Welcome to episode 372 of The Cloud Pod, where the forecast is always cloudy! Justin, Ryan, and Matt have their head in the clouds all week and are ready to bring you all the latest in cloud and AI news, including Microsoft’s continued attempts to keep up with AI-detected issues, updates to Terraform and GKE, plus so much more. Let’s get started!
Titles we almost went with this week
- Bots Join the Slack Chat, Incidents Get Roasted
- Patch Tuesday Becomes Patch Everyday, 972 Times Over
- Big Logs, Big Gateway, Bigger Cloud Bills
- AWS Squeezes a Data Center Into a Closet
- Three Regions Walk Into a Root Login
- Terraform Gets Metrics, Platform Teams Finally Exhale
- Microsoft’s Vulnerability Count Breaks Records, IT Teams Break Down
- Natural Language Meets Unnatural Amounts of Logs
- Google’s Agent Substrate: Kubernetes Gets a Kernel Panic Buster
- OpenAI Lets Your Agents Call in Backup
- Sandboxes, Subagents, and API Fees, Oh My
- Sub-500ms Resumes Make GKE Agents Speedy Gonzales
- Betting the Database on One Big OpenAI Backlog
- GitHub Ships Headroom, Not Just Hotfixes
- Kurian’s Billion-Dollar Boast Fest at Goldman Summit
A big thanks to this week’s sponsors:
We’re sponsorless! Want to get your brand, company, or service in front of a very enthusiastic group of cloud news seekers? You’ve come to the right place! Send us an email or hit us up on our Slack channel for more info.
Security
03:18 Why this month’s Microsoft patch release is a doozy
- Microsoft patched 972 vulnerabilities in September, 112 rated critical, surpassing prior records of 570 (July) and 620 (August) in consecutive months.
- Year to date, Microsoft has fixed 2,760 vulnerabilities in 2026, more than double last year’s total, and on pace to exceed the combined totals of 2023 through 2025.
- Over 100 companies, including OpenAI, Anthropic, AWS, Google, and Microsoft, signed an open letter warning that AI-enabled attacks are shrinking the window defenders have to patch before exploitation occurs.
- Zero Day Initiative researcher Dustin Childs notes AI-assisted vulnerability discovery is accelerating patch volume, though active exploit rates have not yet spiked correspondingly.
- For IT teams, this trend means patch management cadence and prioritization processes need reevaluation, as monthly patch volumes at this scale strain traditional testing and deployment cycles.
AI Is Going Great – or How ML Makes Money
08:15 Introducing the Agents API
- OpenAI released the Agents API in public beta, exposing the same harness and infrastructure that powers Codex and ChatGPT for Work, letting developers create production-ready agents with a single API call specifying task, model, tools, and environment.
- Developers get flexible compute options: an OpenAI-managed sandbox, self-hosted infrastructure, or partner-provided sandboxes from Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, and Vercel, allowing selection based on cost, performance, and cold-start requirements.
- New harness capabilities include automatic context compaction for long-running sessions, tool search to reduce token usage by loading only relevant tool definitions, and programmatic tool calling that lets agents run parallel calls and filter results in code before returning them to context.
- Multi-agent support lets a main agent delegate subtasks to parallel subagents, each maintaining independent context, which is useful for research, analysis, and coding workflows without requiring custom orchestration.
- Pricing follows standard token and tool usage costs with no additional API fees, and the underlying Codex harness is open source, giving developers visibility into the orchestration logic via the public GitHub codebase.
09:22 Ryan – “This is what I thought sort of the Vertex AI agent SDK was going to be, but that was more of just a common way to define these instructions and models. And then you still had to have that execution platform running somewhere; and so they did build that into Vertex, and I’m happy to see it being built out other places as well… I’m happy to see harness definitions be more than just sort of agent instructions and agent tools and skill definitions, but also including that execution layer because it is important.”
11:39 Introducing ChatGPT Images 2.5
- OpenAI released ChatGPT Images 2.5, its updated image generation model, cutting generation latency by up to 50% compared to Images 2.0 while improving detail preservation, natural lighting, and multi-turn editing consistency.
- Two new API models are available: GPT-Image-2.5 Flare, the default option offering 50% lower latency than GPT-Image-2 for high-volume use cases like social content and product experiences, and GPT-Image-2.5 Sunburst, aimed at premium workflows requiring tighter editing control such as campaign creative.
