Contract
- Input: infrastructure requirements (compute, storage, network, identity, policies).
- Output: IAC module definitions + state rules + policy checklist.
- Side effects: may create resources when executed (plan/apply).
- Dependencies: cloud provider access (AWS / GCP / Azure / local).
- Stop condition: definitions and rules saved.
- Risk: medium — IAC errors cause outages or data loss; requires testing (terraform plan / dry-run).
- Boundary: defines infrastructure; execution requires explicit approval and testing.
Infrastructure as Code Design
Design reproducible infrastructure — compute, network, storage, identity — with version control, state management, and policy enforcement.
Process
1. Define requirements
- Compute: instances / containers / serverless / managed Kubernetes.
- Storage: object, block, database, cache, archive.
- Network: VPC, subnets, load balancers, DNS, CDN, VPN, private links.
- Identity: IAM roles, service accounts, SSO integration.
Completion criterion: requirements list saved.
2. Design modules
- Module per concern: compute module, network module, storage module, identity module.
- Each module defines resources, variables, outputs.
- Composition: root module calls sub-modules with variables.
Completion criterion: module tree saved.
3. State management
- Remote backend (S3 / GCS / Azure Storage with locking).
- State encryption (at rest / in transit).
- State isolation per environment (workspaces / separate state files).
- State versioning / backup.
Completion criterion: state rules saved.
4. Policy enforcement
- IAM: least-privilege roles; no root/admin by default; service-specific roles.
- Network: default-deny; allow only required ports / sources; private subnets for databases.
- Encryption: at rest (AES-256) and in transit (TLS 1.3); key management.
- Compliance: GDPR / SOC2 / HIPAA / ISO 27001 rules mapped to controls.
Completion criterion: policy checklist filled.
5. Deliver
Module definitions (HCL / TypeScript / YAML) + state rules + policy checklist + plan example (terraform plan output or equivalent).
1---2name: devops-terraform-iac3description: Design infrastructure as code — Terraform / Pulumi / CloudFormation — for reproducible, version-controlled, auditable cloud infrastructure.4---56## Contract78- **Input:** infrastructure requirements (compute, storage, network, identity, policies).9- **Output:** IAC module definitions + state rules + policy checklist.10- **Side effects:** may create resources when executed (plan/apply).11- **Dependencies:** cloud provider access (AWS / GCP / Azure / local).12- **Stop condition:** definitions and rules saved.13- **Risk:** medium — IAC errors cause outages or data loss; requires testing (terraform plan / dry-run).14- **Boundary:** defines infrastructure; execution requires explicit approval and testing.1516# Infrastructure as Code Design1718Design **reproducible infrastructure** — compute, network, storage, identity — with version control, state management, and policy enforcement.1920## Process2122### 1. Define requirements23- Compute: instances / containers / serverless / managed Kubernetes.24- Storage: object, block, database, cache, archive.25- Network: VPC, subnets, load balancers, DNS, CDN, VPN, private links.26- Identity: IAM roles, service accounts, SSO integration.2728**Completion criterion:** requirements list saved.2930### 2. Design modules31- **Module** per concern: compute module, network module, storage module, identity module.32- Each module defines resources, variables, outputs.33- Composition: root module calls sub-modules with variables.3435**Completion criterion:** module tree saved.3637### 3. State management38- Remote backend (S3 / GCS / Azure Storage with locking).39- State encryption (at rest / in transit).40- State isolation per environment (workspaces / separate state files).41- State versioning / backup.4243**Completion criterion:** state rules saved.4445### 4. Policy enforcement46- IAM: least-privilege roles; no root/admin by default; service-specific roles.47- Network: default-deny; allow only required ports / sources; private subnets for databases.48- Encryption: at rest (AES-256) and in transit (TLS 1.3); key management.49- Compliance: GDPR / SOC2 / HIPAA / ISO 27001 rules mapped to controls.5051**Completion criterion:** policy checklist filled.5253### 5. Deliver54Module definitions (HCL / TypeScript / YAML) + state rules + policy checklist + plan example (terraform plan output or equivalent).
quantumquirkxyz