Wire up an AWS billing alarm before the surprise
Setting up an AWS billing alarm before you need one, with a KMS gotcha in the middle that stops the alert ever reaching you.
Categories
21 pages
infrastructure
The reusable AWS building blocks I lean on, all public: Terraform modules and tooling for bootstrapping an account, enforcing a security baseline and managing KMS-backed signing keys. Built for my own use, and yours.
The security service I had to switch off
A fresh AWS account cannot enable GuardDuty or Security Hub without a subscription, so the security baseline failed on the account it protects.
Two bugs that taught me the rules
Two CI and infrastructure bugs with one shape: a GitLab job with no rules block skips merge requests, and an import block runs only once.
Reviewed, then applied
Closing the plan-versus-apply gap in infrastructure CI by applying the saved plan artifact rather than quietly re-planning at apply time.
One graph, not micro-stacks
Why an infrastructure repo stays one OpenTofu graph rather than splitting into per-concern stacks: the engine enforces ordering for free.
CI you include, not copy
Copied .gitlab-ci.yml files drift out of sync. How GitLab CI/CD Components let a repo include and version-pin a shared pipeline instead.
One image for the whole toolchain
Baking OpenTofu, tflint and trivy into a single version-pinned CI image, and publishing the scanned tarball with crane to avoid a kaniko rebuild.
A 403 you can't fix in IAM
A GitLab to AWS OIDC trust policy kept returning 403, and no IAM change fixed it: the policy matched a claim GitLab never actually asserts.
Routing security findings without the noise
Routing AWS GuardDuty and Security Hub findings so an alert still means something: forward high severity only, and drop the duplicates.
Why go-tool-base left GitHub for GitLab
An accidental major version bump was the last straw after months of unreliability. Why a Go framework moved off GitHub, and what moved with it.
