Automate & Recover · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Pipeline stages
terraform fmt -check && terraform validate | Formatting and syntax |
tflint | Terraform linter (provider-aware rules) |
checkov -d . / trivy config . | Security misconfiguration scanning |
terraform plan -out=tfplan | Plan (posted to the PR) |
terraform apply tfplan | Apply the exact reviewed plan |
GitHub OIDC to AWS
permissions: id-token: write | Allow the job to request an OIDC token |
uses: aws-actions/configure-aws-credentials@v4 with role-to-assume | Exchange it for temporary AWS credentials |
State recovery
aws s3api list-object-versions --bucket acme-tfstate-prod --prefix eks/prod/cluster/ | Previous versions of a state file |
aws s3api get-object --bucket … --key … --version-id <id> old.tfstate | Download an older version |
terraform state pull > backup.tfstate | Back up current state before any repair |
import { to = aws_s3_bucket.logs id = "acme-logs" } | Re-adopt an existing resource (in code, Terraform 1.5+) |
Prevention
lifecycle { prevent_destroy = true } | Refuse to plan destruction of critical resources |
deletion_protection / termination protection | Provider-level protection where available |
IAM deny on eks:DeleteCluster for CI roles (except break-glass) | Stop destructive calls at the API |
Readiness checks
aws eks describe-cluster --name prod --query 'cluster.resourcesVpcConfig' | Endpoint access and networking |
aws eks list-access-entries --cluster-name prod | Who can access the cluster |
aws eks list-insights --cluster-name prod | Upgrade readiness |
kubectl get nodepools,nodeclaims | Karpenter capacity |
velero backup get | Backups and their status |
