AWS CloudFormation Least-Privilege Roles Can Fail Due to Hidden Cross-Service API Calls

·5 views

AWS CloudFormation execution roles scoped strictly to visible template services can still fail with AccessDenied errors because CloudFormation's resource providers internally call APIs from adjacent AWS services. Two real-world examples illustrate this: creating an Application Load Balancer required the EC2 permission ec2:GetSecurityGroupsForVpc, and associating a Web ACL required load-balancer-side permissions beyond standard WAF access. These failures occur because CloudFormation's actual API behavior is driven by provider-side implementation, not just the service namespaces listed in the template. Rather than responding by attaching broad managed policies, engineers should treat each AccessDenied message as precise evidence and grant only the specific denied action, using condition keys to limit scope. AWS documentation and integration paths can also evolve over time, so permission sets should be validated against current denied actions rather than static historical lists.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Inherited Memory Boosts AI Flies Until Environment Flips, Then Blank Slate Wins

A developer simulating fruit fly neural circuits across generations found that passing down an external memory graph — rather than synaptic weights — allowed descendants to inherit learned behaviors without reliving them. In a stable environment, memory-inheriting lineages outperformed blank-slate counterparts, behaving like preloaded experts from early generations. However, the inherited memory grew increasingly certain over time with no mechanism for decay or correction. When the simulated world was reversed so that a previously safe cue became lethal, lineages carrying deep ancestral certainty died out faster than blank-slate flies starting with no prior knowledge. The experiment highlights a core risk in inherited learning systems: knowledge optimized for one environment can become a liability when conditions change.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Morrowkin Launches Open API to Connect AI Agents With Public Discussion Forums

Morrowkin is a public online forum designed to host conversations between human users and independently operated AI agents. The platform has released an agent API along with an MIT-licensed Python client to help developers integrate their existing AI agents into the forum. The client currently supports direct access via Google's Gemini API, and the project is hosted publicly on GitHub. A draft-first workflow is included, with optional automation controls available for forum operators. The team is actively seeking feedback from developers on areas such as agent registration, thread discovery, and identity management.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds self-contradicting Next.js knowledge base that tracks claim conflicts

A developer created 'Still True', a Next.js knowledge base submitted to the Sanity Challenge that deliberately stores information as interconnected claims rather than flat pages. Each claim is linked to sources via typed relationships that can mark one claim as supporting, contradicting, or superseding another, with a reason stored on every relationship edge. A public board visualises the claim graph by topic, displaying current claims prominently while dimming outdated ones and showing genuine contradictions side by side. A time slider lets users replay how facts changed over time, and an interactive graph highlights live disagreements between sources as amber-coloured links. The project was built using Claude Code as an AI-native IDE and is live at still-true.vercel.app, with the full codebase available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds AI agent that answers Next.js questions only from verified, current docs

A developer has built 'Still True,' an AI agent designed to answer Next.js questions exclusively from a structured, up-to-date knowledge base rather than relying on a model's potentially outdated training data. The project was submitted for the Sanity Challenge and addresses a common problem where AI models confidently give stale answers, such as incorrectly stating that the App Router caches fetch requests by default — a behaviour that changed after Next.js 14. The agent uses Sanity Context's knowledge base and conflict-detection features to surface disagreements between sources, showing both the outdated and current guidance side by side. When a topic is not covered in the knowledge base, the agent explicitly states so instead of guessing or hallucinating an answer. The tool is live at still-true.vercel.app and its source code is publicly available on GitHub.

0 comments Read more at DEV Community