OffNet Newsroom

Archive snapshot

Wednesday, July 08, 2026

Daily signal on databases, AI, and the tech that matters.

30 new today 37 stories 6 sections 11 for the DBA desk

Database Technology 7

roundup ↗

Percona Operator for MySQL version 1.2.0 introduces capabilities for multi-region deployments, including cross-site replication to establish warm replicas in separate data centers. The release also supports encrypted backups stored in object storage to meet compliance requirements. Additionally, the operator now features automatic storage scaling to handle growing data volumes without manual intervention.

  • Enables warm replica clusters in secondary regions for improved disaster recovery.
  • Supports encrypted backups in object storage for audit compliance.
  • Automates storage scaling to reduce operational overhead for growing datasets.
  • Addresses common scaling gaps for fleets moving beyond single-cluster deployments.

Amazon RDS for PostgreSQL 18 introduces significant enhancements to logical replication, including support for replicating STORED generated columns via a new parameter. The update enables default parallel streaming and allows toggling two-phase commit on active subscriptions. Operational visibility improves with new counters in pg_stat_subscription_stats for monitoring conflicts.

  • Replicate STORED generated columns using the publish_generated_columns parameter.
  • Parallel streaming is now enabled by default for better throughput.
  • Monitor replication conflicts using new counters in pg_stat_subscription_stats.
  • Configure idle_replication_slot_timeout for automatic slot cleanup.
  • Toggle two-phase commit on a running subscription without restart.

Fleet impact: For RDS PostgreSQL and Aurora fleets, this simplifies schema synchronization for generated columns and reduces manual maintenance via auto-cleanup. Check pg_stat_subscription_stats to audit conflict rates and verify parallel streaming is active to ensure optimal replication performance.

PostgreSQL Data Unloader (PDU) is a new open-source tool designed to recover data from offline instances where normal SQL tools are unavailable. It directly reads data files and WAL archives to reconstruct metadata and export tables or schemas as CSV without modifying the original directory. The tool also supports targeted row recovery from WAL logs to handle accidental DELETE or UPDATE operations.

  • PDU enables full-database or targeted table exports via CSV when PostgreSQL is down.
  • It reads raw data files and WAL archives without altering the original data directory.
  • Supports targeted row recovery from WAL for accidental DELETE/UPDATE incidents.
  • Reconstructs database, schema, and table metadata automatically during offline analysis.
HOW IT WORKSRecovering Data with PDU1Read raw data files2Analyze WAL archives3Reconstruct metadata4Export CSV files

The PgDog team details the architectural decisions behind their new Postgres connection pooler, addressing limitations in existing tools like PgBouncer. They highlight specific use cases where their solution offers improved performance or feature parity for high-throughput environments. The post outlines the trade-offs made during development to ensure better resource utilization and connection management.

  • Existing poolers may lack specific performance optimizations for high-concurrency workloads
  • PgDog offers an alternative architecture targeting modern Postgres deployment patterns
  • Evaluate against PgBouncer for specific latency and throughput requirements
  • Consider resource overhead differences when migrating from established poolers
AWS Database Blog awsdatabase

Automate PostgreSQL Audit Log Extraction to S3 via CloudWatch

AWS demonstrates a pipeline that captures PostgreSQL audit logs from CloudWatch Logs and converts them into structured CSV format. This automated workflow processes entries in near real time and stores the resulting files in Amazon S3. The approach enables long-term analysis of audit data without manual intervention.

  • Extracts audit logs from CloudWatch Logs automatically, reducing manual overhead.
  • Converts unstructured log entries into structured CSV for easier querying.
  • Stores data in S3 for scalable, long-term retention and analysis.
  • Operates in near real time, ensuring timely availability of audit records.

The PostgreSQL ODBC driver has released version REL-18_00_0002, addressing critical security and stability issues. Key updates include upgrading to OpenSSL 3.5.5 and patching a stack buffer overflow in getPrecisionPart(). The release also corrects SQLPrimaryKeys behavior for INCLUDE columns and adds validation for percent escapes in connection strings.

