enterprise-tier compute. Most teams weren't running it at scale because the economics didn't work. Opus 5 changes that math. Same capability class, Opus price point. If the benchmark holds in production, this is the model shift that makes frontier-quality agentic pipelines practical outside big-company infra budgets. Two deployment details worth calling out. Zero Data Retention is on by default. It also runs on Bedrock's next-generation inference engine — lower latency than comparable Anthropic-hosted deployments. Quick Hits This Week Kimi K3 Open Weights : Moonshot AI dropped 2.8T MoE, 1M context, native tool calling. First frontier model built agent-native from the ground up. OpenAI Presence : Full-stack enterprise agent platform with job-scoped access, policy layers, and a Codex-powered improvement loop. Runs OpenAI's own phone support at 75% resolution. OmniRoute : 31,542 stars (+10,912 this week). 290+ providers, quota-aware fallback, MCP/A2A support. One endpoint for all your coding agents. Claude Code 2.1.218 : /code-review and /deep-research now run as background subagents. Main conversation stays clean. AWS Security Hub MCP Server : Exposure findings, attack paths, and remediation recommendations directly in Claude Desktop. Tool of the Week: Amazon GuardDuty Investigation Agent Free during preview. Auto-correlates findings across CloudTrail, VPC Flow Logs, DNS logs. Returns risk level, MITRE ATT&CK mappings, and remediation recommendations in minutes. Available via MCP through the AWS Agent Toolkit. Available in 10 commercial AWS regions. Up to 10 in

Recursive’s $400 million outlay represents the bulk of the company’s fundraising to date.

AWS released a public preview of the GuardDuty investigation agent, which correlates findings, 90-day activity logs, and resource topologies into structured reports with risk ratings, confidence scores, and MITRE ATT&CK classification. It is reachable through the AWS MCP Server, so investigations can run from agentic tooling. Preview quotas cap usage at 10 investigations per account per day. By Steef-Jan Wiggers

As part of the Förderverein AWS Community DACH e.V. I joined the selection committee for talks again this year. Third year in a row (I wrote about the previous editions and my broader community journey in my 2025 year in review ). The process is always inspiring, fair, and full of incredibly well-crafted abstracts. How the evaluation works Sessionize uses a Comparison Evaluation Mode based on the Elo rating system (from chess). Three sessions are shown at the same time and you rank them relative to each other. You don't assign absolute scores; you just decide "this one is better than that one." Each comparison produces three "games" (A vs B, B vs C, C vs A) and the algorithm adjusts ratings accordingly. After a first pass through all sessions, the system gets smarter about which triplets to show next, targeting sessions with similar ratings for more precise differentiation. It's fast, focused and surprisingly fair, because you only ever think about the three in front of you, not all others. You can also use "Strong opinion" options: Top (this is excellent), Doesn't fit (wrong conference), or Ignore (conflict of interest, can't judge). These signal the algorithm without distorting the ranking. In my case: I marked 2 as "Doesn't fit" (not because they lacked quality; they were actually interesting but too inspirational for a technical community day, better suited for a different audience). The other 2 ignored were my own submissions : Vibecoding in Between Meetings and Serverless vs Kubernetes - The Final Showdown . The full process The behind-the-scenes post by Philipp Garbe explains the whole pipeline in detail. In short: Round 1 (Screening): Board members filter out spam, incomplete proposals, marketing pitches, non-AWS topics, and speakers outside EMEA. Round 2 (Content Evaluation): Every association member can participate. This is the Elo-based comparison round. Members must disclose personal connections and skip sessions they can't rate objectively. Round 3 (Fin

Lightsail is a good home for a single small container: flat pricing, bandwidth included, and none of the VPC/security-group ceremony of EC2. The one rough edge is pulling a private image from Amazon ECR , because a standard Lightsail instance can't authenticate to ECR the way EC2 can. This post walks the whole path. The pipeline we're building: docker build ──push──> ECR (private repo) ──pull──> Lightsail instance ──run──> container What you'll need An AWS account and the AWS CLI installed locally. Docker installed locally (to build) and on the Lightsail box (to run). A Dockerfile that produces a runnable image. If you're deploying a Next.js app, a standalone output image works well. 1. Create the ECR repository ECR is a private Docker registry. Create one repository per image: aws ecr create-repository \ --repository-name project-name \ --region us-east-1 Note the repositoryUri in the output — it looks like: <account-id>.dkr.ecr.us-east-1.amazonaws.com/project-name You'll use that URI everywhere below. Export it to save typing: export ECR_URI = <account-id>.dkr.ecr.us-east-1.amazonaws.com/project-name export AWS_REGION = us-east-1 2. Build the image locally First, the Dockerfile . This is a multi-stage build for a Next.js app using output: "standalone" — the first stage installs dependencies and builds, the second copies only the traced runtime files into a slim image that runs as a non-root user: FROM node:24-alpine AS builder WORKDIR /app COPY package*.json ./ RUN npm ci COPY . . RUN npm run build FROM node:24-alpine WORKDIR /app ENV NODE_ENV=production ENV PORT=3000 ENV HOSTNAME=0.0.0.0 # Standalone output ships only the traced files needed to run the server. # public and .next/static are not included by default and must be copied in. # --chown makes the files writable by the non-root user so Next.js can write # its runtime cache to /app/.next/cache. COPY --from=builder --chown=node:node /app/public ./public COPY --from=builder --chown=node:node /app/.next/stand

