375: AWS Finally Automates the Blame Game

Welcome to episode 375 of The Cloud Pod, where the forecast is always cloudy! Justin, Ryan, and Matt are in the studio this week, bringing you all the latest in cloud and AI news, including news from Terraform, DigitalOcean, and even Oracle! There’s a lot to cover, so let’s get started!

Titles we almost went with this week

• AWS Hires an AI to Side-Eye Your Cloud
• Terraform Plan, Terraform Apply, Terraform Cry
• Well-Architected Agent Grades Your Cloud Sins
• AWS Agent Checks Your Architecture Homework
• AWS Agent Judges Your Architecture, Finds It Wanting
• SQL Injection Finally Gets Interesting: Doom Edition
• Aurora Breaks the Ice(berg) with Data Lake Queries
• GKE’s CPU Boost Sprints So Your App Doesn’t Crawl
• Cloudflare Bottles Lightning, Charges You for Storage
• AWS Security Hub Stops Playing Whack-a-Mole
• Oracle’s Fusion Claw Grabs For Agentic Dominance
• Justin has flashbacks about Publisher

A big thanks to this week’s sponsors:

We’re sponsorless! Want to get your brand, company, or service in front of a very enthusiastic group of cloud news seekers? You’ve come to the right place! Send us an email or hit us up on our Slack channel for more info.

Follow Up

02:54Shut up and take our money: Amazon plows $1B+ into quashing datacenter dissent

• The article headline references Amazon investing over 1 billion dollars related to datacenter community opposition, suggesting AWS is funding efforts to address or mitigate local pushback against new datacenter construction projects, though the full scope and mechanics of this spending are not detailed in the available text.
• This fits a broader industry pattern where hyperscalers including AWS, Microsoft, and Google face increasing local resistance to datacenter buildouts due to concerns over power consumption, water usage, and land use, similar to the Oracle Wisconsin datacenter delay mentioned elsewhere in this roundup due to grid connection approval issues.
• Listeners should consider the practical implications of datacenter community relations spending: faster project approvals could mean quicker capacity expansion for AWS regions, which directly affects availability zone rollouts and service launch timelines customers rely on.
• The broader context of power and grid constraints appearing across multiple stories in this roundup, including Oracle’s delayed Wisconsin facility, points to energy infrastructure increasingly becoming a bottleneck for cloud provider expansion plans industry-wide.
• Given the limited detail available, hosts may want to flag this as a story to revisit once more reporting details emerge on specific dollar allocations, which communities are affected, and whether this represents direct community investment, lobbying, legal spending, or incentive payments.

06:17 Justin – “I think the water consumption is really the one that I think a lot of environmentalists are jumping on, which, you know, Amazon claims this data center or some of their data centers are seventy-four percent meeting water positive targets, whatever that means. Because there’s no way to quantify what water positive means.”

Con’t Amazon’s $1B plan to combat data center backlash draws more backlash

• Amazon pledged over $1 billion over five years to communities near its data centers for education, job training, energy affordability, and water infrastructure, with local communities deciding how to allocate funds.
• The announcement comes as local protests have blocked over $130 billion in data center projects this year, suggesting the funding commitment responds to mounting community opposition.
• AWS CEO Matt Garman framed data center moratoriums as a national security risk, arguing that slowing US data center growth could let China surpass American AI development.
• Critics, including Stand.Earth note the commitments don’t address Amazon’s backing of a large gas power plant expected to become a significant source of US climate pollution, calling the funding announcement incomplete on environmental impact.
• Amazon claims 75 percent of its data center projects already meet “water positive” targets ahead of a 2030 goal, though specifics on methodology and verification weren’t detailed in the announcement.

AI Is Going Great – or How ML Makes Money

08:58 DevDay 2026 Recap

OpenAI DevDay 2026 talking points:

• OpenAI introduced Dots, always-on agents available on Pro and Business Premium plans that autonomously handle ongoing tasks and responsibilities, marking a shift toward persistent agent-based workflows rather than single-session interactions.
• GPT-6.1 Sol launched as an upgrade with strong agentic coding and computer use performance, priced at one-fifth the input and output token costs of the standard tier, which gives developers more budget flexibility for complex workflows.
• A new Ultrafast tier also offers up to 8x faster token generation in Codex, reaching 300 tokens per second.
• The Agents API now supports computer use, multi-agent capabilities, and context compaction, and OpenAI partnered with Amazon so developers can build these agents natively in AWS through Bedrock Managed Agents, an interesting cross-cloud collaboration.
• OpenAI opened ChatGPT as a developer platform with Plugin extensions, letting third parties build native experiences within ChatGPT’s interface across a reported 1.2 billion weekly users, alongside new collaboration features like Spaces, Pages, and shared team tasks.
• OpenAI Private Intelligence adds Zero Data Retention and Private Safety Processing for enterprise customers, with a Private Inference preview combining confidential computing coming this fall, addressing data protection concerns for regulated industries adopting frontier AI models.

