Your team moves faster when someone owns the infrastructure.

1. Terraform

   Your infrastructure, in code you own

   You get

   • An infrastructure repo in your GitHub, owned by you
   • A written account review before anything changes
   • CI that plans on every PR

   How this goes
   acme / infrastructure · pull request #12

   open

   import: bring the production VPC and RDS under Terraform

   • terraform
   • import
   • no-op

   +module.network.aws_vpc.prod# imported, not recreated

   +module.network.aws_subnet.private[0..2]

   +module.db.aws_db_instance.main# imported

   +module.db.aws_db_parameter_group.main

   Plan: 0 to add, 0 to change, 0 to destroy. 6 resources imported.

   • terraform plan41s
   • tflint8s
   • checkov / policy19s

   

   Shlomo commented

   Zero changes to production. It is now code in your repo, and the next PR can change it safely.

2. Pipelines

   A merged pull request goes to production

   You get

   • One pipeline template, reused by every service
   • Each environment in its own Terraform, sharing one set of modules
   • Deploy notifications in your Slack

   How this goes
   acme / checkout-api · actions · main @ 4f2c1e9

   passed

   1. build1m 12s
   2. test2m 04s
   3. scan38s
   4. deploy staging54s
   5. smoke21s
   6. deploy production58s

   Merged 09:14, in production 09:20. Rollback is reverting the merge; it takes as long as this did.

3. Monitoring

   Alerts that page on customers, not CPU

   You get

   • Alerts on what customers feel, not CPU
   • A runbook linked from every alert
   • One dashboard per service, same shape

   How this goes

   #alerts

   A

   Alerts02:14

   🔴 checkout · p95 latency above 800ms for 5m · 3.1% of requests affected · runbook: /runbooks/checkout-latency

   A

   Alerts02:21

   🟢 resolved · on-call followed the runbook: reconciliation job paused, checkout recovered in 4m

   

   ShlomoDelivOps08:40

   Saw the night. The job now has its own node pool so it cannot evict checkout again. PR up, no downtime to apply.

   • 🙏 2

4. Security

   The baseline an auditor expects, before they ask

   You get

   • IAM, encryption, logging and WAF in Terraform
   • Policy checks in CI that stop regressions
   • The evidence trail SOC 2 auditors ask for

   How this goes
   acme · account review · security

   early

   41findings

   4that matter

   37noise, noted

   1. Root account has no MFAFix today
   2. 3 IAM users with admin keysReplace with roles
   3. S3 bucket public: exports-prodClose, then audit access
   4. RDS not encrypted at restSnapshot, re-create encrypted

   The other 37 are logged with a reason each. The four above are pull requests this week.

5. Cost

   A bill somebody owns

   You get

   • A tagged account with a per-service breakdown
   • A monthly report written for founders
   • Budgets and anomaly alerts before the invoice

   How this goes

   #infra

   

   ShlomoDelivOpsMon 09:00

   March: $18,420, down 9% from February. By service: EKS $7,900 · RDS $4,100 · data transfer $2,300 · S3 $1,600 · other $2,520. Next: the cross-AZ transfer on the ingest workers, worth about $900 a month. Commitments still on hold until that settles.

   F

   FounderMon 09:12

   first time I have understood our bill. go ahead.

Illustrative, and typical. Real pull requests, alerts and reports stay in clients' workspaces. Inference workloads included: GPU nodes on EKS, SageMaker, Bedrock. Every platform and tool →