Infrastructure as Code & Observability

A provider update can change defaults, schemas, and replacement behavior across managed resources. Checks to make Pin the current version, read migration notes, test plans against representative workspaces, and inspect every replacement or changed default. Back up state and stage the upgrade before broad rollout; keep a rollback path compatible with...

A small rule change can expose a service through a broader CIDR, port range, or public address than intended. Checks to make Inspect security group and firewall diffs, compare source ranges and protocols with approved design, and trace attached resources. Require review for public exposure and validate resulting rules after apply using authorized...

Resources can outlive their original module or be changed outside code, making ownership and cleanup uncertain. Checks to make Use resource tags for service, owner, environment, and repository, and retain plan and apply records tied to commits. Compare cloud audit events with state history and investigate unmanaged resources before importing or...

Permission changes can broaden access or remove critical service privileges even when the plan touches only a small policy block. Checks to make Review principals, actions, resource scope, conditions, and trust relationships in the full diff. Compare with approved role design, test service behavior, and require an identity-aware reviewer before...

Emergency console edits can create drift that a later apply may unexpectedly revert. Checks to make Record actor, reason, resource, before and after values, and incident reference. Reconcile the intended state in code, review the resulting plan, and restore normal pipeline ownership. Avoid editing state manually to conceal drift. When to get help...

A resource can disappear from a plan because configuration changed, a module address moved, or state no longer matches reality. Checks to make Inspect address and module changes, state history, and the real resource before applying. Use reviewed state moves for refactoring, and do not destroy or re-import resources until ownership and dependencies are...

A saved plan can become stale if another operation changes state or resources before apply. Checks to make Use backend locking, check plan freshness, and regenerate plans after state-changing operations. Tie approvals to the exact plan artifact and fail if the state serial or workspace no longer matches review. When to get help Infrastructure...

Network changes can disconnect services or redirect traffic even when infrastructure plans show only a few resources. Checks to make Trace affected domains, routes, gateways, and dependencies; compare planned values with approved design; and test resolution or path behavior in staging where possible. Schedule high-impact changes with rollback and...