Tag

#terraform

8 posts ·all posts

The log bucket that finally takes KMS

S3 server access logs could only land in an AES256 bucket for years, and AES256 is exactly what Security Hub flags. The escape was never a bucket setting. It was a KMS key policy that lets the logging service write with your key.

Read

Two Tenants in One Apply: Workspaces as Code

Multi-tenancy on a data platform is usually a ticket and a week of console clicking. We made it a Terraform apply: a workspace, its catalog, its groups, its grants, and its dbt project — isolated by construction, reviewed in a pull request.

Read

Setting It All Up With Terraform

A Terraform provider for the platform's own resources — warehouses, namespaces, grants, dbt projects, contracts, ontologies — managed in HCL, in a repo, in a pull request, with a plan you can read before you apply.

Read