I help teams build resilient systems in the cloud. Day-to-day I'm in the Terraform and Go trenches, maintaining Infrastructure-as-Code, authoring cybersecurity tools, and contributing to MITRE, OWASP, Debian, Terraform Best Practices, and Terraform Proverbs.
A few days ago, I was pleasantly surprised to discover that TFLint has a ruleset plugin for writing custom rules in Rego. For those who don’t know, I tend to roll my own CI/CD pipelines, scanning, and most of the other pieces that make up a solid IaC experience. I’ve been slightly envious of Terraform Cloud users with Sentinel and the Spacelift crowd who get policy enforcement out of the box.
Infrastructure teams run into an interesting challenge as more people begin contributing to the same codebase. One developer is on Windows, another gray beard on Debian, and the rest (James, the FinOps bro, and the temp consultants) on some combination of macOS and Ubuntu. When all of those environments converge on an infrastructure-as-code repository, differences in package managers, installation…
I can’t escape IAM user access keys. Every night, I have the same nightmare of asking a Ouija board how I’ll die. My fingers slowly move over the letter “AKIA.” They are everywhere, but I’ve done my best to promote, mandate, and migrate teams to IAM roles and other authentication methods. Nevertheless, there are still legacy applications and one-offs that require them. If you can’t kill them, you…
It is such a terribly long time since I last wrote to you — almost two years but I know you’ll excuse me because you understand how I am, stubborn and realistic; and I thought there was no sense to writing with all these AI companies unethically stealing all of our intellectual property.” -Richard Feynman
Sorry I’ve been quiet lately. My head has been down on my newest adventure. I’m so used to being the sole operator, platform engineer, SRE, or whatever that day brings that it’s odd to take a step back and be tasked with providing enterprise cybersecurity for cloud environments that other teams are operating. I’ve had so many cool new projects that will make for some great technical blogs, so I…
At 00:21 UTC on March 31, someone published axios@1.14.1 to npm. Three hours later it was pulled. In between, every npm install and npx invocation that resolved axios@latest executed a backdoor on the installing machine. Axios has roughly 80 million weekly downloads, and here’s what that three-hour window looked like from one developer’s MacBook.
A few days ago I wrote about how the Trivy ecosystem got turned into a credential stealer. One of my takeaways was “pin by SHA.” Every supply chain security guide says it, I’ve said it, every subreddit says it, and the GitHub Actions hardening docs say it.
On March 19, 2026, someone (or some group) poisoned the Aqua Security Trivy ecosystem. A tool that thousands of organizations rely on to find vulnerabilities in their container images and configurations was quietly turned into a weapon that stole their secrets instead. I spent some time pulling apart the malicious code and cross-referencing findings from Wiz’s analysis, and figured the walkthrough…
TL;DR Build a _zero-cost_ drift detection system using GitHub Actions and Terraform's native exit codes. This workflow automatically discovers all Terraform root modules, runs daily drift checks, and creates GitHub issues when changes are detected.
After a few years of writing open-source Terraform modules, I’ve picked up a few syntax tricks that make code safer, cleaner, and easier to maintain. These aren’t revolutionary, but they’re simple patterns that prevent common mistakes and make the infrastructure more resilient. Based on the configurations I’ve seen in the wild, these techniques seem to be underutilized.