Hey folks,
I wonder if you know platforms (not upwork) where I can find short term projects to work on and get paid.
I’m on a parental leave since a few months now and I need to work a bit (4 hours a day maximum).
I’m an SRE with +6 years of experience, I worked on high availability platform, CI/CD, observability, etc.

Been building this on nights/weekends for the past couple months. Background: I've spent 3.5 years doing PAM engineering (CyberArk), so this is basically me translating that into cloud-native.

The problem I kept running into reading about this space: every tool I looked at (Cloudsplaining, Prowler, even AWS's own IAM Access Analyzer) stops at detection. They'll tell you a role has a wildcard action or an unused key, and then... that's it. You get a report. Somebody has to go fix it by hand. Even the free/open-source ones don't touch remediation.

So I built NHI Risk Analyzer — discovers IAM users/roles/groups, runs it against a set of detection rules (grounded in Rhino Security Labs' documented privilege escalation paths + Cloudsplaining's policy analysis methodology + CIS benchmark stuff for credential hygiene), and then actually does something about what it finds:

• Wildcard/admin-equivalent policies and privilege escalation paths get a Permissions Boundary slapped on them — containment without touching the underlying policy, so it doesn't risk breaking whatever the identity legitimately needs to do
• Stale/unused access keys get deactivated (never deleted — always reversible)
• Everything's gated by an exemption file (nhi-ignore.yaml) so break-glass/deployment identities never get auto-remediated
• Three modes: scan only, dry-run (shows what it would do), and live remediation

Architecture is offline-first — it snapshots the AWS account state to JSON once, then evaluates all the risk rules against that snapshot with zero live API calls. Makes the whole rule engine testable and fast (unit tests run in under a millisecond) and means findings are reproducible against an exact point in time instead of drifting mid-scan.

Tested it against synthetic "canary" identities I built specifically to safely trigger the containment logic without touching anything real, then ran it live against a real (throwaway) AWS account — 57 findings, 24 auto-remediated, 0 failures.

Still rough in places — trust policy analysis isn't built yet, surgical wildcard-narrowing (vs. the current boundary-containment approach) is next, and it's AWS-only for now. Not trying to oversell it, it's a v1. But the core loop — detect, decide safely, act — actually works end to end, which is the part I couldn't find anywhere else at this tier.

Repo: In comments

Would genuinely appreciate anyone poking holes in the detection logic or the remediation safety assumptions — that's exactly the kind of feedback I'm here for.

I’ve been working on Terraform generation for multi-cloud architectures and I keep coming back to the same problem:
Generating valid HCL is the easy part.
Generating infrastructure I would actually trust is much harder.
Right now I’m looking at the generated stack in several layers:
provider-specific Terraform resources
variables and outputs
remote state configuration
networking and IAM
security validation
cost estimation
documentation explaining the architecture
The difficult part isn’t generating those files. It’s deciding what should be automatically generated versus what should require an engineer to explicitly approve it.
For example, I wouldn’t want a generator silently making important IAM, networking or state decisions just because the Terraform validates successfully.
So for people running Terraform in production:
What would you need to see before you’d trust generated Terraform enough to actually run terraform plan on it?
Tests? Checkov/tfsec? Policy-as-code? A generated architecture diagram? Cost diff? Something else?

Inherited an AWS account with hundreds of resources never in code. Manual terraform import at this scale is brutal, writing HCL by hand, then reconciling state one resource at a time.
A few things I've looked at:
AI-assisted codification (tools that generate HCL from discovery scans)
Scripted wrappers around terraform import for bulk jobs
How much time did automated codification actually save people who've tried it?

We have a networking module that about half a dozen root modules consume, and most weeks more than one change is in flight against it. Those changes collide in two unrelated ways, which took us a while to notice.

Each root has its own state, so across roots there is no lock contention. You get version skew instead. A module bump is one change per consumer, each with its own plan and apply, so two versions of the module are live in production until the rollout finishes.

Contention only shows up when two changes hit the same root. Terraform locks state for all operations that could write state, and if state locking fails it does not continue. None of the documented escapes fix it. A lock timeout only retries before erroring, running with -lock=false is documented as dangerous when others might concurrently run commands against the same workspace, and force-unlock warns that unlocking a lock someone else holds could cause multiple writers.

