Good Morning!
In this week’s exciting shitpost, “what my co-founder getting hit by a car taught me about incident response;” because experience is what you get when you don’t get what you wanted.
Things I Found on the Internet
Notice your GIF picker on X, Discord, or WhatsApp looking thinner lately? Google killed the Tenor API last week, and a lot of integrations break tomorrow. Ben Schoon’s rundown covers who’s affected and which Google apps survive. A reminder that “free third-party API” always has an expiration date you didn’t get to pick, and why Google in your dependency path is always an incident waiting to happen.
Speaking of shitty Google decisions, it turns out your Maps key picked up Gemini permissions while you weren’t looking because some toolbar at Google needed to juice their adoption stats, and nobody sent a memo. The author dug into how the scope expanded without anyone asking, which matters if you’ve got that key floating around in client-side code. Worth a read before your next billing surprise, and definitely before trusting Google again anytime soon.
Why does Cursor leave you more drained than a day of actual coding? Ohad Ravid nails it: a good tool feels like an extension of your body, but an LLM makes you pay the social tax of conversing and negotiating without giving back what people do. Sharp take on why LLMs exhaust us.
Most incident response advice assumes you already know where the bodies are buried. This AWS forensics primer starts further back, walking security analysts through organizations, accounts, and IAM before the alarm goes off. Solid grounding for anyone who suddenly has to investigate a cloud they’ve never administered.
My talk at Percona Live has been posted: RDS is Crap.
Aidan Steele has been in the AWS weeds long enough to know when something actually matters, and his read on apps impersonating human access via Identity Center is worth your time. Ten years he’s wanted this. It’s not finished, but the direction finally makes sense. Worth a look if IAM keeps you up at night.
What AWS Has For Us This Time
Announcing general availability of Amazon WorkSpaces for AI agents
We’ve reached the stage where you rent a virtual desktop so a robot can squint at your CRM the way an intern would. Pricing scales with session time, naturally, because nothing motivates efficiency like billing your bot by the minute. The “revoke access mid-session” button is the actual product you’re gonna care about here.
Amazon CloudWatch supports creating alarms from log queries
Alarming on logs without first sacrificing a goat to the metric filter gods? Only took a decade after real observability tools empowered this. The catch, because of course there’s always a catch: you’re now running log queries on a schedule, and CloudWatch bills those per gigabyte scanned. Convenient, y’know, until your error spike doubles as a billing spike. Watch that query frequency!
How InterWiz reduced AI costs by 90% with Amazon Bedrock
A 90% cost cut headline that means “we stopped paying OpenAI and started paying AWS instead.” Maybe the savings are real, but do notice the migration required an Advanced Tier Partner, a seven-phase methodology, and POC credits. Escaping vendor lock-in, brought to you by your next vendor.
Accelerate your infrastructure deployments by up to 4x with AWS CloudFormation Express mode
“Express mode” achieves its speed the way I achieve a faster commute: by skipping the part where I confirm I actually arrived. It disables rollback and waves off stabilization checks, so your AI vibe-coder can produce broken infrastructure 4x faster. The ops team cleaning up afterward gets no such acceleration. But still, this is great when your cycle time is tied to CloudFormation. My solution (“don’t use CloudFormation”) isn’t viable for everyone.
Automate public TLS certificate issuance with ACME support in AWS Certificate Manager
Let’s Encrypt has offered this free, with a single command, since 2015. AWS arrives a decade late with IAM bindings, EAB credentials, and CloudTrail logging bolted on, because heaven forbid you issue a certificate without an audit trail and a meeting. Free for everyone else, enterprise governance theater for you.
Upgrade Amazon EKS clusters with confidence using Kubernetes version rollbacks – An undo button for Kubernetes upgrades, arriving only after years of ops teams building bake periods and month-long ceremonies to avoid the one-way door. Seven days to change your mind, which is roughly six more than you’ll get before something breaks. Progress, technically. I’ll take it.
Safely Releasing Frontier Models to Customers
A frontier model got so good at finding vulnerabilities that Amazon freaked out, called the White House (who yanked it), and now it’s back again. They’re hoping you won’t remember who it was that called the White House.
ECS Service Connect now supports Zone-Aware routing
For years, AWS billed you a penny per gigabyte to shuffle traffic between zones it told you to spread across for resilience. Now they’ll keep that traffic local by default, no charge. SO SOON? Note: they took down the post after I wrote this, but I kept the receipts. You can’t hide, AWS post author.
Accelerating government FinOps with Amazon Quick
No, governments are not adopting Amazon Quick. You’ve barely been able to get this sold in the enterprise, and government moves at the speed of sloth. You forgot to keep this shit at least semi-real.
This week’s batch reads like a group project on failing at your one job, starting with a firewall that skipped chapters by only inspecting part of an HTTP/2 body split across frames, then leaving ALB customers to flip a config option to actually receive the protection they already paid for. If the WAF was reading half your request, the CLI was oversharing all of it, scribbling credentials into world-readable files where any local user could help themselves, which is a bold interpretation of “secrets manager.” The JDBC wrapper trots out Java deserialization, that ageless hit whereby anyone with cache write access drops a poisoned object and owns your app server, mercifully off by default so the responsible move was doing nothing. And rounding it out, version strings that run shell commands in CDK’s Node bundling, because infrastructure-as-code apparently now includes arbitrary-execution-as-a-package.json-field. Four bulletins, four defaults that trusted the wrong thing. Patch everything and reconsider what “secure by default” was ever supposed to mean.
… and that’s what happened Last Week in AWS.
