First Touch Provisioning
No Change
adopt
First Touch Provisioning. First touch provisioning creates the foundation layer of infrastructure: cloud accounts and guardrails, networks, DNS, IAM roles, clusters, VMs, databases as managed services, and remote state.
Summary
Garden stance: We adopt First Touch Provisioning for our estate.
Key points:
| Topic | Notes |
|---|---|
| Tools | Terraform (adopt); avoid new Imperative IaC / Pulumi generators for greenfield |
| State | Remote backend per env; locking; no local-only state for shared infra |
| Modules | Reusable VPC/cluster modules; watch blast radius (DRY discipline) |
| Policy | Policy as Code on plans before apply |
| Provisioner anti-pattern | Terraform remote-exec / heavy local-exec blurs touches; keep first touch declarative |
References
Details
| Topic | Notes |
|---|---|
| Tools | Terraform (adopt); avoid new Imperative IaC / Pulumi generators for greenfield |
| State | Remote backend per env; locking; no local-only state for shared infra |
| Modules | Reusable VPC/cluster modules; watch blast radius (DRY discipline) |
| Policy | Policy as Code on plans before apply |
| Provisioner anti-pattern | Terraform remote-exec / heavy local-exec blurs touches; keep first touch declarative |
References