# infrastructure as code (IAC) Published articles for infrastructure as code (IAC). This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Architecting a secure landing zone in the AWS European Sovereign Cloud DevFeed: [Architecting a secure landing zone in the AWS European Sovereign Cloud]() Original publisher: [Read original article]() Author: Pablo Pagani Published: 2026-09-16T21:20:48Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Amazon Web Services](), [Cloud](), [Architecture & Design](), [AWS IAM](), [Infrastructure as code](), [CI/CD](), [SIEM, Security](), [Incident response]() Tags: [advanced-300](), [aws](), [aws-identity-and-access-management-iam](), [ci-cd](), [cloud](), [eu](), [europe](), [incident-response](), [infrastructure-as-code-iac](), [partition](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article explains how to architect a secure, scalable landing zone in the AWS European Sovereign Cloud. It describes the aws-eusc partition boundary and covers governance, identity, logging, data protection, network design, CI/CD, artifact distribution, and incident response. ### Source excerpt The AWS European Sovereign Cloud is a new, independent cloud for Europe, physically and logically separate from existing AWS Regions and operated within the European Union (EU). It provides the same services, features, and APIs as AWS commercial Regions, but runs as a distinct AWS partition (aws-eusc), with its own control plane, AWS Identity and [...] ## Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline DevFeed: [Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline]() Original publisher: [Read original article]() Author: Luis Pastor Published: 2026-09-15T15:53:51Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [AWS Identity and Access Management (IAM)](), [CI/CD](), [Infrastructure as code](), [AWS CloudFormation](), [Amazon Web Services]() Tags: [aws](), [aws-cloudformation](), [aws-cloudtrail](), [aws-iam](), [aws-identity-and-access-management-iam](), [aws-organizations](), [best-practices](), [ci-cd](), [expert-400](), [iam](), [infrastructure-as-code-iac](), [least-privilege](), [pull-request](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article describes an automated workflow for operationalizing least privilege in AWS. It explains how AWS IAM Access Analyzer identifies unused permissions and how remediation can be routed through different paths for infrastructure-as-code-managed, manually created, and unused IAM principals. ### Source excerpt The principle of least privilege is straightforward to articulate but challenging to maintain at scale. When teams first deploy applications to AWS, they often grant broader permissions than strictly necessary; it's faster to get things working, and the plan is always to tighten permissions later. But later rarely comes. Permissions accumulate, AWS Identity and Access [...] ## KCP: How to Migrate to Confluent Cloud in Days, Not Weeks DevFeed: [KCP: How to Migrate to Confluent Cloud in Days, Not Weeks]() Original publisher: [Read original article]() Author: Ahmed Saef Zamzam Published: 2026-09-14T07:00:00Z Content type: tutorial Language: en Sources: [Confluent: Data in motion]() Topics: [Kafka](), [migration](), [Confluent Cloud](), [Replication](), [Infrastructure as code](), [Provisioning](), [Access Control](), [Structured-data]() Tags: [access-control](), [confluent](), [confluent-cloud](), [data-replication](), [infrastructure-as-code-iac](), [kafka](), [migration](), [open-source](), [provisioning](), [replication](), [schema]() ### AI overview The article explains how Confluent's open source KCP tool automates migration from Amazon MSK to Confluent Cloud. KCP supports discovery, infrastructure provisioning, ACL and schema mapping, and migration, while Cluster Linking provides offset-preserving data replication. Support for self-managed Kafka migrations is described as coming soon. ### Source excerpt Use Kafka Copy Paste (KCP) to automate Kafka migration with infrastructure generation, ACL and schema mapping, and offset-preserving data replication. ## Now generally available: See how Stack Automation by Quali cuts deployment time DevFeed: [Now generally available: See how Stack Automation by Quali cuts deployment time]() Original publisher: [Read original article]() Author: Carlos Campos Torres Published: 2026-09-09T15:00:14Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Automation](), [Deployment](), [Provisioning](), [configuration](), [cloud-infrastructure](), [Cloud]() Tags: [agenticops](), [automation](), [cloud](), [data-center](), [deployment](), [documentation](), [infrastructure](), [infrastructure-as-code-iac](), [platform](), [software](), [ubuntu](), [windows]() ### AI overview Stack Automation by Quali, co-developed with Cisco, is generally available as a deployment automation platform for validated Cisco and third-party infrastructure solutions. Its Solutions Hub supports planning, modeling, bill of materials generation, and automated deployment across on-premises and public-cloud services, reducing deployment cycles from weeks to hours or minutes. ### Source excerpt Still burning weeks on manual infrastructure deployment? Stack Automation by Quali, co-developed with Cisco, is now available--turning that grind into an automated, cloud-like experience that takes minutes. ## Pulumi Context API: query your infrastructure as a graph DevFeed: [Pulumi Context API: query your infrastructure as a graph]() Original publisher: [Read original article]() Author: Levi Blackstone Published: 2026-08-26T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [API](), [Graphs](), [Cloud APIs](), [infrastructure as code (IAC)](), [Command-line interface](), [JSON](), [pulumi-neo]() Tags: [agent](), [ai-agents](), [api](), [cli](), [features](), [graph](), [iac](), [infrastructure-as-code-iac](), [json](), [product](), [pulumi](), [pulumi-cloud](), [pulumi-neo](), [rest-api]() ### AI overview Pulumi is launching the Context API, a read-only API that connects Pulumi-managed and discovered resources, stacks, and their relationships into a graph. Available in public preview for Enterprise and Business Critical organizations, it supports infrastructure-impact, coverage, and cleanup queries through the Pulumi CLI or REST API. Pulumi Neo uses it out of the box, and other authenticated agents can access its schema and query guidance. ### Source excerpt Every platform team fields the same questions: What is running? What breaks if we change this? What can we safely delete? The answers exist, but they're scattered across state files, cloud consoles, and the memories of whoever set things up. Today we're launching the Pulumi Context API, a read-only API that connects Pulumi-managed and discovered resources, stacks, and their relationships into a graph. It's designed agent-first: Pulumi Neo, our infrastructure agent, uses it out of the box, and other agents can fetch the current graph vocabulary and query guidance on demand. It's available in public preview for organizations on the Enterprise and Business Critical editions. Answers that follow infrastructure relationships Pulumi already records the resources your programs manage, their dependencies, how stacks consume each other's outputs, and the resources Pulumi Discovery finds outside infrastructure as code (IaC). The Context API connects this data so you can ask questions that depend on the relationships: Impact: Which stacks are affected if we upgrade this provider? If this stack changes, what consumes its outputs? Coverage: How much of our infrastructure lives outside IaC, and in which accounts? Cleanup: Which stacks have no dependents and are candidates for retirement? A query is a JSON document with a handful of clauses. anchor names the starting nodes, traverse follows relationships from there, and return chooses what comes back. You can run a query through the Pulumi CLI or REST API. Here's a selector that starts from AWS provider instances older than version 7.0.0 and follows incoming provided_by relationships back to the visible resources they manage: { "anchor": { "nodeType": "resource", "match": { "type": "pulumi:providers:aws", "fields": { "provider_version": { "op": "lt", "value": "7.0.0" } } } }, "traverse": [ { "edgeTypes": ["provided_by"], "direction": "in", "alias": "managed" } ], "return": { "select": ["anchor", "managed"] } } A response for one m ## How Terraform Works DevFeed: [How Terraform Works]() Original publisher: [Read original article]() Author: Saurabh Dashora Published: 2026-05-05T07:41:46Z Content type: tutorial Language: en Sources: [System Design Codex]() Topics: [Terraform](), [Infrastructure as code](), [Provisioning](), [CI/CD](), [Pull Request](), [Command-line interface]() Tags: [changes](), [ci-cd](), [hcl](), [infrastructure-as-code-iac](), [plan](), [preview](), [provisioning](), [terraform]() ### AI overview A step-by-step introduction to how Terraform uses Infrastructure as Code and HCL configurations to define resources, preview changes with Terraform Plan, and provision infrastructure with