All posts
8 posts · IaC
Terraform remote state and locking on S3 and DynamoDBMove Terraform state off your laptop into an encrypted S3 or GCS backend with locking, so two applies never race and corrupt your infrastructure.May 5, 2026 · 9 minIntermediateterraformawsScanning Terraform with Checkov before you applyCatch public buckets and open security groups in the plan — in CI, with suppressions that expire and a clean baseline.Feb 12, 2026 · 8 minIntermediateterraformcheckovPolicy-as-code for Terraform: tfsec and OPA in reviewCatch public buckets and open security groups in the plan, not in prod. Policies live next to the modules they guard.Dec 16, 2025 · 10 minIntermediateterraformopaWriting reusable Terraform modules that don't fight youDesign modules with clear inputs and outputs, sane defaults, and versioning so teams reuse them without forking.Oct 15, 2025 · 10 minIntermediateterraformmodulesTerraform workspaces vs directories for environmentsWhen workspaces help and when separate directories are safer for dev, staging, and prod — with the tradeoffs.Mar 11, 2025 · 8 minIntermediateterraformworkspacesTerragrunt: keeping 30 environments DRYStop copy-pasting backend and provider blocks across environments — generate them and keep inputs in one place.Nov 19, 2024 · 11 minAdvancedterragruntterraformImporting existing infrastructure into Terraform stateBring click-ops resources under Terraform with import blocks and generated config — without recreating them.Sep 10, 2024 · 8 minIntermediateterraformimportPulumi vs Terraform: choosing your IaC toolReal programming languages vs HCL: how state handling, unit testing, blast radius, and your team's skills should decide between Pulumi and Terraform.Jul 30, 2024 · 7 minBeginnerpulumiterraform