All news with #devsecops tag

🔧 IAM Policy Autopilot now accepts Terraform plan files to generate baseline IAM policies. The open source tool, launched at re:Invent 2025, deterministically analyzes a plan to produce scoped policies that reference specific resource ARNs where possible. This capability complements existing Terraform-aware analysis and addresses the most requested feature since launch. IAM Policy Autopilot runs locally at no additional cost.

🚀 AWS Console-to-Code now supports 26 additional services and adds cross-region and cross-browser-tab action recording. This expands coverage from 6 to 32 services, helping developers, DevOps, and cloud architects convert manual console workflows into repeatable infrastructure as code (IaC). Actions are consolidated across regions and tabs so complex multi-region deployments retain context. Available today in all commercial AWS Regions.

🔒 Palo Alto Networks announces native integration of Prisma AIRS Runtime API with OpenAI Codex, enabling centralized, API-level security controls for developer workflows. The integration inspects developer inputs and prevents sensitive data leakage without requiring client-side hooks, preserving developer productivity in Codex. SecOps benefit from consistent policy enforcement, audit-ready logging, and organization-wide visibility through the Codex Enterprise Management UI.

🔒 Microsoft expands its Zero Trust for AI strategy with an automated Zero Trust Assessment and a new DevSecOps pillar in the Zero Trust Workshop to help organizations secure AI agents, developer workflows, and CI/CD pipelines. The Assessment evaluates tenant configuration and activity across Identity, Devices, Network, Data, AI, Security Operations, and Infrastructure, producing prioritized recommendations and executive-ready reports. The DevSecOps pillar maps Zero Trust principles into 15 control groups and 91 tasks covering source code, pipelines, dependencies, artifacts, and infrastructure-as-code. Together, the Assessment and Workshop convert findings into a phased 12–24 month remediation roadmap.

🛠️ Cloudflare introduces the CI SDK built on Workflows to run CI pipelines directly on its platform. The system ties Artifacts (versioned code storage) to Workflows so repository pushes can trigger CI jobs, with sandboxed steps, dependency caching, and parallel execution. Platforms can manage CI for many repos while allowing customers to run custom Workflows in the same namespace. The CI SDK supports self-healing agents, R2-backed caches, and improved observability in the Workflows dashboard.

🚀 Cloudflare describes how AI agents are transforming the Software Development Lifecycle and introduces the Agent Development Lifecycle (ADLC). The post argues agents can and should manage more of the SDLC, and presents Cloudflare Workflows and Artifacts as primitives to orchestrate complex, long-running processes. It frames software factories as the future of autonomous software delivery and invites developers to experiment with @cloudflare/ci and agent-driven workflows.

🔎 Over four months, Cloudflare’s AI code reviewer flagged nearly 230,000 deviations from internal engineering standards and blocked almost 16,000 merges. The company consolidated dispersed guidance into the Cloudflare Codex, a governed RFC-based repository of SHOULD and MUST requirements that agents can consume across the engineering lifecycle. Codex-driven agents now review code, specs, and incident reports, improving consistency and surfacing issues earlier while leaving final judgment to engineers.

🔍 AWS Transform continuous modernization is now generally available in all Regions that support AWS Transform. It enables engineering teams to analyze and remediate technical debt across GitHub, GitLab, and Bitbucket repositories at scale, with on-demand or scheduled analyses and prioritization across technical debt, security, agentic readiness, modernization readiness, and custom criteria. Users can create remediations that open pull requests or merge requests, run analyses in their AWS account, and maintain control of source code. Additional workflows are supported via the AWS Transform Kiro Power, agent plugins, and CLI for IDE and terminal use, local analysis, and remote execution on Amazon EC2 or AWS Batch.

🔧 Amazon SageMaker Unified Studio now provides full Git version control directly within core tools like Query Editor, Visual ETL, Workflows, and Notebooks. The updated Repositories experience replaces automatic sync with flexible, file-level control and lets teams choose which files to track in Git on GitHub, GitLab, or Bitbucket. Repositories are decoupled from project creation, support multiple repos and branches concurrently, and preserve CLI access via JupyterLab or Code Editor terminals.

🔒 This post presents an AppSec control framework for AI coding agents that balances developer productivity with risk management. It organizes controls into two pillars: author-time (shaping agent output in the IDE) and build-time (verifying and gating changes in the pipeline). The framework is tool- and cloud-agnostic and recommends deterministic, non-deterministic, and human controls to mitigate risks like prompt injection, insecure defaults, dependency issues, and overbroad access.