- New product features include Sketch, which lets users draw a reference directly in ChatGPT (accessible via “@Sketch”), templates for common formats like flyers and merch, in-image commenting for targeted edits, and the ability to share prompts alongside generated images.
- The model shows improved reference-photo fidelity, better subject preservation across new settings and styles, and more reliable “edit only what’s asked” behavior, which is relevant for developers building brand-consistent or iterative creative workflows via the API.
- Safety measures carry over from prior versions, including prompt/image checks, C2PA metadata, and invisible watermarking; rollout is immediate across ChatGPT, ChatGPT Work, and Codex on all tiers and platforms.
13:34 Nvidia launches free tool that links idle computers into a personal AI data center
- Nvidia’s PAIR is free, open-source software that networks idle home computers (Nvidia GPUs and Apple M4+ chips) to run local AI inference tasks together, rather than a physical device despite its name.
- The tool targets underutilized compute in households with multiple devices, using idle cycles for agentic workflows without disrupting active tasks like gaming.
- Security relies on a six-digit pairing code plus mTLS encryption, addressing a key concern for distributed home computing setups.
- This reflects a broader industry push toward local and edge AI processing, reducing reliance on cloud inference and giving users more control over data and costs.
- Nvidia is also simplifying local GPU setup for third-party agent apps (Perplexity Portable Computer, Hermes Agent, OpenClaw), signaling continued investment in lowering barriers to local AI adoption on Windows.
14:26 Matt – “I feel like this was back in the day of folding at home. You know, where you would run that; it did cancer research and everything else. And then we kinda got away from that, and now I feel like we’re just going back to using our home computers to distribute workloads across the needed capacity with these things.”
Cloud Tools
19:34 GitHub availability report: August 2026
- GitHub’s August 2026 availability report details five incidents affecting service reliability, occurring alongside an ongoing infrastructure migration to Azure. The company continues to prioritize availability and capacity work over new features in response to recurring capacity-related failures.
- Several incidents shared a common root cause pattern: services running too close to capacity or concurrency limits, where routine deployments or traffic peaks triggered cascading failures across service mesh, load balancers, and databases. GitHub is adding headroom, autoscaling corrections, and circuit breakers to address this recurring theme.
- The August 17 outage, previously covered in a dedicated post, stemmed from a service-mesh sidecar failing to scale and a client retry bug that amplified authentication traffic, illustrating how retry logic can turn a partial degradation into a broader outage.
- GitHub is auditing retry and backoff behavior across gateways and clients as a result.
- Despite the incidents, GitHub reported migration progress, including successful production MySQL primary failovers to Azure with minimal customer impact, and read traffic from Azure-migrated services peaking at over 60 percent. Database query load was also reduced significantly, with one change removing roughly one million queries per second from legacy replicas.
- Two incidents involved third-party dependencies: a cloud database provider’s regional outage affecting Copilot cloud agent status tracking, and an upstream model provider degradation impacting the Kimi K3 model in Copilot.
- Both highlight the reliability tradeoffs of relying on external providers for managed infrastructure and AI model serving.
22:31 Introducing HCP Terraform Metrics Operational Visibility At Scale
- HCP Terraform now offers a metrics feature giving organizations visibility into run activity, workspace utilization, and operational health across their Terraform estate, aimed at platform teams managing infrastructure at scale.
- The dashboard surfaces data like run frequency, success and failure rates, and workspace activity trends, helping teams identify bottlenecks or problematic workspaces without manually auditing individual runs.
- This addresses a common pain point for organizations running Terraform across many teams and workspaces, where understanding overall system health and usage patterns previously required custom tooling or manual log review.
- The feature is positioned for platform engineering teams who need to justify Terraform usage, spot anomalies, or plan capacity based on actual usage patterns rather than estimates.
- This fits into HashiCorp’s broader push to add enterprise-grade operational tooling to HCP Terraform, potentially reducing reliance on third-party observability integrations for basic usage metrics.
22:56 Justin – “I’m kind of surprised it didn’t exist, because if you’re trying to show the ROI of why you have HCP Terraform, you should probably have metrics that you can use to justify why you spent, you know, a bajillion dollars on HCP Terraform.”
AWS
24:30 Introducing Pizza Bot, an open-source inbox for AI agents that work in the background
- AWS Open Source released Pizza Bot, an open-source, self-hosted inbox application for background AI agents that started internally at Amazon with over 2,000 users for tasks like meeting prep, email drafting, and CRM logging.
