The cleanup tool that almost deleted its own hands
Reading an aws-nuke dry run: the screenfuls of red are harmless noise, and the real hazard is one quiet line in the middle of them.
Tags
14 pages
AWS
The security finding you must not fix
A checkov finding you must suppress rather than fix: that KMS policy statement is the escape hatch that stops you locking yourself out for good.
A state bucket that defends itself
An OpenTofu state bucket that defends itself against corruption, deletion and its own operator, using lockfiles and prevent_destroy.
The bootstrap that does almost nothing
An AWS bootstrap module that does exactly three things, and writes down what it deliberately does not do. Scope as a design decision.
