Automation / DevOps / IaC

Expedia Group launched STAR, an internal observability platform that leverages LLMs to accelerate production incident investigations. The system analyzes service telemetry via structured workflows to generate root cause assessments while maintaining human oversight. Built on FastAPI, Datadog, Celery, Redis, and Langfuse, STAR aims to streamline response efforts without removing engineers from the loop.

• STAR combines service telemetry with LLMs to automate root cause assessment generation.
• The platform uses structured workflows to keep engineers in control of incident response.
• Core stack includes FastAPI, Datadog, Celery, Redis, and Langfuse for observability.
• Aim is to reduce investigation time while ensuring human validation of AI findings.

AWS has generally available the Durable Execution SDK for .NET, allowing C# developers to build resilient, long-running workflows directly within Lambda. This SDK extends the event-driven model by automatically checkpointing progress and pausing execution for up to a year while waiting on external events. Developers can now implement complex scenarios like payment pipelines and AI agent orchestration without custom tracking or external orchestration services.

• Use the idiomatic C# SDK to build durable functions that auto-checkpoint state.
• Pause execution for up to 12 months while waiting on external events or approvals.
• Eliminate the need for custom progress tracking or external orchestration services.
• Ideal for long-running workflows like payment processing and human-in-the-loop tasks.

AWS Lambda durable functions now allow encryption of execution state using a customer managed KMS key, replacing the default AWS-owned key. This update gives users direct control over key rotation and access permissions for durable execution data. The feature addresses strict data governance requirements in regulated industries like finance and healthcare.

• Encrypt durable execution state with your own KMS key instead of the default AWS-owned key.
• Gain granular control over key rotation policies for compliance in regulated sectors.
• Manage access permissions to execution history and state via your managed keys.
• Enables Lambda workflows to meet stricter data governance and audit requirements.

LikeC4 is a modeling language and toolset that generates up-to-date software architecture diagrams directly from code. Inspired by the C4 Model and Structurizr DSL, it allows teams to visualize, collaborate on, and evolve architectural views. Users can customize notation, element types, and nesting levels to fit specific project needs.

• Generates live diagrams from code to keep architecture views current
• Flexible notation allows custom element types and nesting levels
• CLI tool enables quick previewing via npx likec4 start
• Supports collaboration and evolution of software architecture models

AWS Secrets Manager now publishes direct events to Amazon EventBridge whenever a secret value changes. This replaces the previous reliance on parsing multiple CloudTrail API calls like PutSecretValue and rotation events. The new native integration allows for real-time, event-driven workflows to detect active value changes immediately.

• Eliminates need to parse multiple CloudTrail events for secret changes
• Enables direct routing to Lambda, SNS, SQS, or Step Functions
• Supports proactive cache invalidation when credentials rotate or update

Zalando engineered an in-process, client-side load balancer to manage an API processing approximately one million requests per second. This architecture shift delivered more predictable latency and reduced infrastructure costs while improving failure visibility. The design prioritizes direct client-side decision-making over traditional server-side proxying.

• In-process client-side balancing reduces dependency on external proxy layers.
• Handling 1M RPS requires robust internal state management within the client.
• Predictable latency improvements justify the architectural complexity.
• Better failure visibility stems from centralized client-side metrics.
• Infrastructure cost drops result from optimized request routing efficiency.

A security camera from Hanwha shipped with a hardcoded GitHub admin token visible on its web login interface. The token was exposed directly in the HTML source of the login page, granting unauthorized access to the associated repository. This represents a critical failure in credential management for embedded IoT devices.

• Audit all IoT devices for hardcoded credentials in web interfaces or source code.
• Scan repositories for accidental commits of tokens, especially from vendor firmware.
• Treat vendor-supplied hardware as untrusted until credentials are rotated.
• Implement network segmentation to limit blast radius of compromised IoT devices.