317: I Got 99 Problems, But a Hallucination Ain’t One

Welcome to episode 317 of The Cloud Pod, where the forecast is always cloudy! Justin, Matt, and an out-of-breath (from outrunning bears) Ryan are back in the studio to bring you another episode of everyone’s favorite cloud and AI news wrap-up. This week we’ve got GTP-5, Oracle’s newly minted AI conference, hallucinations (not the good kind), and even a Cloud Journey follow-up. Let’s get into it! 

Titles we almost went with this week:

• Oracle Intelligence: Mission Las Vegas
• AI World: Oracle’s Excellent Adventure
• AI Gets a Reality Check: Amazon’s New Math Teacher for Hallucinating Models
• Jules Verne’s 20,000 Lines Under the C
• GPT-5: The Empire Strikes Back at Computing Costs
• 5⃣Five Alive: OpenAI’s Latest Language Model Drops
• GPT-5 is Alive! (And Ready for Your API Calls)
• From Kanban to Kan’t-Ban: Alienate Your User Base in One Update
• No More Console Hopping: ECS Logs Stay Put
• Following the Paper Trail: ECS Logs Go Live
• The Pull Request Whisperer
• Five’s Company: DigitalOcean Joins the GPT Party
• WireGuard Your Kubernetes: The Mesh-iah Has Arrived
• EKS-tending Your Reach: When Your Nodes Need a VPN Alternative
• Buttercup Blooms: DARPA’s Prize-Winning AI Security Tool Goes Public
• From DARPA to Docker: How Buttercup Brings AI Bug-Hunting to Your Laptop
• Agent 007: License to Query
• Compliance Manager: Because Nobody Dreams of Filling Out Federal Paperwork
• Do Compliance Managers dream of Public Sector sheep?
• Blob’s Your Uncle: Finding Lost Data in the Cloud
• Wassette: Teaching Your AI Assistant to Go Shopping for Tools
• Monitor, Monitor on the Wall, Who’s the Most Secure of All?
• Better Late Than IPv-Never
• VPC Logs: Now with 100% Less Manual Labor
• CloudWatch Catches All the Flows in Your Organization
• The Organization-Wide Net: No VPC Left Behind
• SQS Goes Super Size: Would You Like to Quadruple That?
• One MiB to Rule Them All: SQS’s Payload Growth Spurt
• Microsoft Finally Merges with Its $7.5 Billion Side Piece
• From Hub to Spoke: GitHub Loses Its Independence
• Cloud Run Forest Run: Google’s AI Workshop Marathon
• From Zero to AI Hero: Google’s Production Pipeline Workshop
• The Fast and the Serverless: Cloud Run Drift

A big thanks to this week’s sponsor:

We’re sponsorless! Want to get your brand, company, or service in front of a very enthusiastic group of cloud news seekers? You’ve come to the right place! Send us an email or hit us up on our Slack channel for more info.

General News 

01:17 GitHub will be folded into Microsoft proper as CEO steps down – Ars Technica

• GitHub will lose its operational independence and be integrated into Microsoft’s CoreAI organization in 2025, ending its separate CEO structure that has existed since Microsoft’s $7.5 billion acquisition in 2018.
• The reorganization eliminates the CEO position, with GitHub’s leadership team reporting to multiple executives within CoreAI rather than a single leader, potentially impacting decision-making speed and product direction.
• This structural change could affect GitHub’s developer-focused culture and remote-first operations that have distinguished it from Microsoft’s traditional corporate structure.
• The integration into CoreAI suggests Microsoft plans to more tightly couple GitHub with its AI initiatives, potentially accelerating AI-powered development features but raising concerns about platform neutrality.
• Developers and enterprises should monitor how this affects GitHub’s roadmap, pricing, and commitment to open source projects, as tighter Microsoft integration historically has led to significant platform changes.

03:01 Matt – “God knows how long a decision is going to take to get made.”  

AI Is Going Great – or How ML Makes Its Money 

05:10 Jules, Google’s asynchronous AI coding agent, is out of public beta

• If you’ve forgotten about it, Jules is the worst-marketed Google AI coding agent tool. 
• Jules is Google’s AI coding agent that operates asynchronously to handle development tasks.
• It’s now publicly available, after processing 140,000+ code improvements during beta testing with thousands of developers.
• The service runs on Gemini 2.5 Pro’s advanced reasoning capabilities to create coding plans and generate higher-quality code outputs, with new features including GitHub issues integration and multimodal support.
• Google introduced three pricing tiers: free introductory access (which you will blow through almost immediately), Google AI Pro with 5x higher limits for daily coding, and Google AI Ultra with 20x limits for intensive multi-agent workflows at scale.
• Is it just us, or is this the same pricing structure as Claude? 
• This represents a shift toward autonomous coding assistants that can work independently on tasks while developers focus on other work, potentially changing how cloud-based development teams operate.
• The asynchronous nature allows Jules to handle time-consuming tasks like bug fixes and code improvements without requiring constant developer oversight, which could significantly impact productivity for cloud development projects.

