CommPulse

submitted by /u/RnadmolyGneeraedt to r/FinOps [link] [comments]

For a small team with a few services, an enterprise checklist can become ceremony without reducing the main risks. My minimum gate would cover a tested rollback, backups with a restore exercise, health and readiness checks, bounded timeouts and retries, an alert owner, log correlation, secret ownership, and a short incident runbook. I would add load testing or multi-region recovery only when the service’s traffic and recovery target justify them. Which item has prevented a real incident for a small team, and which common checklist item has mostly created busywork? submitted by /u/UkrMalt to r/devops [link] [comments]

submitted by /u/Spiritual-Kitchen-79 to r/FinOps [link] [comments]

tldr; my coding agent refused to leak a secret after setting up the toolkit and running it through the wringer. Secrets Manager shipped a "secret safety" skill in the aws-core plugin of Agent Toolkit for AWS . The idea is that an agent can use a secret without ever seeing the plaintext. I ran it against a throwaway secret in a real account with Claude Code, then spent a while trying to get around it. Posting the findings in case it saves someone else the same trial and error. How it actually works, which is two layers not one: A PreToolUse hook that denies the tool call before it executes and hands the agent a message pointing at the safe path. A wrapper called asm-exec plus {{resolve:secretsmanager:...}} dynamic references. The agent's command holds a placeholder, asm-exec resolves it in its own process, and the plaintext never lands in the model's context. I tested ten fetch shapes against the hook. Six denied, four correctly allowed. It catches the CLI fetch, the batch fetch, structured API calls, a boto3 call buried in a script, a curl straight at the local daemon on port 2773, and an inline python3 -c one-liner. It leaves writes, unrelated calls and a plain grep alone. A few things that tripped me up: The skill usually refuses before the hook ever fires. When I just asked for the value in plain language, the agent declined on its own, cited the skill and pointed me at asm-exec . The deny message never appeared because no tool call was attempted. I only saw the hook fire when I insisted it actually run the command. The skill is what changes the agent's mind, the hook is the backstop for when it tries anyway. Hooks load at session start. Install the plugin mid-session, retry, and the secret comes back exactly as before. You have to restart the agent session. This is in the docs but it is easy to miss and it looks like the feature is broken. aws configure agent-toolkit does not install this one. That's the one-command setup for all agents, and it pulls from the skills catalog. The secret-safety skill and the hook only ship with the aws-core plugin, so if you set up via the CLI you don't get the block. I have the steps I took to get this setup in the full blog linked below. The safe path still calls GetSecretValue . It is not read-free. Your identity still needs secretsmanager:GetSecretValue , and the read still lands in CloudTrail. What changes is where the plaintext ends up, not whether the API is called. CloudTrail attribution is nicer than I expected, but not how I first assumed. Reads through the MCP endpoint show invokedBy , sourceIPAddress and userAgent all as aws-mcp.amazonaws.com , so agent reads are trivially separable from your own. The aws:CalledViaAWSMCP context key is a related but separate thing, it is what you write IAM and SCP conditions against rather than a field in the event record. The hook is shape-aware, and the boundary is sharper than the docs suggest. grep get-secret-value ./src is allowed. grep 'aws secretsmanager get-secret-value' ./src is denied, because the CLI pattern is checked before the read-only allowlist applies. Same for rg and echo . I tripped it grepping my own notes for this writeup. Stack: Claude Code on macOS, one throwaway secret with fake values in us-east-1, deleted afterward. See the full walkthrough using Claude Code here Happy to answer questions. If you find a fetch shape it misses, post it. For folks already using the toolkit, if there is something in the developer experience that could be better, tell me and I'll pass it to the team. submitted by /u/j-vogel to r/aws [link] [comments]

[ Removed by Reddit on account of violating the content policy . ] submitted by /u/hadez1999 to r/FinOps [link] [comments]

I currently manage 2 different environments: a dev server running in ec2 and an EKS environment for production server. Problem is that their setup is different, which adds extra management and makes it harder to test prod changes before deployment. I can spawn a UAT EKS for load testing and preparing for prod but it would be just too expensive. I already raised the cost concerns with EKS that this would be an expensive and unnecessary setup but the clients wanted it so I did it. Now they're complaining with cost. I'm just trying to find the best way to manage the current architecture without increasing costs too much. How would you handle this? submitted by /u/RoundCircle12 to r/devops [link] [comments]