09:57 Justin – “Didn’t they already have zero data retention? I mean, that seems like one of the big enterprise things that was early on; everyone wanted it in their enterprise agreement. So the fact that they’re announcing this is new makes me a little nervous that they were lying before.”

14:48 Customize Claude Code with mods in TypeScript

• Anthropic introduced mods for Claude Code, small TypeScript functions that can rewrite prompts, add UI elements, replace built-in features, or add new functionality; they go beyond existing hooks by allowing event rewriting and custom UI rendering.
• Mods ship inside plugins and work across both the CLI and desktop app; users can write mods manually or ask Claude Code to generate and hot-reload them during a session.
• Security is a key consideration since mods run unsandboxed with the same machine access as Claude Code itself; Anthropic recommends only installing mods from trusted sources, similar to any other code.
• For Team and Enterprise plans, a built-in mod called sec-default loads first to restrict risky behaviors like overriding permission deny rules, and admins can manage plugin marketplaces or push their own mods via managed settings.
• Anthropic is migrating built-in features, such as the /diff command, into the mods framework, allowing users to disable or replace default functionality, with plans to convert more core features over time to let users build a minimal, customized Claude Code setup.

15:29 Ryan – “And how do you know you’re gonna break whatever cloud experience you have? Because it’s the first thing I did when I tried to do browser rewrites using JavaScript.”

20:49 Our approach to EU text provenance rules

• OpenAI is rolling out text watermarking called textGrain in response to EU AI Act requirements, adding an invisible statistical signal to word choices in generated text, with ChatGPT and Codex watermarking coming to EU users in the next few weeks and API customers globally able to opt in starting now, off by default.
• Detection reliability varies significantly with text length and editing; the detector identified watermarks in about 80 percent of 200-token passages versus 95 percent of 400-token passages, and editing just 10 percent of words with synonyms dropped detection from 92 percent to 66 percent, with 25 percent edits reducing it to 17 percent.
• OpenAI is limiting detector access to approved researchers and expert organizations through an application process rather than a public release, due to risks of false positives and false negatives; OpenAI plans to open-source the textGrain technology for others to build on.
• OpenAI is explicit that watermark detection cannot determine human contribution, ownership, user identity, or content accuracy, and absence of a watermark does not prove human authorship, framing this as one layer alongside existing C2PA Content Credentials and SynthID watermarking for images and audio.
• Benchmarks on OpenAI’s latest model, Astra, reportedly show no meaningful performance differences with watermarking enabled versus disabled, addressing a common concern about quality tradeoffs; the company is also coordinating with cloud partners to extend watermarking to model outputs delivered through their services.

24:19 Matt – “That’s a hundred percent what’s happening. People send me AI slop, I tell AI to decrypt it, and then I read it. And I’m like, how many tokens are getting used just by this? How many gallons of water have we consumed by this email thread? That could have been bullets.”

AWS

24:50 Amazon S3 Tables now support all Apache Iceberg V3 data types

• S3 Tables now support the full Apache Iceberg V3 spec, adding deletion vectors, row lineage, and new data types including variant, nanosecond timestamps, geometry, and geography; this addresses common V2 pain points around compliance deletes, semi-structured JSON parsing, and geospatial data encoding.
• Deletion vectors replace V2’s positional delete files with a compact binary format, so a compliance delete affecting 50,000 rows in a 2-billion-row table writes a single deletion vector file instead of thousands of small delete files, reducing compaction overhead and query latency.
• Row lineage automatically adds _row_id and _last_updated_sequence_number fields, letting downstream pipelines query for changed rows by sequence number rather than scanning entire tables, which simplifies building incremental data pipelines.
• Upgrades from V2 to V3 are atomic and don’t require rewriting data, but the migration is one-way since Iceberg doesn’t support downgrading; teams need Spark 4.0 or later engines (AWS Glue 6.0+ or Amazon EMR 8.1+) to use the new V3 data types, and these types only work with the Parquet file format.
• This fits into AWS’s broader Iceberg strategy spanning EMR, Glue, and Redshift, with both S3 Tables and Glue Data Catalog supporting the Iceberg REST Catalog API for cross-engine interoperability.
• The feature is available now in all S3 Tables-supported regions at no additional charge beyond standard S3 Tables pricing.

