Cloud & IaC
Cloud and infrastructure as code: OpenTofu after the Terraform fork, federated access through OIDC instead of long-lived keys, multi-account layouts with a blast radius you can reason about. About picking a tool and paying for the migration — without the holy wars.
-
Drift detection in 2026: from the alert to remediation as code
Plan says “no changes” while a security group sits open to the internet. The four blind spots of single-layer detection, and where automatic remediation should stop.
-
OpenTofu vs Terraform in 2026: when the fork is already worth it
The question is no longer whether the fork is safe, but when it beats the original. Features, lock-in, and migration cost in 2026.
-
OIDC → AWS STS: CI/CD Without Long-Lived Keys
Federated identity replaces AWS_ACCESS_KEY_ID in CI/CD: one pattern for GitHub, GitLab and Atlantis — no rotation, real CloudTrail attribution.