# IAM Published articles for IAM. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline DevFeed: [Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline]() Original publisher: [Read original article]() Author: Luis Pastor Published: 2026-09-15T15:53:51Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [AWS Identity and Access Management (IAM)](), [CI/CD](), [Infrastructure as code](), [AWS CloudFormation](), [Amazon Web Services]() Tags: [aws](), [aws-cloudformation](), [aws-cloudtrail](), [aws-iam](), [aws-identity-and-access-management-iam](), [aws-organizations](), [best-practices](), [ci-cd](), [expert-400](), [iam](), [infrastructure-as-code-iac](), [least-privilege](), [pull-request](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article describes an automated workflow for operationalizing least privilege in AWS. It explains how AWS IAM Access Analyzer identifies unused permissions and how remediation can be routed through different paths for infrastructure-as-code-managed, manually created, and unused IAM principals. ### Source excerpt The principle of least privilege is straightforward to articulate but challenging to maintain at scale. When teams first deploy applications to AWS, they often grant broader permissions than strictly necessary; it's faster to get things working, and the plan is always to tighten permissions later. But later rarely comes. Permissions accumulate, AWS Identity and Access [...] ## Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection DevFeed: [Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection]() Original publisher: [Read original article]() Author: Osher Jacob Published: 2026-09-14T10:00:01Z Content type: article Language: en Sources: [Unit 42]() Topics: [AWS CloudTrail](), [Cloud](), [threat detection](), [Threat Research](), [SIEM, Security, Observability](), [Machine learning](), [Algorithms](), [SQL](), [IAM](), [identity and access management](), [Amazon Web Services]() Tags: [algorithms](), [amazon-web-services-aws](), [analysis](), [aws-cloudtrail](), [cloud](), [cloud-cybersecurity-research](), [cloud-detection](), [devops](), [iam](), [identity-and-access-management](), [logs](), [machine-learning](), [post](), [sql](), [threat-detection](), [threat-research]() ### AI overview This article presents a behavioral clustering model for mapping cloud identities to functional roles using activity patterns from audit logs. It applies unsupervised machine learning with UMAP and HDBSCAN to data from more than 40,000 identities across 125 cloud environments, and shows how the resulting map can support automated threat detection. The article also explains how lightweight heuristics extracted from the map can classify identities at scale using standard SQL, reducing the need for continuous resource-intensive machine learning pipelines. ### Source excerpt We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. The post Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection appeared first on Unit 42. ## Encore for Python DevFeed: [Encore for Python]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [Encore Updates]() Topics: [Python](), [FastAPI](), [AWS IAM](), [Amazon Web Services](), [Cloud](), [PostgreSQL](), [Terraform](), [postgresql clusters]() Tags: [aws](), [cloud](), [coding-agents](), [configuration](), [git](), [iam](), [infrastructure](), [postgresql](), [python](), [terraform]() ### AI overview Encore is introducing Encore.py, an upcoming beta that brings Encore's type-safe infrastructure primitives to Python and works alongside frameworks such as FastAPI. The article describes how application-level resource declarations can drive infrastructure provisioning while platform teams retain control over environment-specific settings in AWS, GCP, Terraform, or existing infrastructure. It also highlights preview environments where coding agents can implement and verify features against infrastructure configured to resemble production. ### Source excerpt An early look at Encore for Python, entering beta soon. ## Run DuckDB analytics on your Amazon DynamoDB data with zero-ETL DevFeed: [Run DuckDB analytics on your Amazon DynamoDB data with zero-ETL]() Original publisher: [Read original article]() Author: Lee Hannigan Published: 2026-09-11T14:53:57Z Content type: tutorial Language: en Sources: [AWS Database Blog]() Topics: [Databases](), [Amazon S3](), [Apache