26:40 Amazon Aurora PostgreSQL now supports direct querying of Apache Iceberg and Parquet data in your data lake

• Aurora PostgreSQL can now directly query Apache Iceberg and Parquet data in S3, S3 Tables, or AWS Glue Data Catalog without ETL pipelines, letting a single SQL query combine live operational data with historical data lake records.
• The feature embeds DuckDB directly into Aurora PostgreSQL, following Amazon’s recent acquisition of DuckLabs; query processing happens within Aurora with no extra network hops, and DuckDB handles the analytical scan of lake data while Aurora manages operational data.
• Setup requires Aurora PostgreSQL 17.11+ or 18.6+, an IAM role with AuroraAnalytics permissions, and the aurora_analytics extension; foreign tables are created with automatic schema inference from Parquet or Iceberg metadata, and IMPORT FOREIGN SCHEMA can bulk-create tables for an entire Glue database.
• Cross-catalog querying is supported via Glue Data Catalog federation with IRC-compatible catalogs, allowing joins across multiple external catalogs in a single query without data movement or catalog replacement.
• Available now in all commercial AWS regions and GovCloud (US) at no additional feature charge; customers pay only for incremental Aurora compute and standard S3 request costs for reading data lake files.
• For low-latency needs, data can be materialized into native Aurora tables using CREATE TABLE AS SELECT or MERGE INTO.

27:03 Justin – “So basically this DuckDB sits inside of Postgres as a binary extension to allow Postgres to do magic with Apache Iceberg tables. So that’s what you’re hearing.”

28:44 Introducing the Dogwood Local Engine: temporal governance for agent actions

• AWS released the Dogwood Local Engine, an open-source library (Apache 2.0) that enforces temporal governance policies for AI agent actions, letting developers restrict tool calls based on past events, outcomes, and timing, such as requiring passing tests within the last 15 minutes before allowing a git push.
• The engine integrates as a library into an agent harness that intercepts tool calls, checks them against policies, and enforces allow/deny verdicts, while a Rust-based embedded key-value store (redb) handles durability so it survives crashes and restarts without losing event history.
• A notable technical feature is support for dynamic policy updates mid-session, allowing users to tighten or loosen agent permissions without stopping the agent, though updated policies only apply to events occurring after the change rather than retroactively.
• Performance benchmarks show that schema design matters significantly: fine-grained action definitions evaluate roughly 5 times faster than coarse-grained ones, and shorter temporal windows keep evaluation time constant, while a 24-hour window increases evaluation time to 6 milliseconds per decision at 12 hours, 300 times slower than a 15-minute window.
• This addresses a growing concern as AI agents are given more autonomy to call tools, run code, and interact with external systems, giving developers a way to add guardrails around sequences of actions rather than just single-action permissions, available now on GitHub for teams building agentic systems.

29:57 Ryan – “I love this feature. I like anything where you can evaluate policy, and you can define policy and have that be a sensible outcome.”

33:36 Amazon CloudWatch Logs now automatically indexes frequently queried fields

• CloudWatch Logs now auto-indexes fields used with equality and IN filters based on query history, removing the need to manually configure field indexes as usage patterns shift over time.
• Auto-indexed fields don’t count against the existing 20-field-per-log-group limit and persist for 30 days, giving teams a rolling window of optimized query performance without manual tuning.
• The indexing list adjusts dynamically as query patterns change, but teams can promote specific fields to a permanent field index policy via the console or API if they want guaranteed long-term indexing.
• This addresses a common operational pain point: teams previously had to anticipate which fields to index, often requiring rework as logging and query needs evolved, especially across distributed teams.
• The feature is available at no additional cost in all regions supporting CloudWatch Logs field indexing, making it a straightforward performance improvement for existing CloudWatch Logs Insights users with no migration required.

34:19 Justin – “This is a nice feature, like the fact that it’s free and I can now basically get long-term retention of specific patterns that I use all the time in my fill my indexes, that’s nice.”

36:56 AWS Well-Architected Agent is now available in preview

• AWS Well-Architected Agent merges Trusted Advisor and the Well-Architected Tool into an AI-powered service that analyzes infrastructure across cost, security, performance, and reliability, then prioritizes recommendations based on defined business goals.
• The agent reviews Terraform, CDK, and CloudFormation templates directly, identifying gaps against Well-Architected best practices and generating the specific IaC code changes needed to fix them.
• Recommendations come with execution tools built in, including SSM runbooks, CLI scripts, and guided console walkthroughs, plus cross-pillar impact analysis so teams can see cost and performance tradeoffs before applying a change.
• Preview is limited to three regions: US East N. Virginia, US East Ohio, and US West Oregon, though workloads from any commercial region can be onboarded; access requires an active AWS Support plan.
• This signals AWS pushing AI agents into operational and architectural governance, a space previously handled by static checklists and manual reviews, raising questions about how pricing and support tiers will scale once the service exits preview.

