Enforcing AWS Resource Tags with OPA
Check a Terraform plan for required AWS tags and allowed values with OPA: common and per-environment rules, plus a whitelist of exempt resources.
Hugo on S3 and CloudFront with Terraform and GitHub Actions OIDC
How this site runs: Hugo on S3 behind CloudFront, a CloudFront Function for index.html routing, Terraform public modules and GitHub Actions over OIDC.
Testing Terraform Plans with OPA and Conftest (and Atlantis)
A Rego policy that blocks S3 buckets with force_destroy in the Terraform plan, tested with the OPA CLI and Conftest and run in Atlantis or any CI pipeline.
Shift-Left Cost Checks for Terraform with OPA and Terracost
Catch cloud cost problems before apply: OPA policies that block expensive resources in the plan, Infracost estimates and self-hosted Terracost on MySQL.