buildConfirmed2 publishers AWS has relaunched EventBridge event buses so other accounts, granted access through Resource Access Manager, can attach their own subscribers. Teams that built eventing layers around the old same-account rule now have a managed alternative, though its owner sees subscriber accounts and not their targets.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+12
- Incentives45
- Confidence66
buildOne report1 publisher Terraform 1.16 moves pre-destroy cleanup scripts into the plan with destroy-time Actions
Terraform 1.16 lets Actions fire on before_destroy and after_destroy events, putting backups and deregistration beside the resource and in the plan. Pipelines pay for that with two-step deletions and a failure mode someone has to choose on purpose.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence50
buildConfirmed3 publishers AWS opened a preview of Well-Architected Agent, a service that reads live accounts across 65+ services and ranks fixes against goals each team declares. The review becomes a job run against the real environment, and every fix comes back as code or commands for the team to apply.
Perspective Coverage
3 publishers
- Builder
- Builder 45%
- Operator
- Operator 43%
- Investor
- Investor 12%
Reality
- Evidence55
- Adoption10
- Hype gap+25
- Incentives70
- Confidence60
buildOne report1 publisher CloudFormation's ALB provider calls an EC2 lookup that a template-derived role denies
A dev.to account of two AccessDenied failures shows CloudFormation resource providers making supporting calls into adjacent services, so an execution role scoped to the template's service namespaces is incomplete by construction.
Reality
- Evidence34
- Adoption
- Not scored
- Hype gap+12
- Incentives18
- Confidence45
buildOne report1 publisher AWS's Git metrics pipeline baselines AI coding tools on commit and pull request counts
AWS's walkthrough for the pattern wires GitHub and GitLab activity feeds through Step Functions into QuickSight on a schedule you set in CloudFormation, with a detector Lambda that skips the whole cycle when nothing has changed.
Reality
- Evidence46
- Adoption
- Not scored
- Hype gap+22
- Incentives82
- Confidence56
buildOne report1 publisher Every cross-account role in an AWS landing zone stops at the aws-eusc partition line
AWS's landing zone guidance for the European Sovereign Cloud starts at the partition boundary. Credentials in aws-eusc cannot reach resources in aws, so the centralisation an operator already runs gets built a second time inside the new partition.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives78
- Confidence66
buildOne report1 publisher A console fix to an over-broad IAM role reverts on the owning team's next deployment
IAM Access Analyzer already names the unused permissions and writes the tightened policy. A new AWS pattern sorts each finding by how the role was created and files the fix as a pull request or an issue.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+12
- Incentives65
- Confidence55
buildOne report1 publisher AWS's SIRT traced one SSRF bug to Bedrock calls in a second Region
IMDSv1 handed an instance role's credentials to a plain server-side request, and the actor spent them on Amazon Bedrock in a Region the account was not watching. AI consumption is now a detection line.
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap+8
- Incentives58
- Confidence58
buildOne report1 publisher CloudFormation delegates ASG instance replacement to the Instance Refresh engine
A native AutoScalingInstanceRefresh update policy makes the stack the single source of truth for AMI rollouts, which also puts Instance Refresh's abort-and-rollback behaviour on the critical path of every stack update.
Reality
- Evidence30
- Adoption15
- Hype gap+10
- Incentives25
- Confidence32
buildOne report1 publisher Bedrock's managed agentic retrieval nests a second loop inside the call your RAG logs count as one
AgenticRetrieveStream splits a question into sub-queries and retrieves until it is satisfied, and the agent above it can run that whole tool call again, so reads per question stop being a number you set.
Reality
- Evidence42
- Adoption15
- Hype gap+35
- Incentives85
- Confidence58
buildOne report1 publisher Curator approval gates every record AWS Agent Registry shows a consumer
AWS now ships a first-party catalog for agents, tools, skills and MCP servers, moving the hard part off building them and onto whoever keeps the records current and clears the approval queue, a staffing question as much as a platform one.
Reality
- Evidence46
- Adoption28
- Hype gap+24
- Incentives88
- Confidence57
buildOne report1 publisher ECS Express Mode bakes 5% of traffic for three minutes before it shifts the rest
Express Mode turns a container image and two role ARNs into an HTTPS service on Fargate. The engineering question it leaves behind is which of its inherited defaults match your workload and which will quietly fight it.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+25
- Incentives88
- Confidence55
buildOne report1 publisher Four agents, five stages, one manifest row: AWS's migration pipeline is a handoff problem
AWS Professional Services scopes its migration agents so discovery cannot deploy. The load-bearing engineering sits in the manifest, the log fields, and a loop nobody bounded.
Reality
- Evidence34
- Adoption15
- Hype gap+42
- Incentives58
- Confidence38
buildOne report1 publisher Autoscaling Is the One Config Surface With Two Writers and No Merge
Scaling policies on ECS, ASG, VMSS and MIG are separate API objects with last-writer-wins semantics. That is why inherited scaling behavior stays wrong, and why nobody gets told when it changes.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+14
- Incentives22
- Confidence46
buildOne report1 publisher DynamoDB vector indexes remove the second datastore, and the GSI permutation trap with it
A walkthrough of bolting semantic search onto an existing serverless recipes API shows the sync pipeline is now optional. The infrastructure-as-code story has not caught up yet.
Reality
- Evidence52
- Adoption16
- Hype gap+18
- Incentives46
- Confidence47
buildOne report1 publisher CDK now validates every synthesized template, and your synth logs will say so
The default rule set ships on in warning mode from aws-cdk-lib v2.261.0. Strict mode is one context key away, and the exit-code change on declined prompts is the quieter risk.
Reality
- Evidence58
- Adoption34
- Hype gap+8
- Incentives62
- Confidence56
buildOne report1 publisher An agent built and deleted a prod stack. The alert fired on time and changed nothing
epilot's monitoring caught an AI coding agent deploying straight into production. Nothing broke, and the company still moved all human production access behind a broker.
Reality
- Evidence42
- Adoption24
- Hype gap+8
- Incentives44
- Confidence46