--- title: "Infrastructure checklist: all 51 rules ยท Agent Wranglers" url: https://agentwranglers.se/playbook/infrastructure/checklist updated: 2026-10-20 licence: "All rights reserved" --- # Infrastructure checklist By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20. Every rule in the infrastructure playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it. **For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/checklist`. ## Infrastructure as code - [ ] **Required** [Define every resource in code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/define-infrastructure-in-code): Create and change every cloud resource, firewall rule and DNS record through code in version control. Never make a lasting change in a web console. - [ ] **Required** [Keep state remote with locking and encryption](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/remote-state): Keep the state file in a remote backend that locks, encrypts and keeps old versions. Only the deploy roles may read it. Never keep state in git or on a laptop. - [ ] **Required** [Review the plan and apply only from CI](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/plan-in-review): Post the plan in every pull request. Apply only from CI after merge, from the plan file made for that commit. No person applies from a laptop. - [ ] **Required** [Pin the tool and provider versions](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/pinned-provider-versions): Pin the version of the tool and of every provider, and commit the provider lock file with hashes for every platform you run on. - [ ] **Required** [Detect drift every day](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/drift-detection): Run a plan against every state at least once a day. Open a ticket when it finds a change nobody made in code. - [ ] **Required** [Protect resources that hold data](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/protect-stateful-resources): Turn on deletion protection for every database, bucket and disk that holds data. Stop any plan that deletes or replaces one until a second person approves. - [ ] **Recommended** [Split state by environment and layer](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/split-state): Give each environment and each layer its own state, such as network, data and app. One mistake then touches only one of them. - [ ] **Recommended** [Reuse versioned modules](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/versioned-modules): Put each repeated pattern in a module with checked inputs, and pin every use of it to a version. Never copy the same resources between environments. - [ ] **Recommended** [Bring hand-made resources under code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/import-existing-resources): Import every resource that was made by hand into code before you change it. Then tag everything the code manages, so the rest stands out. ## Environments - [ ] **Required** [Give each environment its own account](https://agentwranglers.se/playbook/infrastructure/environments/account-per-environment): Run production in its own cloud account, project or subscription. Development, staging and previews each live in another one. - [ ] **Required** [Build every environment from the same code](https://agentwranglers.se/playbook/infrastructure/environments/same-code-every-environment): Build all environments from the same modules. Let them differ only in values such as sizes, counts and names, kept in one file per environment. - [ ] **Required** [Change staging before production](https://agentwranglers.se/playbook/infrastructure/environments/promote-infrastructure-changes): Apply every infrastructure change to staging first. Apply the same commit to production only after the staging apply and its smoke tests pass. - [ ] **Required** [Start every account from one baseline](https://agentwranglers.se/playbook/infrastructure/environments/account-baseline): Create every new account from code with the same baseline. That means an audit log, a budget, blocked public storage, default encryption and the allowed regions. - [ ] **Recommended** [Delete preview environments on time](https://agentwranglers.se/playbook/infrastructure/environments/preview-environments): Give each pull request its own short-lived environment from the same code. Delete it when the pull request closes, and after 72 hours at most. - [ ] **Recommended** [Turn on threat detection in every account](https://agentwranglers.se/playbook/infrastructure/environments/threat-detection): Turn on the cloud's managed threat detection in every account and region you use. Send high and critical findings to the on-call team within 15 minutes. ## Identity and access - [ ] **Required** [Sign people in through single sign-on](https://agentwranglers.se/playbook/infrastructure/identity-and-access/single-sign-on-for-people): Give people cloud access only through the company identity provider, with two-factor login. Create no separate cloud user with a password for a person. - [ ] **Required** [Keep no long-lived access keys](https://agentwranglers.se/playbook/infrastructure/identity-and-access/no-long-lived-keys): Use short-lived credentials for every person, pipeline and service. Delete every static access key, and alert when a new one appears. - [ ] **Required** [Give every role the least it needs](https://agentwranglers.se/playbook/infrastructure/identity-and-access/least-privilege-roles): Write every role's permissions in code, limited to named actions on named resources. Never grant every action on every resource, except to the break-glass role. - [ ] **Required** [Lock the root account away](https://agentwranglers.se/playbook/infrastructure/identity-and-access/lock-root-account): Protect every cloud root or owner account with a hardware key or passkey, give it no access keys, and alert on every sign-in. - [ ] **Required** [Keep tested break-glass accounts](https://agentwranglers.se/playbook/infrastructure/identity-and-access/break-glass-access): Keep two emergency admin accounts that work when single sign-on is down. Store their factors offline, alert on every use, and test them twice a year. - [ ] **Required** [Grant admin access for hours only](https://agentwranglers.se/playbook/infrastructure/identity-and-access/just-in-time-access): Give admin rights in production only on request, with a reason and an approver, for 8 hours at most. - [ ] **Recommended** [Separate the roles for plan and apply](https://agentwranglers.se/playbook/infrastructure/identity-and-access/separate-plan-and-apply-roles): Give pull requests a read-only role that can only plan. Give the write role only to the main branch in a protected environment. Give the app its own runtime role. ## Configuration and secrets - [ ] **Required** [Create the secret's place in code and its value in the store](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/secret-containers-in-code): Create each secret's entry, owner and access policy in code. Put its value in the store by rotation or by hand, never through a code variable. - [ ] **Required** [Keep secrets out of state](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/secrets-out-of-state): Pass secrets to resources in a way that never writes them into the state or plan files. - [ ] **Required** [Let CI sign in with OIDC](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/oidc-for-ci): Let