Shifting left at enterprise scale: how we manage Cloudflare with Infrastructure as Code

Cloudeflare transitioned its internal operations to an infrastructure as Code (IaC) and "shit left" security model, managing hundreds of production accounts with Terraform and a custom CI/CD pipeline. This approach uses the Open Policy Agent (OPA) framework and Rego to define approximately 50 security polices, ensuring automated compliance checks and peer reviews before deployment to minimize human error. 

Read More