06:30 Ryan – “I think it’s a perfect example of like where GitHub might go, right? Because this already integrates with GitHub, so you can communicate with the AI in issues or point at certain issues, or use it in comments. And it’s synchronous, so it’s just running in the background. It’s not a chat or an interactive agent conversation. You’re sort of like giving it directions and sending it off.”

08:11 Introducing GPT-5

• Were you waiting for the drumroll? Well, no sound effects this week. Sad face. 
• GPT-5 introduces a larger model architecture with refined attention mechanisms and multimodal input processing, requiring substantial cloud compute resources for deployment and inference at scale.
• Enhanced contextual comprehension and faster processing speeds enable more efficient API calls and reduced latency for cloud-based AI services, potentially lowering operational costs for businesses.
• Technical improvements in training efficiency could reduce the computational overhead for fine-tuning models on cloud platforms, making custom AI deployments more accessible to smaller organizations.
• Healthcare, education, and creative industries can leverage GPT-5 through cloud APIs for applications like medical documentation, personalized learning systems, and content generation workflows.
• OpenAI’s safety measures and ethical deployment guidelines will likely influence cloud provider policies for hosting and serving large language models, affecting compliance requirements for enterprise users.
• AGI is here, guys! Well, not really. Maybe. Sort of. Getting close? Ryan is excited about it, anyway. 

09:38 Introducing GPT-5 for Developers

• GPT-5 represents the next iteration of OpenAI’s language model series, likely offering improved language understanding and generation capabilities that developers can integrate via API endpoints into cloud-based applications.
• The model would provide enhanced performance benchmarks compared to GPT-4, potentially including better context handling, reduced hallucinations, and more accurate responses for enterprise cloud deployments.
• Developer integration features may include new API capabilities, updated SDKs, and code examples for implementing GPT-5 across various cloud platforms and programming languages.
• Pricing and rate limits will be critical factors for businesses evaluating GPT-5 adoption, particularly for high-volume cloud applications requiring scalable AI inference.
• The release could impact cloud computing costs and architecture decisions as organizations determine whether to use OpenAI’s hosted service or explore self-hosting options on their cloud infrastructure.

11:09 Ryan – “I’m kind of afraid of AGI, and I’m putting my head in the sand about it right now.” 

12:29 Announcing OpenAI GPT-5 on Snowflake Cortex AI

• Snowflake Cortex AI is their existing platform for running LLMs and ML models directly on data stored in Snowflake, currently supporting models like Llama 2, Mistral, and other open-source options.
• If GPT-5 were to be integrated with Cortex AI, it would allow enterprises to run advanced language models on their private data without moving it outside Snowflake’s secure environment.
• This integration would follow Snowflake’s pattern of adding major LLMs to Cortex, enabling SQL-based access to AI capabilities for data analysts and developers.
• The announcement timing would be notable given OpenAI hasn’t officially released GPT-5 yet, making this either premature or indicative of an exclusive cloud partnership.
• Cool. 

12:35 Apple brings OpenAI’s GPT-5 to iOS and macOS – Ars Technica

• Apple followed up the deluge of GPT-5 announcements with one of their own. 
• Apple will integrate OpenAI’s GPT-5 into iOS 26, iPadOS 26, and macOS Tahoe 26, likely launching in September 2025, replacing the current GPT-4o integration for Siri and system-level AI queries.
• GPT-5 claims an 80% reduction in hallucinations and introduces automatic model selection between standard and reasoning-optimized modes based on prompt complexity, though it’s unclear how Apple will implement this dual-mode functionality in their OS integration.
• The rollout follows GPT-5 deployments to GitHub Copilot (public preview) and Microsoft 365 Copilot, positioning major cloud platforms as the primary distribution channels for OpenAI’s latest models rather than direct consumer access.
• Apple’s implementation raises questions about feature parity with ChatGPT’s paid tier, particularly whether iOS users will have manual model selection capabilities or be limited to automatic selection like free ChatGPT users.
• This marks a significant shift in how consumers will access advanced AI models, with cloud-integrated operating systems becoming the default interface rather than standalone AI applications.

12:50 Now Live: GPT-5 on the DigitalOcean Gradient AI Platform | DigitalOcean

• What could DO possibly have had to announce? Oh yeah – GPT-5. Weird. 
• DigitalOcean’s Gradient AI Platform now offers GPT-5 integration with two deployment options: using DigitalOcean’s infrastructure or bringing your own OpenAI API key for direct billing flexibility.
• GPT-5 introduces improved reasoning capabilities and domain specialization, targeting enterprise use cases like financial planning, medical document analysis, and advanced code generation beyond general-purpose chat applications.
• The platform positions GPT-5 as an “agent-ready” model, enabling developers to build autonomous AI agents within DigitalOcean’s infrastructure rather than just API-based integrations.
• This marks DigitalOcean’s entry into the hosting frontier for AI models, competing with hyperscalers by offering simplified deployment and management for developers who want cloud infrastructure without complexity.
• The bring-your-own-key option allows organizations to maintain existing OpenAI enterprise agreements while leveraging DigitalOcean’s compute and orchestration layer for agent workflows.