pipelines sign in to the cloud with a short-lived token from the CI provider's OIDC issuer. Store no cloud key in CI secrets. - [ ] **Required** [Give services the identity of their machine](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/workload-identity): Let each running service get cloud credentials from the platform's identity, such as an instance role, a Kubernetes service account or a managed identity. Put no cloud key in its settings. - [ ] **Recommended** [Rotate secrets automatically](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/automatic-secret-rotation): Let the secrets store rotate each secret on a schedule, every 90 days at most. The app picks up the new value without a deploy. ## Networking and DNS - [ ] **Required** [Keep databases in private subnets](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-data-stores): Put every database, cache and queue in a private subnet with no public address. Only the app's own security group may reach it. - [ ] **Required** [Deny all traffic unless a rule allows it](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall): Start every security group and firewall from deny. Allow only named ports from named sources, and open a port to the whole internet only on the load balancer. - [ ] **Required** [Close admin ports to the internet](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports): Never open SSH, RDP, database or admin ports to the internet. Reach machines through an identity-aware tunnel or a private network that needs single sign-on. - [ ] **Required** [Force encryption on every managed service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services): Configure every database, cache and bucket to refuse plain connections. Make every client check the server's certificate. - [ ] **Required** [Require tokens for the metadata service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/metadata-service-tokens): Make every cloud server's metadata service answer only requests that carry a session token. Allow the token to travel one network hop, or two when containers on the host need it. - [ ] **Required** [Keep DNS records in code](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/dns-as-code): Manage every DNS record of every domain in code, changed by pull request. Never edit a record in the provider's web panel. - [ ] **Recommended** [Limit where servers can send traffic](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control): Let servers send traffic only to the hosts they need. Databases send none to the internet at all. - [ ] **Recommended** [Shorten the TTL before you move a record](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/lower-ttl-before-changes): Before you point a name at a new server, shorten its TTL and wait one full old TTL. Restore the longer TTL after the move. ## Policy as code - [ ] **Required** [Scan infrastructure code on every change](https://agentwranglers.se/playbook/infrastructure/policy-as-code/scan-infrastructure-code): Run an infrastructure scanner on every pull request, and fail the build on any finding rated high or critical. - [ ] **Required** [Block dangerous actions for the whole organization](https://agentwranglers.se/playbook/infrastructure/policy-as-code/cloud-guardrails): Set organization-wide policies that refuse the most dangerous actions in every account, even for admins. - [ ] **Recommended** [Test your own rules against the plan](https://agentwranglers.se/playbook/infrastructure/policy-as-code/policy-on-the-plan): Write the house rules that no scanner knows as policies, and run them against the plan in CI. Examples are the allowed regions, the required tags and the largest server size. - [ ] **Recommended** [Let every exception expire](https://agentwranglers.se/playbook/infrastructure/policy-as-code/expiring-policy-exceptions): Give every skipped check a reason, an owner and an end date in the code. Fail the build once the date has passed. - [ ] **Recommended** [Test infrastructure modules](https://agentwranglers.se/playbook/infrastructure/policy-as-code/test-infrastructure-modules): Give every shared module tests that check its plan, and run them in CI on every change to the module. ## Servers - [ ] **Required** [Configure long-lived servers from code](https://agentwranglers.se/playbook/infrastructure/servers/configuration-management): When a server lives for months, set up its packages, files and services from code that can run again without changing anything. - [ ] **Required** [Rebuild any server from code](https://agentwranglers.se/playbook/infrastructure/servers/rebuild-from-scratch): Keep everything needed to rebuild each server in code, so one command builds a fresh one. Prove it on a new machine in the quarterly [restore drill](https://agentwranglers.se/playbook/operations/disaster-recovery/restore-drills). - [ ] **Required** [Install security updates by themselves](https://agentwranglers.se/playbook/infrastructure/servers/automatic-security-updates): Let every server install security updates by itself every day, and reboot in a set window when the kernel needs it. - [ ] **Required** [Turn on a firewall on every host](https://agentwranglers.se/playbook/infrastructure/servers/host-firewall): Run a firewall on every server that refuses all incoming traffic except the ports it serves. Allow SSH only from named admin addresses. - [ ] **Required** [Allow SSH with keys only](https://agentwranglers.se/playbook/infrastructure/servers/ssh-keys-only): Turn off password logins and direct root logins over SSH. Give each person their own key, and remove it the day they leave. - [ ] **Recommended** [Replace servers instead of patching them](https://agentwranglers.se/playbook/infrastructure/servers/immutable-servers): Build a new machine image for every change, start new servers from it and stop the old ones. Never change a running server by hand. ## Cost and ownership - [ ] **Required** [Tag every resource with its owner](https://agentwranglers.se/playbook/infrastructure/cost-and-ownership/required-tags): Tag every resource with its owner, service, environment and the tool that manages it. Refuse any plan that creates a resource without them. - [ ] **Required** [Give every account a budget with alerts](https://agentwranglers.se/playbook/infrastructure/cost-and-ownership/budgets-for-every-account): Create a monthly budget in code for every account. Alert the owning team when the forecast passes 80 percent and when spending passes 100 percent. - [ ] **Recommended** [Delete resources that sit idle](https://agentwranglers.se/playbook/infrastructure/cost-and-ownership/delete-idle-resources): Run a weekly job that lists idle resources and deletes them after their owner has had 7 days to object. - [ ] **Recommended** [Size servers from what they use](https://agentwranglers.se/playbook/infrastructure/cost-and-ownership/rightsize-from-measurements): Every quarter, compare each server's size with its measured use over 14 days. Step down one size when its 95th percentile CPU stays under 40 percent and memory under 50 percent. - [ ] **Optional** [Show the cost of each change in review](https://agentwranglers.se/playbook/infrastructure/cost-and-ownership/cost-in-review): Show the monthly cost change of every infrastructure pull request in the review. Ask the budget owner to approve any change above a set amount.