38:08 Ryan – “I couldn’t like this more just because it’s replacing patterns that I think are insufficient. They’re absolutely required ’cause you have to go and review whether something’s well architected, and those processes were previously used to educate developer teams in a lot of cases on, you know, backup strategies, DR strategies, and ensure everything was in place. But I’m sure, because I’ve seen it, the questions get answered in such a way that it’s vague, and people assume that DR is actually in place and functional. And I think that this type of analysis by, you know, an AI agent is gonna really highlight some issues and discover things. So that’s, I think it’s great.”

Con’t. Announcing AWS Well-Architected Agent, an AI-powered intelligence to

optimize your cloud environment

• AWS Well-Architected Agent is an AI-powered preview service that analyzes AWS environments against Well-Architected best practices across 65+ services, replacing manual audits with automated, context-aware recommendations tied to declared business goals like cost, security, performance, and resilience.
• Recommendations come in three tiers: individual resource findings with dollar impact estimates, consolidated application-level findings, and architectural patterns with Infrastructure as Code changes, giving teams flexibility to remediate at the scale that makes sense for their situation.
• Remediation options include console walkthroughs, updated IaC templates (Terraform, CloudFormation, CDK), or CLI commands, and the service supports pre-deployment architecture reviews by uploading IaC projects before resources are provisioned.
• The service requires customer-managed IAM roles for read access to resource configs, metrics, and application topology, and it refreshes recommendations periodically after an initial 24-hour analysis window following profile creation.
• Currently available in preview across three regions (US East N. Virginia, US East Ohio, US West Oregon) for workloads in any commercial region, and is delivered through AWS Support, requiring an active AWS Support plan to access.

43:38 AWS Security Hub introduces remediation plans to prioritize and fix security exposures

• Security Hub remediation plans group related exposure findings by root cause, letting teams fix one misconfigured resource or overly permissive policy to resolve multiple findings simultaneously, rather than addressing each exposure separately.
• Plans include prioritization labels (Critical, High, Medium, Low), impact assessments, and step-by-step fix instructions across AWS CLI, Terraform, CloudFormation, Python, and CDK, giving teams flexibility to remediate using their existing tooling.
• Security Hub automatically ranks plans by risk reduction and surfaces the highest-impact fixes first, helping security teams prioritize limited remediation resources more effectively.
• The API-accessible format lets AI agents consume remediation plans programmatically, enabling automated security-fix workflows rather than requiring manual intervention for every finding.
• This feature is included at no additional cost under the Security Hub Essentials plan. It is available in all regions where Security Hub operates, lowering the barrier for existing customers to adopt consolidated remediation workflows.

GCP

45:52 Enabling end-to-end checksums in Cloud Storage

• Google Cloud Storage SDKs now enable end-to-end checksumming by default, closing a gap where data could be corrupted by bit flips in-flight before server-side checksum validation occurred. Previously, developers had to implement client-side checksums manually.
• The update covers both uploads and downloads, and extends to range reads via gRPC, which leverages built-in checksum verification so partial object downloads are also protected without losing chain-of-custody.
• Technically, Google maintains checksum integrity across multiple transformation layers, encryption, chunking into shard files, and Reed-Solomon encoding in Colossus, using CRC concatenation properties to avoid expensive re-checksumming at each stage.
• This is a free, backward-compatible improvement; customers just need to update to the latest SDK versions to get the protection automatically, with no API changes required for existing applications.
• Relevant for any workload where silent data corruption is a concern, such as data lakes, backup and archival, media storage, or regulated industries with strict integrity requirements, since bit flips at Google’s operating scale happen routinely rather than theoretically.

46:11 Matt – “I don’t know how this wasn’t a requirement for them years ago given some of their customers.”

46:55 Spanner Omni, deploy-anywhere version of Spanner, is now GA

• Spanner Omni, now generally available, lets customers run Google’s distributed SQL database on-premises, on other clouds, or locally, rather than exclusively on Google Cloud; it has seen over 2 million downloads since preview launch at Google Cloud Next ‘26.
• The database combines SQL, graph, key-value, full-text search, and vector search in a single multi-model engine, with native support for KNN/ANN vector search and Spanner Graph for AI and agentic application workloads.
• GA adds enterprise features needed for production: TLS encryption, audit logging, backup/restore, dedicated worker nodes for offloading background operations, and direct Google Cloud Customer Care support.
• Licensing is split into two tiers: a free Developer Edition (90-day license, or perpetual for single-server deployments of 4 vCPUs or less, excluding backup and worker nodes) and a paid Commercial Edition using a vCPU-based annual subscription model, with discounted proof-of-concept pricing available.
• Key tradeoffs versus fully managed Spanner include self-managed operations (upgrades, monitoring, maintenance), no Google-provided availability SLAs, and exclusion of Google Cloud-specific integrations like BigQuery, Knowledge Catalog, and Gemini Enterprise; Attio, an AI-native CRM company, cited Spanner Omni as enabling faster production deployment of agentic workflows across environments.

