Terraform Module Lifecycle: From First Variable to a Release Teams Can Trust
Terraform module lifecycle for platform teams: design, test, review, release, consume and deprecate modules on Azure so every version is one teams can trust.
deniscooper@me.com
Terraform Module Testing as Governance: The Part That Actually Enforces the Rules
Over the last few weeks this series has built up a fair set of rules. Module boundaries decide what each module is responsible for. Calling conventions decide how those modules get pinned, what goes in and what comes out. Pinned sources, typed inputs, validated variables, outputs treated as a contract, providers passed down rather than … Read more
Terraform Calling Conventions: How Your Modules Should Actually Talk to Each Other
Terraform module source, pinning, inputs and outputs: the calling conventions that let platform teams change modules on Azure without breaking every consumer.
Terraform Module Boundaries: What Actually Belongs in a Module
Terraform module boundaries determine what belongs in a module, a helper, or a golden path. Practical rules and examples for getting the split right.
Terraform Repo Structure: Module Repos & Golden Paths Explained
Terraform repo structure explained: how module repos, golden paths, and consumer repos combine to build a governed, reusable Azure platform.
Your Terraform Provider Is Pinned. It’s Still Waiting to Break You
I want to talk about the gap between the Terraform you wrote on day one and the Terraform you’re still running two years later, because that gap is where most of the pain in a mature platform actually lives. Not in the initial build. In everything that happens to your modules and providers after nobody’s … Read more
Drift Isn’t a Detection Problem, It’s an Ownership Problem
Terraform drift ownership is what actually closes out drift, not detection. Here’s how to assign it, respond to it, and stop it reopening.
Workload Identity Lifecycle: The Governance Gap in Azure
Orphaned service principals and stale secrets don’t announce themselves. What operating workload identity lifecycle in Azure actually requires.
Platform Patching Responsibility: Whose Job Is It Really?
Patching still goes wrong even though everyone knows it matters. Because platform patching responsibility is never drawn clearly, and both sides assume the other has it.
Your Landing Zone Is a Snapshot, Not a Standard
Your Azure landing zone was current the day you deployed it. Since then it’s been drifting. Why landing zone currency is an operating problem, not a one-time build.