Probably been answered else where but even AI gets it wrong (surprise surprise). Have a client with a few MS365 business licences. He wants an estimate of costs. Can find previous invoices easy enough but renewal costs has me stumped. AI says to switch off auto renew to get an estimate but no go. Can't believe giving MS a blank cheque is good biz for anyone bar MS or even legal. So how do I get an estimate from the portal? submitted by /u/mujikcom to r/sysadmin [link] [comments]

I’ve been thinking about this while working with observability systems and I’m curious how other people handle it. We have metrics, logs, traces, alerts, deployment information, etc. In theory, there should be enough information to understand what happened during an incident. But in practice, it often seems like the hard part is connecting everything. Something like: latency spike → database saturation → retries → downstream failures The individual signals are there, but figuring out that they’re all part of the same failure — and determining which event was actually the cause — still seems to require a lot of manual investigation. For people who actually operate production systems: what does your RCA process look like when there’s a serious incident? Do your current observability tools actually help you establish the causal chain, or are they primarily helping you find the relevant data? I’m particularly interested in what happens when the information is spread across multiple systems. submitted by /u/Acceptable_Duty4044 to r/devops [link] [comments]

Case ID: 178633616200405 AWS charged my debit card $600 for a transaction that does not belong to my AWS account. My normal AWS bill is about $3.40/month, and this $600 charge appears nowhere in my billing history. I opened a support case with all the transaction details, and AWS still has not meaningfully investigated it. After multiple calls, one Amazon/AWS support agent told me they could see that the charge came from another AWS account that had already been suspended. Despite that, AWS's fraud department later emailed me saying they found nothing wrong with my account, completely missing the issue. Another agent told me the $600 had already been refunded, while another told me the refund was rejected. Wise is refusing to treat the charge as unauthorized because I have legitimately used AWS before and says AWS needs to provide information about the transaction. AWS keeps claiming another department will investigate, but nothing actually happens. At this point, AWS has acknowledged that the charge came from another account, has apparently suspended that account, and still will not properly resolve or document the fraudulent $600 charge they processed against my card. The complete lack of ownership, contradictory information, and failure to investigate is unacceptable. submitted by /u/polarmass to r/aws [link] [comments]

I'm working to try and change the primary domain inside of a Google Workspace. The workspace had chromeOS devices provisioned. I opened up a support ticket with Google and they stated that I just needed to de-provision those devices, which I have now done, and that the licensing needed to be removed which they have done. The error I'm getting says: Changing your primary domain is not available for: Accounts that included the purchase of your domain when you signed up Accounts in a free trial period Accounts purchased from Google Domains G Suite legacy free edition Google Workspace for Education Google Workspace Resellers Chrome Enterprise Upgrade (Standalone, Offline) Chrome Education Upgrade (Standalone, Offline) Kiosk and Signage Upgrade (Standalone, Offline) Chrome Management Hangouts Software The issue is, I don't know that that is the *ONLY* thing that is erroring out. Support is just useless in the matter and keeps linking me the same support docs that do not answer the question. My question: How do I know that deprovisioning these devices is the 1 out of 11 things that it's erroring out about? They are saying I have to wait 24 hours, then try again, and if I get another error, to wait another 24 hours and open up a new ticket. One of the support guys responses was "All the chrome upgrades is the reason for the errors that you are receiving, It falls to this; - Chrome Enterprise Upgrade or Chrome Education Upgrade licenses purchased through an authorized partner - Standalone Chrome Enterprise Upgrade purchased through an authorized partner, Chrome Enterprise trials, and standalone Chrome Education Upgrade" Which I was pointing out, well, if it's failing for multiple reasons, why would you not be able to address those other issues now, rather than having to wait 24 hours between issue? Anyone by chance have any advice? submitted by /u/nme_ to r/sysadmin [link] [comments]

