Build infrastructure from code (IaC and cloud CLIs)

$terraform init
$terraform fmt -recursive && terraform validate
$terraform plan -out tfplan
$terraform apply tfplan
$terraform plan -detailed-exitcode

Security checklist:

• Remote state with locking (Azure Storage, S3); state holds secrets — restrict access.
• Never commit *.tfstate or secret *.tfvars; commit .terraform.lock.hcl.
• Scan with trivy config . or Checkov in every PR; review every plan.

$ansible all -i inventory.ini -m ping
$ansible-playbook -i inventory.ini site.yml --check --diff
$ansible-playbook -i inventory.ini site.yml -l web1 -t nginx
$ansible-vault edit group_vars/db/vault.yml

Security checklist:

• Secrets in Ansible Vault or a secret manager lookup.
• Use modules, not shell; run ansible-lint in CI.

$packer init . && packer validate .
$packer build -var-file=prod.pkrvars.hcl .

Security checklist:

• Deprovision at the end (SSH host keys, history, machine ID).
• No secrets baked into images; rebuild monthly.

$cloud-init schema -c user-data.yaml --annotate
#cloud-init status --wait --long
#tail -50 /var/log/cloud-init-output.log

Security checklist:

• User-data is readable inside the VM: no secrets in it.
• ssh_pwauth: false, disable_root: true.

$az login && az account set --subscription "Lab Subscription"
$az group create -n rg-lab-weu -l westeurope
$az aks get-credentials -g rg-lab-weu -n aks-lab
$az vm list -d -o table --query "[].{name:name, state:powerState}"

Security checklist:

• Managed identities and OIDC instead of client secrets.
• Least-privilege role assignments at the smallest scope; budgets on lab subscriptions.

$aws sso login --profile lab
$aws sts get-caller-identity
$aws s3 ls
$aws eks update-kubeconfig --name eks-lab --region eu-central-1

Security checklist:

• No root keys; SSO for people, OIDC roles for CI.
• Block public S3 access; encryption on by default.