HashiCorp

Terraform Auto-Removes Manual AWS EC2 Tag

A developer tested an automatic remediation control loop that detects Terraform drift in AWS, classifies the severity, and runs a separate remediation pipeline to restore declared infrastructure. The pipeline uses a drift detector CodeBuild job that runs terraform plan, publishes structured changes via SNS, a Lambda that classifies changes (LOW/MEDIUM/HIGH) and, for eligible LOW non-deletion updates, starts a remediation CodeBuild job that runs terraform apply. The author adjusted the classifier to treat in-place updates on MEDIUM resources as LOW, separated detector and remediation IAM roles, ensured the correct Git commit is cloned for remediation, and observed that a manually added EC2 tag was removed when Terraform applied the Git-declared state.

Productionizing an MCP AI Agent with Docker & Kubernetes

This technical article presents a practical architecture and checklist for taking a Model Context Protocol (MCP)-based AI agent from local development to production. It covers containerization (Docker), deployment to Kubernetes, secrets management (cloud secret stores and Vault), CI/CD with GitHub Actions, observability (logs, metrics, traces), failure-handling patterns, and scaling based on meaningful signals. The guide emphasizes security best practices (least privilege, secret rotation), reliability controls (readiness/liveness probes, retries, circuit breakers), and operational requirements such as reproducible images, structured logs, and tested rollback procedures.

Treat Environments as Ephemeral Pipeline Outputs

The author argues that the common subscription-per-team vs subscription-per-environment debate is a proxy for a deeper decision: whether environments are durable resources you manage or disposable outputs you create on demand. In a branching release model they replaced fixed non-prod subscriptions with templated, branch-tied environments provisioned by Terraform and torn down when branches merged or went stale. This approach cut their typical live non-prod footprint from four always-on subscriptions to one or two active environments, but it requires strict, idempotent IaC and exposes manual configuration gaps (they found an omitted Key Vault access policy). The piece also notes compliance reviewers may prefer long-lived resources, so teams should choose based on whether continuity or controls matter more to their audit posture.