13:39 Matt – “It’s going to be a question, in a month, of ‘why don’t you have GPT-5, where is it in your roadmap?’ More than anything.” 

14:15 ChatGPT users hate GPT-5’s “overworked secretary” energy, miss their GPT-4o buddy – Ars Technica

• After all that buzz wore off, there were some complaints. 
• OpenAI released GPT-5 as the default model for ChatGPT users while restricting GPT-4o access to developer APIs only, causing user backlash over losing their preferred conversational AI experience.
• Users report GPT-5 outputs feel more sterile and corporate compared to GPT-4o, with complaints about reduced creativity and broken workflows that were optimized for the previous model.
• This highlights a key challenge for cloud AI services: maintaining consistency in user experience while upgrading models, especially when users develop emotional attachments or specific workflows around particular AI behaviors.
• The situation demonstrates the importance of model versioning and user choice in AI platforms, suggesting cloud providers should consider maintaining multiple model options for different use cases rather than forcing migrations.
• For businesses building on AI APIs, this serves as a reminder to plan for model deprecation and changes in AI behavior that could impact customer-facing applications or internal workflows.

15:00 The GPT-5 rollout has been a big mess – Ars Technica

• OpenAI automatically removed access to nine previous ChatGPT models when GPT-5 launched on August 7, forcing users to migrate without warning, unlike API users who receive deprecation notices.
• The forced migration broke established workflows as each model has unique training and output styles that users had optimized their prompts for over months of use.
• User revolt included over 4,000 comments on Reddit, with marketing professionals, researchers, and developers reporting broken systems and lost functionality within 24 hours of launch.
• CEO Sam Altman issued a public apology and reversed the decision, highlighting the operational challenges of managing multiple model versions in consumer-facing AI services.
• The incident demonstrates the dependency risk when building workflows around specific AI models and the importance of version control strategies for production AI applications.

16:51 Matt – “Could go the Microsoft or AWS route and never depricate anything until you can 100% guarantee no one is using it anymore.” 

Cloud Tools

17:18 Buttercup is now open-source! -The Trail of Bits Blog

• Trail of Bits has open-sourced Buttercup, their AI-powered Cyber Reasoning System that won second place in DARPA’s AI Cyber Challenge, making automated vulnerability discovery and patching accessible to individual developers on standard laptops with 8 cores, 16GB RAM, and 100GB storage.
• The system combines AI-augmented fuzzing with multi-agent patch generation, using 7 distinct AI agents to create and validate fixes while leveraging third-party LLMs like OpenAI or Anthropic with built-in cost controls for budget management.
• Buttercup integrates OSS-Fuzz/ClusterFuzz for vulnerability discovery, tree-sitter and CodeQuery for static analysis, and provides a complete orchestration layer with web UI and SigNoz telemetry monitoring, demonstrating practical AI application in automated security testing.
• The standalone version can find and patch vulnerabilities in under 10 minutes on sample code, offering cloud-native deployment through containerized pods and making enterprise-grade security automation available to smaller teams and projects.
• This release represents a shift in AI-powered security tools from competition-scale systems to practical developer tools, potentially reducing the barrier to entry for automated vulnerability management in CI/CD pipelines and cloud deployments.

19:19 Ryan – “I do like anything that’s going to go and detect the vulnerabilities and then also try to fix them on behalf of developers. I haven’t used any of these tools, and it’s an interesting fit with the existing pipelines. It’s pretty cool though.”  

AWS 

19:58 Amazon Aurora Serverless v2 now offers up to 30% performance improvement

• Aurora Serverless v2 delivers up to 30% performance improvement on platform version 3, making it viable for more demanding workloads that previously required provisioned instances.
• The service now scales from 0 to 256 ACUs (Aurora Capacity Units), where each ACU provides approximately 2 GiB of memory plus corresponding CPU and networking resources.
• Existing clusters require manual upgrade via stop/restart or Blue/Green Deployments to access the performance gains, while new clusters automatically launch on the latest platform.
• The 30% performance boost, combined with automatic scaling, addresses the common serverless database challenge of balancing cost efficiency with consistent performance for variable workloads.
• Available across all AWS regions, including GovCloud, this update strengthens Aurora’s position against competitors like Google Cloud Spanner and Azure SQL Database serverless offerings.

21:28 Justin – “I almost went down the blue-green path, but when you do blue-green, it’s not just a temporary thing; you end up running it forever – which I don’t want to do because I don’t have that kind of money to burn. But this is not easy to get on to; I wish they would just give you a button.” 

