Tagged
On a 40-account AWS Organization, platform baseline via CloudFormation StackSets (Hooks, GuardDuty enroll) plus app teams on Terraform/OpenTofu cut org-wide guardrail rollout from 9 weeks to 3 — without forcing one tool for everything.
June 2026 benchmark on the same read-only AWS scaffold: OpenTofu 1.12 plan median 5.2s vs Pulumi 3.248 preview median 10.6s—plus when to pick HCL over TypeScript on landing zones.
May 2026 guidance with a reproducible scaffold—9 artefact files, 0 Terraform-managed creates at plan baseline, anchored to official OpenTofu, HashiCorp, and Ansible project documentation.
July 2026 Terraform command reference for AWS — Terraform 1.10+ plan/apply/state, use_lockfile, import/removed/ephemeral, and the five Monday-morning checks that close real failure modes.
July 2026 production walkthrough of Anton Babenko's Terraform Claude Skill on AWS — VPC, EKS, S3 + KMS, IAM OIDC — with measured scorecards, five gaps the skill still won't cover, and a reproducible eval harness.
Most DevOps guides teach what AWS services are. Production teaches what happens when 200 engineers use them together. Here's the gap.
Terraform to OpenTofu migration: compatibility, risks, tools, and production deployment patterns for AWS infrastructure.
Detect AWS config drift with terraform plan + Config. July 2026 runbook: schedule, triage, prevent console writes.
One bad `terraform apply` still deletes databases. July 2026: plan→review→apply, no -auto-approve, OIDC CI, Atlantis/HCP Terraform gates.
AWS provider 6.0 GA June 2025. July 2026: upgrade 4→5→6 one major at a time, changelog-first, staging plan, lockfile commit.
Terraform on AWS: import, state mv/rm, stuck locks. July 2026 — S3 use_lockfile (TF 1.10+); DynamoDB locking is legacy.
CI/CD infrastructure is invisible until your DevOps bill hits $15,000/month. Build minutes, artifact storage, and ephemeral environments accumulate costs that few teams track. Here is how to measure and control them.