Article URL: https://mlq.ai/news/meta-caps-internal-ai-token-spending-after-costs-approach-billions-in-2026/ Comments URL: https://news.ycombinator.com/item?id=48754713 Points: 6 # Comments: 1
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A Databricks cluster deployed on AWS inside a customer-managed VPC repeatedly failed to start, producing a BOOTSTRAP_TIMEOUT error after roughly 25 minutes despite all EC2 nodes passing health checks. The cluster was routed through a multi-hop egress path involving a Transit Gateway, an inspection firewall, and a NAT gateway before reaching the internet. The root cause was that the cluster nodes, which had no public IPs under secure cluster connectivity, could not establish outbound communication to the Databricks control plane's relay service. Unlike AWS-native services such as S3 or STS, the Databricks control plane and its secure cluster connectivity relay have no AWS VPC endpoint, meaning egress must be explicitly permitted through the firewall or routed via AWS PrivateLink. The investigation highlighted that a healthy EC2 instance combined with a cluster stuck in INSTANCE_INITIALIZING is a reliable signal of a broken outbound network path rather than an IAM or capacity issue.
A three-part technical series on building a Databricks AI platform on AWS addresses a critical but often overlooked problem: ungoverned compute access. Without controls, any user can launch large, expensive clusters and forget to shut them down, resulting in unexpected five-figure cloud bills. Databricks tackles this through three governance layers — instance pools, cluster policies, and entitlement gates — each progressively narrowing what hardware a user can spin up. Instance pools pre-warm virtual machines to speed up cluster starts and improve cost predictability, while cluster policies enforce rules on instance types, worker counts, and auto-termination. Together with role-based entitlements that restrict who can create clusters at all, the system ensures users access only the compute resources their role permits.
A developer has released an open-source conformance checker for the Universal Commerce Protocol (UCP), a standard enabling AI agents to discover products and process checkouts with merchants. The tool enforces a strict rule: no check is released until it has been proven to catch its own injected defect, preventing false-positive results that could give users misleading confidence. Each check references official UCP schema validators and specific normative spec clauses, making results traceable rather than reliant on the author's interpretation. Testing against real implementations revealed apparent structural mismatches between the official Node.js reference sample and the 2026 profile schema, which the developer has flagged upstream for clarification. The tool is available via pip, a GitHub Actions integration, and a no-install web interface at spck.dev/check.
A technical guide for Databricks on AWS outlines how role-based access control (RBAC) works across account-level groups and workspaces. The author argues that most access control layers — including workspace assignments, entitlements, object ACLs, and Unity Catalog grants — are Databricks built-ins, not custom designs. The only element engineers truly create are function-role groups, such as ai_admin, ai_engineer, and ai_analyst, which act as intermediaries between users and permissions. These account-level groups can be assigned to multiple workspaces at either USER or ADMIN level using Terraform's databricks_mws_permission_assignment resource. Keeping the group set minimal and avoiding pre-built roles for hypothetical personas is recommended to reduce churn and maintain a manageable infrastructure-as-code footprint.
Discussion (0)
Log in to join the discussion and vote.
Log in