- The application addresses a specific gap: instead of requiring users to watch a chat window while an agent works, Pizza Bot uses an email-style interface with All, Unread, and Action queues so agents surface results or approval requests only when needed.
- Architecture is a local server plus client model (Electron desktop app, browser, or terminal), with all data stored as SQLite databases and files in a single user-controlled folder, supporting model providers including Anthropic, Amazon Bedrock, Google Gemini, OpenAI, OpenRouter, or local models via Ollama.
- Extensibility relies on existing standards rather than proprietary formats: Model Context Protocol (MCP) servers for tools and Anthropic’s Agent Skills markdown convention for packaging specialist capabilities, meaning teams can reuse tooling they’ve already built.
- Notable caveat for listeners: this is a community project under Apache License 2.0, not an official AWS service, so there’s no AWS support or SLA, and users are responsible for hosting, backups, and updates themselves.
- Available now at github.com/pizza-bot-app/pizza-bot for macOS, Windows, and Linux.
27:06 Announcing second-generation single-rack AWS Outposts
- AWS launched second-generation single-rack Outposts, a self-contained 42U rack combining compute, storage, and networking, delivering up to 2,688 vCPUs and 100 TB of EBS storage for on-premises deployments.
- The single-rack form factor targets space- and power-constrained locations like manufacturing floors and gaming venues, offering a smaller footprint alternative to multi-rack Outposts for organizations needing low latency and local data processing.
- Supports the latest x86 EC2 instance families including general purpose (M7i, M8i), compute-optimized (C7i, C8i), memory-optimized (R7i, R8i), and accelerated networking instances (Bmn-sf2e, Bmn-cx2, Bmn-cx3a), matching capabilities available on multi-rack configurations.
- Maintains consistency with AWS Regions through identical APIs, management console, automation, and governance policies, allowing customers to extend existing cloud operations and security controls to on-premises environments without retooling.
- Availability varies by country and territory; customers should check the Outposts rack FAQs page for current regional support before deployment, and can get started through the AWS Outposts console.
28:15 Ryan – “This is single rack, specifically. The second generation of single rack, which is separate from Outposts in general.”
30:34 Amazon API Gateway now supports 1 MB execution logs with configurable delivery destinations
- API Gateway execution logs jump from 1 KB to 1 MB per event, finally giving developers actual visibility into full request and response payloads instead of truncated snippets.
- Logs can now route to CloudWatch Logs, S3, or Data Firehose simultaneously, allowing teams to send JSON to CloudWatch for real-time alerting while archiving Parquet-formatted logs in S3 for cost-efficient long-term storage and Athena analysis.
- This addresses a long-standing pain point for API debugging, where truncated logs often cut off exactly the data needed to diagnose issues.
- Available across all AWS regions, including GovCloud (US), with setup via console, CLI, or CloudFormation, so no waiting on regional rollout.
- Billed at CloudWatch vended logs rates, meaning costs scale with log volume, worth factoring in for high-traffic APIs before enabling full 1 MB logging broadly.
31:22 Justin – “I think you should turn this on when you need to troubleshoot something; not just leave it on all the time.”
32:08 Introducing Amazon EBS Volume Clones across AWS accounts
- AWS extends EBS Volume Clones to support cross-account copying, allowing customers to create point-in-time copies of EBS volumes in a different AWS account, with optional re-encryption using a KMS key in the target account.
- The workflow uses AWS Resource Access Manager (RAM) for sharing: the source account shares the volume via RAM, the target account accepts the resource share, then initiates the copy from their own EBS console.
- A key use case is refreshing test and development environments with production data while maintaining isolation and applying different encryption keys, useful for separating prod and non-prod AWS accounts.
- Technical constraints include: volumes encrypted with AWS-managed keys cannot be shared (only unencrypted or CMK-encrypted volumes), the copy must stay within the same Availability Zone as the source (using AZ IDs to match across accounts), and CMKs must also be shared if the source volume uses one.
- Pricing is a one-time fee based on volume size charged to the target account, plus standard EBS storage charges once the copy is created; sharing via RAM itself is free.
- Monitoring is available through CloudTrail (SharedVolumeCopyInitiated) and EventBridge events for tracking copy initiation and completion.
32:57 Justin – “Now, this may sound cool to you, but I will tell you that this is a sharp edge VERY quickly.”
36:28 AWS DevOps Agent adds support for bidirectional Slack communication
- AWS DevOps Agent now supports two-way Slack communication, letting engineers run full incident investigations without leaving the chat thread they’re already using for team coordination.
