Infrastructure as Code

**Judgement:** Strong, practical Infrastructure-as-Code reference focused on AWS with Terraform, CloudFormation, and Pulumi. It’s especially good for engineers who already know basic cloud concepts and want concrete IaC patterns and commands they can apply directly. **What it does well** - Gives full, realistic examples: AWS VPC, public/private subnets, Internet gateway, route tables, security groups, EC2, S3 static website, RDS Postgres, Lambda + IAM. - Covers full workflows for all tools: - **Terraform:** init, plan/apply/destroy, fmt/validate, remote state (S3 + DynamoDB), state commands, imports, workspaces, and multi-environment patterns. - **CloudFormation:** template structure, parameters/conditions, VPC + EC2 + RDS example, and CLI usage including change sets. - **Pulumi (TS/Python):** simple but complete examples plus stacks, per-env config, and secrets handling. - Includes operational and debugging guidance: drift detection (`plan -refresh-only`), tainted resources, lock handling, provider version conflicts, circular dependencies, and cost estimation with Infracost. - Emphasizes good practices: tagging, remote state, not storing secrets in `.tf`/`terraform.tfvars`, pinning provider versions, `prevent_destroy` for stateful resources, and using change sets / previews. **Risks / limitations** - **AWS-centric:** While Terraform is by nature multi-cloud, almost all concrete examples are AWS-only; there’s little guidance for GCP/Azure specifics. - **Security posture:** - S3 static website example intentionally configures public read access and disables some public-access blocks. That’s appropriate for public sites but could be misapplied to sensitive buckets without extra warnings. - IAM examples are minimal (Lambda basic execution); there’s no deep coverage of least-privilege policies, org-level guardrails, or compliance. - **Destructive operations:** Includes commands like `terraform destroy`, `pulumi destroy`, and `cloudformation delete-stack` without explicit, repeated warnings about their irreversibility in production contexts. - **Depth boundaries:** Excellent for standard app stacks and workflows, but doesn’t go deep into complex topics like large-scale module design, multi-account/landing zone patterns, GitOps workflows, or policy-as-code (OPA/Conftest, Sentinel, etc.). **Recommended scenarios** Use this skill when: - You are building or extending **AWS infrastructure** with Terraform, CloudFormation, or Pulumi and want solid, production-like example code. - You need to **set up Terraform correctly** from the start: remote state in S3, DynamoDB locks, workspaces, environment-specific variable files, and imports of existing resources. - You’re introducing **multi-environment (dev/staging/prod)** workflows and want clear patterns for both Terraform and Pulumi. - You’re troubleshooting **Terraform state/drift issues** or provider/version problems and want concrete commands and approaches. - You want a concise but practical reference for **CloudFormation change sets** or **Pulumi stacks/config** rather than reading all of the official docs. Avoid relying on it as your sole guide for: - Highly regulated or security-critical environments where you need detailed IAM, network security, and compliance patterns. - Non-AWS cloud providers, advanced enterprise IaC architectures, or opinionated organizational patterns (landing zones, multi-account governance).