Program JavaZone

Foredrag Onsdag 2. september

No More Forks: Policy Transformation for Terraform at Scale

– Room 3

Engelsk 1 t Terraform Compliance best-practices

Foredragsholder

Anton Babenko

LinkedIn X

Anton is an AWS Community Hero and helps companies around the globe build solutions using AWS, and specializes in infrastructure-as-code, DevOps, and reusable infrastructure components.

He spends much of his time as an open-source contributor on various Terraform & AWS projects, such as Terraform AWS modules (downloaded more than 2 billion times), Terraform best practices ebook (www.terraform-best-practices.com), doing serverless with Terraform (serverless.tf), Terraform Weekly (weekly.tf), Your Weekly Dose of Terraform (http://bit.ly/terraform-youtube).

Om sesjonen

Every org enforcing Terraform standards eventually hits the same wall: policy tools can flag issues, but they cannot fix module code. The result is a graveyard of forked modules that drift from upstream and turn upgrades into a full-time job. This talk introduces policy transformation: automatically rewriting Terraform modules at download time so teams get compliant code without maintaining forks.

I will demo eight real transformation rules across four categories: lifecycle management (prevent_destroy, ignore tag drift, protect KMS keys), block removal (strip provisioners), attribute restriction (deny GPU or specialty instances), and content sanitization (safe regex cleanups). You will see the before-and-after HCL, plus the safety model that makes this production-ready: deterministic outputs, collision detection, preview diffs, and a four-level risk classification.

You will leave with a practical decision framework for validate vs transform, a DIY toolkit using pre-commit, hclwrite, custom tflint rules, and plan validation, and a simple migration path from module forks to rule-based enforcement. No vendor account required to apply the patterns from this talk.

Passer for

Platform and DevOps engineers tired of maintaining forked Terraform modules, security engineers writing OPA or Sentinel who want policies that do more than just fail plans, and infra leads looking to enforce standards across teams

Samtidig i programmet

  1. Å skifte vinger i lufta eller hjul mens sykkelen er i nedoverbakke: Modernisering av samfunnskritiske systemer uten høye skuldre Room 1
  2. Hexagonal happiness! Room 2
  3. Global Cultural Reflections on Software Testing Practices Room 4
  4. Your Database Sprawl is a 1990s Workaround, Give it a KISS Room 5
  5. Nyheter i JavaScript - ES2026 Room 6
  6. Managing the chaos: Automating internal dependency upgrades with OpenRewrite Room 7
  7. Gentle Introduction to Lock-Free Programming in Java Room 8
  8. Korleis me gjekk frå React til CSS hos Designsystemet Room 6
  9. Få oversikt over JSON med JSONata-spørringer Room 6
  10. Stop Writing API Clients — Let the Spec Do It Room 6