Iceberg](), [AWS Lambda](), [AWS IAM](), [Latency]() Tags: [advanced-300](), [amazon-dynamodb](), [amazon-s3-tables](), [analytics](), [apache-iceberg](), [aws-lambda](), [duckdb](), [how-to](), [iam](), [integration](), [sql](), [technical-how-to]() ### AI overview This tutorial explains how to run ad hoc SQL analytics on Amazon DynamoDB data with DuckDB through a zero-ETL replication flow. ### Source excerpt Run ad hoc SQL analytics on your Amazon DynamoDB data with DuckDB. A zero-ETL integration replicates your table into Apache Iceberg tables on Amazon S3 Tables, and an AWS Lambda function running DuckDB serves SQL queries through an IAM-authorized function URL. ## Set Up Cloud OIDC From the Pulumi CLI DevFeed: [Set Up Cloud OIDC From the Pulumi CLI]() Original publisher: [Read original article]() Author: Sean Yeh Published: 2026-09-11T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [OpenID connect (OIDC)](), [Command-line interface](), [AWS IAM](), [Cloud](), [AWS Identity and Access Management (IAM)](), [Azure](), [Google Cloud Platform (GCP)]() Tags: [automated](), [aws](), [azure](), [cli](), [cloud](), [configuration](), [docs](), [esc](), [google-cloud](), [how-to](), [iam](), [identity](), [oidc](), [openid-connect](), [product](), [pulumi](), [pulumi-cli](), [security](), [terminal](), [workflow]() ### AI overview This tutorial explains how to use the Pulumi CLI command pulumi env setup to configure Pulumi ESC as an OIDC provider for AWS, Azure, and Google Cloud. It covers interactive onboarding, non-interactive flags for scripts and agents, cloud credentials, account selection, access policies, and automatic creation of identity providers, IAM roles, policy attachments, and ESC environments. ### Source excerpt Pulumi ESC can act as an OpenID Connect (OIDC) provider for AWS, Azure, and Google Cloud, issuing short-lived, signed tokens that these clouds exchange for temporary credentials. This eliminates hard-coded credentials and improves your security posture. Last year, we introduced an onboarding flow in the Pulumi Cloud console that makes it super easy to configure OIDC for your cloud provider in a few guided steps. We're bringing Pulumi Cloud into the CLI so agents can use its capabilities directly from the terminal, without requiring a human to complete steps in the console. The new pulumi env setup command brings OIDC onboarding to that workflow, with interactive prompts for guided setup and non-interactive flags for scripts and agents. pulumi env setup - how it works Run the command with your desired cloud provider (aws, azure, gcp). For example: pulumi env setup aws The command then asks what it needs to configure your cloud, including your credentials, the accounts to configure, and the level of access. The questions differ per cloud. For AWS, it asks: How to authenticate to AWS. It uses the credentials you already have, or it signs you in with AWS SSO. Which accounts to configure. Which policy to attach to the OIDC role. Choose AdministratorAccess for Pulumi Deployments, ReadOnlyAccess for Pulumi Insights, or any other policy ARN. Then, it will print out the plan: About to configure OIDC for organization my-org: account 111111111111: create role pulumi-esc-oidc-622e86ea-319ba4c675bb3c00-role attach arn:aws:iam::aws:policy/AdministratorAccess create ESC environment my-org/aws-login/sandbox-account-env Proceed? [yes/no] After you confirm, the command creates the identity provider, the IAM role, and the policy attachment in each account. It then creates one ESC Environment per account, with the aws-login provider already configured. Non-interactive setup You can also run the command without interactive prompts by passing in the necessary flags. Each cloud has its ow ## Testing application resilience with Amazon SQS and AWS Fault Injection Service DevFeed: [Testing application resilience with Amazon SQS and AWS Fault Injection Service]() Original publisher: [Read original article]() Author: Richard Whitworth Published: 2026-09-09T21:33:59Z Content type: tutorial Language: en Sources: [AWS Architecture Blog]() Topics: [Amazon Simple Queue Service (SQS)](), [AWS Fault Injection Service (FIS)](), [Chaos Engineering](), [AWS IAM](), [AWS Identity and Access Management (IAM)]() Tags: [advanced-300](), [amazon-cloudwatch](), [amazon-simple-queue-service-sqs](), [amazon-sqs](), [automation](), [aws](), [aws-fault-injection-service-fis](), [experiments](), [how-to](), [iam](), [observability](), [resilience](), [technical-how-to](), [testing]() ### AI