CloudWise Details Exact AWS IAM Permissions Its Cost Tool Uses and Why

·1 views

Cloud cost platform CloudWise has published a detailed breakdown of the AWS IAM permissions it requests when users connect their AWS accounts, aiming to clarify what 'read-only' access actually means in practice. The tool deploys a single CloudFormation stack during onboarding, using a custom allow-list policy scoped only to the specific read actions needed for cost scanning, rather than the broad AWS-managed ReadOnlyAccess policy. Every permitted action is a Get, Describe, List, or BatchGet call, with no write, create, delete, or modify verbs included, meaning IAM itself would block any such attempt. A separate, optional remediation role exists for users who want CloudWise to act on identified waste, but it is never deployed during sign-up and includes explicit deny blocks covering identity management, secrets, audit trails, and core infrastructure deletion. The company says it published this transparency post because the word 'read-only' is used loosely across the industry and should not be taken on trust without verification.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Random Forests Cut Variance: The Math Behind Bagging and Tree Averaging

Random forests reduce prediction variance by averaging many deep, unpruned decision trees, each trained on a different bootstrap sample of the data. Random feature selection at every split ensures trees remain diverse, preventing a single dominant feature from making all trees look alike. A mathematical identity shows that the mean squared error of an ensemble always equals the average individual tree error minus the spread among trees, explaining why diversity directly drives accuracy gains. Each tree leaves out roughly 37% of training rows, enabling out-of-bag error estimation as a free, honest validation method without a separate holdout set. Unlike boosting, adding more trees to a random forest converges to an error floor and cannot overfit, making the two methods fundamentally different in how they use depth, data, and sequential dependence.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OpenClaw vs Hermes Agent: Two Rival Open Source AI Frameworks Compared

OpenClaw and Hermes Agent have emerged as two of the most discussed open source autonomous agent frameworks in 2026, each taking a fundamentally different approach to AI task automation. OpenClaw treats agents as a team of workers, using Markdown-based identity files to define each agent's role, memory, and behavior, making it suited for structured, multi-agent workflows. Hermes Agent, released by Nous Research in February 2026, focuses on a single self-improving agent that automatically distills complex tasks into reusable skills and refines them over time. Hermes gained over 215,000 GitHub stars within weeks of launch, making it one of the fastest-growing agent projects of the year. Developers are advised to choose OpenClaw for team-oriented, deterministic setups and Hermes for a continuously learning, solo agent experience.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rust API Design: How to Manage Type Changes Without Breaking User Code

A technical guide on advanced Rust API design warns developers to think carefully before making interface changes visible to users, as frequent backward-incompatible updates frustrate downstream consumers. The article explains that even subtle modifications—like adding a field to a public struct—can silently break existing user code that previously compiled without issue. To minimize this risk, developers are advised to use Rust's visibility modifiers such as pub(crate) and pub(in path) to limit how much of an API is publicly exposed. The fewer public types an API surfaces, the greater the freedom a developer retains to make internal changes later. The guide also introduces the non_exhaustive attribute as a tool to signal that types may grow over time, helping users write more future-proof code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Strategies for Handling AI Prompts That Exceed Context Window Limits

As AI-powered chat applications grow longer, developers face the challenge of deciding what conversation history to drop when prompts exceed a model's context window. Engineers must preserve certain elements at all costs, including the system prompt, the latest user message, and paired tool calls, since losing these causes functional failures rather than mere quality dips. Five truncation approaches exist, ranging from crude hard string cuts to sophisticated retrieval-based systems, ranked by how much useful information they retain per token. Most production applications are advised to use the middle-out strategy, which drops mid-conversation content while preserving the opening context and recent exchanges. Developers are also urged to handle truncation themselves rather than delegating it to the AI provider, ensuring they can log dropped content, notify users, and apply different strategies across product features.

0 comments Read more at DEV Community