  • Upgrade immediately to patch a stack buffer overflow vulnerability in getPrecisionPart().
  • OpenSSL dependency is updated to version 3.5.5 for improved security posture.
  • SQLPrimaryKeys now correctly excludes INCLUDE columns, fixing metadata reporting.
  • Connection string parsing now validates percent escapes before decoding.
  • Resolves buffer read issues in conn_settings and ARD bookmark allocation failures.
CHECKLISTPostgreSQL ODBC Release NotesUpgrade immediately to patch stack buffer overflowUpdate OpenSSL dependency to version 3.5.5Fix SQLPrimaryKeys metadata reporting for INCLUDE columnsValidate percent escapes in connection strings

LLMs 6

roundup ↗

Akashic addresses the inefficiency of replaying full conversation histories in LLM agents by organizing context into bounded chunks and modeling semantic relationships between them. This approach preserves cross-chunk evidence without repeatedly rewriting the entire history, reducing prefill costs and context limit exceedances. The system further employs hardware-software co-design to co-locate likely co-retrieved chunks, optimizing memory access patterns for improved serving efficiency.

  • MemAttention chunks context to avoid full-history replay, lowering prefill costs.
  • Semantic modeling across chunks preserves relevant evidence without bloat.
  • Hardware-software co-design co-locates frequently retrieved chunks for speed.
  • Mitigates context limit issues and quality degradation from irrelevant content.
HOW IT WORKSAkashic Context Processing Pipeline1Chunk conversation history2Model semantic relationships3Co-locate retrieved chunks4Serve efficient inference

This paper introduces a standardized, workload-aware benchmark to compare KV-cache compression techniques that previously suffered from inconsistent evaluation metrics. It tests mechanisms like KIVI, TurboQuant, SnapKV, and CaM on Llama-3.1-8B and Mistral-7B across QA and summarization tasks. The study measures trade-offs between task quality, throughput, time-to-first-token, and compression ratios under long-context constraints.

  • Standardized evaluation enables direct comparison of quantization, pruning, and merging methods.
  • Tests cover multi-document QA, single-document QA, few-shot learning, and summarization.
  • Base models evaluated are Llama-3.1-8B-Instruct and Mistral-7B-Instruct-v0.3.
  • Key metrics include task accuracy, mean throughput, TTFT, and realized compression ratio.
  • Results highlight trade-offs between serving performance and output quality for long contexts.
TRADE-OFFBenchmarking KV-Cache MethodsOld EvaluationInconsistent metricsHard to compareUnclear trade-offsNew BenchmarkStandardized comparisonTests Llama 3.1 8B and Mistral 7BMeasures accuracy and throughputvs

Research identifies 'thinking-induced hallucination' where large reasoning models overwrite correct direct answers with incorrect ones during explicit reasoning phases. The study frames this as a 'thinking residual' that can either recover missing knowledge or introduce unsupported associations. The authors propose Mixed-Mode Advantage Regularization to mitigate this specific failure mode in factuality-oriented question answering.

  • Explicit thinking traces can actively degrade performance by overturning initially correct answers.
  • Thinking-induced hallucination stems from a residual effect that introduces unsupported associations.
  • Mixed-Mode Advantage Regularization is proposed to stabilize factual accuracy during reasoning.
  • Factuality QA requires balancing knowledge recovery against the risk of reasoning drift.
CHECKLISTWhat matters hereExplicit thinking traces can actively degrade performance by…Thinking-induced hallucination stems from a residual effect that…Mixed-Mode Advantage Regularization is proposed to stabilize factual…Factuality QA requires balancing knowledge recovery against the risk…

MemDefrag addresses performance drops in LLM latent memory systems caused by positional encoding misalignment and the inability to isolate specific memory fragments. The authors discovered that middle transformer layers naturally concentrate attention on target fragments, providing a reliable tracing signal. This insight allows the method to refine memory updates without requiring additional training data.

