Infrastructure as Code

IaC is one of those things that's only as good as the second person to use it. Module that worked great for the original author? Confusing for the next team. State file in someone's laptop? Time bomb. No drift detection? Click-ops returns by Q3.

I set up IaC the way it survives.

What I deliver

Module catalog — Composable, versioned modules for the resources your org actually uses. Documented inputs, sensible defaults, examples. Semver discipline. Hosted privately with proper change logs.

Workspace strategy — Per-environment, per-team workspaces with clear blast radius. State stored remotely with locking. Backed up. Recoverable.

PR-driven changes — Atlantis or Terraform Cloud running plans automatically on PRs. Plans reviewed in code review. Apply gated on approvals. Audit log preserved forever.

Policy as code — OPA or Sentinel checking PRs for org policy: required tags, allowed regions, instance size caps, no public S3 buckets. Compliance shifts left.

Drift detection — Scheduled drift reports. Anything that changed outside Terraform shows up in Slack within 24 hours. Click-ops becomes visible.

What I steer you away from

Mega-monorepo with one giant state file. 'IaC by ChatGPT' modules with 200 lines and no inputs. Pulumi when you don't have a strong reason to write infra in TypeScript. Pick boring, pick composable, pick what your team can maintain.