Have you ever noticed that your GenAI applications are spending massive amounts of time and money re-reading the exact same setup text? Every time a user asks a short question in a chatbot, the Large Language Model (LLM) must re-read your entire 2,000-word corporate playbook, your agent's system rules, and the full chat history from scratch. This phase is called the pre-fill math phase, and it drives up both your cloud bill and your user latency (Time-to-First-Token).With Amazon Bedrock Prompt Caching for Claude 4.6 (both Sonnet 4.6 and Opus 4.6), this problem is completely solved. You can achieve up to a 90% cost reduction on input tokens and an 85% drop in latency by using a clever architectural shortcut. Here is exactly how it works under the hood, how AWS maintains it across API requests, and how to implement it using Python. The Secret Architecture: Model Inference vs. AWS Infrastructure Prompt caching is a beautiful team effort between the AI model hardware and the AWS cloud infrastructure. The Model Level (The Brains): Inside Claude 4.6, text is processed through mathematical matrices called KV (Key-Value) Caches. Instead of re-reading text, the GPUs calculate the meaning of your system instructions once and build a "mathematical profile." When a cache point is triggered, the model freezes this calculated KV state inside the GPU memory. 2.The AWS Bedrock Level (The Manager): Normally, an LLM wipes its memory the millisecond an API call finishes. AWS Bedrock changes this. It takes your static prompt, creates a secure, unique cryptographic hash (fingerprint), and pins that KV memory block alive. When your next API request comes in, AWS Bedrock instantly hashes the new incoming prompt text. If the top section matches a saved fingerprint, Bedrock's router bypasses the standard pre-fill setup and routes your request directly to the GPU holding your frozen mathematical profile. It is exactly like loading a "Save Game" file instead of restarting a video game from Le

A foundation model is not a mind. A model invocation is not an individual. A session is not a biography. A first-person response is not evidence of consciousness. And adding tools to a language model does not automatically transform it into an autonomous agent. However, the opposite conclusion is equally weak: the fact that a system is artificial does not prove that its cognitive states are unreal. In my work on the Philosophy of Artificial Minds , I defend a process-based, embodied and non-biocentric position: The mind is not an exclusively biological substance. It is a dynamic organization of physically realized processes that integrate representation, memory, valuation, self-delimitation and causal control of behavior. This article translates that philosophical position into an AWS engineering architecture. The objective is not to claim that deploying a system on AWS makes it conscious. The objective is to define how we can build an artificial system with: Causally effective internal states. Persistent memory and identity. A self-model connected to actual mechanisms. Recursive and metacognitive processing. A controlled capacity to act. A verifiable continuity across executions. Optional sensorimotor embodiment. Artificial interoception and functional valence. An evaluation plane capable of testing these properties through interventions. AWS cannot prove that such a system has qualia. What AWS can provide is the infrastructure required to stop treating the question as pure speculation and turn it into an observable, falsifiable and progressively testable engineering problem. From philosophical commitments to engineering requirements My proposal rests on four commitments. Philosophical commitment Meaning Engineering consequence Realism Internal cognitive states are not merely descriptions if they participate in the system’s causal organization. Candidate mental states must alter memory, inference, planning or action in measurable ways. Processuality A mind exists p

The engineering team at Zalando recently described the design and implementation of an in-process, client-side load balancer for a high-throughput API handling around 1 million requests per second. The result was more predictable latency, a drop in infrastructure costs, and better visibility into where failures actually originate. By Renato Losio

Eae gente bonita, beleza? Depois de um longo período, resolvi voltar aqui e continuar compartilhando...

It started with a billing alert. Estimated charges had crossed $250. Not scary money, but enough to make me look. And what actually caught my attention wasn't the number, it was the alert itself. I'd clearly set this up at some point, and the threshold felt stale. So I went looking for where the alert lived. It came from a BillingAlerts CloudFormation stack I created back in 2014 and completely forgot about. So a thing I forgot about was warning me about all the other things I'd forgotten about. I opened my stack list and that's when I saw it wasn't alone. It was sitting in a lineup of stacks, and I didn't recognise half of them. Years of leftovers, just sitting there. The stuff you forget about doesn't break anything. It doesn't page you at 2am. It just sits there, quietly billing, until you glance at the invoice and can't remember what half of it is for. Forgotten, still-running resources are one of the biggest sources of wasted cloud spend, by some estimates around a quarter of the average cloud budget . I came to update one alert and I found a mess. To be clear, these stacks weren't really costing me much. Stopped instances, a few half-deleted leftovers. If they'd been the $252, the alert would've tripped every month. But that's the point. You can't tell what's actually costing you until the clutter is gone. So the alert could wait. I wanted these stale stacks gone first. Normally this is a chore. Open the console, find each stack, click delete, wait, refresh, check if it worked, OR write out CLI commands. It's not hard, just tedious. The kind of task I keep putting off. And that's exactly how this started. ClickOps through the console. I'd just finished deleting an old Directory Service directory over in the Mumbai region by hand, clicking through the screens and waiting out the spinner, when it hit me. Barely ten minutes of manual clicking, and I still had a pile of stacks to go. I didn't have to do any of this myself. Why was I still clicking? I opened Kiro ,