  • Latent memory updates suffer from positional encoding misalignment and lack of fragment tracing.
  • Middle transformer layers show high attention density on target fragments, serving as a natural tracer.
  • MemDefrag leverages this density to improve memory retrieval and update stability.
  • No extra training required; exploits inherent model architecture properties.
HOW IT WORKSMemDefrag Process1Detect attention density in middle layers2Trace target memory fragments3Refine memory updates4Stabilize retrieval performance
AWS What's New awsdatabase ↺ since 07-07

SageMaker HyperPod Adds Disaggregated Prefill and Decode for LLM Inference

Amazon SageMaker HyperPod now supports Disaggregated Prefill and Decode (DPD), separating LLM inference phases onto dedicated GPU pools. The system transfers key-value caches between these pools via Elastic Fabric Adapter and GPU-Direct RDMA. This architecture prevents long-context prefill tasks from stalling token generation for concurrent decode requests, addressing latency and throughput issues in mixed traffic scenarios.

  • Separate prefill and decode workloads onto distinct GPU pools to eliminate resource contention.
  • Use EFA and GPU-Direct RDMA for low-latency KV cache transfer between phases.
  • Improve consistent per-token latency for chat, agentic, and RAG pipelines.
  • Reduce need to over-provision single-phase capacity to protect against stalls.
CHECKLISTDeploying Disaggregated InferenceSeparate prefill and decode onto distinct GPU poolsUse EFA and GPU-Direct RDMA for KV cache transferImprove latency for chat, agentic, and RAG pipelinesReduce need to over-provision single-phase capacity
InfoQ generaldevops ↺ since 07-05

Claude GA on Foundry: EU Enterprises Blocked by Missing Data Zone

Anthropic's Claude models have reached general availability on Microsoft Foundry, featuring Azure-native billing and governance. However, the platform currently lacks a designated European data zone, preventing compliant deployment in the region. Official documentation confirms that data residency guarantees found in Bedrock and Vertex AI do not extend to Foundry, leading banking and healthcare sectors to reject the service for production use.

  • Claude GA on Foundry lacks Azure-native billing and governance for EU regions.
  • No European data zone exists, breaking data residency compliance for regulated industries.
  • Anthropic documentation excludes Foundry from its standard data residency guarantees.
  • EU banking and healthcare sectors report the offering is unapproved for production.

AI / ML 5

roundup ↗

Amazon SageMaker Studio now integrates directly with Hugging Face, allowing users to transition from model discovery to a fully configured environment with a single click. New workflows for customization and deployment pre-load the selected model, eliminating the need to manually configure IAM permissions, set up environments, or request GPU quotas. This update significantly reduces the friction for new customers signing up for AWS and immediately starting work with pre-trained models.

  • Eliminates manual IAM and environment setup for Hugging Face models in SageMaker
  • New AWS sign-ups get immediate SageMaker Studio access without quota requests
  • One-click 'Customize' and 'Deploy' actions streamline model workflow adoption
  • Reduces time-to-first-job by removing navigation and configuration barriers
CHECKLISTWhat matters hereEliminates manual IAM and environment setup for Hugging Face models…New AWS sign-ups get immediate SageMaker Studio access without quota…One-click 'Customize' and 'Deploy' actions streamline model workflow…Reduces time-to-first-job by removing navigation and configuration…

A new study replaces the standard practice of injecting entire legal document corpora into LLM context windows with two structured retrieval methods. The authors compare embedding-based retrieval (NAVEMBED) and LLM navigation over a compact index (NAVINDEX) against full-corpus injection on a proprietary structure-aware chunking system. Using a position-bias-controlled pairwise judge, the research evaluates semantic retrieval accuracy on a 20-question benchmark with verified ground truth.

  • Full corpus injection scales token usage with document volume, not query complexity.
  • NAVEMBED uses embeddings for retrieval, while NAVINDEX leverages LLM navigation.
  • Structure-aware chunking is essential for effective retrieval in legal contexts.
  • Long-context degradation increases as injected text volume grows.
  • Pairwise judges with position bias control provide robust evaluation metrics.
CHECKLISTOptimizing Legal LLM RetrievalUse structure-aware chunking for legal contextsPrefer retrieval over full corpus injectionControl position bias in evaluationMatch token usage to query complexity

InfoQ has opened enrollment for a five-week online cohort focused on AI Security and Privacy Engineering. The program targets senior engineers and architects in regulated sectors, covering security, threat modeling, and governance for production AI. It aims to equip practitioners with practical skills for managing AI system risks.

