September 2026 Summaries

Auditing cloud spend in an inherited AWS, Azure, or Google Cloud environment requires a data-first approach because resource purpose, ownership, and cost baselines are often unclear. The recommended process begins with comparing historical billing periods and inventorying deployed resources, utilization, infrastructure-as-code definitions, and deployment pipelines before matching resources to billable line items. It then emphasizes improving tags and cost allocation to identify responsible teams, checking for configuration drift and unmanaged infrastructure, and investigating orphaned resources such as detached disks, unused IP addresses, stale snapshots, and idle services without deleting them prematurely. Organizations should right-size resources based on measured usage while accounting for legitimate needs such as disaster recovery, document inherited reservations and subscriptions, and prioritize changes that reduce costs without disrupting critical workloads. Ongoing governance—including consistent tagging, recurring audits, drift detection, FinOps tooling, and pull-request cost estimates and policies—can help prevent waste from returning, while platforms such as Spacelift are presented as tools for automating infrastructure management, policy enforcement, and cost visibility.

AI infrastructure comprises the compute, storage, networking, software, and governance layers used to train, deploy, and operate models and agents, with specialist tools needed to address GPU-intensive workloads, distributed scheduling, model serving, data management, and AI-specific operational risks. The overview groups tools into seven categories: GPU provisioning providers such as CoreWeave, Lambda, RunPod, and major cloud platforms; Kubernetes-focused orchestration tools including Kubeflow, Run:ai, Kueue, Volcano, and KubeRay; training and serving technologies such as PyTorch, JAX, vLLM, NVIDIA Dynamo, KServe, and managed cloud AI platforms; data systems including Airflow, Dagster, Snowflake Cortex AI, and Databricks; observability platforms such as Arize, LangSmith, Langfuse, Datadog, and Grafana; governance and security products including Credo AI, Lakera, and VerifyWise; and infrastructure orchestration through Spacelift. It emphasizes that organizations generally combine multiple tools rather than adopting a single end-to-end platform, and recommends evaluating options according to workload requirements, compatibility with existing systems, scalability, total cost, security, compliance, reliability, and support for open standards. The discussion also presents Spacelift as a governance layer for infrastructure-as-code and AI-generated provisioning, using policies, approvals, drift detection, audit trails, and access controls to manage changes across multiple infrastructure tools.

Infrastructure-as-code governance is presented as a security responsibility because consequential cloud configuration choices, such as access permissions, encryption, network exposure, and logging, are made in Terraform, OpenTofu, CloudFormation, Kubernetes manifests, and related code before deployment. The playbook recommends four continuous pillars: inventorying coded and unmanaged infrastructure while measuring drift and policy coverage; linking Git history, CI/CD records, and cloud logs into a reliable audit trail; introducing targeted policy-as-code checks gradually from warning to enforcement; and conducting recurring reviews of human and machine access, especially privileged CI roles and state-backend credentials. It advises prioritizing issues by potential impact and exploitability, with reusable insecure modules receiving particular urgency, and measuring progress through enforced-policy coverage, drift levels and duration, IaC adoption for changes, pipeline pass rates, and exceptions rather than raw finding totals. Common risks include treating governance as a finite project, deploying broad scanner rule sets or blocking controls too quickly, inadequately protecting Terraform state, lacking an accountable exception process, and failing to collaborate with platform and development teams. The text also describes Spacelift as an orchestration platform offering policy enforcement, drift detection, multi-IaC workflows, access features, and automated infrastructure management.

Spacelift Flows, launched on September 8, 2026, is a visual workflow automation capability designed to bring governed, auditable infrastructure-as-code practices to Day 2 operations such as incident response, provisioning, drift handling, and cleanup. Users can build workflows from connected blocks for HTTP calls, transformations, conditions, and schedules, while receiving execution logs and step-level audit trails for troubleshooting and oversight. The product supports AI-assisted workflow creation and more than 40 templates for common use cases, including incident enrichment, certificate monitoring, environment provisioning, and Jira or ServiceNow self-service requests. Flows also provides a governed way for AI agents to interact with infrastructure through MCP servers, approval gates, distinct access paths, and traceable activity. Integrated natively with Spacelift Deploy, it can respond to infrastructure events such as stack changes, runs, and drift, allowing deployment and operational automation to operate under a shared control plane, governance model, and audit trail.