Rebuilding Infrastructure (as Code)
summary
Trimble moves from manual AWS provisioning to a unified codebase using Terraform Cloud, with environment-specific workspaces and a three-branch promotion pipeline (dev → staging → prod). Started July 2021 and now covers 17 environments, 30 feature flags controlling ~300 resource types, and blocks ad-hoc creation by removing create permissions. Sentinel policies enforce security and deprecated-module bans at plan time. Outcomes include a new SQL architecture, Kubernetes rolled out across all environments, faster incident response (including Log4j), and fewer midnight surprises.
AI-written summary · about
chapters (13)
- 0:00Introduction to talk
- 1:51Benefits of IaC
- 3:17Starting IaC with existing infra
- 5:07Setting up Terraform workspaces
- 8:02Building new alongside old
- 9:26Abstracting environments
- 12:59Consistency and promotion
- 14:03Feature flags for control
- 17:50Leadership and policy enforcement
- 19:34Sentinel for security
- 22:25Sentinel resources and help
- 22:49Results and impact
- 23:52Closing and Q&A
related talks
19mSynchronization of Infrastructure Provisioning & Application Deployments
44mEvolution of Infrastructure Management
27mCase Study: Re-Thinking Our Infrastructure Tooling
22mCase Study: Re-Thinking Our Infrastructure Tooling
44mTaming the cloud sprawl
22mLessons Learned from Scaling Infrastructure as Code
10mInfrastructure as a Code Best Practices with Terraform
29mEverything, Everywhere, All at Once: Terraform and Indeed's Move to AWS