overview A tutorial on testing application resilience when Amazon SQS data-plane operations fail. It uses AWS Fault Injection Service and Systems Manager Automation to progressively deny queue access, evaluate recovery and observability with CloudWatch metrics, and avoid IAM deny-policy lockouts. ### Source excerpt Learn how to use AWS Fault Injection Service and AWS Systems Manager Automation to run progressive chaos experiments against Amazon SQS queues. Validate that your retry logic, circuit breakers, and dead-letter queues actually work under failure before a real outage hits production. ## Building async Python applications with Tortoise ORM and Amazon Aurora DSQL DevFeed: [Building async Python applications with Tortoise ORM and Amazon Aurora DSQL]() Original publisher: [Read original article]() Author: Lasita Bhattacharya Published: 2026-09-09T15:27:43Z Content type: tutorial Language: en Sources: [AWS Database Blog]() Topics: [DSQL](), [Concurrency](), [AWS IAM](), [Database](), [CRUD]() Tags: [advanced-300](), [amazon-aurora](), [concurrency](), [database](), [dsql](), [how-to](), [iam](), [orm](), [postgresql](), [python](), [rideshare](), [serverless](), [technical-how-to]() ### AI overview A tutorial for building a high-concurrency asynchronous Python rideshare application with Tortoise ORM and Amazon Aurora DSQL. It covers UUID-based models, IAM-authenticated asyncpg connections, OCC retry handling, and asynchronous CRUD operations. ### Source excerpt Build a high-concurrency async Python rideshare application with Tortoise ORM and Amazon Aurora DSQL. This post walks through the key adaptations: UUID primary keys, IAM-authenticated asyncpg connections with a connection-pool patch, individual DDL execution, and optimistic concurrency control (OCC) retry logic. ## Getting started with Oracle Database@AWS: A complete onboarding guide DevFeed: [Getting started with Oracle Database@AWS: A complete onboarding guide]() Original publisher: [Read original article]() Author: Raghu Soma Published: 2026-09-08T16:59:29Z Content type: tutorial Language: en Sources: [AWS Database Blog]() Topics: [Oracle Database](), [cloud-infrastructure](), [AWS IAM]() Tags: [aws](), [aws-marketplace](), [best-practices](), [database](), [guide](), [iam](), [infrastructure](), [intermediate-200](), [onboarding](), [oracle](), [oracle-database-aws]() ### AI overview A step-by-step guide to onboarding Oracle Database@AWS, covering service selection, AWS Marketplace offers, prerequisites, OCI tenancy linking, and IAM configuration before provisioning. ### Source excerpt A practical, step-by-step guide to getting Oracle Database@AWS up and running. It covers the five procurement and onboarding steps, from securing your AWS Marketplace offer through validating prerequisites, linking your OCI tenancy, and configuring IAM, so you can move from purchase to a provisioning-ready environment. ## Infrastructure identity for platform engineers DevFeed: [Infrastructure identity for platform engineers]() Original publisher: [Read original article]() Author: Sam Barlien Published: 2026-09-08T12:20:22Z Content type: tutorial Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [internal developer platform](), [Zero Trust](), [IAM](), [AI Agent]() Tags: [iam](), [identity](), [internal-developer-platform](), [platform-engineering](), [zero-trust]() ### AI overview A guide for platform engineers on adopting infrastructure identity: assigning cryptographic identities and short-lived, just-in-time access to people, machines, workloads, and AI agents. It argues that this approach can replace static secrets and network-based trust in an internal developer platform. ### Source excerpt Discover how platform engineers can eliminate static secrets and embed Zero Trust into their IDP using short-lived, cryptographic infrastructure identities. ## Kubernetes access via an identity provider: Public client, not confidential DevFeed: [Kubernetes access via an identity provider: Public client, not confidential]() Original publisher: [Read original article]() Author: Kolawole Olowoporoku | CNCF Ambassador and Senior Platform Engineer Published: 2026-09-08T11:30:00Z Content type: tutorial Language: en Sources: [Cloud Native Computing Foundation]() Topics: [Kubernetes](), [Authorization](), [client]() Tags: [api](), [architecture](), [authentication](), [blog](), [browser](), [iam](), [identity](), [integration](), [kubernetes](), [on-prem](), [operations]() ### AI overview The article explains how to replace static Kubernetes credentials with identity-provider login using a public OIDC client and PKCE. It describes kubectl with kubelogin, Keycloak, kube-apiserver token validation, and RBAC-based access decisions. ### Source excerpt Access control belongs on the same day-zero checklist as networking and storage. On most on-prem clusters, it never makes the list. The Identity Gap Managed cloud Kubernetes ships IAM or SSO integration out of the box.... ## AWS PrivateLink is now available on Pro and Enterprise DevFeed: [AWS PrivateLink is now available on Pro and Enterprise]() Original publisher: [Read original article]() Author: Bryan Mishkin Published: 2026-09-01T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Network](), [Amazon Web Services](), [AWS IAM](), [Amazon S3](), [MongoDB]() Tags: [aws](), [enterprise](), [iam](), [mongodb](), [networking](), [pricing](), [s3](), [vercel]() ### AI overview Vercel has made AWS PrivateLink available to Pro and Enterprise teams through Advanced Networking. Vercel Functions and builds can privately access AWS-hosted databases, SaaS services, internal services behind an AWS Network Load Balancer, and S3 or DynamoDB without using the public internet. ### Source excerpt AWS PrivateLink is now available for Pro and Enterprise teams as part of Advanced Networking. It allows Vercel Functions and builds to connect to AWS-hosted services without sending traffic over the public internet. Use it to reach AWS-hosted databases such as RDS, Aurora, and Neon; SaaS services such as Snowflake and MongoDB Atlas; internal services behind an AWS Network Load Balancer; and S3 or DynamoDB through gateway endpoints. To configure PrivateLink, open your project's Networking settings and enable Advanced Networking. Select New Connection, then enter the service name and region. The service must accept connections from all AWS principals or allowlist the IAM role Vercel provides for your team. Vercel creates the connection and provides a stable hostname. Use this hostname from your Functions and builds to reach the service privately. Pricing: The first AWS PrivateLink connection is included with Advanced Networking. Each additional connection costs $30 per month. PrivateLink data transfer costs $0.04 per GB. Learn more in the AWS PrivateLink documentation. Read more ## Automate IAM Identity Center governance with continuous discovery and reporting DevFeed: [Automate IAM Identity Center governance with continuous discovery and reporting]() Original publisher: [Read original article]() Author: Jonathan Nguyen Published: 2026-08-31T17:18:31Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [AWS IAM](), [CSV]() Tags: [advanced-300](), [authentication](), [aws](), [aws-iam-identity-center](), [aws-organizations](), [compliance](), [iam](), [iam-identity-center](), [identity](), [integration](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview The article explains how to plan identity governance for AWS IAM Identity Center and use an automated discovery and reporting sample solution to track application access assignments across an organization. ### Source excerpt AWS IAM Identity Center integrates with external identity provider (IdP) to provide customers with a centralized authentication and authorization solution for AWS resources across AWS Organizations. AWS continues to invest into IAM Identity Center with a growing number of AWS services that natively integrate with IAM Identity Center. As your AWS organization scales, maintaining visibility [...] ## Password spraying campaign targets AWS root user accounts across 150+ organizations DevFeed: [Password spraying campaign targets AWS root user accounts across 150+ organizations]() Original publisher: [Read original article]() Author: Martin McCloskey Published: 2026-08-31T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Amazon Web Services](), [Security](), [Threat Research](), [AWS IAM](), [IAM](), [Authentication](), [passwords]() Tags: [authentication](), [aws](), [aws-iam](), [iam](), [identity](), [password-spraying](), [research](), [security]() ### AI overview Datadog Security Research describes a password