🔐 The article argues that CISOs must shift from merely securing the business to enabling secure business operations with AI. It emphasizes focusing on intent, governance, and scope rather than assigning blame to AI agents, and recommends partnering with engineering, prioritizing high-risk exposures, and embedding continuous assurance into CI/CD. The piece frames AI security as a strategic enabler that preserves speed and mitigates risk.

🚀 Amazon SageMaker Unified Studio can now connect to existing Amazon Managed Workflows for Apache Airflow (MWAA) environments, enabling teams to manage Airflow workflows from within their Studio projects. To add a connection, open the Workflows tool, choose "Add connection," and supply the Airflow configuration referencing your domain and project. Once connected, project members can sync, trigger, and monitor workflows; environments running Apache Airflow 3+ also gain the visual drag-and-drop authoring experience.

🔧 AWS CodeBuild now supports Amazon Linux 2023 for on-demand build hosts via a new host kernel selection setting. This managed CI service lets you choose between Amazon Linux 2 (kernel 4) and Amazon Linux 2023 (kernel 6) for new or non-production projects to validate builds while keeping production unchanged. Host kernel selection is broadly available across Regions except GovCloud (US) and China, which only offer Amazon Linux 2023.

🧭 AWS announces general availability of experimentation tools in AWS AppConfig, enabling built-in A/B testing and multivariate experiments without separate infrastructure. The tools leverage 25+ years of Amazon experimentation practices and provide AI-driven guidance, exposure control, and locked treatment allocations to support robust, data-driven releases. Experiments can be configured via console, CLI, API, or AWS CDK and analyzed with CloudWatch or existing analytics tools before promoting winners through standard safe rollouts.

🛡️ AWS Security Agent (now part of AWS Continuum) is available in Asia Pacific (Mumbai), Asia Pacific (Singapore), and South America (São Paulo). Customers in these regions can access STRIDE-based threat modeling (preview), full-repo and PR-level code reviews (preview) across major source platforms, managed compliance packs, and custom security requirements. New IDE plugins and MCP integration enable triggering threat modeling, code reviews, and remediation from Kiro or Claude Code, while on-demand penetration testing and retesting provide validated findings and fixes; simulated validation remains only in US East (N. Virginia).

🚀 AWS announces CloudFormation and CDK express mode, cutting deployment time by up to 4x for developers and AI agents by marking stacks complete once resource configuration is applied, rather than waiting for extended stabilization. Express mode lets propagation and long-running stabilization continue asynchronously, preserves dependency ordering and failure handling within stacks, and disables rollback by default to speed iterative fix-and-retry workflows. It requires no template changes and can be enabled via CLI, SDKs, console, or cdk deploy --express. The feature is available in all Regions where CloudFormation is supported.

🔍 AWS CloudFormation now performs pre-deployment validation on Create Stack and Update Stack operations, surfacing common deployment errors in seconds before any resources are provisioned. The release extends validation previously limited to change set creation and introduces three new checks as warnings for service quota limits, AWS Config Recorder conflicts, and ECR repository deletion readiness. Validation results are viewable via the DescribeEvents API, the CloudFormation console Deployment validations tab, and in CDK outputs for automation and AI agents. Pre-deployment validation is enabled by default across supported regions (excluding China) and can be skipped per-operation with the DisableValidation parameter or CLI flag.

🔒 Google Cloud describes how it embeds modular AI agents across the software development lifecycle to create autonomous security guardrails. The approach includes centralized code analysis via the Mantis framework, multi-agent fuzz testing with self-reflection, and an autonomous patching pipeline that validates fixes before human review. Continuous reflection and a programmable posture management system help convert lessons into reusable skills that improve remediation speed and reduce false positives.

🔒 AWS has introduced Continuum, a service to continuously discover, investigate, and remediate vulnerabilities across first-party and third-party codebases. The platform uses AI to validate exploitability, generate remediation recommendations, and propose fixes that integrate with existing development workflows. New capabilities include automatic threat modeling in STRIDE format, while more established features derive from the Security Agent product. Continuum supports graduated trust from human-in-the-loop review to an "enforce mode" for autonomous remediation.

🛠️ AWS DevOps Agent now includes a release management capability in preview that reviews code changes for release readiness and runs autonomous release testing to improve production deployments. The feature evaluates drift from internal standards, dependency impacts, and access controls, and maps cross-repository dependencies to surface breaking changes. It also generates and executes test plans for web and API applications in customer environments to catch regressions and integration issues. The preview is available in US East (N. Virginia) at no additional cost.