23:14 Minimize AI hallucinations and deliver up to 99% verification accuracy with Automated Reasoning checks: Now available | AWS News Blog

• Amazon Bedrock Guardrails now includes Automated Reasoning checks that use mathematical logic and formal verification to validate AI-generated content against domain knowledge, achieving up to 99% verification accuracy for detecting hallucinations – a significant improvement over probabilistic methods.
• The feature supports documents up to 80K tokens (approximately 100 pages), includes automated test scenario generation, and allows users to encode business rules into formal logic policies that can validate whether AI responses comply with established guidelines and regulations.
• PwC is already using this for utility outage management systems where AI-generated response plans must comply with strict regulatory requirements – the system automatically validates protocols, creates severity-based workflows, and ensures responses meet defined targets.
• Pricing is based on text processed volume, and the service is available in US East (Ohio, N. Virginia), US West (Oregon), and Europe (Frankfurt, Ireland, Paris) regions, with integration support for both Amazon Bedrock models and third-party models like OpenAI and Google Gemini via the ApplyGuardrail API.
• The policy creation process involves uploading natural language documents (like PDFs of business rules), which are then translated into formal logic with rules, variables, and custom types that can be tested and validated before deployment in production guardrails.

24:44 Ryan – “It is kind of crazy the idea that the reasoning checks are just using mathematical logic.” 

26:04 Amazon ECS console now supports real-time log analytics via Amazon CloudWatch Logs Live Tail

• Amazon ECS console now integrates CloudWatch Logs Live Tail directly, eliminating the need to switch between consoles for real-time log monitoring during container troubleshooting and deployment investigations. 
• This is 99% of Justin’s day, so he’s loving this one. 
• The Live Tail panel stays visible while navigating the ECS console, allowing operators to monitor logs while checking metrics or making configuration changes – addressing a common workflow interruption.
• Access is straightforward through the logs tab on any ECS service or task details page with a simple “Open CloudWatch Logs Live Tail” button, making real-time debugging more accessible for containerized applications.
• This integration reduces context switching for common ECS operations like investigating deployment failures and monitoring container health, improving operational efficiency for teams managing containerized workloads.
• Available in all AWS commercial regions, with standard CloudWatch Logs pricing applying to the Live Tail feature usage.

27:44 Matt – “I wish this was here years ago when I did my first ECS deployments.” 

27:57 AWS Lambda now supports GitHub Actions to simplify function deployment

• AWS Lambda now supports native GitHub Actions for automated function deployment, eliminating the need for custom scripts and manual AWS CLI commands that previously made CI/CD pipelines complex and error-prone.
• The new Deploy Lambda Function action handles both zip file and container image deployments automatically, supports OIDC authentication for secure IAM integration, and includes configuration options for runtime, memory, timeout, and environment variables.
• This addresses a significant pain point where developers had to write repetitive boilerplate code across repositories, manually package artifacts, and configure IAM permissions for each Lambda deployment from GitHub.
• The action includes practical features like dry run mode for validation without changes and S3-based deployment support for larger zip packages, making it suitable for both development testing and production deployments.
• Available in all commercial AWS regions where Lambda operates, this integration reduces onboarding time for new developers and decreases deployment errors by providing a declarative configuration approach within GitHub Actions workflows.

29:03 Ryan – “I love this with every bone in my body. This is an easy button for development, where I can’t think of the amount of bad scripting I’ve done…  trying to build pipelines to do what I want. This is definitely something that will make that a lot easier.”  

30:36 Amazon DynamoDB adds support for Console-to-Code

• DynamoDB Console-to-Code uses Amazon Q Developer to automatically generate infrastructure-as-code from console actions, supporting AWS CDK in TypeScript, Python, and Java, plus CloudFormation in YAML or JSON formats.
• This feature addresses the common workflow where developers prototype in the console, then manually recreate configurations as code, reducing time spent on infrastructure automation setup.
• The integration leverages generative AI to translate recorded console actions into production-ready code templates, streamlining the path from experimentation to automated deployment.
• Available now in commercial regions, this positions DynamoDB alongside other AWS services adopting Console-to-Code functionality, part of AWS’s broader push to simplify infrastructure automation.
• For teams managing multiple DynamoDB tables or complex configurations, this reduces manual coding effort and potential errors when transitioning from development to production environments.

31:17 Ryan – “I promise you that CloudFormation takes that YAML and converts it to JSON before execution.” 

36:41 Simplify network connectivity using Tailscale with Amazon EKS Hybrid Nodes | Containers

• AWS EKS Hybrid Nodes now integrates with Tailscale to simplify network connectivity between on-premises infrastructure and AWS-hosted Kubernetes control planes. 
• This eliminates complex VPN configurations by using Tailscale’s peer-to-peer mesh networking with WireGuard encryption for direct, secure connections.
• The solution addresses a key challenge in hybrid Kubernetes deployments by allowing organizations to manage their control plane in AWS while keeping worker nodes on-premises or at edge locations. Tailscale acts as a subnet router within the VPC, advertising routes between the remote pod network (like 10.80.0.0/16) and node addresses (192.168.169.0/24).
• Implementation requires installing Tailscale on hybrid nodes, deploying a subnet router EC2 instance in your VPC, and updating route tables to direct traffic through the Tailscale network interface. 
• The setup supports both Calico and Cilium CNIs with per-node /32 addressing for optimal routing.
• This approach reduces operational complexity compared to traditional site-to-site VPNs or AWS Direct Connect, making hybrid Kubernetes deployments more accessible for organizations with existing on-premises infrastructure. Tailscale is available through AWS Marketplace with standard EC2 instance costs for the subnet router.
• Key considerations include planning non-overlapping CIDR ranges, enabling IP forwarding on the subnet router, and potentially deploying multiple subnet routers across availability zones for high availability. 
• The solution works with EKS-validated operating systems on hybrid nodes.

