AI Security & Next-Gen Terraform Ops

Join us for our next Cloud Native Seattle Meetup at the F5 Tower in downtown Seattle! 5:00pm - Doors Open 5:30pm - Networking (pizza & drinks provided) 6:00pm - Scott McAllister: Why Your WAF Can’t Read a Prompt Injection 6:30pm - Cody Gagnon: Unlocking Terraform Day-2 Ops 7:00pm - Games and more networking Talk 1: Why Your WAF Can’t Read a Prompt Injection Your WAF is very good at its job. It inspects the structure of every request and blocks the malformed ones. SQL injection has a shape. XSS has a shape. But a prompt injection has none: it's a plain, well-formed natural-language sentence that happens to also be an instruction. There's nothing for a signature to match. As we wire LLMs into our stacks, we've grown a new layer that inspects meaning, not structure — and none of our existing tooling watches it. This talk shows, with a live demo, how an ordinary-looking message walks past request inspection and makes an AI app leak data it was told to protect. We'll look at where inspection has to move to catch this, why indirect injection makes it worse, and what a solid defense actually looks like. This talk will be presented by Scott McAllister. He is a Community Evangelist at F5. He has been building software in several industries for over a decade. Now, he's helping others learn about various software development, delivery, and infrastructure principles. Talk 2: Unlocking Terraform Day-2 Ops You may have heard of Terraform — but did you know it can now assist with your Day-2 Ops? At last year's HashiConf, Terraform Actions were unveiled to handle everything from VM power state to cache purges and invalidations. Fast forward to today, and only a handful of Actions have been released by the major cloud hyperscalers. But there are more Actions out there than meets the eye. Discovering and implementing Actions is one of the most important steps toward unlocking automated Day-2 Ops — and that has been, fittingly enough, a Day-2 problem of its own. Using Azure as our proving ground, we'll unlock dozens more Actions available today through what I've coined the "gateway action." But even if you know these Actions exist, will you keep up with them? Actionize finds the Actions worth using, scaffolds them into your config, and keeps them current as providers ship more.This talk will be presented by Cody Gagnon. Cody is a Lead Cloud Engineer at Oshkosh building Azure IaC for industrial IoT. He blogs at blog.codycodes.cloud and has been hacking on Terraform Actions since HashiConf 2025.Food & drinks provided courtesy of our sponsor, F5 Networks.