spraying campaign that repeatedly targeted AWS root user accounts at more than 150 organizations between July 24 and August 23, 2026. The campaign used Chrome and Firefox user-agent fingerprints and proxy infrastructure; no successful authentications were observed, and the attackers' motive remains undetermined. The article explains the privileges and safeguards associated with AWS root users and recommends reducing reliance on persistent root credentials. ### Source excerpt Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations. ## Extend your data perimeter to the AWS Management Console with Private Access DevFeed: [Extend your data perimeter to the AWS Management Console with Private Access]() Original publisher: [Read original article]() Author: Madhur Kulkarni Published: 2026-08-28T18:53:57Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [AWS Management Console](), [VPC](), [network security](), [Authentication](), [Amazon Web Services](), [Virtual Private Network](), [Amazon EC2](), [Amazon WorkSpaces]() Tags: [advanced-300](), [authentication](), [aws](), [aws-management-console](), [aws-organizations](), [iam](), [network](), [network-security](), [private-access](), [routing](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to](), [vpc]() ### AI overview AWS Management Console Private Access is generally available with support for VPCs without internet connectivity. Supported console traffic, including authentication flows, static assets, console-only APIs, and AWS service API calls, can route through VPC endpoints, eliminating the need for an internet gateway, NAT gateway, or public-internet route. ### Source excerpt Organizations in regulated industries such as financial services, government, defense, and healthcare restrict their sensitive workloads to isolated network environments with no access to the public internet. Until now, customers could restrict AWS Management Console access to authorized AWS accounts and corporate networks, but the console itself required internet connectivity. This was creating tension between [...] ## How Does CockroachDB Automate SQL User Lifecycle Management? DevFeed: [How Does CockroachDB Automate SQL User Lifecycle Management?]() Original publisher: [Read original article]() Author: Pritesh Lahoti,Biplav Saraf,Sourav Sarangi Published: 2026-08-28T00:00:00Z Content type: tutorial Language: en Sources: [Cockroach Labs]() Topics: [CockroachDB](), [IAM](), [identity and access management](), [active directory](), [Entra ID](), [okta](), [Microsoft]() Tags: [active-directory](), [cockroachdb](), [entra-id](), [iam](), [identity-and-access-management](), [microsoft](), [okta]() ### AI overview The article addresses how CockroachDB automates SQL user lifecycle management and notes that large enterprises commonly rely on identity provider and identity and access management platforms such as Okta, Microsoft Entra ID, Microsoft Active Directory, and Ory. ### Source excerpt Fortune 1000 enterprises widely rely on major Identity Provider (IdP) and Identity and Access Management (IAM) platforms like Okta, Microsoft Entra ID, Microsoft Active Directory, and Ory. ## Durable Digest: August highlights DevFeed: [Durable Digest: August highlights]() Original publisher: [Read original article]() Author: Temporal Technologies Published: 2026-08-27T00:00:00Z Content type: release Language: en Sources: [Temporal Blog]() Topics: [Cloud](), [AI Development](), [AWS Lambda](), [Workers](), [autoscaling](), [Amazon Web Services](), [AI Agent](), [AWS IAM](), [SDKs]() Tags: [ai](), [ai-agent](), [announcements](), [autoscaling](), [aws](), [aws-lambda](), [cloud](), [distributed](), [durability](), [genai](), [google](), [iam](), [infrastructure](), [workers]() ### AI overview Temporal's August 2026 Durable Digest highlights new and preview features for running Workers on AWS Lambda, organizing Temporal Cloud resources, invoking Nexus Operations, and building durable AI applications. ### Source excerpt Highlights this month include new ways to run Workers without managing infrastructure, organize Temporal Cloud resources and build more durable AI applications. ## Multi-tenant OAuth requires credential lifecycle management beyond token isolation DevFeed: [Multi-tenant OAuth requires credential lifecycle management beyond token