Separate authoring from authority
Engineers should be able to propose infrastructure change without every workstation holding unrestricted cloud credentials. Use pull requests, reviewed plans and workload identities so the delivery system becomes the controlled execution boundary.
Protect state as production data
Terraform state can contain infrastructure identifiers and sensitive values. Use a remote backend with encryption, versioning, locking and tightly scoped access. Recovery procedures for state should be documented and tested before the first serious drift or failed migration.
Make the plan an approval artefact
Generate plans from immutable commits and retain enough context for reviewers to understand destructive actions, replacements and privilege changes. Recreate the plan after approval when inputs or code change rather than applying an artefact that no longer represents the reviewed configuration.
Add policy without hiding engineering judgement
Automated policy can reject known-dangerous patterns such as public storage or unrestricted management ports. It should complement architecture review rather than create a false assumption that passing policy checks means the design is secure or cost effective.
AL Group can assess, design, implement and operate the underlying technology rather than stopping at advice.
Talk to an engineer