Authoring parallelizes fine. Two consumer bumps can be drafted and checked at once, and lately I have had verdent running on both, one agent writing while another verifies. Ordering the applies is still manual.

Review drift sits under both. The plan docs note that other changes made to the target system in the meantime might cause the final effect to differ from what an earlier speculative plan indicated, and a saved plan handed to apply runs without prompting for confirmation.

Curious how other teams order rollouts. Per environment sequencing, a CI queue keyed on the state, or calling it out in chat. We do the last one.

HashiCorp has introduced tfpolicy, a new HCL-based policy-as-code framework for Terraform, now available in public beta within HCP Terraform. It is designed to simplify and modernize infrastructure governance by integrating policy creation and enforcement directly into Terraform workflows, eliminating the need for separate tools and languages.

Terraform policy is a declarative, HCL-based policy as code framework that enables platform teams to define and enforce policies using a familiar language while introducing new governance capabilities designed for modern infrastructure systems.

*Disclaimer: I am the open-source author/creator of TellIaC.*

Hey r/SideProject !

After years of managing multi-cloud infrastructure across AWS, Azure, GCP, and K8s in Terraform HCL and YAML, I noticed that team architecture discussions always happen in plain English ("We need an AWS VPC with 2 subnets connected to an EC2 instance"), but converting that into code takes hours of boilerplate.

So I built **TellIaC** (Human Infrastructure as Code).

### ⚡ How it works

You write your cloud setup as natural English sentences:

Use provider "aws" region "us-east-1" for environment "production".

Create 1 "aws_vpc" resource named "prod_vpc" with cidr_block "10.100.0.0/16".

Create 1 "aws_subnet" resource named "prod_subnet" with cidr_block "10.100.1.0/24", vpc "prod_vpc".

Create 2 "aws_instance" resource named "web_app" with instance_type "t3.micro", vpc "prod_vpc", subnet "prod_subnet".

### 🛠️ Key Features

1. Zero Lock-in (`telliac export`): Converts plain English into standard Terraform HCL (`main.tf`, `variables.tf`, `outputs.tf`).

2. Cloud Cost Estimator (`telliac cost`): Shows a dollar breakdown of monthly spend before running apply.

3. Security Linter (`telliac lint`): Catches open CIDRs (`0.0.0.0/0`), plaintext secrets, and unencrypted buckets.

4. Standalone Binary: Single executables for Windows & Linux with zero Python or dependency installation needed.

I’ve shared the live playground and download links in the comments below. I’d love your feedback!

I just acquired my Terraform Associate (004) certification a few weeks ago, and I already have my GCP PCA cert, and I would like to continue along the Iac path, then head into Kubernetes soon.

I felt like the test was a breeze to me, being that I've been using Terraform for at least 2 years now with GCP and AWS.

Do any of you think that the "Terraform Authoring and Operation Professional" is valuable and sought out by employers, or is it a waste of my time?

An assistant wrote a chunk of our Terraform. It read clean, been approved and it had a security group open to the world on a port that had no reason to be public. The diff looked fine, the person who prompted it did not clock the CIDR and neither did the reviewers.

Luckily, a pre apply scan caught it. The config was syntactically perfect and quietly wrong, which is the exact thing eyes slide over.

What are you gating on before apply, is it advisory, does it really block? Advisory did nothing for us until we made it a hard gate.

A few days ago, I was pleasantly surprised to discover that TFLint has a ruleset plugin for writing custom rules in Rego! So far, so good.

TL;DR from what I found: agentic cloud automation platform. Does drift detection, auto-codifies unmanaged resources into IaC, and recently added disaster-recovery-as-code. Firefly ai takes a different approach with estate-wide governance and inventory layer, sitting on top of whatever runs your Terraform to provide visibility and compliance across everything running in your cloud. Anyone running it, how's the "cloud system of record" pitch holding up day to day?

If you are someone who's advanced with Terraform/Terragrunt and you know any tips, hacks or tools that works with them that you wished you knew before in the beggining of you career share it here.