AWS Lambda

So Cirrus is really quite lightweight.

The core components are two Lambda functions that manage state and a DynamoDB table here.

Around them, we just put a handful of things.

We've got an input SQS queue where users put payloads to be processed, and output messages like published items or workflow events flow to output SNS topics.

Workflows are run via AWS step functions, and tasks within those workflows generally leverage either Lambda or AWS Batch for compute.

It's simple, but it's a robust and featureful system.

Now, originally, all of this was distributed as a file directory tree.

Because in the industry, lift and shift means you just grab your stuff, move it up to the cloud, do something like that.

What the reality is, we had to break down all our processing steps that were built on things like Fortran code and redo that all as AWS Lambdas.

So it was a large effort to move all that data, move our processing over there.

And so we're sort of in this pink spot here right now.

For example, disabling tool access, modifying network controls, or revoking credentials.

This is where services such as AWS Lambda, AWS Step Functions, EventBridge, Systems Manager, IAM, CloudWatch, CloudTrail, GuardDuty, and Security Hub can become components of an automated security response architecture.

The goal is not to create another isolated AI security stack.

The goal is to extend the security architecture you already have.

As organizations move from co-pilots to autonomous agents and eventually to multi-agent ecosystems, these foundations will become increasingly important.

AWS already provides many of the building blocks.

IAM and STS for identity, CloudTrail for auditability, CloudWatch for telemetry, GuardDuty for threat detection, Security Hub for centralized security operations, KMS for cryptographic protection, VPC controls for isolation, and Lambda and Step functions for automated response orchestration.

The architectural challenge is to bring these capabilities together into a coherent control plane for agentic workloads.

Let's see what AWS has for us this week.

Lambda functions now support full IAM resource-based policies.

After 12 short years, my CloudFormation or CDK files for deploying Lambda's function, which, yes, is how you pluralize it, are no longer 80% IAM by volume.

Unfortunately, this is just in time for me to not care since it's Claude's problem now.

AWS Security Agent, now part of AWS Continuum, now supports budget controls and finding revalidation.

This is code that AWS publishes but does not operate, fixing it thus falls to the customer.

We start with four consecutive free RTOS kernel CVEs that read like a bulk order, where AWS's exposure is a web page and yours is a truck roll to microcontrollers with no OTA update path.

Then comes the Neptune Federated Query Connector, a Lambda function you adopted from a repo and now own forever like an incontinent chihuahua, whatever the word managed implied at adoption time.