Terraform
Terraform reviews are where I catch problems before they're deployed rather than after. Policy-as-code gating in the pipeline is worth more than any amount of after-the-fact CSPM alerting.
Updated
How I use it
- Module review for hardcoded credentials, overly permissive IAM and public-by-default resources
- Policy-as-code gating in CI/CD before apply
- State file access review — who can read secrets embedded in state
Recurring problems I find
- Terraform state stored without encryption or access control, holding plaintext secrets
- No policy gate at all — misconfigurations caught by CSPM after deployment instead of blocked before it
IBM completed its acquisition of HashiCorp in early 2025. OpenTofu, the community fork, is now a viable alternative for the Business Source License, and HashiCorp's policy direction is shifting toward tfpolicy.
Related
Cloud security assessment
Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.
Cloud security
Multi-cloud security practice: landing zones, identity, posture management, MITRE ATT&CK-aligned detection engineering and CIS hardening baselines.
4Developers
Speaking at 4Developers, a large Polish conference for software engineers, on secure design and AI security.