Infrastructure as Code & Observability

Manual changes made in a cloud console can leave infrastructure out of sync with Terraform state. A scheduled apply may then overwrite an emergency change or replace a resource unexpectedly. What to check Run a reviewed plan against the intended workspace and account, compare detected drift with change records, and identify who or what changed the...

Removing a network rule can reduce exposure, but an overly broad change may interrupt critical service access or hide an unexpected dependency. A plan can also appear to remove a rule that was managed by a separate system. What to investigate Review the exact rule, source and destination, affected environments, traffic logs, current state ownership,...

A Terraform plan that changes DNS can redirect customer traffic, mail, or service integrations. A small record edit may have broad impact if it changes authoritative delegation or a shared hostname. What to check Inspect the exact zone and record, TTL, alias chain, dependent services, environment, and planned deletion or replacement behavior. Confirm...

A Terraform change can expose a service to the public internet by widening a source range or attaching a public route. The resulting plan may affect a shared security group used by several workloads. What to check Inspect source and destination ranges, resource references, route tables, attached interfaces, environment, and plan replacement behavior....

A Terraform change can shorten backup retention, remove recovery points, or change where backups are stored. The plan may appear small while affecting compliance, recovery objectives, or the ability to investigate past incidents. What to check Compare old and new retention, backup frequency, vault location, encryption, and deletion behavior. Identify...

Changing a firewall default from deny to allow, or the reverse, can affect many resources that do not appear directly in the plan. The default may be inherited by networks or workloads managed elsewhere. What to check Inspect the resource dependency graph, attached networks, existing exceptions, policy inheritance, and actual traffic requirements....

A Terraform plan may replace a load balancer after a naming, provider, or immutable setting change. Replacement can alter public addresses, health checks, certificates, or routing for multiple services. What to check Inspect replacement markers, listeners, target groups, DNS dependencies, security groups, certificates, and provider behavior. Confirm...

A Terraform plan may alter or replace a DNS zone in a way that changes delegation, mail routing, or application records. Shared zones can affect services that are not represented in the same infrastructure repository. What to check Inspect the zone, record set, nameserver delegation, TTLs, dependent applications, and whether the plan deletes records...