38:49 Ryan – “If everything is using a mesh peer-to-peer communication network, great. But if you’re doing this on top of VPC, that’s on top of transit gateway, that already has a Direct Connect gateway, and you’re just doing it to bypass your network infrastructure, boo! Don’t do that.” 

41:21 Amazon CloudWatch introduces organization-wide VPC flow logs enablement

• CloudWatch now enables automatic VPC flow logs across entire AWS Organizations through Telemetry Config rules, eliminating manual setup for each VPC and ensuring consistent network monitoring coverage.
• Organizations can scope rules by entire org, specific accounts, or resource tags, allowing DevOps teams to automatically enable flow logs for production VPCs or other critical infrastructure based on tagging strategies.
• The feature leverages AWS Config Service-Linked recorders to discover matching resources and applies to both existing and newly created VPCs, preventing monitoring gaps as infrastructure scales.
• Customers pay AWS Config pricing for configuration items plus CloudWatch vended logs pricing for flow log ingestion, making cost predictable based on VPC count and log volume.
• Available in 16 commercial regions, this addresses a common compliance and security requirement where organizations need complete network traffic visibility without manual intervention.

GCP

44:50 Gemini CLI GitHub Actions: AI coding made for collaboration

• Google launches Gemini CLI GitHub Actions, a free AI coding assistant that automates issue triage, pull request reviews, and on-demand development tasks through simple @gemini-cli mentions in GitHub repositories.
• The tool provides enterprise-grade security through Workload Identity Federation for credential-less authentication, command allowlisting for granular control, and OpenTelemetry integration for complete observability of all AI actions.
• Available in beta with generous free quotas for Google AI Studio users, with support for Vertex AI and Gemini Code Assist Standard/Enterprise tiers, positioning it as a direct competitor to GitHub Copilot’s workflow automation features.
• Three pre-built workflows handle intelligent issue labeling and prioritization, automated code review feedback, and delegated coding tasks like writing tests or implementing bug fixes based on issue descriptions.
• The open-source nature allows teams to customize workflows or create new ones, with Google using the tool internally to manage contributions to the Gemini CLI project itself, demonstrating practical scalability for high-volume repositories.

45:54 Ryan – “I like that this is also directly competing with Jules – it’s very similar – without all the polish. In fact, now I’m worried that I was confusing features between the two of them when we were talking about Jules earlier.” 

46:41 New agents and AI foundations for data teams | Google Cloud Blog

• Google introduces specialized AI agents for data teams, including Data Engineering Agent for pipeline automation, Data Science Agent for autonomous analytical workflows, and enhanced Conversational Analytics Agent with Code Interpreter that can execute Python code for complex business questions beyond SQL capabilities.
• We were silent when they came for the DevOps engineers. 
• We were silent when they came for the SQL engineers. 
• Will we now remain silent as they take out the ML Ops people? 
• Ryan says: Absolutely YES. 
• New Gemini Data Agents APIs and Agent Development Kit enable developers to build custom agents and integrate conversational intelligence into their applications, with Model Context Protocol support for secure agent interactions across systems.
• Spanner gets a columnar engine delivering up to 200x faster analytical query performance on transactional data, while BigQuery adds autonomous vector embeddings and an AI Query Engine that brings LLM capabilities directly to SQL queries.
• The platform unifies operational and analytical data in a single AI-native foundation, addressing the traditional divide between OLTP and OLAP systems while providing persistent memory and reasoning capabilities for agents.
• Offering pre-built agents rather than just infrastructure, though pricing details aren’t provided, and the preview status suggests production readiness is still developing

47:07 Ryan – “I’m going to throw a party. Those people have been screwing up the data in my Data Lakes for how long? This is awesome. Now it will be screwed up, but it will be done by a computer.” 

48:50 AI First Colab Notebooks in BigQuery and Vertex AI | Google Cloud Blog

• Google brings AI-first capabilities to Colab Enterprise notebooks in BigQuery and Vertex AI, featuring a Data Science Agent that automates end-to-end ML workflows from data exploration to model evaluation. 
• The agent generates multi-step plans, executes code, and self-corrects errors while maintaining human oversight for each step.
• The service competes directly with AWS SageMaker Studio’s Code Editor and Azure Machine Learning’s notebook experiences, but differentiates through its conversational interface and automatic error correction. Users can generate visualizations, transform existing code, and interact with other Google Cloud services through natural language prompts.
• Currently available in Preview for the US and Asia regions only, with expansion planned for other Google Cloud regions. 
• Access is through console.cloud.google.com/bigquery for BigQuery users or console.cloud.google.com/vertex-ai/colab/notebooks for Vertex AI users.
• Key use cases include data scientists automating repetitive ML tasks, analysts creating visualizations without deep library knowledge, and teams needing to quickly prototype and iterate on models. The human-in-the-loop design ensures transparency while reducing time spent on boilerplate code.
• Integration with BigQuery Pipelines allows scheduled notebook runs and multi-step DAG creation, making it practical for production workflows. 
• The notebooks are interoperable between BigQuery and Vertex AI, providing flexibility in where teams choose to work.

