Wire up an AWS billing alarm before the surprise
Setting up an AWS billing alarm before you need one, with a KMS gotcha in the middle that stops the alert ever reaching you.
Tags
6 pages
Terraform
Sign your own binaries with go-tool-base, part 2: a signing key in AWS KMS
Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.
One graph, not micro-stacks
Why an infrastructure repo stays one OpenTofu graph rather than splitting into per-concern stacks: the engine enforces ordering for free.
Why I hand-rolled every module
Why security-critical infrastructure got raw resources rather than community wrapper modules, and what that actually cost in lines and in review.
The chicken-and-egg of remote state
The bootstrap stack has to create the bucket its own state lives in. Applying once with a local backend, then migrating the state into it.
The bootstrap that does almost nothing
An AWS bootstrap module that does exactly three things, and writes down what it deliberately does not do. Scope as a design decision.
