Skip to main content

Model Artifact: Terraform/IaC Change Review

Scenario​

A Semester 9 learner reviews a Terraform change that creates a production object-storage bucket for audit exports.

Completed learner-quality example​

Change summary​

Create audit-export-prod with versioning, server-side encryption, public-access blocks, lifecycle transition to cold storage after 90 days, and least-privilege writer access for the export job role.

Plan review​

Expected creates:

  • One storage bucket.
  • Bucket versioning configuration.
  • Bucket encryption configuration.
  • Public access block.
  • Lifecycle policy.
  • IAM policy attachment for audit-export-writer.

Unexpected changes: none. The plan does not destroy or replace existing resources.

Security review​

  • Public ACLs and public policies are blocked.
  • Encryption is enforced by bucket default and deny policy for unencrypted writes.
  • Writer role can put objects only under exports/tenant_id=*/ and cannot read all exports.
  • Human break-glass read access is separate and audited.

Operational review​

  • Versioning protects against accidental overwrite.
  • Lifecycle policy limits long-term storage cost.
  • Metrics and alerting are required for failed export jobs, not for bucket creation alone.
  • Rollback means disabling writer access and retaining the bucket for forensic safety; do not destroy production audit data casually.

Decision​

Approve after adding a missing tag: data_classification = "confidential".

How to read this example​

  • Passing: Compares intended resources against the plan and checks for destructive surprises.
  • Strong: Reviews security, operations, cost, and rollback implications.
  • Portfolio-worthy: Shows production judgment by refusing casual data destruction and requiring classification metadata.