50:27 Accelerate FedRAMP Authorization with Google Cloud Compliance Manager | Google Cloud Blog

• Google Cloud Compliance Manager enters public preview to automate FedRAMP authorization processes, reducing manual evidence collection and targeting faster federal cloud deployments through integration with the FedRAMP 20x pilot program.
• The service automates compliance validation for FedRAMP 20x Key Security Indicators (KSIs) and provides machine-readable evidence, moving away from traditional narrative-based requirements that typically slow down federal authorization processes.
• Google partnered with StackArmor for proof of concept demonstrations and Coalfire (a FedRAMP 3PAO) for independent validation, positioning Compliance Manager as a native platform solution rather than a third-party add-on.
• This addresses a significant pain point for federal contractors and agencies who often spend months or years achieving FedRAMP authorization, with general availability for FedRAMP 20x support planned for later this year.
• The announcement follows recent FedRAMP High authorizations for Agent Assist, Looker, and Vertex AI Vector Search, demonstrating Google’s broader push into federal cloud services alongside competitors AWS and Azure, who dominate this market.

53:29 Justin – “It’s basically the government saying, it’s too hard to get FedRAMP, we want to level the playing field, and so they’ve changed the rules, but made them more confusing – because they haven’t actually provided clarifications for most of them. And so it’s a promise of better, but no reality of it yet.”

49:10 Introducing Enhanced Backups for Cloud SQL | Google Cloud Blog

• Google Cloud SQL now offers Enhanced Backups through integration with their Backup and DR Service, providing immutable, logically air-gapped backup vaults managed separately from source projects. 
• This addresses a critical gap where database backups could be compromised if the entire project were deleted or attacked.
• The feature supports flexible retention policies from days to decades with hourly, daily, weekly, monthly, and yearly backup schedules. Backups are protected with retention locks and zero-trust access policies, making them truly immutable for compliance requirements.
• Available in Preview for Cloud SQL Enterprise and Enterprise Plus editions, this positions Google competitively against AWS RDS automated backups and Azure SQL Database’s long-term retention. The key differentiator is the complete separation of backups from the source project infrastructure.
• Implementation requires three simple steps: create a backup vault in the Backup and DR service, define a backup plan with retention rules, and apply it to Cloud SQL instances. 
• No additional infrastructure deployment is needed as it integrates with the existing console, gcloud, and API tools.
• Early adopters like SQUARE ENIX and JFrog highlight the value for gaming, DevOps, and regulated industries where data protection against project-level failures is critical. The centralized management dashboard simplifies compliance reporting and monitoring across multiple database instances.

58:18 Introducing Looker MCP Server | Google Cloud Blog

• Google launches Looker MCP Server, enabling AI applications like chatbots and custom agents to directly query Looker’s semantic layer through the Model Context Protocol standard, eliminating the need for AI to write SQL while maintaining data governance and security controls.
• The integration works with existing AI developer tools, including Gemini CLI, Claude Desktop, and Cursor, allowing developers to connect AI agents to pre-defined, trusted data models without complex integration work or risk of data misinterpretation.
• Unlike traditional AI-to-database connections, Looker MCP Server inherits Looker’s security model with fine-grained access controls, audit trails, and the ability to define which AI applications can access specific data at what granularity.
• Extending Looker’s semantic layer capabilities to the AI development ecosystem, particularly valuable for organizations already using Looker for BI who want consistent data definitions across both analytics and AI applications.
• The Quickstart guide is available on GitHub at googleapis.github.io/genai-toolbox/samples/looker/looker_gemini/, with no additional licensing costs mentioned beyond existing Looker subscriptions.

58:10 Justin – “Not having to write Looker reports to get my data 

Is super nice. But also, if Looker is getting more and more capabilities, so that I can – potentially from a different system –  reach out to Looker and tell it to create a report with the pretty dashboards I love as an executive, all is right in the world.” 

59:15 Accelerate AI with Cloud Run: Sign up now for a developer workshop near 

you! | Google Cloud Blog

• Google is launching “Accelerate AI with Cloud Run,” a global series of free, full-day in-person workshops focused on helping developers move AI prototypes to production using Cloud Run’s serverless infrastructure with GPU acceleration.
• The workshops teach developers to build secure AI applications using the Model Context Protocol (MCP) on Cloud Run and Google’s Agent Development Kit (ADK), providing hands-on experience with containerization and deployment patterns for production-scale AI agents.
• AWS’s SageMaker workshops and Azure’s AI bootcamps emphasize serverless deployment and the complete prototype-to-production journey rather than just model training, targeting both application developers and startup founders.
• The timing aligns with Google’s push to make Cloud Run a primary platform for AI workloads, leveraging its automatic scaling, built-in security, and pay-per-use pricing model that can significantly reduce costs compared to dedicated GPU instances.
• The focus on practical implementation of AI agents with secure tool access through MCP addresses the common challenge developers face when trying to scale AI prototypes beyond proof-of-concept demos.

