Shifting left at enterprise scale: how we manage Cloudflare with Infrastructure as Code

What this post added

This post details Cloudflare's internal adoption of Infrastructure as Code (IaC) for managing its own platform, focusing on the 'shift left' principle for security and consistency across hundreds of internal production accounts. It highlights the use of Terraform, Atlantis, GitLab, and a custom state file manager (tfstate-butler). A key contribution is the implementation of Policy as Code using Open Policy Agent (OPA) and Rego to define and enforce security baselines, including handling exceptions. The post also shares lessons learned regarding onboarding, configuration drift, and the importance of automation, particularly the use of cf-terraforming for migrating existing resources.