Shifting left at enterprise scale: how we manage Cloudflare with Infrastructure as Code

This post details Cloudflare's internal adoption of Infrastructure as Code (IaC) for managing hundreds of internal production Cloudflare accounts. It outlines the "shift left" principles applied, the use of Terraform with the Cloudflare provider, Atlantis for CI/CD, tfstate-butler for secure state management, and Open Policy Agent (OPA) with Rego for defining and enforcing security baselines. It also discusses challenges like importing existing configurations, handling configuration drift with a custom detection service, and the evolution of the Terraform provider.