The post walks through how to use the Open Policy Agent to enforce Terraform policies that restrict instance types, require tags, and block public exposure. You will learn how to convert Terraform plans to JSON and run OPA checks in CI/CD pipelines so every pull request is validated before apply.

Manu Chandrasekhar demonstrates how to extract the full AWS provider schema using terraform providers schema command and jq queries. You will discover hidden capabilities like actions for CloudFront cache invalidation, ephemeral resources, list resources for importing existing infrastructure, and provider functions.

Rayane Kadi walks through hardening a serverless AWS platform by replacing shared credentials with IAM Identity Center and enforcing least privilege through scoped permissions. The modular Terraform setup covers role-based access for five team types plus security layers like CloudFront and WAF.

Compliance.tf introduces a private Terraform registry that embeds compliance controls directly into popular AWS modules. Instead of scanning code after writing it and fixing findings, you get guardrails that block misconfigurations at plan time by simply changing the module source URL.

Learn how to validate compliance.tf modules with IaC scanners before deployment and infrastructure scanners after, what evidence auditors need, and how pre-apply and post-apply verification work together.

I recommend this project by Luc van Donkersgoed (fellow AWS Hero) to help you keep track of AWS news and blogs in one place. See what's hot, read summaries, search, set bookmarks and ratings, and categorize articles with tags.