Ad: Terragrunt is a band-aid. See what replaces it at Stategraph Demo Day, live on November 4.

Terraform locks the whole state, so teams split it and use Terragrunt to wire the pieces back together. Stategraph replaces the state file with a dependency graph. A change that spans several states is one plan and one apply. Nothing is mocked, no run-all. It locks only the resources you’re changing, and nothing in your HCL changes. Terraform and OpenTofu. Live demo and open Q&A with the people writing the code, 30 minutes, recorded.

Articles 📚

From Terminal to Terraform, The Consistently Costly Side of Code

Robert Glenn traces how sysadmins became software engineers once cloud and declarative IaC arrived, and why HCL's flexibility leaves quality up to you. His point is that AI agents write code fast, but the hard calls on design and operations remain expensive.

Medium • Robert Glenn

Security as Code: Terraform Operations on AWS in the Age of Frontier Agents

Alam Ahmed argues that as AWS agents like Kiro and the Security Agent write and review code at machine speed, the pipeline must become the control plane. Expect layered defenses, OPA and Checkov gates, state hardening, drift checks, and a 90 day rollout plan.

DEV Community

What If Your AWS Bill Suddenly Doubled? Build a Cost Anomaly Detector with Terraform

Sudip Paramanik builds a serverless watchdog that compares yesterday's AWS spend with a seven day average and emails you through SNS when it spikes. Terraform wires up Lambda, EventBridge, Cost Explorer, and IAM, with honest notes on its limits and where to take it next.

Sudip Paramanik

Building a Secure Terraform and OpenTofu Artifact Distribution Platform with OpenDepot

Yevgeni Shapiro walks through OpenDepot, a Kubernetes controller setup that discovers upstream releases, scans and checksums them, then stores approved artifacts in S3. The takeaway is to treat discovery and promotion as separate steps in your supply chain.

Yevgeni Shapiro

Open-source projects

terragucci

Intentius presents terragucci, an Apache 2.0 workflow that plans, approves, and applies hundreds of Terraform and OpenTofu roots from pull requests inside your own CI. Expect approval gated waves, grouped plan notes, OpenTelemetry traces, and no server to run.

terragucci

Remote EU Jobs 🇪🇺

Three Terraform-heavy infrastructure roles: two remote across the EU, one open worldwide.

Engineering Manager, Kubernetes at Spacelift (Remote, EU)
kubernetes · argocd · terraform · opentofu · go
Founding manager for a new Kubernetes application-delivery product: hire the team and own the architecture for release promotion across environments on top of the customer's existing Argo CD, with Terraform and OpenTofu outputs from Spacelift flowing into application config and a Terraform provider of its own. Asks for recent hands-on engineering, production Argo CD or Flux, and working knowledge of Terraform or OpenTofu. Note: B2B contract.

DevSecOps Platform Engineer at Cloudera (Remote: Poland, Czechia, Hungary, Spain)
terraform · kubernetes · argocd · istio · opa · vault
An everything-as-code operating platform: modular Terraform primitives and GitOps patterns for multi-cloud Kubernetes (EKS and AKS), software-defined networks and pod identity, with OPA/Rego policy gates in the pipelines, Istio/Envoy at the edge and keyless identity via OIDC and Vault. Asks for high proficiency in Terraform module design and 5+ years of production Kubernetes.

Senior Infrastructure Engineer at Buffer (Worldwide)
aws · terraform · kubernetes · argocd · cloudflare
Joins two infrastructure engineers running EKS, ArgoCD and an AWS estate mostly managed in Terraform; the posting wants someone who defaults to modules and "can say what happens when a plan touches something load-bearing", and lists an open-source Terraform module you've contributed as a bonus. Also owns progressive delivery with Argo Rollouts. $164.6K–212.7K plus equity. Note: prefers 4 hours of EMEA overlap, open to candidates anywhere.

More EU-remote roles like these, biweekly from Jobs Brief. Free, every role takeable remotely from anywhere in the EU, and every one taken straight from a company's own career page rather than aggregated from job boards.

Feedback ❤

If you have feedback to share or are interested in sponsoring this newsletter, feel free to reach out via Twitter / X, LinkedIn, BlueSky, or simply reply to this email.

Sharing is caring! Please spread the word by sharing this newsletter with your friends and colleagues—it helps grow the Terraform community and supports this weekly effort.

Also, if you are working on compliance, security, or standardization for Terraform at scale, check out compliance.tf. It is a growing library of compliance-mapped Terraform modules and controls designed to make it easier to ship secure, audit-ready infrastructure with less friction.

PS: One of the best ways to support Ukraine is by donating to savelife.in.ua

Glory to Ukraine! 🇺🇦

Keep Reading

View more
caret-right
© 2026 Terraform Weekly.
beehiivPowered by beehiiv