The Policy-as-Code Decision That Doesn't Bite You Until Later
The policy-as-code choice between OPA and Cedar feels low-stakes at ten accounts. It stops feeling that way at 500.
Posts tagged terraform.
zopdev writing tagged terraform. Engineering and FinOps notes, post-mortems, and benchmarks.
Let an AI Agent Author Policy-as-Code, Never Override Its Verdict
Fourteen new MCP tools let an agent create, dry-run and manage IaC pull-request policies. The two withheld tools are the ones that bypass the gate.
Why Autoscaler Choice Becomes a Crisis at 10,000 Nodes
The autoscaler decision you made at 50 nodes becomes a structural liability at 10,000. By the time the cluster grows to enterprise scale, the choice is load-bearing infrastructure. Replacing it…
The 3-Month Cliff: When Policy as Code Stops Working
Policy as Code works cleanly until it meets ten teams, and then it breaks in ways the pilot never predicted. The first three months feel like a governance win. Policies deploy, violations get caught,…
The Fork That Shook Infrastructure Teams
HashiCorp's August 2023 switch from the Mozilla Public License to the Business Source License forced every infrastructure team running Terraform to make a governance decision they had not budgeted…
The 500-Resource Threshold Where Drift Becomes a Crisis
At 500 managed resources, infrastructure drift stops being a maintenance nuisance and becomes a misdiagnosis engine that corrupts incident response at the root.
The Hidden Invoice Arrives Every Quarter
Every time a team ships before governance is ready, they do not pay once. They pay every quarter the gap stays open.
The Credit Cliff: Why Free Tiers Create a False Sense of Cost Security
Free cloud credits do not reduce your infrastructure costs. They defer them, invisibly, until expiration forces a full-price reckoning on a codebase that was never designed with billing in mind.
The Scale Trap: When Terraform Stops Being the Problem
At 500 Terraform resources, the bottleneck is never Terraform. It is the organization running it.
The Visibility Trap: Seeing Costs Isn't the Same as Cutting Them
Visibility without workflow integration is a cost center, not a cost cure. Most engineering organizations have invested in dashboards, tagging policies, and cost explorer tools. The spend keeps…
Why the Terraform Fork Was a Bigger Deal Than It First Appeared
HashiCorp's August 2023 relicensing of Terraform from MPL-2.0 to the Business Source License 1.1 was not a routine legal update. It was a governance event that forced every infrastructure team to…
Why Multi-Account Policy Enforcement Breaks Down at Scale
Ad-hoc policy management breaks down precisely at the point where account count and resource sprawl outpace human review cycles. Below 50 resources across two or three accounts, a shared spreadsheet…
Why 200 Resources Is Where IaC Tools Start to Break
At 200 resources, the architectural assumptions baked into every IaC tool become load-bearing walls, and some of those walls crack.
The Convergence of Prompt Engineering and DevOps
Prompt engineering entered DevOps not as an experiment but as a pressure valve: teams shipping faster than their tooling could support needed a way to extract precise, repeatable outputs from AI…
The License Change That Split the Terraform Community
HashiCorp's August 2023 switch from the Mozilla Public License 2.0 to the Business Source License 1.1 drew a hard line between commercial and community use of Terraform, and that line fractured a…
The Fork That Changed Infrastructure-as-Code Forever
HashiCorp's August 2023 relicense of Terraform from MPL-2.0 to the Business Source License forced every infrastructure team to make a governance decision, not a technical one.
The Hidden Invoice in Your Platform Engineering Budget
Platform engineering teams are paying $180,000 per year in duplicate tooling costs without a line item that names it (ZopDev, "The IDP Tax"). That cost has a name: the IDP tax. It accumulates because…
The Productivity Paradox at the Heart of Most IDPs
Most IDPs ship as friction-reducers and land as a new category of sprint tax. The promise is a self-service portal that abstracts infrastructure complexity. The reality, in production, is a platform…
The Fork Decision: Why Teams Are Reconsidering Terraform
HashiCorp's August 2023 license change from MPL-2.0 to the Business Source License forced every team running Terraform in production to make a governance decision they had not budgeted for. The BSL…
The IDP Bill: $180k/Year in Hidden Platform Toil
Most engineering organizations budget precisely for building an Internal Developer Platform and budget nothing for operating one. The build cost is visible: headcount, tooling licenses, sprint…
Why Your IDP Ships Features Slower After Month 3
Every Internal Developer Platform we have seen hits the same wall: feature shipping slows down at the three-month mark, not because the platform was built wrong, but because the forces that made…
OpenTofu vs Pulumi: Which One Survives a 200-Account Landing Zone
IaC tools built for single-team deployments fail structurally at 200 accounts because the failure modes are architectural, not configurational.
The IDP Adoption Problem: Why Most Platforms Fail
Most IDPs fail because they solve the wrong problem: they build self-service portals instead of standardizing the work developers already do. We measured this in production. Teams spend six months…
The Alert Fatigue Problem in Cloud Policy Management
Traditional cloud alerting creates more work than it prevents because engineers spend 60-90 minutes per day triaging notifications that describe problems without fixing them. The mechanism is…
Self-Service Terraform: 8 Modules That Killed 60% of Our Platform Tickets
Self-Service Terraform: 8 Modules That Killed 60% of Our Platform Tickets Platform teams do not fail because they hire the wrong people. They fail because the right people spend most of their time…
Cloud Configuration Drift: How Silent State Changes Become Expensive Incidents
Configuration drift is the gap between what Terraform declares and what runs in production. AWS Config detects it in 15 minutes. Most teams find it in 72 hours. Here is how to close that gap.
Get the weekly in your inbox.
One post a week. Sundays. No "10 ways to think about cloud" listicles, just the engineering and FinOps notes we'd want to read.