This article outlines Cloudflare's approach to implementing a 'shift-left' methodology for managing its own critical infrastructure at an enterprise scale. Facing the challenge of securing hundreds of internal accounts consistently and minimizing human error, Cloudflare transitioned from manual configuration to Infrastructure as Code (IaC). The core strategy involves treating configurations as code, integrating security checks early in the development lifecycle via CI/CD, and enforcing policy as code. Key technologies include Terraform for infrastructure provisioning, Atlantis for CI/CD, a custom `tfstate-butler` for secure state management, and Open Policy Agent (OPA) with Rego for policy enforcement. The article also addresses challenges encountered, such as importing legacy click-ops configurations, managing configuration drift, and keeping the Terraform provider up-to-date, sharing lessons learned around minimizing adoption barriers, automating drift detection, and leveraging OpenAPI for provider generation. The overarching message emphasizes a proactive approach to security and configuration management, enabling secure scaling and increased engineering velocity.