- The update targets a common on-call pain point: context-switching between Slack and separate investigation tools during high-severity incidents, consolidating conversation, agent findings, and remediation steps into one thread.
- Engineers trigger investigations by @mentioning the agent in a connected private Slack channel, then can query AWS resources, metrics, alarm status, deployment history, and incident patterns conversationally.
- The feature works across AWS, multicloud, and on-premises environments, positioning DevOps Agent as a unified operations layer rather than an AWS-only tool.
- Available now in all commercial regions where AWS DevOps Agent is supported; setup details are in the user guide, with no pricing specifics mentioned in the announcement itself.
37:52 Amazon OpenSearch Serverless is now available on v0 by Vercel
- AWS integrates OpenSearch Serverless directly into v0, Vercel’s AI-powered app builder, letting developers spin up full-text and vector search infrastructure using natural language prompts instead of manual configuration.
- The integration targets RAG workloads specifically, provisioning OpenSearch collections, handling indexing, and configuring endpoints automatically so developers can focus on application logic rather than search infrastructure.
- This reflects a broader trend of AWS services embedding into third-party developer tools and AI coding platforms, meeting developers where they already build rather than requiring a trip to the AWS console.
- Available across 17 regions at launch, including standard US, Europe, and Asia Pacific locations, plus Canada and South America, giving reasonably broad geographic coverage from day one.
- Developers can provision resources under a new AWS account or link an existing one, which lowers the barrier to entry but also means teams should watch for OpenSearch Serverless’s consumption-based pricing model, since costs scale with indexing and search compute (OCUs) rather than a flat fee.
38:39 Ryan – “I guess their idea is that you can use OpenSearch Serverless natively inside your app as like the data layer for your application.”
39:04 AWS Transform for .NET modernization is now generally available via CLI
- AWS Transform for .NET modernization now supports a CLI interface, adding to existing web app, Visual Studio IDE, Kiro Power, and MCP agent options; the CLI can be triggered with a single command and scripted into CI/CD pipelines for autonomous execution.
- This falls under AWS Transform custom, which handles language version upgrades, framework migrations, performance optimization, and code base analysis at scale, with transformations that improve through continuous learning across engagements.
- Availability is limited to eight regions: US East (N. Virginia), Mumbai, Tokyo, Seoul, Sydney, Canada Central, Frankfurt, and London, which may affect teams needing local processing for compliance reasons.
- Pricing includes 50,000 free agent minutes per month for the .NET transformation, with additional usage billed per AWS Transform pricing details.
- The CLI option targets DevOps teams wanting to embed .NET modernization directly into automated workflows rather than relying on interactive tools, useful for organizations managing large-scale legacy .NET application portfolios.
39:36 Ryan – “None of what they just said made sense.”
43:06 AWS improves regional resiliency for root user sign-in
- Root user sign-in traffic is now distributed across three regions: US East N. Virginia, US East Ohio, and US West Oregon, reducing dependency on a single region for this critical authentication path.
- Routing is automatic and transparent to users; no configuration changes or region selection needed on the customer side.
- This directly addresses a known failure mode where US East N. Virginia outages could block root user access entirely, a scenario that has caused issues during past AWS service disruptions.
- Security and compliance teams need to update CloudTrail monitoring and alerting rules, since ConsoleLogin events for root sign-ins will now appear in whichever of the three regions processed the request, not just the historical default region.
- No additional cost for this change; it is a built-in resiliency improvement available immediately to all AWS accounts.
44:01 Justin – “First, you had to know that this thing got enabled, and if you didn’t enable the CloudTrail logging, it could be logging you in right now, and you would not know. That’s maybe the bad part of how they’re rolling this out.”
46:05 Analyze your CloudTrail events using natural language in Amazon Q Console
- Amazon Q Console now integrates with CloudTrail, letting users query account activity, audit configurations, and troubleshoot issues using natural language instead of writing manual queries or parsing log files.
- Practical use cases include checking trail configuration gaps, investigating IAM role access, tracing VPC changes, identifying unauthorized access attempts, and finding the source of unexpected billing spikes.
- Q pulls from CloudTrail trails, CloudWatch log groups, and event data stores directly, so answers are grounded in actual account activity rather than generic documentation or guesswork.
