DevOps Platform Patterns

Platform-specific verification checklists for infrastructure code.

DigitalOcean

Check Pass Fail

VPC used for private networking Private network configured Public networking only

Reserved IPs for production Static IPs assigned Ephemeral IPs for critical services

Managed database in same region Co-located DB Cross-region latency

Spaces for state backend Remote state in Spaces Local state only

Firewall attached to all droplets Firewall rules applied No firewall

Best Practices:

• Use digitalocean_vpc for internal communication

• Attach firewalls via digitalocean_firewall with inbound rules

• Store Terraform state in DigitalOcean Spaces with versioning

Hetzner

Check Pass Fail

Private network configured Network created No private networking

Firewall rules defined Rules restrict access Open to internet

SSH keys managed via resource hcloud_ssh_key used Keys in user_data only

Placement groups for HA Servers distributed Single point of failure

Best Practices:

• Use hcloud_network

• hcloud_network_subnet for internal traffic

• Apply hcloud_firewall to all servers

• Use placement groups with spread type for critical workloads

AWS

Check Pass Fail

VPC with private subnets Multi-AZ VPC Default VPC usage

Security groups least-privilege Specific ports/IPs 0.0.0.0/0 ingress

IAM roles over access keys Instance profiles Hardcoded credentials

KMS encryption for data Customer-managed keys No encryption

CloudTrail enabled Audit logging on No audit trail

Best Practices:

• Never use default VPC for production

• Prefer aws_iam_role with instance profiles over access keys

• Enable S3 bucket versioning and encryption by default

• Use aws_kms_key for sensitive data encryption

Cloudflare

Check Pass Fail

API tokens over global key Scoped tokens Global API key

WAF rules configured Protection enabled No WAF

SSL mode is strict Full (strict) mode Flexible SSL

Rate limiting on endpoints Rules applied No rate limiting

Best Practices:

• Create scoped API tokens per environment/purpose

• Set SSL mode to strict for origin protection

• Apply rate limiting to authentication endpoints

• Enable Bot Management if available

Cross-Platform Checks

Check Applies To Verification

Private networking All Internal services not exposed

Firewall/security groups All Explicit allow rules only

State backend remote All Not in local tfstate

Encryption at rest All Data encrypted

Audit logging AWS, Cloudflare Activity tracked