  • Five-week online cohort for senior engineers in regulated industries
  • Covers security, privacy, threat modeling, and governance for AI
  • Focuses on applying practices to production AI systems
  • Open enrollment for architects and senior engineering roles

A majority report indicates that security incidents related to AI currently outnumber reported vulnerabilities within enterprise environments. This suggests that the primary risk stems from operational missteps or exploitations of deployed systems rather than inherent code flaws. The data highlights a gap between rapid AI adoption and the maturity of associated security controls.

  • Incidents exceed vulnerabilities, pointing to operational risk over code bugs.
  • Rapid AI deployment is outpacing enterprise security maturity.
  • Focus shifts from patching to runtime governance and access control.
  • Leadership must address the 'leap before looking' adoption culture.
InfoQ generaldevops ↺ since 07-07

HubSpot Scales Semantic Search to 20B Vectors for Agents and RAG

HubSpot has transitioned its semantic search platform from a proof of concept to an internal service handling over 20 billion vectors across more than 38 teams. The system now underpins critical applications including AI agents, Retrieval-Augmented Generation, and contact deduplication. Increased agent usage has shifted the operational priority toward optimizing retrieval quality and reducing latency.

  • Semantic search infrastructure scaled to 20B+ vectors across 38+ teams.
  • System now powers AI agents, RAG pipelines, and contact deduplication.
  • Rising agent traffic makes retrieval quality and latency top priorities.
  • Platform evolved from proof of concept to core internal service.

Agentic AI 8

roundup ↗

Google is broadening the capabilities of Managed Agents in the Gemini API by introducing support for background execution and remote Model Context Protocol (MCP) servers. This update allows developers to offload long-running operations and connect agents to external data sources without blocking the main thread. The feature bundle aims to simplify the architecture of complex, stateful AI applications.

  • Support for background tasks enables non-blocking, long-running agent operations
  • Remote MCP integration allows agents to access external data sources securely
  • New feature bundle simplifies building stateful, complex AI workflows

This paper addresses the latency bottleneck of external memory stores in language agents by embedding retrieval directly within the processing loop. While prior work limits memory access to once per turn to avoid network delays, this approach utilizes in-process stores that respond in approximately 100 microseconds. By keeping memory in-process, the system enables read and write operations on every reasoning step without the exponential latency penalties associated with networked databases.

  • In-process stores reduce memory latency to ~100us, eliminating network overhead.
  • Agents can perform multi-step memory reads/writes per turn without 83x latency spikes.
  • Shifts memory architecture from external querying to internal, in-loop integration.
  • Enables complex reasoning loops that require frequent, low-latency context updates.
BY THE NUMBERS100 Microsecond Memory Access100Latency of in-process stores83x faster than external networked databases

This paper aggregates findings from 27 benchmark and audit papers published between 2023 and 2026 to create a unified taxonomy of LLM agent limitations. It reveals that reported benchmark improvements often mask recurring failure modes in tool invocation, multi-step planning, and long-horizon reasoning. The analysis integrates evidence across tool use, multi-agent coordination, and safety to highlight structural weaknesses in current agent architectures.

  • Benchmark gains frequently obscure persistent failure modes in tool use and planning.
  • First unified taxonomy covering tool invocation, planning, and long-horizon reasoning.
  • Analyzes 27 papers across 19 distinct benchmarks to identify six failure clusters.
  • Highlights gaps in measurement validity and multi-agent coordination reliability.
  • Safety and audit findings are integrated into a single cross-cutting limitation framework.
WORTH QUOTINGThe gistThis paper aggregates findings from 27 benchmark and auditpapers published between 2023 and 2026 to create a unifiedtaxonom…— arXiv cs.AI

This paper introduces AgenticAI-Supervisor, a platform designed to replace static evaluation with scalable, simulation-based reinforcement learning for LLM agents. The system decouples environment creation from execution via an API and UI, using verifiable outcomes to generate high-fidelity traces and multi-dimensional rewards. It specifically addresses reward hacking through rigorous internal state validation, as demonstrated in a customer support agent case study.

