Infrastructure checklist

Every rule in the infrastructure playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it.

Infrastructure as code

• Required Define every resource in code
• Required Keep state remote with locking and encryption
• Required Review the plan and apply only from CI
• Required Pin the tool and provider versions
• Required Detect drift every day
• Required Protect resources that hold data
• Recommended Split state by environment and layer
• Recommended Reuse versioned modules
• Recommended Bring hand-made resources under code

Environments

• Required Give each environment its own account
• Required Build every environment from the same code
• Required Change staging before production
• Required Start every account from one baseline
• Recommended Delete preview environments on time
• Recommended Turn on threat detection in every account

Identity and access

• Required Sign people in through single sign-on
• Required Keep no long-lived access keys
• Required Give every role the least it needs
• Required Lock the root account away
• Required Keep tested break-glass accounts
• Required Grant admin access for hours only
• Recommended Separate the roles for plan and apply

Configuration and secrets

• Required Create the secret's place in code and its value in the store
• Required Keep secrets out of state
• Required Let CI sign in with OIDC
• Required Give services the identity of their machine
• Recommended Rotate secrets automatically

Networking and DNS

• Required Keep databases in private subnets
• Required Deny all traffic unless a rule allows it
• Required Close admin ports to the internet
• Required Force encryption on every managed service
• Required Require tokens for the metadata service
• Required Keep DNS records in code
• Recommended Limit where servers can send traffic
• Recommended Shorten the TTL before you move a record

Policy as code

• Required Scan infrastructure code on every change
• Required Block dangerous actions for the whole organization
• Recommended Test your own rules against the plan
• Recommended Let every exception expire
• Recommended Test infrastructure modules

Servers

• Required Configure long-lived servers from code
• Required Rebuild any server from code
• Required Install security updates by themselves
• Required Turn on a firewall on every host
• Required Allow SSH with keys only
• Recommended Replace servers instead of patching them

Cost and ownership

• Required Tag every resource with its owner
• Required Give every account a budget with alerts
• Recommended Delete resources that sit idle
• Recommended Size servers from what they use
• Optional Show the cost of each change in review