Solving AWS IAM Challenges at Scale With Terraform
summary
Red Ventures builds a custom Terraform provider plus an API and AWS Step Functions workflow to manage access across more than 400 AWS accounts, replacing brittle per-account Terraform runs. It implements dynamic account filters (IDs, names, tags, OUs), integrates with ServiceNow for approvals, uses GitHub code-owners for delegated team folders, and enforces a multi-step approval flow (manager → account owner → tech VP). Real-time audit logging surfaces via Slack. The system operates in production and reduces manual toil and compliance gaps.
AI-written summary · about
chapters (9)
- 0:00Introduction and context
- 3:31Key IAM challenges overview
- 6:18Initial manual approach limitations
- 9:25Terraform provider evaluation
- 11:08Custom Terraform provider design
- 13:56Self-service Terraform delegation
- 15:24Security and compliance hurdles
- 18:55Compliance framework integration
- 20:20Lessons learned and future outlook
related talks
25mSecuring and Scaling AWS with Terraform, Vault, and Veeam: A Practical Guide
34mScaling access with AWS IAM Identity Center, feat.
21mA secure automation platform: Terraform Enterprise, Ansible Automation Platform, & Vault Enterprise
15mA Diary of Change in the Dusty Financial Sector
30mWhy you should take care of infrastructure drift
13mMaking cloud security more human
01h 00mGotchas using Terraform in a secure delivery pipeline
41mAutomating Multi-Cloud, Multi-Region Vault for Teams and Landing Zones