After over a decade working in software sales, along with dealing with a recent layoff, I'm seriously considering making a career switch into IT. It's something I've wanted to do for several years, but I never really had a clear idea of what the path into the industry would look like. I have some limited technical experience and have been learning Python and SQL on my own, but I wouldn't consider myself an experienced programmer. Right now, I'm particularly interested in Linux System Administration and potentially working my way toward DevOps, SRE, or Cloud Engineering down the road. I've been looking closely at Yellow Tail Tech's Linux System Administrator & DevOps Training Program. A friend of mine made a similar career switch and completed the program in 2024. He was eventually able to land a Site Reliability Operations Engineer role, so seeing someone I personally know make the transition has made me more interested in the program. I'm normally pretty skeptical of bootcamps and career-training programs, so I'm not taking the decision lightly. One thing that interests me about this program is that it's around 10 months and includes an unpaid apprenticeship, which would give me an opportunity to get some hands-on experience and potentially have something relevant to put on my resume. I actually considered joining their September cohort but decided to hold off until January so I could spend the next few months doing as much research as possible before committing. The biggest thing giving me pause is the cost. I would need to take out a loan to pay for the program, so I want to be very confident that I'm making a smart investment rather than making an impulse decision because I'm currently unemployed. I'm fully aware that completing a program doesn't guarantee a job, and I'm not expecting to go from zero experience to a six-figure DevOps job immediately. I'm prepared for the possibility that I'll need to start in an entry-level IT/Linux role and work my way up. For those who currently work in Linux, System Administration, DevOps, SRE, or related fields: Is a program like this actually worth paying for, or would you recommend going the self-study/certification route? Has anyone here completed Yellow Tail Tech's program? What was your experience? How valuable is the apprenticeship portion when trying to land that first IT job? Given my background in software sales, would you see that as an advantage, disadvantage, or mostly irrelevant when applying for technical roles? If you were in my position, what would you do over the next 6–12 months to make yourself employable? Are there specific certifications, projects, or skills you'd prioritize before spending money on a program like this? I'm not necessarily looking for someone to tell me whether I should or shouldn't do the program. I'm more interested in hearing from people who have actually made a similar career transition and what you would do differently if you were starting over. Any honest feedback, including criticism of the plan, would be greatly appreciated. submitted by /u/Cheem1014 to r/sysadmin [link] [comments]

Hello I’m 28 years old. I’m not married, I don’t have a partner. I don’t have children. I don’t have pets. I’m on my own for everything at the moment. I’m currently enrolled in an apprenticeship in Networks & Systems Administration (Sysadmin). I recently got an internship offer at Google. I’m in Belgium, so this type of opportunity, especially as a student, is very rare and hard to get here. I’m very excited about this opportunity, but there are some elements I need to seriously take into account before jumping on it: - Commute (from Monday to Friday): 245km (150 miles) per day. Leave home at 7:00AM and drive for 100 minutes, leave work at 6:00PM and drive back home for 100 minutes. That’s best case scenario, without traffic jams. Highways here often have heavy traffic jams, so honestly I’m probably looking at a 120-minute/2-hour commute for a single trip on most days. Which means I’d get home at around 8:00PM. Here, shops close at 6:00PM and supermarkets at 8:00PM. Working from home isn’t possible during the internship. - School obligations: I have class on every Saturday from 09:00AM until 4:00PM. - Transportation: No public transport reaches the workplace. I’d have to use my personal car and pay for the fuel costs. My car is from 2023 and has 7000km (4500 miles). From my calculations, I’d have to spend about 600€ ($700) per month on fuel alone. The increased wear and tear on my car means that I’ll have to get car maintenance twice per year, so I’d be spending about 400€ ($460) for car maintenance each year, instead of the usual 150-180€. The workplace is located in an area where it snows a lot during winter, so I’d have to spend about 500€ ($580) on new winter tyres the first year. - Income: The internship pays 1000€ ($1200) per month, or 12K€ ($14.4K) per year, which isn’t enough to cover all of my monthly expenses. No possible help from my family. I’d have to take about 500€ ($580) out of my savings each month to cover all of my expenses for 2 years. By my calculations, my savings can juuusssttt cover my expenses for the 2 years. I won’t have much left after that. If something happens to my car, I won’t have enough money to replace it. - Long-term and after the internship: The recruiter told me that because of my profile, and if the internship goes great, it’s highly likely that I will be offered a permanent contract after the internship. But a lot can happen in 2 years, so who really knows… Worst case, I have the experience of working for Google and it looks great on my CV. For 2 years, and maybe more, my professional life will be great, but my personal and social life will be non-existent. Is an internship at Google worth that? I value my time with my friends and my time doing sports activities a lot, I really need that to change my mind and decompress, but I also want to build a good career. I also received other internship offers from 2 other companies. These companies are a lot closer to me. I’d have to drive 15 minutes to get there. But they’re both small MSP companies and my role would be Helpdesk in a 3-people team and no access to infrastructure at all, basically just answering the phone and solving problems from a distance. But at Google, I would be part of a big team, I would be mentored by a senior employee and I would work with infrastructure every day. Google checks all of the boxes for me. Except for the fact that it’s really far away. What would you do if you were in my place? Thanks! submitted by /u/bluedorar to r/sysadmin [link] [comments]

