Sign your own binaries with go-tool-base, part 2: a signing key in AWS KMS
Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.
Tags
12 pages
OpenTofu
The security service I had to switch off
A fresh AWS account cannot enable GuardDuty or Security Hub without a subscription, so the security baseline failed on the account it protects.
Two bugs that taught me the rules
Two CI and infrastructure bugs with one shape: a GitLab job with no rules block skips merge requests, and an import block runs only once.
Reviewed, then applied
Closing the plan-versus-apply gap in infrastructure CI by applying the saved plan artifact rather than quietly re-planning at apply time.
One graph, not micro-stacks
Why an infrastructure repo stays one OpenTofu graph rather than splitting into per-concern stacks: the engine enforces ordering for free.
CI you include, not copy
Copied .gitlab-ci.yml files drift out of sync. How GitLab CI/CD Components let a repo include and version-pin a shared pipeline instead.
Why I hand-rolled every module
Why security-critical infrastructure got raw resources rather than community wrapper modules, and what that actually cost in lines and in review.
Hardening the account that will hold the keys
Applying a security baseline to a fresh AWS account: audit logging, config recording, threat detection and an operator role that is not root.
Two layers of tags, and which one wins
AWS tagging in two layers: account-wide invariants on the provider default tags, resource specifics in the module, and which one wins on a clash.
The chicken-and-egg of remote state
The bootstrap stack has to create the bucket its own state lives in. Applying once with a local backend, then migrating the state into it.