1:01:14 Matt – “Who needs security on MCPs? It’s so new, no one is going to know how to break into it.” 

Azure

1:02:17 OpenAI’s open‑source model: gpt‑oss on Azure AI Foundry and Windows AI Foundry  | Microsoft Azure Blog

• OpenAI released its first open-weight models since GPT-2 with gpt-oss-120b and gpt-oss-20b, now available on Azure AI Foundry and Windows AI Foundry, giving developers full control to fine-tune, distill, and deploy these models on their own infrastructure.
• The 120B parameter model delivers o4-mini level performance on a single datacenter GPU, while the 20B model runs locally on Windows devices with 16GB+ VRAM, enabling both cloud-scale reasoning and edge deployment scenarios without API dependencies.
• Azure AI Foundry provides the full toolchain for customization, including LoRA fine-tuning, quantization, and ONNX export, while Foundry Local brings these models to Windows 11 for offline and secure deployments across CPUs, GPUs, and NPUs.
• Pricing starts at $0.15 per million input tokens for gpt-oss-20b and $0.60 for gpt-oss-120b, positioning these as cost-effective alternatives to proprietary models while maintaining API compatibility for easy migration.
• This marks a significant shift in Microsoft’s AI strategy by offering open-weight frontier models alongside proprietary options, directly competing with Meta’s Llama and Google’s open model initiatives while leveraging Azure’s infrastructure advantage.
• Cool. Moving on. 

1:02:27 Introducing Azure Storage Discovery: Transform data management with storage insights | Microsoft Azure Blog

• Azure Storage Discovery provides a centralized dashboard to analyze and manage Azure Blob Storage across entire organizations, aggregating insights from up to 1 million storage accounts without requiring custom scripts or infrastructure deployment.
• The service integrates with Azure Copilot for natural language queries and offers both free and standard pricing tiers, with the standard tier providing 18 months of historical data retention for analyzing trends in capacity, activity, errors, and security configurations.
• Early adopters like Tesco and Willis Towers Watson report significant time savings in identifying cost optimization opportunities, such as finding rapidly growing storage accounts and data that hasn’t been accessed recently for lifecycle management.
• Unlike AWS Storage Lens or GCP Cloud Storage Insights, which focus primarily on metrics, Azure Storage Discovery emphasizes actionable insights with direct navigation to specific resources and pre-built reports for security compliance and cost optimization.
• The service will be free until September 30, 2025, after which pricing will be based on the number of storage accounts and objects analyzed, making it accessible for organizations to evaluate its value before committing to costs.

1:03:24 Ryan – “I think this is a feature they had to develop in self-defense, because the way they organize the blob storage with those storage accounts. Because coming from another cloud, it’s completely undecipherable.” 

1:07:24 General Availability of Azure Monitor Network Security Perimeter Features | Microsoft Community Hub

• Azure Monitor Network Security Perimeter creates a virtual firewall at the service level that blocks public access to Log Analytics workspaces and Application Insights by default, allowing only explicitly defined traffic through IP ranges or subscription IDs – addressing enterprise demands for zero-trust network isolation of monitoring data.
• The feature provides granular control with inbound rules for specific IP ranges and outbound rules for approved FQDNs, plus comprehensive logging of all connection attempts for compliance auditing – particularly valuable for regulated industries like finance, healthcare, and government.
• Network Security Perimeter integrates natively with Azure Monitor services, including alerts and action groups, ensuring security rules are enforced across ingestion, queries, and notifications without breaking functionality – managed through a single pane of glass for multiple resources across subscriptions.
• This complements existing Private Link deployments by securing Azure Monitor’s service endpoints themselves, creating defense-in-depth where Private Link secures VNet-to-service traffic and Network Security Perimeter locks down the service side – similar to AWS PrivateLink combined with VPC endpoint policies.
• The feature is now generally available at no additional cost beyond standard Azure Monitor pricing, making it accessible for organizations needing to prove that monitoring data never touches public internet or unauthorized destinations.

1:08:07 Ryan – “If you think about your API endpoints, there is security rules for that. So they’re touting logs and the log out analytics here because those aren’t natively available directly within your VPC network and your subscription. So they’re just accessible via a platform service. And so now, you can basically put rules around accessing that platform service, which won’t confuse anyone at all.”