I have been working on something around AI efficiency metrics and what a scoring system could look like to make users within our company pick a model better. The scoring is based on our own data. Not sure if its right or wrong but it gives me a starting point. https://www.linkedin.com/pulse/thought-efficiency-index-tei-experiment-measuring-ai-jason-ward-mba-gibxc?lipi=urn%3Ali%3Apage%3Ad_flagship3_messaging_conversation_detail%3BkD2D4%2FRjRSaaa%2FVNaLwE9g%3D%3D submitted by /u/DifficultyIcy454 to r/FinOps [link] [comments]

submitted by /u/heldsteel7 to r/FinOps [link] [comments]

submitted by /u/easybits_ai to r/FinOps [link] [comments]

We’re seeing a 300–400% increase in VMware licensing costs. On top of that, recent quotes from Dell are three to four times higher than we would normally expect, especially for memory and storage. Fortunately, we refreshed our storage environment about a year ago and went all-in on Pure Storage as-a-Service, its the only predictable fixed dollar amount subscription at this point, so we don’t have a major SAN lift-and-replace looming. Given today’s pricing, I can only imagine what that would cost now. We’re also in a good position on the compute side. Production is running almost entirely on current-generation Dell R7xx servers, which means we could pause hardware procurement for two or three years and likely remain under active maintenance without much operational risk. That said, simply kicking the can down the road doesn’t feel like a sustainable strategy. We would eventually be facing a large, simultaneous refresh—potentially at even higher hardware and licensing costs. Our on-prem footprint is relatively small: two three-node clusters, each with 192 cores, 4 TB of memory, and 23 TB of low-latency NVMe storage, plus a handful of high-performance, dedicated ERP/database and dedicated backup servers. At this point, I’m genuinely questioning whether continuing to operate our own data center will remain economically viable. What are other on-prem shops doing? Are you maintaining staggered refresh cycles, extending hardware lifespans, moving away from VMware, switching vendors, buying refurbished equipment, or shifting more workloads to the cloud? I also have to assume these increases will eventually ripple through to IaaS pricing from AWS, Azure, and other cloud providers. Those of you in similar situations, how are you approaching this? submitted by /u/-c3rberus- to r/sysadmin [link] [comments]

Built this to run inside our own AWS account which utlizes Redshift, RDS, S3 and Amazon bedrock, and it might be useful to others here. It's one stateless Node container plus a Postgres (Supabase) project. Runs fine on ECS/Fargate, App Runner, EKS, or plain EC2 — /api/health for ALB target-group checks, no sticky sessions, no local state, so it scales horizontally behind an ALB. Background work (scheduled refreshes, syncs) is coordinated through the database with a cross-instance lease, and DISABLE_INPROCESS_SCHEDULER pins it to one task if you'd rather. AWS-relevant bits: Redshift, Athena, RDS/Aurora (Postgres + MySQL) queried read-only in place, with connection pooling Bedrock as a model provider (or OpenAI/Anthropic/OpenRouter/Ollama — your keys, direct from your account, nothing proxied through me) Outbound calls honour HTTPS_PROXY/NO_PROXY for accounts with no direct egress SSRF guard blocks 169.254.169.254 and link-local ranges while deliberately allowing private ranges, so a Redshift cluster in your VPC works but a prompt can't talk the instance metadata endpoint into handing over role credentials Governance: read-only SQL enforcement, RLS on every table, hash-chained audit log, per-user spend caps, full cost traces. Honest bits: needs a Supabase project specifically (Postgres + auth + storage + pgvector — self-hostable, or their free tier), no SOC 2, no pentest report, and it's source-available under Elastic License 2.0, not OSI open source — run it for yourself and your clients, just don't resell it as a hosted service. github.com/AgentSwarms-fyi/agentswarms — happy to talk architecture. submitted by /u/Outside-Risk-8912 to r/aws [link] [comments]

