Enabling Developer Autonomy through Infrastructure as Code and Policy as Code

Introduction

Infrastructure as Code (IaC) and Policy as Code have become foundational pillars in modern DevOps practices, enabling teams to manage infrastructure and compliance with automation and consistency. For organizations like TV4 and MTV3, which operate in the Nordic market and rely on AWS for hundreds of microservices, the integration of these practices is critical to maintaining scalability, security, and developer productivity. This article explores how TV4 leverages OpenTofu (Terraform), CDK for Terraform (CDKTF), and Open Policy Agent (OPA) to empower developers while addressing the challenges of infrastructure management in a large-scale environment.

Key Concepts and Implementation

Infrastructure as Code (IaC) with OpenTofu

TV4 and MTV3 use OpenTofu as their sole cloud resource management tool, deploying over 300 projects and 1,400 workspaces across AWS. This centralized approach ensures consistency but introduces challenges such as a steep learning curve for developers unfamiliar with HCL syntax. The declarative nature of HCL, combined with meta arguments like count and for_each, complicates the maintenance of large modules. Additionally, the lack of type information in AWS services like ECS and the delayed validation during apply operations further hinder developer efficiency.

CDK for Terraform (CDKTF) as a Solution

To address these challenges, TV4 adopts CDKTF, which allows developers to write infrastructure configurations in TypeScript. This approach simplifies the learning curve by leveraging JavaScript-like syntax and provides dynamic configuration capabilities through functions. Key advantages include:

• TypeScript Integration: Enables type safety and compile-time validation, reducing configuration errors.
• Dynamic Configuration: Supports logic-driven configurations, such as environment-specific backend setups.
• Modular Design: Encapsulates infrastructure modules using JavaScript objects, improving maintainability.
• Automated Workspace Management: CLI tools handle dependency sorting and execution order, streamlining workflows.

Policy as Code with Open Policy Agent (OPA)

TV4 integrates OPA to enforce security and compliance policies across infrastructure configurations. By defining declarative policies in Rego, teams can validate configurations before deployment. For example, policies ensure ECS Fargate services use the latest platform version, preventing outdated configurations. This proactive validation reduces the risk of misconfigurations and aligns with DevOps principles of continuous improvement.

Challenges and Limitations

While CDKTF and OPA offer significant benefits, TV4 faces several technical challenges:

• CDKTF’s Limited Updates: The project, maintained by HashiCorp, has seen no major updates since January 2024, raising concerns about long-term support.
• CLI Binding Constraints: The default CLI is tightly coupled with Terraform, requiring custom adjustments to support OpenTofu.
• Resource Intensity: The AWS provider’s TypeScript bindings (352MB) impact deployment efficiency in multi-microservice environments.
• Abstraction Layer Risks: Over-reliance on CDKTF’s abstractions may lead to complexity when resolving issues that require raw HCL configuration.

Real-World Applications

TV4’s implementation of CDKTF and OPA includes practical use cases such as:

• Dynamic Backend Configuration: Environment variables allow developers to specify remote backends dynamically.
• Automated Cost Tagging: Policy updates propagate cost tagging strategies across all resources.
• Pre-Deployment Validation: OPA policies check configurations before Terraform plans are executed, ensuring compliance.

These practices reduce manual intervention, accelerate deployment cycles, and foster a culture of self-service infrastructure management among developers.

Conclusion

By combining CDKTF and OPA, TV4 has transformed its infrastructure management from a centralized, error-prone process into a developer-centric, automated system. The integration of type-safe configurations and policy-driven validation enhances productivity while maintaining security and compliance. However, ongoing efforts are required to address CDKTF’s long-term viability and optimize its performance in large-scale deployments. As the DevOps landscape evolves, the synergy between IaC and Policy as Code will remain essential for achieving scalable, secure, and developer-friendly infrastructure management.