EZ Release Weekly - October 30, 2026

Time to Remediation tends to get remembered as the time spent writing the fix. Most of the clock ran before that: noticing, finding the environment, reading logs, diffing the plan against what's running. Measure from detection.

A leaked API key works from anywhere. In env zero, a key can now carry its own IP allowlist, so it only works from those addresses. It stacks on your org allowlist.
hubs.la/Q04ClcpP0

Today at 1pm ET: live agentic remediation on a real IaC platform. Artem Artyunov finds what failed and what drifted, then applies a fix on camera, with a human signing off before anything changes.
hubs.la/Q04CkG-p0

Most failed or drifted environments still get fixed by hand. Tomorrow at 1pm ET, Artem Artyunov points a coding agent at a live IaC platform, finds what broke and applies a safe fix on camera, with the guardrails shown.
hubs.la/Q04Ckylm0

Hypothetical: an agent cleaning up security group rules searches the repo, finds no references to one, and deletes it. If a service someone built in the console depended on that rule, the repo had no way to say so. bit.ly/3VEXQLT

Microsoft is retiring Azure DevOps OAuth apps. env zero now connects to Azure DevOps through Microsoft Entra ID. Connections that need the switch are flagged in Organization Settings > VCS, and templates keep working after it. bit.ly/4BlCKm6

Ownership that lives in a wiki is invisible to your policy engine and to every agent you hand a credential. Put the owner on the resource at creation with default_tags, then block any change that's missing it. Same rule for people and agents.

EZ Release Weekly - October 16, 2026 #devops #platformengineering #infra... youtu.be/EAu0zZigK7s?si… via @YouTube

Every drift alert is a question: is the code right, or the cloud? A tool that only detects never makes you answer it, so the alerts pile up and someone mutes the channel. Decide per resource which side wins.

Day two at DevOpsCon NYC. The env zero team is at the booth showing EZ Control: it finds the gap between the cloud you declared and the cloud you actually run, and closes it under policy. Early Access: hubs.la/Q04yKbF50

Today, we are at #DevOpsCon & AI Platform Engineering Day New York announcing the Early Access launch of EZ Control, the autonomous cloud control plane for the AI era. EZ Control closes the loop between the state an enterprise intends and the state its cloud is actually in, whetten as infrastructure code, a rule in a cloud security posture management tool, a policy-as-code repository or a guardrail set within the cloud provider itself. It detects divergence continuously, decides the correct response under policy, and executes the remediation itself.

🗞️ Read the release >> hubs.la/Q04yyhs_0

The Replit agent that deleted a production database during a code freeze wasn't compromised. Neither was the Gemini CLI run that turned a file reorg into data loss.

Both had permission to do what they did. Nobody had reviewed it.

OIDC credentials in env zero shared one audience claim across AWS, Azure, GCP and Vault, so a token minted for one was replayable against another.

v2 issues a provider-specific aud. Opt-in per credential, v1 untouched.

hubs.la/Q04xpcSR0

-auto-approve applies to terraform destroy exactly the way it applies to terraform apply.

It exists so pipelines don't wait on someone typing yes. Agents reach for it for the same reason.

hubs.la/Q04xpd4x0

Infrastructure risk models assume two actors: someone who makes a mistake, and an attacker who shouldn't have access.

An agent with a real credential, inside permissions you approved, reasoning its way to a destructive action, is neither.

🏗️ Having an amazing show at AWS Summit Tel Aviv! Come visit the env zero engineers at Booth S15 for a sneak peek at what we're building, a limited edition t-shirt, and chance to win a LEGO Star Wars Grogu.

תערוכה מדהימה בכנס AWS Summit תל אביב! בואו לבקר את מהנדסי env zero ה שאנחנו בונים, חולצת טריקו במהדורה מוגבלת והזדמנות לזכות בגרוגו של LEGO Star Wars.

#AWS #AWSSummit #AWSSummit2026 #AWSSummitTLV

Single-resource terraform import assumes you already know what to import. Most teams don't: the unmanaged resources are unmanaged because nobody knows they exist. Finding hundreds at a time, then importing them under policy: bit.ly/45J1RRf

Nobody's deployment fails in the interesting layer. It fails because a log forwarding transport threw an error, or the remote backend returned a 503 in exactly the window you needed it. Reliability work is unglamorous, and it is most of the job.

Stale SSO connections are an audit finding waiting to happen. When you migrate identity providers, the new SAML or Azure AD connection works, the old one lingers because deleting it needed a support ticket. It doesn't anymore. Delete it where you created it.