The AI-Native Internal Developer Platform
IDP adoption has always been hard. AI coding assistants change that — and force us to rethink who the platform's customers actually are.
aws_oam_sink and aws_oam_link in Terraform: Centralized AWS Observability (Part 2)
Terraform for CloudWatch cross-account observability: aws_oam_sink and aws_oam_link for metrics, plus CloudWatch Logs centralization rules, with code snippets.
Centralized AWS Observability Architecture: CloudWatch, YACE and Grafana (Part 1)
How we chose an observability stack for multi-account AWS and on-prem workloads: Grafana, Prometheus, YACE and LGTM, and the reasons behind each pick.
Allow Only Approved AMIs in Terraform with OPA
An OPA policy that fails the Terraform plan when an EC2 instance uses an AMI that isn't on an approved list, with the list kept in an external JSON data file.
Enforcing AWS Resource Tags with OPA
Check a Terraform plan for required AWS tags and allowed values with OPA: common and per-environment rules, plus a whitelist of exempt resources.
Hugo on S3 and CloudFront with Terraform and GitHub Actions OIDC
How this site runs: Hugo on S3 behind CloudFront, a CloudFront Function for index.html routing, Terraform public modules and GitHub Actions over OIDC.
Testing Terraform Plans with OPA and Conftest (and Atlantis)
A Rego policy that blocks S3 buckets with force_destroy in the Terraform plan, tested with the OPA CLI and Conftest and run in Atlantis or any CI pipeline.
How I Learned the Hard Way That Terraform Needs Policy as Code
A deleted Terraform state bucket forced a rebuild of 15 AWS accounts. How it became a policy-as-code guardrail that stops dangerous changes at plan time.
Shift-Left Cost Checks for Terraform with OPA and Terracost
Catch cloud cost problems before apply: OPA policies that block expensive resources in the plan, Infracost estimates and self-hosted Terracost on MySQL.