Replace Terraform Module Forks with Automatic Policy Transformation Rules
summary
Claims that teams can eliminate the fork graveyard by replacing module forks with automatic policy transformations that rewrite modules at download time, saving roughly 40 hours/month per team. Demonstrates a small toolchain using HCL edit and mapf, a Compliance.tf provider that proxies AWS calls and enforces hard/soft/advisory failures, and examples that add lifecycle prevent_destroy, strip provisioners, or restrict instance types. Shows implementation via a simple HTTPS/registry zip and reports it working in Compliance.tf proofs of concept.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:50Speaker introduction
- 3:17The fork graveyard problem
- 5:27Validation vs transformation
- 8:23Compliance vs operational rules
- 11:57Common module modifications
- 15:14Detective vs preventive checks
- 17:00Compliance TF provider demo
- 20:39Building transformation rules
- 25:22Tools for policy enforcement
- 28:39Summary and resources
- 29:23Q&A on module updates
related talks
45mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
45mStreamlining Compliance: Leveraging OS Terraform AWS modules
31mTerraform Practices to Enable Infrastructure Scaling
47mHow to build scale & maintain 45 pub Terraform mod. with over 100 million provisions
22mLessons Learned from Scaling Infrastructure as Code
31mTerraform Structure & Enablement
46mTerraform best practices with examples and arguments
35mTerraform Practices - The Good, the Bad and the Ugly