CLOUD SECURITY / DEVELOPER TOOLINGCASE STUDY / 4 minute read

Infraguard

SEE THE RISK.BEFORETHE CHANGE.

A Terraform plan says what will change. Infraguard asks which changes deserve attention, explains its reasoning, and gives CI a decision it can act on.

Independent project · Offline public fixturesThe 60-second overview

Checked against GitHub

Last successful check · 2026-09-05 22:54 UTC5428ed6Refresh Career Atlas after public repository changes

★ 1 stars 0 forks ↗Commit · 2026-09-05No published releaseLatest default-branch run · success · 2026-09-05 · 5428ed6 ↗

THE SHORT VERSION

WHAT THIS
DEMONSTRATES.

01
Three focused checks share one CLI: Terraform plan risk, AWS resource tags, and IAM policies.
02
Risk comes from explicit action weights, resource criticality, and an environment multiplier detected from the resource address.
03
An isolated review passed all 58 repository tests and recorded three Terraform fixture results.

01 / CONTEXT

THE PROBLEM.

Infrastructure reviews can bury a destructive database change among routine updates. Reviewers need a small, explainable signal that can travel from a local terminal to a pull request without requiring a live cloud connection.

Constraints that shaped the work

Analyze exported plans without applying infrastructure.
Keep every risk factor inspectable.
Support offline resource and policy inputs.
Distinguish rejected changes from invalid inputs.

02 / FOLLOW THE SYSTEM

ARCHITECTURE.

Choose a stage to explore its purpose and supporting source.

ARCHITECTURE WALKTHROUGH01 / 03

Read the proposed change

The parser reads Terraform plan JSON and normalizes resource actions, including replacement. The tool analyzes the proposal; it does not apply it.

WHAT TO INSPECT

Public fixtures include creation, mixed changes, and a database deletion.

Read the implementation

RECORDED FROM PUBLIC SOURCE

CHANGE THE SCENARIO.

5 SEP 2026
OFFLINE RECORDING

Inspect inputs and outputs captured from the repository. Switching scenarios replays saved results; it does not run cloud services or a model.

INPUT / SCORED CHANGES

[
  {
    "address": "aws_instance.web",
    "action": "create",
    "weight": 1,
    "criticality": 4,
    "environmentMultiplier": 1,
    "score": 4
  },
  {
    "address": "aws_security_group.web",
    "action": "create",
    "weight": 1,
    "criticality": 4,
    "environmentMultiplier": 1,
    "score": 4
  }
]

RECORDED OUTPUT

{
  "totalScore": 8,
  "threshold": 50,
  "verdict": "PASS"
}

Recorded source calculation: action weight × criticality × environment multiplier. The displayed gate applies the reviewed CLI’s > 50 comparison. Inspect the complete input plan in the recording.

Inspect the complete recording

03 / ENGINEERING JUDGMENT

THE TRADEOFFS.

Prefer explainable rules

Use deterministic factors instead of an opaque risk prediction.

The tradeoffTeams can inspect the calculation, but address naming and default resource classifications can misrepresent their environment.

Inspect the decision

Separate review from deployment

Consume exported JSON and emit standard reports.

The tradeoffThe tool stays easy to run offline, while freshness and completeness of the input remain the caller’s responsibility.

Inspect the decision

04 / WHAT THE WORK SHOWS

OUTCOMES & LIMITS.

58 tests passed in the recorded review

The public repository’s parser, scorer, tag checks, and IAM checks passed locally on 5 September 2026. This is a dated result for the linked revision.

Supporting source

A reviewable CI boundary

The same score used in the report controls the threshold exit code. Reviewers can explain why a plan was blocked.

Supporting source

Security findings with specific reasons

IAM checks identify broad administrative access, wildcard actions, sensitive permissions, and missing constraints.

Supporting source

THE LESSON

A guardrail earns trust when a reviewer can reconstruct its decision. The score is useful as a prompt for review, with local policy and engineering judgment still required.

Where the evidence ends

The score is not a security certification, loss estimate, or full dependency blast-radius analysis.
The README advertises custom plan-risk rules, but the reviewed CLI does not expose a --rules option. Scorer overrides exist at the Python function boundary.
Tests and fixture recordings do not establish production adoption or prevented incidents.

05 / CHECK THE WORK