Why I hand-rolled every module
Why security-critical infrastructure got raw resources rather than community wrapper modules, and what that actually cost in lines and in review.
Categories
21 pages
infrastructure
The reusable AWS building blocks I lean on, all public: Terraform modules and tooling for bootstrapping an account, enforcing a security baseline and managing KMS-backed signing keys. Built for my own use, and yours.
Hardening the account that will hold the keys
Applying a security baseline to a fresh AWS account: audit logging, config recording, threat detection and an operator role that is not root.
No access keys in CI
Replacing long-lived AWS access keys in CI with OIDC federation, so the pipeline mints a short-lived token instead of holding a secret.
Two layers of tags, and which one wins
AWS tagging in two layers: account-wide invariants on the provider default tags, resource specifics in the module, and which one wins on a clash.
The chicken-and-egg of remote state
The bootstrap stack has to create the bucket its own state lives in. Applying once with a local backend, then migrating the state into it.
The cleanup tool that almost deleted its own hands
Reading an aws-nuke dry run: the screenfuls of red are harmless noise, and the real hazard is one quiet line in the middle of them.
The security finding you must not fix
A checkov finding you must suppress rather than fix: that KMS policy statement is the escape hatch that stops you locking yourself out for good.
A state bucket that defends itself
An OpenTofu state bucket that defends itself against corruption, deletion and its own operator, using lockfiles and prevent_destroy.
The bootstrap that does almost nothing
An AWS bootstrap module that does exactly three things, and writes down what it deliberately does not do. Scope as a design decision.
A signing key needs somewhere to live
A checksum hosted beside your download stops accidents, not a compromised platform. Why the signing key has to live somewhere you control.