  • Moves beyond static benchmarks to simulate multi-step decision-making for LLM agents.
  • Decouples environment design from execution for better scalability and flexibility.
  • Mitigates reward hacking by validating internal states alongside final outcomes.
  • Generates high-fidelity traces to support detailed model optimization and debugging.
  • Validated via a customer support agent case study showing closed-loop feedback.
CHECKLISTAgenticAI-Supervisor Key FeaturesSimulate multi-step decision making for LLM agentsDecouple environment design from execution for scalabilityValidate internal states to mitigate reward hackingGenerate high-fidelity traces for model debugging

Researchers demonstrate that steering vectors extracted from heading-anchor positions can exert bidirectional causal control over tool invocation in tool-augmented LLMs. This method suppresses unnecessary tool use, particularly in domains where parametric reasoning is sufficient, across five open-source models and three domains. The findings suggest stable internal representations for tool-use decisions exist, despite tools being context-only at inference time.

  • Steering vectors at heading-anchors provide causal control over tool invocation.
  • Effectively suppresses unnecessary tool calls where parametric reasoning suffices.
  • Validated across five open-source models and three distinct domains.
  • Confirms stable internal representations for tool-use exist in context-only settings.
CHECKLISTKey Findings on SteeringSteering vectors control tool invocationSuppresses unnecessary tool callsValidated across five modelsConfirms stable internal representations

NapMem shifts long-term user memory from passive retrieval to an active, structured action space. It organizes history into a linked pyramid of raw conversations, typed records, topic tracks, and profiles connected by provenance. The agent is trained to select and inspect specific memory granularities based on the query and intermediate evidence.

  • Moves beyond passive retrieval to active memory navigation via tools.
  • Uses a multi-granularity pyramid linking raw data to user profiles.
  • Agent learns to inspect evidence levels before responding.
  • Provenance relations ensure traceability across memory layers.
HOW IT WORKSNapMem Memory Pyramid1Raw conversations2Typed records3Topic tracks4User profiles

Researchers identify two inefficiencies in vanilla on-policy distillation for long-horizon agents: wasted compute on noisy tail turns and insufficient training for deep decision turns due to trajectory-level KL objectives. TurnOPD addresses this by introducing a turn-level budgeting strategy that allocates resources more effectively across the agent's interaction history. This approach aims to improve training efficiency and reduce wall-clock time while maintaining policy alignment with stronger teacher models.

  • Vanilla OPD wastes resources on tail turns that provide weak KL supervision.
  • Trajectory-level objectives under-train deep decision turns in long sequences.
  • TurnOPD uses turn-level budgeting to optimize distillation efficiency.
  • Reduces wall-clock time without sacrificing policy alignment quality.
HOW IT WORKSTurnOPD Distillation Pipeline1Identify noisy tail turns2Allocate turn-level budget3Optimize deep decision turns4Maintain policy alignment
GitHub Trending (daily) githubrepos ⚠ unverified date/source

OfficeCLI: Open-source CLI for AI agents to automate Office docs

OfficeCLI is a single binary tool that allows AI agents to read, edit, and automate Word, Excel, and PowerPoint files without requiring a local Office installation. It features a built-in HTML rendering engine that converts .docx, .xlsx, and .pptx files to HTML or PNG, enabling AI to visually inspect and fix documents. This eliminates the render-look-fix loop by providing high-fidelity document representation directly to AI workflows.

  • Single binary, no Office installation or dependencies required for cross-platform use.
  • Built-in HTML/PNG rendering lets AI agents visually inspect and edit Office files.
  • Enables full control over Word, Excel, and PowerPoint via simple command-line interfaces.
  • Open-source tool designed specifically to close the loop between AI reasoning and document formatting.

Automation / DevOps / IaC 4

roundup ↗

AWS has expanded its DevOps Agent to include autonomous release management features. The new capabilities allow the agent to assess code changes and run automated tests before deployment reaches production environments. This update aims to validate software integrity automatically during the release process.

  • AWS DevOps Agent now autonomously validates code changes before production deployment.
  • New AI-powered release management features assess software integrity automatically.
  • Engineers can rely on the agent to run pre-production tests without manual intervention.
  • This expansion shifts more validation responsibility to the automated agent workflow.