isolation]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-27T00:00:00Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [Encryption](), [Authorization]() Tags: [architecture](), [encryption](), [iam](), [lifecycle](), [oauth](), [rotation](), [storage](), [vault]() ### AI overview The article argues that token isolation and storage architecture are only the starting point for multi-tenant OAuth. The harder, ongoing problems include refresh races, key rotation, provider-wide revocations, token expiration, and external revocations without webhooks. It also explains how envelope encryption and per-tenant key contexts can support bridge-style isolation. ### Source excerpt Storage architecture is the half you can finish. The refresh loop, key rotation, and revocation are the half that never does. ## ICYMI: July 2026 @AWS Security DevFeed: [ICYMI: July 2026 @AWS Security]() Original publisher: [Read original article]() Author: Rodolfo Brenes Published: 2026-08-26T19:32:55Z Content type: news Language: en Sources: [AWS Security Blog]() Topics: [Application Security](), [AI-assisted coding](), [AWS IAM]() Tags: [ai-agent](), [ai-coding](), [ai-security](), [amazon-bedrock](), [announcements](), [aws](), [compliance](), [ddos](), [firewall](), [foundational-100](), [iam](), [secrets](), [security](), [security-blog](), [security-identity-compliance]() ### AI overview A July 2026 AWS Security roundup covering AI-agent security, data protection, supply-chain protection, firewall automation, DDoS mitigation, and compliance readiness. ### Source excerpt If you found time for a bit of vacation this summer, you might be in catch-up mode. Here's a list to help: all the expert blog posts, new service capabilities, code samples, and workshops, in case you missed it, from July 2026. AWS Security Blog post This month's AWS Security Blog posts covered AI agent [...] ## KEYCONF26 agenda and speakers announced for 8 October 2026 in Prague DevFeed: [KEYCONF26 agenda and speakers announced for 8 October 2026 in Prague]() Original publisher: [Read original article]() Author: Alina Rudyk Published: 2026-08-23T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [identity and access management](), [openid](), [Security]() Tags: [iam](), [idm](), [kerberos](), [keycloak](), [ldap](), [openid](), [openid-connect](), [saml](), [security](), [sso](), [talk]() ### AI overview Keycloak has announced the speaker line-up and agenda for KEYCONF26, taking place in Prague on 8 October 2026. The programme covers Keycloak operations, extensions, identity standards, security, access tokens, and related use cases. ### Source excerpt The KEYCONF26 speaker line-up is taking shape, and this year's agenda is now live! 📍 KEYCONF26 is taking place in Prague on 8 October 2026. This October, the Keycloak community will come together once again for a full day of technical insights, real-world experiences and conversations around identity and access management. This year's programme brings together speakers from across the Keycloak ecosystem - from organisations running Keycloak in complex production environments to experts exploring new standards, architectures and use cases. Talk highlights The talks announced highlight the broad spectrum of the Keycloak ecosystem: how to run Keycloak securely and at scale, how to extend it, and how identity is evolving to support new technologies and use cases. Here are just a few highlights: What Role Can Keycloak Play for International Science? An Introduction to the OpenID Shared Signals Framework Keycloak becomes familiar with AI: the advancement of integrating Keycloak with AI Wicked Keycloak challenges and how to resolve them Token Hygiene - Why Your Keycloak Access Tokens Need a Diet And that is only a glimpse of what is waiting for you in Prague 👉 Explore the KEYCONF26 agenda announced: https://keyconf.dev/ A great place to network KeyConf is about more than the talks. It is also an opportunity to meet the people behind the technology, exchange experiences and connect with others working on similar identity challenges. Networking lunch Our extended lunch break gives you plenty of time to meet fellow attendees, swap ideas and continue conversations from the sessions in a relaxed setting. Meet the community KeyConf brings together Keycloak users, contributors, developers, architects, security specialists and IAM experts from different organisations and industries. Whether you want to discuss a challenge from your