47:46 Ryan – “But is it a real database if it can’t do an installed plugin?”

48:50 Google Cloud CLI remote MCP server in preview

• Google Cloud launched a remote MCP server for Cloud CLI in public preview, giving AI agents direct access to gcloud and bq commands without requiring local CLI installation or dependency management in agent environments.
• The server exposes two tools, run_gcloud_command and run_bq_command, allowing agents to handle infrastructure management, incident diagnostics, BigQuery job monitoring, scheduled queries, and permissions control through natural language.
• Security relies on zero ambient credentials, with authentication via Agent Identity, OAuth 2.0, and IAM; every command runs under the authenticated caller’s permissions, and org policy constraints are enforced on target resources.
• Model Armor integration screens prompts and responses for risks like prompt injection, and audit logging captures caller identity and authorization decisions under cloudcli.googleapis.com/mcp without exposing sensitive payloads or PII.
• No additional charge for using the MCP server itself; customers only pay for underlying GCP resources and data transfer; setup requires enabling the Cloud CLI Execution API and granting the roles/mcp.toolUser IAM role.

49:37 Ryan – “Plot twist: I love this. The reason I love this is because you want to run those agent executions inside of a sandbox environment, and you don’t want to have all that token and credential data pass through environment details, so it’s excluded. And now you finally have a way to safely execute against gcloud in either a remote agent execution or in a sandbox environment.”

51:51Data Agent Kit is now GA: Bring Google Data Cloud to any coding agent

• Data Agent Kit is now generally available, offering free MCP tools and agent skills that connect coding agents like Claude Code, Codex, and Antigravity to over 15 Google Data Cloud services, giving agents live context on schemas, partitions, and job logs instead of relying on pasted-in assumptions.
• GA adds support for BigQuery Graph, Bigtable, and Managed Service for Apache Spark, letting agents design Bigtable row keys, build property graphs with GQL, and run serverless Spark sessions against Iceberg tables with branching and time travel.
• The federate-lakehouse-catalog skill connects to AWS Glue and Databricks Unity Catalog, allowing agents to query data across cloud providers without building separate ingestion pipelines first.
• Security is handled through existing IAM permissions, with agents connecting as the user or an impersonated service account, so row- and column-level policies apply automatically; admins can further control access via Model Armor and VPC Service Controls.
• There’s no additional cost for Data Agent Kit itself; customers only pay standard pricing for the underlying Google Cloud services used, and the skills are open source on GitHub for auditing or customization.
• Setup takes under a minute via IDE extension (VS Code, Cursor, Antigravity) or CLI plugin, and it’s pre-installed in Cloud Shell and Cloud Workstations, lowering the barrier for teams to try agent-assisted data workflows.

52:33 Ryan – “I’m really enjoying sort of the proliferation of these dedicated skills and tools and the installation, just because I think it’s so much better than relying on the data that’s trained into the model whenever that was.”

55:30 Introducing Gemini 4 Argon

• Gemini 4 Argon expands output token limits to 1M tokens, up from 64K, enabling the model to sustain long, multi-step reasoning in a single pass for complex software engineering and enterprise tasks.
• It launches at $2 per million input tokens and $10 per million output tokens, with cached inputs priced 95% lower.
• The model is rolling out initially through the Fairwind Program to trusted cyber defenders, with access expanding gradually to API customers and Google AI Ultra subscribers as guardrails are refined.
• Google is also participating in the U.S. government’s voluntary pre-release model access process.
• Internal use cases highlight concrete efficiency gains: Argon agents identified memory optimizations freeing over 300 TiB across Google data centers, and were used in large-scale C/C++ to Rust migrations, including a 2.7x speedup on libgav1’s video decoder while maintaining memory safety.
• Argon leads several benchmarks relevant to enterprise adoption, including the Vals Index (finance, legal, tax, coding), Zapier’s AutomationBench (51.3%), and LVBench for long-video understanding (91.7%), suggesting applicability across knowledge work beyond coding.
• For cybersecurity, Argon ties for first on CWE-bench v1 at 68% and is used by Wiz’s Scan for Good initiative, where it identified a critical healthcare software vulnerability that prior models missed. Trusted defenders will get access without cyber guardrails to use its full vulnerability discovery and patching capabilities.
• Google outlines expanded safety measures ahead of broader release, including monitoring internal activations for misuse, defenses against indirect prompt injection attacks, and chain-of-thought monitoring to catch misalignment before execution.

56:09 Justin – “Thanks, Google, for announcing it but not letting us play with it.”

