About this project
Description from the program archive
When managing cloud infrastructure through GitLab using Terraform, there is a critical security concern: any maintainer can make destructive changes from any branch, even unintentionally. This opens up risks where unreviewed or experimental branches can alter production environments.
This project aims to implement a system of Protected Terraform States, similar to protected branches in Git. The idea is to enforce that only designated branches (like main or production) can trigger state changes to Terraform-managed infrastructure.
The proposal includes: Creating backend logic to enforce state protection rules. Designing GraphQL APIs to manage and query protected states. Enabling fine-grained permission controls for reading, writing, or deleting Terraform state files. Integrating usage tracking to help teams audit and improve security.