Terraform Apply. It also explains providers, variables, modules, state, workspaces, and CI/CD or pull-request workflows. ### Source excerpt Step by step ## DevSecOps Automation Framework DevFeed: [DevSecOps Automation Framework]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-03-11T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [DevSecOps](), [Automation](), [Framework](), [Application Security](), [Testing](), [CI/CD](), [iac-security](), [Vulnerabilities]() Tags: [application-security](), [automation](), [awareness](), [blog](), [ci-cd](), [devops](), [devsecops](), [executive](), [framework](), [iac-security](), [infrastructure-as-code-iac](), [megawatt](), [security](), [snyk-platform](), [vulnerabilities]() ### AI overview This article explains how DevSecOps automation integrates security throughout the software development lifecycle. It discusses automation frameworks, automated security testing in CI/CD pipelines, early vulnerability detection, consistent security policies, compliance, SAST, and Infrastructure as Code security. ### Source excerpt Learn about the principles of DevSecOps automation, how to implement a DevSecOps automation strategy, & the best DevSecOps tools. ## Move Fast and "Branch" Things DevFeed: [Move Fast and "Branch" Things]() Original publisher: [Read original article]() Author: Stephen Siegert Published: 2024-04-15T16:38:10Z Content type: article Language: en Sources: [Blog -- Neon Docs]() Topics: [Databases](), [infrastructure as code (IAC)](), [Serverless](), [autoscaling](), [Cloud](), [Provisioning](), [Amazon RDS](), [Amazon Web Services]() Tags: [amazon-rds](), [autoscaling](), [availability](), [cloud](), [community](), [database](), [iam](), [infrastructure-as-code-iac](), [networking](), [provisioning](), [serverless]() ### AI overview Neon presents scalable Postgres with database branching, autoscaling, and serverless scale to zero as a way to reduce infrastructure complexity from development through production. The article contrasts this approach with traditional AWS RDS and Google Cloud SQL setups that require extensive infrastructure-as-code, networking, access management, high availability, scaling, backup, and cost planning. ### Source excerpt Neon simplifies the use of scalable Postgres, changing how you handle your database infrastructure from development through production. This is a fundamental shift in how to leverage your Postgres infrastructure. Instead of spending time on Infrastructure as code (IaC) and cloud-... ## Rego 101: Introduction to Rego DevFeed: [Rego 101: Introduction to Rego]() Original publisher: [Read original article]() Author: Becki Lee Published: 2023-11-02T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Open Policy Agent](), [Infrastructure as code](), [Security](), [Programming]() Tags: [blog](), [blog-post](), [cloud-security](), [developer](), [devrel](), [enablement](), [how-to](), [iac-security](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [learn](), [opa](), [policy](), [rego](), [security](), [snyk-cloud](), [snyk-iac](), [tutorial]() ### AI overview A beginner-focused introduction to Rego, the declarative policy language used with Open Policy Agent (OPA). It explains policy as code, how OPA evaluates Rego policies, and how these policies can be applied to cloud and infrastructure-as-code resources. ### Source excerpt Learn how to write your first policy as code rules in Rego. This Rego tutorial for beginners covers the basics of Rego syntax and using OPA. ## AWS IAM in layman's terms DevFeed: [AWS IAM in layman's terms]() Original publisher: [Read original article]() Author: info@goteleport.com (Shuo Yang) Published: 2021-06-16T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [AWS Identity and Access Management (IAM)](), [IAM](), [Access Control](), [Authorization](), [Development](), [Security](), [Infrastructure as code]() Tags: [access-control](), [aws-iam](), [development](), [diagram](), [figure](), [how-to](), [iam](), [infrastructure-as-code-iac](), [policy](), [security]() ### AI overview This tutorial explains AWS IAM roles, STS, identity pools, and IAM policy mechanisms. It focuses on separating access-control responsibilities between central security or platform teams and individual application development teams, including the interaction between permission boundaries and identity-based policies. ### Source excerpt Learn how to leverage the right AWS IAM policy mechanisms to build responsibility separation between a central platform team and individual development teams.