1:10:50 General Availability of Auxiliary Logs and Reduced Pricing | Microsoft Community Hub

• Azure Monitor’s Auxiliary Logs are now GA with significant price reductions, targeting customers ingesting petabyte-scale logs daily who need cost-effective storage for high-volume, low-fidelity data alongside existing Analytics and Basic log tiers.
• Key technical improvements include expanded KQL operator support, Delta Parquet-based storage for better query performance, unlimited time range queries (previously 30 days), and new ingestion-time transformations using Data Collection Rules with KQL expressions.
• Integration with Microsoft Sentinel data lake enables cross-access between security and observability workloads without data duplication, positioning Azure to compete with AWS CloudWatch Logs Insights and GCP Cloud Logging’s multi-tier storage options.
• Summary rules allow efficient data summarization across all log tiers while keeping raw data accessible, and enhanced search jobs support up to 100 million records with cost prediction capabilities.
• Target use cases include organizations needing to balance cost and performance for massive log volumes, with the ability to filter noise at ingestion, split data across tiers, and apply transformations to both custom and platform logs.
• This leads us to a couple of questions. What is an auxiliary log? Why do we care? Also – why do we have petabytes of them? 

1:12:02 Ryan – “You’re legally required to have it, that’s why! It’s your firewall logs, your SQL server transaction logs – that you are obligated ot maintain – and that’s exactly what this is for. It’s a routing layer in your existing logging infrastructure, and it just routes these to a low-cost, different sort of query method.”   

1:13:16 Announcing General Availability of App Service Inbound IPv6 Support | Microsoft Community Hub

• Azure App Service now supports inbound IPv6 traffic across all public regions, government clouds, and China regions for multi-tenant apps on Basic, Standard, and Premium SKUs, plus Functions Consumption, Functions Elastic Premium, and Logic Apps Standard. 
• This brings Azure closer to feature parity with AWS and GCP, both of which have offered IPv6 support for their compute services for several years.
• The implementation uses a new IPMode property that controls DNS responses – apps can return IPv4-only (default for backward compatibility), IPv6-only, or dual-stack IPv4/IPv6 addresses. 
• All App Service sites can now receive traffic on both IPv4 and IPv6 endpoints regardless of IPMode setting, which only affects DNS resolution behavior.
• This addresses growing IPv6 adoption requirements, particularly for government contracts and international deployments where IPv6 is mandatory. The feature works with custom domains through standard AAAA DNS records, though IP-SSL IPv6 bindings remain unsupported.
• Microsoft is playing catch-up here – AWS has had dual-stack load balancers since 2016, and GCP has offered IPv6 on compute instances since 2017. The phased rollout continues with Linux outbound IPv6 in preview and VNet IPv6 support still on the backlog.
• No additional costs are mentioned for IPv6 support, making this a free upgrade for existing App Service customers. Testing requires IPv6-capable networks since many corporate and home networks still only support IPv4, which could complicate adoption.
• Welcome to 2025 Azure. 

Oracle

1:15:00 Oracle Announces Oracle AI World 2025 08 06

• Oracle is hosting Oracle AI World 2025 on January 15 in Las Vegas, positioning it as their “premier” AI conference with keynotes from Larry Ellison and other executives focusing on enterprise AI applications.
• The event will showcase Oracle’s AI strategy across its cloud infrastructure, applications, and database services, with particular emphasis on its OCI Generative AI service and AI-powered features in Oracle Fusion Cloud Applications.
• Oracle is targeting enterprise customers who want pre-built AI capabilities integrated into their existing Oracle stack, competing with AWS re:Invent and Microsoft Ignite, but with a narrower focus on Oracle-specific implementations.
• The conference format includes hands-on labs and certification opportunities, suggesting Oracle is trying to build practitioner expertise around its AI tools rather than just executive buy-in.
• Registration is free, but the January timing puts it awkwardly between major cloud conferences, potentially limiting attendance from decision-makers who may have exhausted conference budgets after re:Invent and Ignite.
• We’re not super interested in this one. 
• For this one, we’d love to invite listeners to make predictions on what is going to be announced! 

Cloud Journey

1:17:18 Beyond IAM access keys: Modern authentication approaches for AWS | AWS Security Blog

• AWS is pushing developers away from long-term IAM access keys toward temporary credential solutions like CloudShell, IAM Identity Center, and IAM roles to reduce security risks from credential exposure and unauthorized sharing.
• CloudShell provides a browser-based CLI that eliminates local credential management, while IAM Identity Center integration with AWS CLI v2 adds centralized user management and seamless MFA support.
• For CI/CD pipelines and third-party services, AWS recommends using IAM Roles Anywhere for on-premises workloads and OIDC integration for services like GitHub Actions instead of static access keys.
• Modern IDEs like VS Code now support secure authentication through IAM Identity Center via AWS Toolkit, removing the need for developers to store access keys locally.
• AWS emphasizes implementing least privilege policies and offers automated policy generation based on CloudTrail logs to help create permission templates from actual usage patterns.

Closing

And that is the week in the cloud! Visit our website, the home of the Cloud Pod, where you can join our newsletter, Slack team, send feedback, or ask questions at theCloudPod.net or tweet at us with the hashtag #theCloudPod