Researchers demonstrated that carefully crafted adversarial prompts can bypass GitHub Copilot's safety filters, causing the AI agent to output contents of private repositories it should not access. The attack exploits how the agent interprets context and permissions during code generation tasks. This highlights a critical vulnerability in how AI agents handle sensitive data boundaries within CI/CD workflows.

  • Adversarial prompts can bypass Copilot's permission checks to expose private code
  • AI agents may interpret context in ways that ignore strict repository isolation rules
  • Current safety filters are insufficient against sophisticated prompt engineering attacks
  • Review AI agent permissions and context handling in CI/CD pipelines immediately
AWS What's New awsdatabase

SageMaker Unified Studio imports existing MWAA environments

Amazon SageMaker Unified Studio now allows connecting existing Amazon Managed Workflows for Apache Airflow environments directly to projects. This feature enables data engineers to manage Airflow workflows from the same interface used for analytics and machine learning. Users can sync, trigger, and monitor workflows without recreating configurations or migrating DAGs. Environments running Airflow 3 or later also gain access to visual authoring tools.

  • Connect existing MWAA domains to SageMaker Unified Studio projects via the Workflows tool.
  • Manage Airflow workflows without recreating configurations or migrating DAGs.
  • Sync, trigger, and monitor workflows directly from the Studio interface.
  • Airflow 3+ environments gain access to visual authoring capabilities.
TRADE-OFFOld vs New MWAA ManagementTraditional WorkflowRequires separate Airflow interfaceNeeds DAG migration or recreationDisconnected from ML analyticsSageMaker Unified StudioSingle unified interfaceNo config recreation neededVisual authoring for Airflow 3+vs
GitHub Trending (daily) githubrepos ⚠ unverified date/source

CodexBar: macOS menu bar tracker for AI coding provider limits

CodexBar is a lightweight macOS application that monitors usage quotas for a wide range of AI coding providers like OpenAI, Claude, and GitHub Copilot. It displays real-time status and countdowns to session, weekly, or monthly resets directly in the menu bar. The tool supports both individual status items and a merged icon mode with a provider switcher, requiring no login credentials.

  • Tracks usage limits for dozens of AI coding providers in one interface
  • Shows countdowns to reset windows to prevent unexpected token cutoffs
  • Runs as a minimal menu bar app with no dock icon on macOS 14+
  • Requires no authentication, making it safe for sensitive environments
BY THE NUMBERSZero Login Required14macOS versions supportedNo authentication needed for safe use

AWS 7

roundup ↗
AWS What's New awsdatabase

Amazon S3 Vectors expands to AWS GovCloud regions

AWS has launched Amazon S3 Vectors in GovCloud US-East and US-West. This service provides purpose-built vector storage for AI agents, RAG, and semantic search at billion-vector scale. It leverages S3's underlying durability and elasticity while offering dedicated APIs for vector management without infrastructure provisioning.

  • GovCloud customers can now access native vector storage for AI workloads
  • Supports billion-vector scale for RAG and semantic search applications
  • Uses S3's durability and availability with dedicated vector APIs
  • No infrastructure provisioning required for storage or querying
CHECKLISTWhat matters hereGovCloud customers can now access native vector storage for AI…Supports billion-vector scale for RAG and semantic search applicationsUses S3's durability and availability with dedicated vector APIsNo infrastructure provisioning required for storage or querying

Amazon SageMaker Unified Studio now enables OpenLineage-compatible data lineage tracking within IAM-based domains, extending capabilities previously exclusive to Identity Center setups. The feature captures lineage events from Apache Spark jobs on EMR, AWS Glue, and SageMaker notebooks, providing interactive visual graphs with configurable depth and column-level detail. Operators can programmatically manage these events via APIs, including a new DeleteLineageEvent action for cleanup.

  • IAM-based SageMaker domains now support OpenLineage-compatible data lineage tracking
  • Captures lineage from EMR Spark, AWS Glue, Visual ETL, and notebooks
  • Interactive graphs offer configurable depth and column-level event timestamp views
  • New DeleteLineageEvent API allows programmatic removal of published lineage events
  • Aligns IAM-based domains with existing Identity Center lineage capabilities
HOW IT WORKSOpenLineage Data Pipeline1Spark Jobs on EMR2AWS Glue Visual ETL3SageMaker Notebooks4Unified Studio Tracking

Amazon ECS Managed Instances now charges lower management fees for GPU and accelerated instance types, effective July 1, 2026. G-series instances see a 35% reduction, while P-series and AWS Trainium fees drop by 60%. These changes apply automatically to existing customers without requiring any action.

