First steps

As I mentioned in my previous blog post, my first OPA policy was just to catch one simple parameter, if we have in the S3 Terrafom module set the force_destroy = true.

Here’s a simple OPA policy that will catch this dangerous configuration:

package terraform.plan

deny[msg] {
    # Find all resources in the plan
    resource := input.resource_changes[_]
    
    # Check if it's an S3 bucket
    resource.type == "aws_s3_bucket"
    
    # Look for force_destroy in the configuration
    resource.change.after.force_destroy == true
    
    msg := sprintf("S3 bucket '%s' has force_destroy set to true. This is dangerous as it allows bucket deletion even when not empty.", [resource.address])
}

This policy works by:

Why Cloudy mountains

Reading time: 0 minutes and 37 seconds

In the fast-evolving world of cloud computing, managing costs effectively has become a crucial aspect of maintaining a sustainable and profitable business. The “Shift left” paradigm, originally a concept in software development, emphasizes the importance of addressing potential issues early in the development process. When applied to AWS cost optimization and management, this approach ensures that cost considerations are integrated into the earliest stages of the development lifecycle.

By shifting cost management left, organizations can avoid unexpected expenses and optimize their cloud spending proactively. This blog post explores the application of the “Shift left” paradigm to AWS cost optimization, focusing on tools like Open Policy Agent (OPA) policies, Infracost, and Terracost. We will delve into how these tools can help estimate and control costs efficiently, ensuring that your AWS resources are both cost-effective and aligned with your financial goals.

How I Learned the Hard Way That Terraform Needs Policy as Code

Reading time: 3 minutes and 14 seconds

A few years ago, while working for a cloud consultancy company, I made a mistake that I will never forget. It was the kind of mistake that keeps DevOps engineers up at night. I accidentally deleted a Terraform state bucket—an S3 bucket that stored the state for bootstrapping 15 AWS accounts, each packed with resources. To make things worse, this wasn’t just any bucket—it belonged to a very tough client.

Using Shift Left paradigm to manage cloud cost

Reading time: 6 minutes and 9 seconds

Start small using OPA

First steps

Why Cloudy mountains

How I Learned the Hard Way That Terraform Needs Policy as Code

Using Shift Left paradigm to manage cloud cost

Introduction