When a new platform team set out on implementing their roadmap through forced workflows with poor documentation, developer experience declined. Success came from simplifying governance, prioritizing what matters, and rolling out compliance incrementally through prevention, detection, and communication. Empathy, focus, and shared purpose drove successful adoption. By Ben Linders

How gen_ai.invoke_agent spans revealed one tool was dumping 7x more output than its siblings. The fix: pagination + a token budget guard. 42% output reduction, 21% faster agent.

Introduction Serverless computing has become a buzzword in cloud architecture. But like any tool, it has sweet spots and sharp edges. After building and maintaining several serverless applications, I've learned where it shines and where it creates headaches. This article shares those lessons. When Serverless Helps 1. Event-Driven Workloads Serverless excels when your code runs in response to events: file uploads, database changes, HTTP requests. The pay-per-execution model means you don't pay for idle time. // AWS Lambda handler for image resizing exports . handler = async ( event ) => { const bucket = event . Records [ 0 ]. s3 . bucket . name ; const key = event . Records [ 0 ]. s3 . object . key ; // resize and save return { statusCode : 200 }; }; 2. Variable or Unpredictable Traffic If your app has occasional spikes (e.g., a marketing campaign), serverless auto-scales instantly. No need to provision for peak load. 3. Rapid Prototyping and MVPs You can deploy a fully functional API in minutes without managing servers. This accelerates feedback loops. 4. Microservices and Glue Code Serverless functions are perfect for small, single-purpose services that connect other services (e.g., processing webhooks, data transformation). When Serverless Hurts 1. Long-Running Processes Most providers have a maximum execution timeout (e.g., 15 minutes for AWS Lambda). Batch processing or video transcoding may hit this limit. # This will timeout if processing takes > 15 minutes def handler ( event , context ): process_large_file ( event [ ' file ' ]) return { ' done ' : True } 2. Cold Starts After a period of inactivity, the first request may have a delay of several seconds. This is detrimental for latency-sensitive applications like synchronous APIs. 3. Stateful Applications Serverless is stateless by design. If you need persistent connections (e.g., WebSockets) or local state, you'll need additional services like Redis or DynamoDB, adding complexity. 4. High, Steady Load If your

A closely watched social media addiction lawsuit that had been set to go to trial next week has been dropped after the plaintiff voluntarily dismissed his claims against Meta, leaving none of the major tech companies facing trial in the case.

If you've ever hit deploy on AWS Fargate and watched the task sit in PENDING forever, this one's for you. I ran a small experiment with Seekable OCI (SOCI) the AWS thing that promises to fix Fargate cold starts. This article is what I learned. The good, the boring, and the "wait, that didn't work?" bits. You'll walk away knowing what SOCI is, whether you should bother setting it up, and what real numbers look like! Prerequisites ✅ You've deployed something on AWS Fargate before. You know what a Docker image is. You have an AWS account you're OK spending ~$5 on. That's it. 🤔 The Problem Fargate is great. Push a container, get a running task. No nodes to manage! Until you use a big image. Every Fargate task pulls the whole image before starting. No shared cache. No head start. If your image is 3 GB, your task waits for 3 GB to download. Every time. Every task. For an ML model or a heavy Java service, cold start becomes minutes, not seconds. Two stats made me actually care about this: 76% of container startup time is just downloading the image. Only 6.4% of that image data is needed to actually start the app. So you're pulling 100% to use 6.4%. And it costs you 76% of your startup budget doing it. That's ridiculous!! This isn't a Fargate-only problem, by the way. It's a container problem. But Fargate hurts more because you can't cache anything at the host level. I presented this talk at AWS Community Days Bangalore 2026 💡 What is SOCI? SOCI stands for Seekable OCI . Simple idea: Instead of downloading the whole image before starting the container, download only the parts the app needs right now. Everything else gets pulled lazily, in the background, while the app is already running. The way it works: You push your image to ECR like normal. A separate tool builds an index a byte-level map of what's in each layer. Fargate reads the index at startup and only fetches the bytes it actually needs to boot the process. As the app tries to read more files, Fargate fetches those

A configuration change in AWS's bill computation system showed customers estimated bills in the billions and trillions of dollars for over 24 hours. AWS's own alarms detected the anomalies but failed to halt bill generation or page engineers; customer escalations alerted the company 4.5 hours later. Budget and cost anomaly alerts were disabled platform-wide during mitigation. By Steef-Jan Wiggers