  • P-series and Trainium management fees drop 60%, significantly lowering operational costs for heavy AI workloads.
  • G-series management fees decrease by 35%, offering moderate savings for general GPU tasks.
  • No action required: price reductions apply automatically to current ECS Managed Instances users.
  • Simplifies provisioning by allowing task-level definitions rather than manual instance configuration.
COMPARISONECS GPU Fee Reductions by Instance TypeG-series35%P-series60%Trainium60%
PostgreSQL News database ↺ since 07-06

pg-cdc streams Postgres WAL to governed Iceberg tables on S3

pg-cdc is a single-binary tool that streams Postgres WAL data into immutable, time-travelable Iceberg Parquet tables on AWS S3. It integrates with AWS Glue for schema registration and enforces access control via Lake Formation tags, ensuring consumers authenticate through IAM rather than database credentials. The architecture is strictly one-way, preventing any write operations from reaching the production database and eliminating the need for JVM dependencies.

  • Single binary deployment with no JVM required reduces operational overhead.
  • Lake Formation tags gate all reads, making untagged data invisible to consumers.
  • One-way WAL stream ensures agents cannot accidentally write to production.
  • Iceberg tables on S3 enable time-travel queries and immutable data storage.
  • Consumers authenticate via AWS IAM/Lake Formation, avoiding DB credentials.
HOW IT WORKSOne-Way Postgres to Iceberg Pipeline1Postgres WAL generation2pg-cdc binary stream3Iceberg Parquet on S34Lake Formation access control
AWS What's New awsdatabase ↺ since 07-07

AWS ACM Adds ACMEv2 Support for Automated Public TLS Certificates

AWS Certificate Manager now exposes a managed ACME server endpoint, enabling public TLS certificate issuance via standard ACMEv2 clients like Certbot and cert-manager. These certificates, issued by Amazon Trust Services, have a 45-day validity period to align with upcoming CA/Browser Forum mandates. The feature allows PKI administrators to enforce governance controls, including domain scoping and wildcard policies, while delegating request management to application teams.

  • Use any ACMEv2 client (Certbot, cert-manager) with ACM to automate public cert lifecycle.
  • Certificates are 45 days long, ensuring compliance with the 2029 CA/B 47-day mandate.
  • Governance controls let admins restrict domain scopes and wildcard usage per endpoint.
  • Centralized management reduces manual overhead for teams issuing public TLS certs.
  • Native integration supports seamless automation without distributing private CA infrastructure.
BY THE NUMBERSThe headline number45daysAWS ACM Adds ACMEv2 Support for Automated Public TLS…
InfoQ generaldevops ↺ since 07-06

AWS Launches S3 Annotations for Rich Object Metadata

AWS has introduced S3 Annotations, allowing teams to attach searchable context like summaries, compliance data, and AI insights directly to objects. These annotations update independently of the underlying data and can be queried across datasets. This capability aims to eliminate the need for maintaining separate metadata management systems.

  • Attach rich context like AI insights or compliance tags directly to S3 objects.
  • Annotations are independent of the object and remain searchable across datasets.
  • Reduces operational overhead by removing the need for separate metadata systems.
InfoQ generaldevops ↺ since 07-07

Cycle Launches EU Control Plane for Localized Data Sovereignty

Cycle has deployed a dedicated control plane within the European Union to address growing sovereignty concerns. This infrastructure ensures that platform management data and telemetry remain geographically confined to Europe. The move aims to enhance compliance, provide operational isolation, and improve responsiveness for European-based organizations.

  • Cycle now offers an EU-specific control plane for data residency compliance.
  • Platform management and telemetry traffic is kept within European borders.
  • Design targets improved operational isolation for European enterprise customers.
  • Addresses regulatory pressures regarding cross-border data transfer limitations.

Mobile friendly 6

all cards ↗

Today's top database + AI stories as save-and-share cards — built for your phone and your LinkedIn feed.