Engineer Builds Terraform-Managed Demo Proving Zero Trust Policies With Entra ID and Cloudflare

·1 views

A developer has published a fully Terraform-managed demonstration project that tests real Zero Trust failure modes using Microsoft Entra ID and Cloudflare Access. The setup registers Entra with Cloudflare twice — once via OIDC and once via SAML — to compare how each protocol handles identity and group claims. Three demo users with varying group memberships validate include, require, and exclude policy logic, exposing edge cases that typical Zero Trust write-ups overlook. The origin server verifies JWT signatures against the team's JWKS, resolves group GUIDs into readable names, and labels whether each claim came from the OIDC identity endpoint or the SAML assertion. The project is intended as a learning demonstration rather than a production template, and its full code is publicly available on GitHub.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Control Claude Code API Costs With Token Budgets and Smarter Caching

Production teams using Claude Code often face runaway API costs driven by silent context accumulation and cache invalidation that standard billing dashboards fail to surface. Conversation histories can quietly balloon from 10,000 to 200,000 tokens across multi-turn sessions without any code changes, causing monthly token spend to double. Anthropic's billing interface shows aggregate input and cached token counts but omits per-session context growth and the cascading expense triggered when a cache invalidates mid-session. Experts recommend enforcing hard token budgets at the request level before API calls are made, rather than relying on reactive alerts after costs have compounded. Complementary strategies include prompt caching with explicit TTL tracking and context managers that summarize or truncate conversation history at fixed intervals to prevent unbounded spend.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Open-source tool distills smaller AI models to cut agent inference costs by 40%

Experiential Labs has launched 'wmo serve', an open-source tool designed to reduce the cost of running AI agents by routing repetitive tasks to smaller, distilled models instead of expensive frontier models. The tool ingests existing agent traces and uses them to continuously train specialized smaller models through distillation from open-source alternatives. A built-in router dynamically decides which tasks require a frontier model and which can be handled by the cheaper distilled model, while token compaction further reduces costs by removing noise. Users can run it locally via an OpenAI-compatible endpoint using an OpenRouter key, or opt for a hosted solution that promises equivalent quality at over 40% lower cost. The project is open-source on GitHub, and a hosted waitlist is available at experientiallabs.ai.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

AWS Lambda MicroVMs Offer Isolated Sandboxes for Running Untrusted Code Safely

AWS has released Lambda MicroVMs, Firecracker-based virtual machines designed to safely execute untrusted code in hardware-isolated sandboxes that boot in roughly one second. A developer built a multi-tenant pipeline where users upload CSV files and custom Python transformation functions, both treated as untrusted inputs requiring different security approaches. Uploaded files are scanned for malware using GuardDuty, while code is contained within MicroVMs rather than scanned, since legitimate-looking code can still be destructive. Each sandbox runs with a sealed VPC network blocking all outbound internet traffic, a least-privilege IAM role limited to writing logs, strict memory and timeout limits, and per-tenant S3 Access Points to prevent cross-tenant data access. Testing confirmed that runaway memory usage, infinite loops, and malicious file uploads were each caught by their respective layers before reaching clean storage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engineer Ran Just One LLM Cost Experiment and Found It Sufficient

A software engineer set out to determine when expensive frontier AI models are truly necessary versus when cheaper alternatives suffice for real work tasks. He designed a 10-experiment evaluation program, complete with a reusable harness called model-compass, to benchmark multiple LLMs across agent use cases like CI diagnostics, code review, and incident triage. The motivation was personal: at home, every API call comes out of his own pocket, making model selection a financial decision rather than a convenience. He ultimately ran only the first experiment, focused on CI log diagnostics, choosing it because it reflected his team's actual daily pain points across multiple codebases and languages. That single experiment yielded enough actionable insight to inform his model-routing decisions without needing to complete the remaining nine.

0 comments Read more at DEV Community