own Keycloak environment, exchange experiences or simply meet people from the community in person, there will be plenty of opportunities to connect thr ## Fine-Grained Access Control Now Available for All Heroku Customers DevFeed: [Fine-Grained Access Control Now Available for All Heroku Customers]() Original publisher: [Read original article]() Author: Alberto Sigismondi Published: 2026-08-21T17:07:29Z Content type: release Language: en Sources: [Heroku]() Topics: [Heroku](), [Access Control](), [Security](), [IAM](), [Zero Trust](), [legacy]() Tags: [access-control](), [deploy](), [heroku](), [iam](), [identity-and-access-management](), [least-privilege](), [legacy](), [news](), [permissions](), [pipelines](), [security](), [security-compliance](), [zero-trust]() ### AI overview Heroku announces that Fine-Grained Access Control is available to all customers. The feature replaces fixed legacy roles with capability-based roles and app-specific permissions for roles such as view, deploy, operate, and manage. ### Source excerpt Fine-Grained Access Controls is now available to all Heroku customers. Heroku's legacy system gave you predefined roles like admin, member, or collaborator, each with a fixed bundle of permissions. It replaces that system with fine-grained roles like view, deploy, operate, and manage, with specific capability sets. Access control is managed at an app-specific layer, giving [...] The post Fine-Grained Access Control Now Available for All Heroku Customers appeared first on Heroku. ## How Temporal Adds Durability to AWS Agentic AI Workloads DevFeed: [How Temporal Adds Durability to AWS Agentic AI Workloads]() Original publisher: [Read original article]() Author: Rahman Syed Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [Temporal Blog]() Topics: [Amazon Web Services](), [Artificial Intelligence](), [Agent Framework](), [Amazon Bedrock](), [Strands Agents](), [AWS Lambda]() Tags: [agent-framework](), [agentic](), [ai](), [amazon-bedrock](), [aws](), [aws-lambda](), [cloud](), [iam](), [temporal-voices]() ### AI overview This developer article explains how Temporal adds a durability layer to AWS-based agentic AI systems. It presents a loan-underwriting example and describes using Amazon Bedrock, Strands Agents, and AWS Lambda to build recoverable, scalable workloads. ### Source excerpt AWS gives developers the best-in-class tools for building agentic AI -- models, an agent framework, and compute to run it all on. As those systems grow more complex with more tools, more agents, and longer-running steps that wait on human-intervention, keeping the whole thing consistent and recoverable becomes its own design challenge. This is the layer Temporal adds. ## Amazon EKS is replacing the deprecated aws-auth ConfigMap for IAM-to-cluster permission mapping DevFeed: [Amazon EKS is replacing the deprecated aws-auth ConfigMap for IAM-to-cluster permission mapping]() Original publisher: [Read original article]() Author: Yannick Struyf Published: 2026-08-19T18:59:54Z Content type: article Language: en Sources: [Kubernetes Overview, News and Trends | The New Stack]() Topics: [Amazon EKS](), [Kubernetes](), [AWS IAM](), [Access Control](), [Amazon Web Services](), [Cloud](), [migration]() Tags: [access-control](), [amazon-eks](), [aws](), [cloud](), [cloud-native](), [deprecated](), [iam](), [kubernetes](), [migration](), [nutanix](), [platform-engineering](), [post](), [report](), [security](), [sponsor-nutanix](), [sponsored](), [sponsored-post]() ### AI overview The article examines security challenges in Kubernetes and cloud-native infrastructure, focusing on Amazon EKS's replacement of the deprecated aws-auth ConfigMap with an API-driven method for mapping IAM identities to cluster permissions. It also explains how Kubernetes security spans code, containers, clusters, and cloud infrastructure. ### Source excerpt The migration to Kubernetes and cloud native infrastructure has been one of the defining IT trends of the past decade. The post AWS deprecated this EKS auth method. 