- This lowers the technical bar for security and operational investigations, useful for teams without deep CloudTrail or log query expertise, though it raises the usual questions about accuracy and how Q handles ambiguous or incomplete log data.
- Available now in all commercial regions where Amazon Q Console is supported, accessible directly from the AWS Management Console with no separate setup required.
GCP
48:21 3 Highlights from the Goldman Sachs Communicopia & Technology Conference
- Full stack positioning: Google Cloud emphasizes it’s the only provider spanning the entire AI stack, citing 17 product lines exceeding $1 billion in revenue and over 300 customers with $100 million-plus contractual commitments
- Deal size growth: Kurian noted more than 2x quarter-over-quarter and year-over-year growth in the number and value of $100 million to $1 billion deals, suggesting large enterprise AI commitments are accelerating
- TPU economics: Google claims a 2-year AI server payback period, with TPUs offering faster payback than GPUs, and notes most AI infrastructure contract value comes from committed five-year deals
- Gemini Enterprise adoption: Google states customers using its AI products use 1.8 times as many products overall compared to non-AI customers, framing AI as a driver of broader platform stickiness and cross-sell.
- Want to check it out for yourself? You can find the source materials here: Full slide deck and transcript from the September 8 Goldman Sachs Communicopia Conference (yes, it’s a terrible name, we agree) are linked in the post for listeners wanting primary source detail beyond the summarized highlights.
49:44 Ryan – “I don’t trust any of these numbers, because the like with Gemini Enterprise, Gemini Enterprise that was Vertex AI. Gemini Enterprise that was like the Gemini model that was once Bard. Like they just rename these things and then move the things around.”
51:34 Introducing the Google Cloud Developer Plugin for AI Coding Agents
- Google Cloud launched a plugin system for AI coding agents that bundles related skills, documentation access, and MCP server configurations into a single installable package, addressing the complexity of managing individual agent skills separately.
- The flagship google-cloud-developer plugin handles core GCP workflows like authentication, authorization, project management, and gcloud CLI guardrails, and includes the Developer Knowledge MCP server for grounding agents in current official documentation.
- The plugin is built on the open Agent Plugins specification, a vendor-neutral standard, meaning developers can use the same plugin across different AI coding environments like Claude Code, Codex CLI, and Antigravity CLI without maintaining separate configurations for each.
- Installation is handled through the Google Agent Skills repository, with straightforward setup commands provided for major coding agents, plus a codelab available for guided walkthroughs in Antigravity.
- This targets developers integrating AI coding agents into GCP workflows, particularly around project bootstrapping and IAM tasks, where the plugin can apply best practices automatically, such as flagging risks like accidental key leaks before executing changes.
52:23 Ryan – “I love this. As I just completed my first sort of internal plugin for my company using the same framework, and it is just so much easier than trying to figure out all the different ways to configure your the GitHub repo to point at your Claude Code, your cloud agent or cloud app, or your BS code, or now it’s just an installable package that puts all the skills and the tools and and prompts in place, which is fantastic. And so having that be tailor-built for Google Cloud is great.”
53:58 We’re exploring a potential data center in Lea County, New Mexico
- Google is in early discussions to build a data center in Lea County, New Mexico, with the announcement framed as a community outreach effort ahead of formal project details.
- The company is emphasizing three commitments: responsible water resource management, paying for 100% of the energy used, and covering infrastructure costs associated with the project.
- No technical specifications, capacity figures, timeline, or investment amount have been disclosed yet, making this more of an early-stage community engagement announcement than a concrete infrastructure reveal.
- This fits Google’s broader pattern of proactively addressing data center concerns around water and energy usage, likely in response to increased public scrutiny of AI-driven data center expansion nationwide.
- Worth discussing how this compares to other hyperscaler data center siting strategies, particularly the trend of choosing less densely populated regions and leading with sustainability messaging before breaking ground.
56:13 Filestore agent volumes
- Filestore agent volumes provide fully managed, dynamically provisioned file storage designed specifically for AI agent sandboxes, addressing storage lifecycle problems that emerge when scaling to thousands or millions of concurrent agent sessions.
- The service integrates directly with GKE Agent Sandbox and Agent Substrate on GKE, automatically attaching isolated workspaces in milliseconds when a sandbox launches, removing the need for platform teams to manually provision or tear down storage volumes.
- Key technical features include per-workspace access isolation for security boundaries, sub-second attach and detach times to support suspending and resuming idle sandboxes, and native Read-Write-Many support with POSIX file locking for multi-agent collaboration on shared file trees.
