Infrastructure as Code & Observability

Infrastructure changes to DNS can redirect traffic, remove validation records, or affect services beyond the intended application. Checks to make Compare the full record diff with an approved zone export, identify dependent services, and verify TTL and ownership. Apply changes in a controlled sequence and check authoritative answers after deployment...

A health check path, threshold, or timeout change can remove healthy instances or direct traffic to an unready service. Checks to make Compare the planned values with application startup and readiness behavior, test the endpoint from the load balancer network, and review thresholds and grace periods. Stage the change and monitor target health after...

Firewall logging changes can reduce visibility or increase data volume and cost if destinations and retention are not considered. Checks to make Compare enabled rules and destinations, confirm log format and retention, and verify that security monitoring can ingest the events. Test volume and access permissions before apply, and alert if expected logs...

Federation changes can alter which external identities may assume cloud roles and access resources. Checks to make Inspect issuer, audience, subject conditions, trust policies, and attached permissions in the full plan. Validate expected identity claims, test with a controlled principal, and require identity owner review before production apply. When...

Tag changes can affect ownership, cost allocation, policy enforcement, automation, and resource discovery. Checks to make Inspect resources and tag diffs, identify tags used by policies or jobs, and confirm required owner, environment, and service values. Test downstream automation and cost reporting before applying broad tag normalization. When to...

Removing deletion protection can make a later mistake or compromised account more destructive. Checks to make Identify protected resources and business owners, compare plan changes with approved maintenance, and confirm backups and recovery procedures. Require explicit review for disabling protection and verify the final setting after apply. When to...

A Terraform plan can propose replacing a production database after a setting, provider, or resource identity change. Applying without understanding the replacement may cause downtime or data loss even when the plan is syntactically valid. What to check Inspect the full plan and replacement markers, compare state with the live resource, review provider...

A Terraform plan that unexpectedly includes unrelated resources can indicate the wrong workspace, backend, variable set, state file, or provider identity. Applying that plan may affect a different environment than the operator intended. What to check Before applying, confirm repository branch, workspace, backend configuration, state identity, cloud...