Infrastructure as Code, in practice.
Field notes on turning live AWS into Terraform — codification, brownfield migration, and drift.
Guide · Terraform
How to Generate Terraform from an Existing AWS Account
You inherited infrastructure that was clicked together in the console. Here are the four ways to reverse-engineer it into Terraform — terraform import, open-source exporters, automated services, and the hybrid approach — with the trade-offs of each.
Guide · FinOps
AWS Cost Optimization & FinOps: Finding Waste Without Inflating the Number
The AWS waste that is genuinely measurable — idle compute, unattached EBS, gp2 volumes, ECS over-reservation, Auto Scaling floors, S3 lifecycle — and the five rules that stop a savings total from overstating what you would actually save.
Comparison
Terraformer Alternatives, Chosen by the Limit You Hit
Four different problems send people looking for a replacement and only one needs a different tool. The specific output failures, and the free native path.
Comparison
former2 Alternatives, by the Reason You Outgrew It
No install is a genuine advantage until scale, snapshots or credentials-in-a-browser make it stop mattering. Each reason points somewhere different.
Comparison
driftctl Alternatives: Replacing Drift and Coverage
It did two jobs and most replacements do one. What Terraform gives you natively, and why the coverage half is the harder one to replace.
Guide · Drift
Unmanaged AWS Resources and Why Your Plan Says Nothing
An account can be half unmanaged while every plan reports no changes. How to find what IaC missed, and why importing all of it is the wrong move.
Comparison
InfraSync vs Firefly
Firefly is a multi-cloud governance plane with agents that can act on your environment. InfraSync is AWS-only and read-only. Which trade-off suits your risk appetite.
Comparison
InfraSync vs ControlMonkey
One runs your Terraform estate end to end. The other gets your estate into Terraform in the first place. They are sequential, not competing.
Comparison
InfraSync vs Brainboard
One turns a diagram into code, the other turns a running account into code. What makes the reverse direction genuinely harder.
Comparison
InfraSync vs CloudGeni
CloudGeni bets on autonomous agents. InfraSync is deliberately deterministic and read-only. A question about authority, not about features.
Comparison
InfraSync vs Terraformer and former2
The free tools export once and stop. What the raw output actually needs before it plans cleanly, described by people who patch it.
Guide · FinOps
AWS Savings Plans: Sizing a Commitment You Will Not Regret
Every other finding asks you to change something. This one asks you to change nothing and pay less — so long as you size it to your steady-state floor and rightsize first.
Guide · FinOps
ECS Task Over-Reservation: The Gap Between Reserved and Used
On Fargate the reservation is the bill. Why both CPU and memory have to be slack before a cut is safe, and the one place a memory recommendation rests on measurement.
Guide · FinOps
S3 Lifecycle Rules and the 128 KB Floor Nobody Reads
Below 128 KB, objects do not transition to any storage class. For many real buckets every transition rule anyone could write is inert — here is what to write instead.
Guide · Workflow
Terraform to GitHub: Why a GitHub App and a Pull Request
Getting generated Terraform into the repository your team reviews, without handing a tool a personal access token that can reach every repository you can.
Guide · Workflow
Scheduled AWS Scans: Cadence, Timezones and Running Once
A one-off scan describes one afternoon. Choosing a cadence, why a timezone is a correctness question, and claiming a job exactly once across several servers.
Guide · Drift
AI Drift Remediation Advice That Cannot Break Production
A mutating-verb denylist fails open. Why every suggested command is validated against a real AWS service model, and why there is no automatic revert.
Guide · Architecture
Scanning Many AWS Accounts and Regions Without Lying About Coverage
Most AWS APIs answer for one region and some resources have no region at all. How scope, account boundaries and deduplication decide what a report is worth.
Guide · FinOps
Unattached EBS Volumes: What They Cost and How to Find Them
Detaching a volume saves nothing — only deleting it does. How orphaned volumes accumulate, what they cost per GB-month, the one API call that finds them, and the stopped-instance leak that hides better.
Guide · FinOps
gp2 to gp3: What the Migration Actually Saves
Twenty percent per GB, converted online with no downtime. Where that number holds, where provisioning IOPS erodes it, and how to avoid counting the same volume twice.
Guide · FinOps
Your Auto Scaling Group’s MinSize Is the Bill
Rightsizing asks whether each instance is the right size. It structurally cannot ask whether you need this many. How to tell if a floor has never been exercised.
Guide · FinOps
AWS Compute Optimizer vs CloudWatch Rightsizing
What each one covers, the memory blind spot they share, the observation window that makes a claim defensible, and how to use both without double-counting.
Guide · Operations
How to Set Up Live Drift Detection with CloudTrail and EventBridge
A nightly scan tells you what changed by morning. This tells you in seconds, and who did it — using a push pipeline that never gets write access to your account.
Playbook · Migration
ClickOps to Infrastructure as Code: A Migration Playbook
Most real-world AWS accounts weren't built with Terraform. This is a staged plan for codifying a brownfield estate without breaking what's running in production.
Guide · Operations
Terraform Drift Detection: What It Is and How to Stay Ahead of It
Drift is the silent gap between your code and your cloud. What causes it, why it's dangerous, and how to catch it before it causes an outage or a failed apply.
Guide · Tooling
Terraform vs OpenTofu: Differences, Licensing & How to Choose
They share a language and most of their DNA — but the license split and diverging features matter. The honest breakdown for 2026.
Guide · Getting started
How to Connect Your AWS Account to InfraSync
Give InfraSync read-only access in a couple of minutes — read-only access keys or a cross-account role, set up in the AWS console or with the CLI.
Guide · Security
How to Create a Read-Only IAM Role for Safe AWS Scanning
Give a scanning tool the least power that does the job. A step-by-step on read-only roles, cross-account trust, and external IDs.
Tutorial · Terraform
The Terraform import Block: A Practical Tutorial
Terraform 1.5 turned importing into a reviewable, code-first workflow. How the import block works, with copy-paste examples.
Guide · Operations
Terraform State Management: Best Practices for Teams
State is the one file that makes Terraform dangerous when it goes wrong. The rules that keep it safe, shared, and recoverable.
Guide · Terraform
An AWS Tagging Strategy for Terraform
Tags are the index to your whole account — for cost, ownership, and security. Designing a convention and enforcing it with default_tags.
Guide · Terraform
Building Terraform Modules from Existing Infrastructure
Refactor flat, generated HCL into clean, reusable modules — without Terraform destroying a single resource.
Stop reading. Start scanning.
Connect a read-only IAM role and watch InfraSync turn your live AWS account into reviewable Terraform — your first pull request in minutes.