- Pricing follows a pay-per-use model based on actual storage consumed rather than pre-allocated capacity, with automatic lifecycle tiering to shift idle data to lower-cost storage tiers; specific rate details aren’t published in the announcement.
- Target use cases include agentic coding platforms running isolated build and test environments, multi-agent swarms sharing unified file trees, and long-running interactive workflows requiring user approval steps between execution phases.
- Availability is open to all Google Cloud customers now for non-production workloads, while production GA access requires signing up via an allowlist form; more details are available in the Filestore and GKE documentation.
58:09 Justin – “This is one of the biggest areas that I think we’re gonna see a lot of development, a lot of consolidation, because there’s a lot of solutions for secure agent runtime. And then everyone’s gonna have a solution, everyone’s gonna have their things, and then they’re gonna start collapsing and compressing a little bit because they need to. There’s too many options at the moment.”
58:37 Agent Substrate available on GKE
- Agent Substrate is now available on GKE, an open-source runtime designed specifically to run AI agent sandboxes at scale, claiming 10x higher density than standard containers and sub-500ms resume times at over 500 activations per second.
- The architecture addresses four specific problems with running autonomous agents in production: kernel and network isolation for untrusted code execution, low-latency activation via a dedicated control and data plane, active-only compute economics that free RAM and CPU when agents idle, and using Kubernetes for node management while a custom data plane handles suspend and resume operations.
- Security is handled through hardware-isolated Cloud Hypervisor microVMs or gVisor sandboxing, plus an integrated gateway that manages egress and ingress and injects credentials outside agent reach, aimed at preventing credential theft and host escape.
- On GKE specifically, Agent Substrate integrates with custom ComputeClasses for dynamic machine pool management across spot and on-demand capacity, native support for Google Axion Arm processors (claimed up to 30 percent better price-performance for sandbox workloads), and optional Filestore agent volumes for millisecond NFS mount attach and detach with RWX access for multi-agent collaboration.
- Nous Research, maker of the Hermes Agent (currently ranked number one on OpenRouter usage), is an early design partner.
- Agent Substrate is open source and available to all GKE customers for non-production workloads now, with GA production support available via allowlist.
1:00:44 Introducing new session management tools with native, granular controls
- Google Cloud has completed its global rollout of a 16-hour default session length for all customers who hadn’t self-configured this setting, aimed at reducing credential theft and account takeover risk.
- Session Controls are now generally available as part of Context-Aware Access with automation support via Terraform, gcloud CLI, and REST APIs, allowing policy management as code rather than manual UI configuration.
- Policies can now target Google Groups instead of organizational units, enabling different session lengths for different user types, for example, a two-hour session for billing admins versus a 16-hour session for general developers, regardless of org hierarchy placement.
- Administrators can apply session controls to specific applications such as the Cloud Console, gcloud CLI, or individual OAuth apps, avoiding blanket policies that could disrupt BI tools or dashboard integrations.
- A preview feature now lets admins manage session policies directly in the Google Cloud Console alongside other Access Context Manager settings, rather than requiring the separate Workspace admin console; sign-up is available via a linked form for early access.
1:01:22 Matt – “That’s a really nice feature. The buy type of user setup is really great.”
Azure
1:03:54 Azure Front Door Edge Actions
- Azure Front Door now supports Edge Actions, letting customers run JavaScript at the edge to inspect and manipulate requests before they hit the origin, including header manipulation, origin override logic, and lightweight JWT claims checking.
- Edge Actions are managed as standalone Azure resources (not tied directly into the AFD profile), configured via the Azure portal, REST API, or a new PowerShell module, Az. EdgeAction.EdgeAction. Notably, there is no Azure CLI support yet.
- The runtime is intentionally minimal: no outbound network access, no crypto libraries, and a 10-millisecond execution limit with fail-open behavior, meaning errors or timeouts result in the request passing through unprocessed. This makes it suitable for claims prefiltering (checking exp, nbf, aud, iss, roles) but not full JWT signature validation.
- Because Edge Actions cannot cryptographically verify tokens, actual authentication must still happen at the origin or another trusted gateway. This is a prescreening layer for rejecting obviously invalid requests early, not a replacement for backend security controls.
- Logging is handled through Diagnostic Settings on the Edge Action resource itself rather than the AFD profile, with service logs for execution status and console logs for detailed request outcomes, both correlated via a TrackingReference for troubleshooting across Front Door access logs.
