AWS Guide: Enforcing AI Agent Authorization on EKS Using Cedar and Step Functions

·1 views

A technical guide published on DEV Community outlines an architecture for safely governing AI-driven operations on Amazon EKS clusters. The core argument is that AI agents should propose typed remediation actions rather than execute free-form instructions, keeping authorization logic outside the model itself. Amazon Verified Permissions with Cedar policies is recommended to externalize and enforce access decisions based on deterministic infrastructure signals, not just model confidence. AWS Step Functions is proposed to manage workflow state, including human approval loops with evidence-refresh steps to prevent stale approvals from executing against an already-changed production environment. The design enforces a strict boundary where the AI proposes, trusted infrastructure verifies facts, and a separate policy layer decides whether the action is permitted.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Railway, Render, Fly.io or AWS: Which Platform Costs Less as Your App Scales

A cloud professional has broken down the real costs of popular hosting platforms — Railway, Render, Fly.io, and AWS — for teams that have moved beyond free tiers. Platform-as-a-service options like Railway and Render offer developer-friendly experiences at a premium, making them ideal for early-stage projects where engineering time is more valuable than cost savings. Fly.io sits closer to raw infrastructure, often proving cheaper for compute-heavy or globally distributed workloads. AWS offers the lowest per-unit cost and greatest flexibility at scale, but requires significant engineering effort for networking, security, and operations. The key takeaway is that the best choice is stage-dependent — switching platforms as an app grows is not a failure but a rational response to shifting cost trade-offs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GreenOps Treats Carbon as a Cost: How Cloud Teams Can Cut Both Bills

GreenOps is an emerging practice that applies the same optimization logic as FinOps to cloud infrastructure's carbon footprint, treating emissions as a measurable and reducible metric. The approach relies on two core levers: time-shifting workloads to run during low-carbon grid windows, and region-shifting them to areas powered by cleaner energy sources. Many standard cost-cutting actions — such as eliminating idle resources, rightsizing instances, and improving server utilization — simultaneously reduce carbon emissions, making the overlap largely free of tradeoffs. However, the two goals can diverge: a cheaper cloud region is not always a greener one, and delaying jobs to hit a cleaner grid window adds latency that not all workloads can tolerate. Engineers are advised to start by establishing a carbon baseline using existing cloud dashboards and open tools before pursuing dedicated carbon-aware scheduling.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Maps 26 macOS Automation Jobs to Regain Control of Runaway launchd Setup

A developer running 26 launchd automation jobs on macOS found it increasingly difficult to track which processes were active or broken, sometimes taking two days to notice failures. To solve this, they built a shell script called env-map.sh that collects system, Claude environment, and project-level data twice daily via scheduled launchd jobs. The script generates Mermaid diagrams and summary tables, writing a snapshot to a Markdown file inside an Obsidian vault. Because the vault is version-controlled via Git, daily overwrites of the environment map automatically create a historical record of changes. The author identified five key launchd pitfalls encountered along the way, including silent process restarts and logs from multiple jobs overwriting each other in the same directory.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Track Kubernetes Costs by Team Without Perfect Pod Labeling

Shared Kubernetes clusters make it difficult to attribute cloud costs to individual teams, as cloud providers bill per node rather than per pod or team. A practical approach involves splitting each node's hourly cost across the pods it ran, based on resource requests rather than actual usage, to prevent teams from hiding wasteful over-provisioning. When pod-level team labels are missing, a fallback hierarchy using namespaces and controller names can still assign ownership to most workloads, with remaining costs placed in a visible 'unallocated' bucket that incentivizes teams to improve their labeling. Tools like Kubecost and its open-source counterpart OpenCost automate much of this translation from node cost to per-pod cost. Two commonly overlooked cost categories — shared cluster overhead and idle node capacity — can account for 20 to 40 percent of the total bill and should be reported separately to give teams an accurate picture of their spending.

0 comments Read more at DEV Community