57:10 GKE CPU startup boost: Faster pod starts, lower costs

• GKE CPU startup boost, now in preview, temporarily increases CPU allocation for pods during initialization and automatically scales back to baseline once the app is ready, addressing the common tradeoff between cold start latency and resource over-provisioning.
• Google reports up to 2x faster application initialization for CPU-heavy startup workloads like Java/Spring Boot, Node.js, and Python/AI libraries (PyTorch, NumPy, LangChain), without requiring developers to permanently over-provision CPU requests for steady-state operation.
• The feature relies on Kubernetes In-place Pod Resize (IPPR, KEP-1287), which graduated to GA in Kubernetes 1.35, allowing CPU requests to be adjusted on running pods without restarts, cache invalidation, or rescheduling overhead.
• Configuration is handled through a startupBoost section in the VerticalPodAutoscaler manifest, supporting simple pod-level multipliers or granular per-container rules, useful for excluding sidecars like logging agents or service mesh proxies from the boost.
• Available now on GKE Standard and Autopilot clusters running version 1.36.0-gke.4447000 or later, with VPA enabled by default on Autopilot; teams should pair this with tuned readiness probes and short cooldown durations to avoid HPA misreading startup spikes as sustained load.

Azure

58:36 SQL Server on Azure Local is now generally available

• SQL Server on Azure Local is now generally available, supporting both connected and fully disconnected deployments for environments where cloud connectivity cannot be assumed, such as remote industrial sites or regulated sectors like defense and healthcare.
• The disconnected mode, called Azure Local Disconnected Operations (ALDO), lets SQL Server keep running locally when external connectivity is restricted or unavailable, meeting sovereignty and operational continuity requirements.
• Foundry Local on Azure Local, currently in preview, lets customers run AI inference on-premises alongside their SQL Server data, avoiding the need to move sensitive data to the cloud for AI workloads.
• Licensing is flexible: connected deployments support existing licenses with Software Assurance or pay-as-you-go through Azure Arc, while disconnected deployments rely on Azure Hybrid Benefit, allowing customers to apply existing SQL Server investments.
• Target customers include public sector, financial services, healthcare, manufacturing, and energy organizations that need local control due to latency, regulatory, or connectivity constraints, giving them a consistent Azure Arc management experience regardless of deployment model.

1:00:00 Justin – “If you had this use case before, you just use Real SQL, but now this is like, well, I don’t wanna buy Real SQL; I just wanna use the subscription that I normally have. This is what you’re getting now through Azure local.”

1:00:58 How Microsoft Circular Centers support the Azure cloud infrastructure lifecycle

• Microsoft now operates eight Circular Centers globally, with new facilities in Newport, Wales, and Sydney, Australia, expanding coverage to North America, Europe, and Asia Pacific; a ninth center is planned for San Antonio, Texas.
• These facilities handle decommissioned data center hardware and decide whether complete systems can be reused (labs, schools, resale to qualified buyers), components can be harvested as spare parts, or materials need recycling. Microsoft reports a 92% reuse and recycling rate for decommissioned servers and components last year.
• Microsoft cites substantial efficiency gains since 2014: cores per rack have increased roughly 13-fold while power consumption for equivalent workloads has dropped about 90%, meaning more compute capacity from the same datacenter footprint and power budget.
• The custom Azure Cobalt processor line ties into this lifecycle strategy, with Cobalt 200 delivering up to 50% higher performance than Cobalt 100 through co-designed silicon, networking, and storage.
• Microsoft is applying automation and AI to the circular process itself, including robotic disassembly and autonomous material handling, to speed up component and material recovery at scale.

1:02:32 Matt – “It is nice to see that they’re upcycling.”

1:02:50 Microsoft Publisher will no longer be supported after October 2026

• Microsoft Publisher reaches end of life in October 2026, with Microsoft 365 subscribers losing access to the app entirely while perpetual license holders (Office LTSC 2021, Office 2021) retain functionality but lose support.
• Microsoft recommends migrating common Publisher use cases—templates, labels, calendars, business cards—to Word, PowerPoint, or Microsoft Create templates, signaling a consolidation of desktop publishing features into existing apps rather than a standalone replacement.
• Users need to proactively convert existing pub files to PDF or Word before the deadline, as post-retirement files won’t open in Publisher for Microsoft 365 subscribers; Microsoft provides a PowerShell script for bulk conversion.
• This is a file format and compatibility planning issue for any organization with legacy Publisher content in SharePoint or OneDrive; IT teams should run file searches for pub extensions now to scope the migration effort.
• The move reflects a broader pattern of Microsoft retiring niche legacy desktop apps and consolidating functionality into core Microsoft 365 apps, reducing the product portfolio they need to maintain and support.

1:03:15 Justin – “Good Riddance! I hated this product. It was always a terrible tool.”

