Infrastructure as Code in the Wild
summary
Built a secure credit‑card processing infrastructure on AWS that is PCI-DSS compliant and managed as 100% infrastructure as code, using Terraform, Packer, Ansible, Consul, Nomad, Vault and ELK. Claims: immutable AMIs replace live patching, Vault uses a 6‑key split with 3 required for recovery, Terraform modules and state splitting avoid destructive cycles, and Consul/Nomad require pinned IPs or manual quorum recovery after instance rotation. Result: runs in production processing every transaction, but required nontrivial operational workarounds.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:33Infrastructure as code
- 4:53PCI DSS and Pagar.me case
- 7:41Tooling and implementation
- 12:53Terraform challenges
- 17:08Consul service discovery
- 22:19Nomad deployments
- 25:18Secret management with Vault
- 31:11Logging and monitoring
- 34:27Best practices and conclusion
related talks
34mPCI and Politics
18mInfrastructure as Code Security Best Practices & Strats
15mInfrastructure as a Code: Best Practices and Myths
39mAutomating Immutable Infrastructure With Packer & Terraform
52mInfrastructure as Code with Terraform
15mA Diary of Change in the Dusty Financial Sector
34mA House of Cards (of Credit) in the Cloud
23mA Journey to Automated Infrastructure