We received an email about PostgreSQL versions 11, 12, and 13 are all going into extended support and costs will increase starting 9/1. There isn't any information on how much more the cost will be. We only have two DB instances running on the affected versions, so hopefully it won't be much of an impact, but does anyone know how to find out pricing for the extended support? I've already spoke with the business unit that uses the database and they can be upgraded eventually just not at the moment. Also, I inherited this environment this week and this was one of the first emails I've received so... good start :) submitted by /u/No_Ring1809 to r/sysadmin [link] [comments]

https://preview.redd.it/xwwdz2ozw9kh1.png?width=1246&format=png&auto=webp&s=f19f1cfadf6e4e48d2f56a0135f3fd5e49011bd1 Today, I passed CKS with 75% (not a good score) and wrote a detailed blog about my exam experience, preparation approach, the resources I used, and the Kubernetes security topics that helped me the most. DMs are open if you are preparing for the exam. I can help with whatever is still fresh in my memory. My biggest takeaway: CKS is noticeably harder than CKAD and CKA. It is not only about knowing Kubernetes commands. You need to understand why a configuration is insecure, how to fix it, and how to verify that your change actually worked. The biggest mistake I made was spending around 10–15 minutes too long on one question because I felt I was close to solving it. That created unnecessary pressure towards the end and probably led to a couple of avoidable mistakes. So my strongest advice is: if you are stuck and don’t see a clear path after a few minutes, mark the question and move on. A few things that helped me: Don’t memorise solutions. Understand the security reasoning behind them. If a NetworkPolicy, API server flag, securityContext, audit policy, or admission control changes slightly, memorised YAML will not help much. Always verify your work. Security changes can easily break workloads or cluster components. Check Pods, control-plane components, logs, services, NetworkPolicy connectivity, admission behaviour, audit logs, node readiness, and systemd services wherever required. Be comfortable with Linux as well as Kubernetes. CKS can require you to work with configuration files, systemd services, container runtimes, permissions, certificates, and node-level settings. Use documentation whenever required instead of trying to remember every flag or custom resource. Topics I would strongly recommend practicing: Kubelet and etcd hardening kube-apiserver authentication and authorization Admission controls and ImagePolicyWebhook Secure Dockerfiles and non-root containers Container immutability and securityContext Audit policies and API server logging NetworkPolicy HTTPS Ingress and TLS ServiceAccount token security Worker node administration and upgrades SBOM and software supply-chain security Restricted Pod Security Standard Docker/container runtime hardening Istio STRICT mTLS Cilium network security CIS benchmarks and kube-bench remediation Resources I used: KodeKloud CKS course KodeKloud Ultimate Mock Exam Series iximiuz Labs KillerKoda Killer.sh CKS simulator ChatGPT/Claude for topics that needed a simpler explanation or extra practice scenarios Between the KodeKloud course mocks and Ultimate Mock Exam Series, I had around six mock exams. I found them very useful and reasonably close to the level of difficulty you should prepare for. Killer.sh felt a little off-track compared with the actual exam in some areas, but I would still recommend doing it. It is useful for practicing under time pressure, discovering knowledge gaps, and improving troubleshooting skills. I also used ChatGPT and Claude quite a lot during preparation. CKS has many small security topics, and sometimes a course or lab explanation may not immediately click. In those cases, asking AI to explain the concept differently, compare configurations, or generate a small practice scenario was very useful. The simplest advice I can give is: practice a lot, understand the security reasoning behind what you are doing, verify every change, and don’t let one difficult question consume your exam time. I also wrote a full blog with more details on my preparation strategy, resources, task areas, mistakes, and lessons from the exam. Blog: https://blog.prateekjain.dev/cks-exam-experience-2026-preparation-strategy-and-lessons-learned-1fad785a430b?sk=52b58a9c6d812444bc1340f15eda7dd6 submitted by /u/root0ps to r/devops [link] [comments]

submitted by /u/HiHiRedditUser to r/FinOps [link] [comments]