Blog

Giving developers a path to a Postgres instance with no public IP, without a self-managed bastion anyone logs into and without standing up a VPN. Uses GCP Identity-Aware Proxy TCP forwarding to a headless relay VM that runs one socat process and nothing else, no SSH keys, no OS Login, IAM gates the tunnel instead of a login. Covers the network layer and the separate, non-optional step after it: Postgres-level group authentication and privilege grants, since reaching the instance is not the same as being able to query it.

Standing up two new GCP projects for a payments service migrating from an existing PCI-DSS environment on another cloud, with isolated Terraform state, scoped service accounts, a network and encryption-key layer built from a documented audit question list, and an IAM-only access design for a multi-schema Postgres database.

Migrating Azure Key Vault Terraform state between two repositories with separate backends. Covers cross-state terraform state mv, a resource-group mismatch caught before apply, and a method for distinguishing an in-use resource from an orphaned one.

Migrating a shared dev/prod Terraform state into separate Azure backends without recreating resources. Covers terraform state mv between local files and remote backends, the handling of data blocks, outputs, and random_* resources, plus rollback via reverse state mv and switching the storage account or container for an existing environment.