81% of clusters still run it. appeared first on The New Stack. ## AWS Weekly Roundup: EC2 application status checks, IAM role manager, OpenAI Daybreak on Bedrock, and more (August 17, 2026) DevFeed: [AWS Weekly Roundup: EC2 application status checks, IAM role manager, OpenAI Daybreak on Bedrock, and more (August 17, 2026)]() Original publisher: [Read original article]() Author: Channy Yun (윤석찬) Published: 2026-08-17T16:02:36Z Content type: news Language: en Sources: [AWS News Blog]() Topics: [Amazon Web Services](), [Amazon EC2](), [AWS IAM](), [Amazon OpenSearch Service](), [Open Source](), [Amazon Bedrock](), [Linux](), [OpenAI](), [MCP]() Tags: [amazon-bedrock](), [amazon-ec2](), [amazon-elasticache](), [amazon-opensearch-service](), [amazon-sagemaker-jumpstart](), [aws](), [aws-certificate-manager](), [aws-client-vpn](), [aws-identity-and-access-management-iam](), [bedrock](), [iam](), [linux](), [mcp](), [news](), [open-source](), [openai](), [oracle-database-aws](), [week-in-review]() ### AI overview AWS Weekly Roundup highlights EC2 application status checks, automatic IAM role setup, OpenAI Daybreak on Amazon Bedrock, and updates involving OpenSearch, Valkey, and open source community events. ### Source excerpt Last week, AWS contributors joined the OpenSearch and Valkey communities at Open Source Summit Korea 2026 and MCP DevSummit Seoul 2026 to meet open source developers and contributors. At the four-day event, community leaders and users of these Linux Foundation open source projects gathered to share knowledge, collaborate on solutions, and push the projects forward. [...] ## Best Kubernetes Infrastructure as Code Tools in 2026 DevFeed: [Best Kubernetes Infrastructure as Code Tools in 2026]() Original publisher: [Read original article]() Author: Pulumi Content Team Published: 2026-08-14T00:00:00Z Content type: comparison Language: en Sources: [Pulumi]() Topics: [Infrastructure as code](), [Kubernetes](), [Terraform](), [argo-cd](), [Helm charts](), [GitOps](), [flux](), [opentofu](), [Amazon EKS](), [AWS CloudFormation](), [VPC](), [AWS IAM]() Tags: [argo-cd](), [cloudformation](), [code](), [comparisons](), [devops](), [flux](), [general](), [gitops](), [helm](), [helm-charts](), [iam](), [infrastructure](), [infrastructure-as-code](), [kubernetes](), [opentofu](), [platform-engineering](), [terraform](), [vpc]() ### AI overview This comparison explains that Kubernetes infrastructure as code spans cluster and cloud provisioning, in-cluster workload definition, and continuous delivery and reconciliation. It presents Pulumi and Terraform or OpenTofu as general-purpose provisioning options, Helm and Kustomize for workload templating, and Argo CD and Flux for GitOps reconciliation. ### Source excerpt There is no single best Kubernetes infrastructure as code tool, because "Kubernetes IaC" actually spans three different jobs. For provisioning the cluster and its cloud dependencies, Pulumi and Terraform (or OpenTofu) are the strongest general-purpose options. For templating and packaging workloads, Helm and Kustomize dominate. For continuous reconciliation once things are running, Argo CD and Flux lead the GitOps category. The right stack usually combines one tool from each layer, not a single tool that claims to do all three. What counts as infrastructure as code for Kubernetes? Kubernetes infrastructure as code work splits into three layers that get conflated constantly, and the confusion is where most tool comparisons go wrong. The cluster and cloud layer provisions the things Kubernetes itself sits on top of: the managed control plane (EKS, GKE, AKS), node pools, the VPC and subnets, IAM roles, load balancers, and cluster add-ons. Terraform, Pulumi, and cloud-native tools like CloudFormation operate here. The in-cluster workload layer defines what runs on the cluster once it exists: Deployments, Services, ConfigMaps, CustomResourceDefinitions, and the Helm charts or Kustomize overlays that template them. This is where Helm, Kustomize, and Crossplane's custom resources live. The delivery and reconciliation layer keeps what's declared in Git in sync with what's actually running on the cluster, continuously, rather than as a one-shot apply. Argo CD and Flux own this layer, and they consume the output of the other two rather than replacing them. Most real Kubernetes platforms use tools from at least two of these layers together. A team might provision EKS with Terraform, package its application with Helm, and let Argo CD reconcile it continuously. Knowing which layer a tool actually addresses, rather than treating "Kubernetes IaC" as one shopping list, is the first decision that matters. Pulumi provisions the cluster and the workloads on it in the same language Pul [Next page]()