Infrastructure as Code & Observability

A Terraform plan can remove a backup policy while leaving the workload running, creating an unnoticed recovery gap. Policy inheritance or separate backup systems can make the impact difficult to see. What to check Map affected resources and inherited policies, review retention and recovery objectives, check backup job history, and confirm whether...

A Terraform plan can change a recovery vault’s access, immutability, retention, or encryption settings. The change may affect whether backups survive account compromise or can be restored during an outage. What to check Inspect vault policy, retention lock, key access, cross-account permissions, deletion behavior, and dependent backup jobs. Confirm...

A Terraform change can disable a load balancer or application health check, causing unhealthy instances to receive traffic or hiding a service failure. The change may appear harmless if monitoring exists elsewhere. What to check Identify the affected check, thresholds, target group, alert routing, replacement monitoring, and workloads that depend on...

A Terraform change may disable an alert because of a threshold or resource rename, leaving logs collected but no one notified when a critical pattern appears. What to check Inspect alert resource changes, source logs, filters, thresholds, notification targets, and ownership. Confirm whether a replacement alert is active and has been tested....

A Terraform plan may replace a gateway and change egress, public addresses, routes, or VPN connectivity. Applications can lose access to vendors even if the new gateway is healthy. What to check Inspect replacement actions, routes, NAT, public IPs, VPN peers, allowlists, dependent subnets, and failover. Identify services that rely on current egress...

An infrastructure plan may propose replacing a database because of an immutable setting, resource rename, or state mismatch. Applying without understanding the replacement can risk data and availability. What to check Inspect the plan, resource address, lifecycle settings, state history, provider changes, and backup status. Confirm whether the plan...

A new alert may fire continuously because its threshold, evaluation window, missing-data behavior, or label matching differs from the intended condition. What to check Compare the rule revision, query output, time window, labels, and recent metric gaps. Check whether the alert targets the intended service and environment. Recommended next step...

Infrastructure metrics can show a healthy server while the application is unavailable, returning errors, or unable to reach a dependency. What to check Compare host metrics with application-level checks, request success, dependency health, and user-facing response. Confirm probes test meaningful behavior rather than only an open port. Recommended next...