DevOps Platform Patterns

Platform-specific verification checklists for infrastructure code.

DigitalOcean

Check	Pass	Fail
VPC used for private networking	Private network configured	Public networking only
Reserved IPs for production	Static IPs assigned	Ephemeral IPs for critical services
Managed database in same region	Co-located DB	Cross-region latency
Spaces for state backend	Remote state in Spaces	Local state only
Firewall attached to all droplets	Firewall rules applied	No firewall

Best Practices:

• Use digitalocean_vpc for internal communication
• Attach firewalls via digitalocean_firewall with inbound rules
• Store Terraform state in DigitalOcean Spaces with versioning

Hetzner

Check	Pass	Fail
Private network configured	Network created	No private networking
Firewall rules defined	Rules restrict access	Open to internet
SSH keys managed via resource	hcloud_ssh_key used	Keys in user_data only
Placement groups for HA	Servers distributed	Single point of failure

Best Practices:

• Use hcloud_network + hcloud_network_subnet for internal traffic
• Apply hcloud_firewall to all servers
• Use placement groups with spread type for critical workloads

AWS

Check	Pass	Fail
VPC with private subnets	Multi-AZ VPC	Default VPC usage
Security groups least-privilege	Specific ports/IPs	0.0.0.0/0 ingress
IAM roles over access keys	Instance profiles	Hardcoded credentials
KMS encryption for data	Customer-managed keys	No encryption
CloudTrail enabled	Audit logging on	No audit trail

Best Practices:

• Never use default VPC for production
• Prefer aws_iam_role with instance profiles over access keys
• Enable S3 bucket versioning and encryption by default
• Use aws_kms_key for sensitive data encryption

Cloudflare

Check	Pass	Fail
API tokens over global key	Scoped tokens	Global API key
WAF rules configured	Protection enabled	No WAF
SSL mode is strict	Full (strict) mode	Flexible SSL
Rate limiting on endpoints	Rules applied	No rate limiting

Best Practices:

• Create scoped API tokens per environment/purpose
• Set SSL mode to strict for origin protection
• Apply rate limiting to authentication endpoints
• Enable Bot Management if available

Cross-Platform Checks

Check	Applies To	Verification
Private networking	All	Internal services not exposed
Firewall/security groups	All	Explicit allow rules only
State backend remote	All	Not in local tfstate
Encryption at rest	All	Data encrypted
Audit logging	AWS, Cloudflare	Activity tracked