Day 21/90: Practice: Multi-cloud deployment

90 Day Security Infrastructure Challenge

I am writing this one as if a teammate opened the pull request and asked what actually matters. My answer is that combining modules, configuration management, policy checks, and rollout steps into one delivery system a team can actually maintain. Good infrastructure content should make the operational boundary visible, not bury it behind screenshots or one happy-path command.

The Copy-Paste Multi-Cloud Problem

The practical reason to spend time on the copy-paste multi-cloud problem is simple: it is one of the places where infrastructure drift hides behind a clean-looking diff. Combining modules, configuration management, policy checks, and rollout steps into one delivery system a team can actually maintain.

The repo earns trust when module outputs, pipeline logs, state backends, deployment runbooks, change approvals, and restore steps kept together tell the same story as the PR summary. That is how you get to a production-ready infrastructure pipeline with clear ownership, promotion stages, and recovery notes for every major component. Project days only count if the repo is reviewable by someone who did not build it and still needs to operate it next quarter.

terraform show -json practice_multi_cloud_deploym.tfplan > artifacts/practice_multi_cloud_deploym.json
checkov -d terraform/
conftest test artifacts/practice_multi_cloud_deploym.json --policy policies/
echo "rollback owner for practice: multi-cloud deployment: platform-oncall" >> runbooks/practice_multi_cloud_deploym.md

Shared Module Interface

Shared Module Interface sounds narrow until it fails under pressure. Then you find out whether the infrastructure repo can explain its own behavior. The real work is still combining modules, configuration management, policy checks, and rollout steps into one delivery system a team can actually maintain.

I do not want a magical success message. I want module outputs, pipeline logs, state backends, deployment runbooks, change approvals, and restore steps kept together, because that evidence is what turns the work into a production-ready infrastructure pipeline with clear ownership, promotion stages, and recovery notes for every major component. Project days only count if the repo is reviewable by someone who did not build it and still needs to operate it next quarter.

Cloud-Specific Implementations with Baked-In Defaults

Cloud-Specific Implementations with Baked-In Defaults is where practice: multi-cloud deployment becomes operational. On a real team, the argument is rarely about syntax. It is about combining modules, configuration management, policy checks, and rollout steps into one delivery system a team can actually maintain.

What I want back from this day is a production-ready infrastructure pipeline with clear ownership, promotion stages, and recovery notes for every major component. That only happens when the change leaves evidence in module outputs, pipeline logs, state backends, deployment runbooks, change approvals, and restore steps kept together. Project days only count if the repo is reviewable by someone who did not build it and still needs to operate it next quarter.

Review posture

• I want the pull request to name the affected environment, the rollback path, and the state or inventory boundary touched by practice: multi-cloud deployment.
• The review should show exactly how the copy-paste multi-cloud problem changes behavior, not just that the file format is valid.
• If a pipeline gate, policy check, or drift report disagrees with the proposed change, that disagreement belongs in the review thread instead of hidden in logs.

The outcome I care about is a production-ready infrastructure pipeline with clear ownership, promotion stages, and recovery notes for every major component. That is only believable when module outputs, pipeline logs, state backends, deployment runbooks, change approvals, and restore steps kept together are easy to find and consistent with the explanation in the pull request. Project days only count if the repo is reviewable by someone who did not build it and still needs to operate it next quarter.

Why this belongs in a security infrastructure track

IaC, Ansible, policy as code, GitOps, and infrastructure testing all share the same responsibility: make change review safer than console drift. That is why I keep bringing the lesson back to Terraform, IaC boundaries, pipeline evidence, and the operational story behind the diff.