Oracle

1:05:44 Oracle Extends Fusion Agentic Applications with Introduction of Fusion Claw

• Oracle Fusion Claw adds 25 new agentic applications covering finance, HR, supply chain, and sales use cases, bringing the total Agentic Applications portfolio to 75. The pitch is moving from AI that assists to AI that executes, though customers will want to see concrete results before buying into that framing.
• The architecture splits work between frontier models (Gemini, OpenAI) for reasoning and deterministic enterprise computation for execution, which Oracle frames as an economic advantage by limiting expensive AI inference to only where judgment is needed. Whether this actually translates into meaningful cost savings versus competitors running similar hybrid approaches remains unproven.
• Governance features like the Enterprise Operating Envelope, Outcome Trust Harness, and Outcome Receipts aim to ease enterprise concerns about autonomous execution by providing an audit trail for every agent action. This is a reasonable response to the trust gap that has slowed agentic AI adoption, but it also adds complexity that customers will need to configure and maintain.
• The announcement is packed with quotes from Accenture, Deloitte, KPMG, and PwC, signaling Oracle is leaning heavily on systems integrators to drive adoption and justify the investment. That often means significant services spend on top of licensing to actually stand this up.
• No pricing details were disclosed, so actual cost of running Claw-powered applications at scale versus existing Fusion Applications is unclear. Listeners should treat the “economic advantage” claims skeptically until real customer case studies with numbers emerge.

Emerging Clouds

1:07:52 AI Search is now generally available

• Cloudflare’s AI Search is now GA after a year in preview, bundling Workers AI, Vectorize, R2, and Browser Rendering into a managed retrieval pipeline; billing starts November 1, 2026, with a free tier remaining on all Workers plans.
• The major upgrade here is native multimodal retrieval: instead of just captioning images and searching the text, AI Search now embeds image pixels directly using Qwen3-VL-Embedding, preserving visual details like texture, layout, and color that captions tend to lose.
• Matryoshka Representation Learning is used to keep these richer multimodal embeddings storage-efficient and fast to search, which matters for teams worried about cost and latency scaling with image-heavy datasets.
• File size limits doubled to 10 MiB and OCR support was added for scanned PDFs, letting developers index documents that previously had no extractable text, billed separately as image processing ingestion tokens.
• Pricing is based on three factors: ingestion tokens, storage size, and query volume (split between semantic and full-text queries), with the free tier now offering 1,000 of each query type rather than a shared pool, giving developers a predictable cost model before indexing.
• Roadmap items worth noting include upcoming video and audio ingestion support and a refactored keyword search engine aimed at better scaling for large data stores.

1:08:04 Announcing Cloudflare K2: serverless event streams

• Cloudflare K2 is a new serverless event streaming primitive, now in public beta, built to decouple event producers from consumers so slow or unavailable downstream services don’t cause dropped data.
• Instead of using Apache Kafka, Cloudflare built K2 on top of its R2 object storage layer, offloading replication and durability guarantees to R2 rather than managing a traditional distributed log system across its edge network of 335+ cities.
• The design tradeoff is higher produce latency, around 1 second at the 99th percentile, since writes are batched into segment files before being committed to object storage, rather than appended directly like a local disk-based log.
• K2 fills a specific niche alongside Cloudflare Queues and Basin Pipelines: Queues handle individual work items with retries and dead-letter handling, while K2 is designed for high-throughput data movement, long-term retention, and fan-out to multiple independent consumers.
• Public beta pricing is free, with initial limits of 10GB storage and 30 MB/s produced per stream, and the roadmap includes multi-GB/s throughput, Kafka client compatibility, and push-based consumers, suggesting Cloudflare intends this as a long-term alternative to self-managed Kafka clusters.

1:08:19 Cloudflare OS: your company’s agent workspace, managed for you

• Cloudflare is introducing a fully managed version of Cloudflare OS, its agent workspace product, reducing the operational burden of self-hosting and configuring the open-source deployment for organizations that don’t want to manage it themselves.
• Setup for the managed tier is simplified to a custom domain, Cloudflare Access policies, and an AI Gateway connection, with Cloudflare handling the underlying infrastructure and maintenance.
• New integrations let agents work directly with GitHub repositories, including searching code, making edits, creating commits, and opening pull requests, expanding use cases beyond document and task automation into software development workflows.
• Google Workspace integration has been expanded through a dedicated Gatekeeper Worker, allowing agents to read and draft Gmail messages and connect to Drive files, folders, or individual documents and sheets.
• Export functionality now supports common business formats including Excel, CSV, PDF, Markdown, and HTML, with Word and PowerPoint support planned, addressing the practical need to move agent-generated work into formats other teams already use.
• Want to join the waitlist? You can do that here.