- Documentation is available here.
Matt – “Wow welcome to like 2020 with lambda at the edge…”
1:07:07 Generally Available: User-bound user delegation SAS for Azure Storage
- User-bound user delegation SAS is now generally available across all Azure public regions, adding a new layer of security to Azure Storage authentication by tying SAS tokens to a specific Entra ID identity rather than just the delegator.
- This builds on the existing user delegation SAS feature, which already required Entra verification to generate tokens; the new capability restricts token usage further so only the intended end user can actually use it, even if the token is intercepted or shared.
- Tokens remain valid for up to 7 days, consistent with existing user delegation SAS limits, but the added identity binding reduces risk from leaked or misused SAS tokens compared to account SAS or service SAS.
- Applies across Azure Blobs, Files, Tables, and Queues, giving customers a consistent security model across storage types for tightening access control.
- There is no additional cost for this feature; customers pay standard transaction costs based on their storage account type, so it is a low-friction security upgrade for teams already using user delegation SAS.
1:08:13 Matt – “So, with a pre-signed URL, anybody who gets that URL can use it, but this is also verifying it with the identifier to say, Ryan, here’s a pre-signed URL. You can use it for two hours, and it will verify your user along with that URL for the same usage.”
Oracle
1:10:25 Oracle’s stock moves higher on surging cloud infrastructure revenue growth
- Oracle’s cloud infrastructure revenue jumped 121% year over year to $7.4 billion, driving a 30% overall revenue increase to $19.35 billion and beating Wall Street estimates on both revenue and EPS ($1.92 vs $1.74 expected).
- Nearly half of Oracle’s $664 billion backlog comes from a single OpenAI contract, tying Oracle’s stock performance closely to sentiment around OpenAI, which has cooled as Anthropic gains ground and open-weight models pressure pricing across the industry.
- Financial red flags are notable: negative free cash flow of $5.4 billion (down from -$362 million a year ago), capex tripling to $28.5 billion, and total debt reaching $125 billion, raising questions about how sustainable this growth pace is without stronger cash generation.
- One counterbalancing signal is that customer prepayments now cover 40% of Oracle’s capex, up from zero a year ago, suggesting customers have enough confidence in the buildout to help finance it directly rather than waiting for capacity to come online.
- Regional imbalance is emerging as a concern, with the Americas driving most growth while APAC and EMEA combined now generate just 40% of Americas revenue, down from roughly 50% a year ago, and it is unclear whether this reflects slower OCI rollout, execution issues, or regional demand differences.
- Oracle’s core software business actually declined 3% year over year to $5.55 billion, missing estimates, and was only partially offset by a new $7 billion Pentagon contract, underscoring how dependent Oracle’s growth story has become on the AI infrastructure narrative rather than its traditional business.
- Larry Ellison announced he wasn’t going to sell 7.5 billion in stock and crashed the stock on Monday. As well as a 13% layoff.
After Show
1:14:38 Trialing AI-powered contrail mitigation technology
- Google expanded its contrail avoidance trials to Asia-Pacific, partnering with Cathay Pacific on ultra-long-haul flights; more than 80 of over 100 test flights followed contrail-avoidance routes, with an estimated 40% reduction in warming impact from contrails.
- The system combines AI predictions, satellite imagery, and weather data to identify contrail-forming zones, then relays this to pilots via in-flight Wi-Fi and Cathay Pacific’s Electronic Flight Folder, without altering standard cockpit workflows. This is a practical example of AI and data pipelines applied to real-time operational decision-making.
- Notably, a single route, Hong Kong to Singapore, accounted for more than 50% of the trial’s total emissions reductions, suggesting that targeted interventions on high-impact corridors may be more efficient than broad network-wide changes.
- Contrails account for roughly one-third of aviation’s total climate impact, and this approach requires no new aircraft or fuel technology, just altitude adjustments based on better data, making it a low-cost, near-term lever for emissions reduction.
- Google is also partnering with Contrails.org, a nonprofit focused on contrail science, indicating a move toward open research collaboration rather than a proprietary solution, which could accelerate industry-wide adoption if the data and methods are shared.
- Does this mean the conspiracy theorists were on to something?
- “Listen, listen…” -Cody
Closing
And that is the week in the cloud! Visit our website, the home of the Cloud Pod, where you can join our newsletter, Slack team, send feedback, or ask questions at theCloudPod.net or tweet at us with the hashtag #theCloudPod