1:08:34 Introducing Clef: our open-source decision models, and new RL fine-tuning platform

• Cloudflare released Clef and Clef-flash, open-source decision models hosted on Workers AI, positioned as a faster alternative to Typesafe’s Jev for structured, non-text classification tasks in agentic workflows.
• The models output bounded, typed probabilities rather than generated text, which Cloudflare says enables 2x latency savings compared to general LLMs like gpt-oss-120b in their internal threat intelligence domain classification tests (2.2s versus 4.7s).
• Technical differentiators include a vision encoder for image classification (Jev is text-only), a 64k context window versus Jev’s 32k, and a non-autoregressive architecture built on a frozen Qwen backbone with low-rank adapters for parallel schema scoring.
• Cloudflare is also launching a reinforcement learning fine-tuning service, starting with a hands-on, forward-deployed engineer team before moving to self-serve, letting customers adapt Clef using their own AI Gateway traffic data.
• This ties into Cloudflare’s broader AI Platform strategy, combining AI Gateway, Workers AI, Containers, and a new Trainer component to support the full fine-tune-and-redeploy loop, reinforcing their positioning as infrastructure for agentic and decision-making workloads.

1:08:59 Introducing Cloudflare Traces: follow requests through our entire platform

• Cloudflare Traces extends automatic tracing beyond Workers to the full request path, covering security rules, transformations, cache decisions, routing, and origin handling in a single timeline, requiring no additional setup once enabled.
• The feature supports W3C traceparent headers for end-to-end context propagation, letting a single trace follow a request from upstream services through Cloudflare and on to origin or third-party systems, which is useful for distributed tracing across hybrid stacks.
• Trace Rules allow teams to keep a low baseline sampling rate (e.g., 1%) while targeting 100% tracing for specific conditions like a customer hostname, IP, or debug header, helping control data volume and cost during targeted investigations.
• Traces can be exported via OTLP to any compatible observability backend, aligning with Cloudflare’s broader OpenTelemetry commitment and allowing Cloudflare spans to sit alongside existing application telemetry.
• Pricing shifts from a per-span/event model to one based on data ingestion and retention duration, with the new model applying to both Cloudflare Traces and Workers Tracing starting December 1, 2026.
• The Cloudflare Observability MCP server lets coding agents query trace data directly, enabling automated comparison of failed versus successful requests and connecting findings back to source code for debugging.

1:11:31 Introducing Agent Droplets: everything an agent needs, one price, one bill

• DigitalOcean is bundling agent infrastructure (compute, storage, inference, and access to 16,000+ tools) into a single monthly price called Agent Droplets, addressing the common pain point of piecing together separate vendors like Fly.io, AWS, Fireworks, and Anthropic with different billing units.
• The core issue being solved is billing fragmentation: a typical agent stack today involves six vendors, six invoices, and multiple pricing units, making it difficult for teams to know what a single agent run actually costs.
• Technical details worth noting: agents run in dedicated microVMs that start in seconds and resume from pause in about 300 milliseconds, with automatic pausing when idle to reduce cost; this is compatible with existing harnesses like Claude Code, Codex CLI, and OpenCode.
• Pricing tiers include a free trial with $5 credit, Agent Droplet Pro (15% off), and Team (20% off), with discounts applying across all resource types rather than a single layer, unlike competitors like AWS AgentCore, which bill memory, gateway, and observability separately.
• This reflects a broader trend of cloud providers trying to simplify costs for AI agent workloads, as usage-based billing across compute, tokens, and storage has become harder for smaller teams and individual developers to predict and reconcile.

After Show

1:12:39 Someone got Doom in an SQL database – Ars Technica

• Developer Lukas Vogel rendered Doom using an SQL database, with about 1,300 lines of SQL across 89 common table expressions generating 35 full-color 640×480 frames per second in CedarDB.
• The project converted Doom’s WAD files into relational tables of vertices, lines, and sectors, and replicated the game’s binary-space partition tree logic using a precomputed sort_key and ORDER BY statements for rendering.
• This builds on the developer’s earlier DoomQL project, which produced only grayscale ASCII raycasting graphics, showing a clear jump in what’s achievable when pushing a database engine to handle real-time rendering tasks.
• For cloud and database professionals, this illustrates how far SQL query engines can be stretched beyond typical transactional workloads, and helps you think about the limits and creative potential of existing data infrastructure.
• The “Doom runs on anything” tradition continues with unrelated community efforts porting Doom to Neo Geo hardware, including one using a Raspberry Pi Pico 2 chip as a co-processor, highlighting the enduring appeal of testing hardware and software limits with a 1993 game.
• https://umgamer.com/en-us/articles/the-10-most-absurd-places-that-people-ran-doom
• https://canitrundoom.org/
• Bravo! Now go outside.

Closing

And that is the week in the cloud! Visit our website, the home of the Cloud Pod, where you can join our newsletter, Slack team, send feedback, or ask questions at theCloudPod.net or tweet at us with the hashtag #theCloudPod