--- title: "Terraform" description: "5 posts about Terraform, summarised, each linking to the original." --- # Terraform > 5 posts about Terraform, summarised, each linking to the original. ## Articles ### [How the FDA is building a secure, AI-ready data foundation on Databricks for Government](https://yomu.fyi/post/how-the-fda-is-building-a-secure-ai-ready-data-foundation-on-databrick.md) - Company: [Databricks](https://yomu.fyi/company/databricks.md) - Author: Filippo Seracini, Vijay Raja - Published: Sep 1, 2026 The FDA built HALO (Harmonized AI and Lifecycle Operations for Data) as a secure, governed, AI-ready enterprise data platform for modernizing siloed systems without interrupting regulatory work. Its move to Databricks on AWS GovCloud, following FedRAMP High authorization sponsorship, added Unity Catalog as a governance layer across a multi-tenant architecture, while Terraform-based security patterns, PrivateLink, customer-managed keys, and the compliance security profile support regulated workloads. The agency migrated more than 5,000 users and 8,000 jobs and pipelines with zero downtime, refactoring over 1,000 pipelines and 4,000 notebooks. After onboarding eight centers and 30 programs, FDA reported query responses improving over 30%, compute costs falling over 20%, and provisioning and sharing time dropping over 75%. HALO also supports responsible AI use cases such as MARS, with humans retaining decision authority. ### [Provisioning for the Agentic Era: How Databricks Built a Self-Serve Infrastructure Vending Machine](https://yomu.fyi/post/provisioning-for-the-agentic-era-how-databricks-built-a-self-serve-inf.md) - Company: [Databricks](https://yomu.fyi/company/databricks.md) - Author: Evan Pandya, Greg Wood, Joel Thomas - Published: Jul 23, 2026 Databricks built the Field Engineering Vending Machine (FEVM) to replace shared environments with isolated, centrally governed infrastructure for its growing field organization. Users or agents describe a use case and configuration details, receiving an environment assembled through a React frontend, Python backend, Databricks Apps, Terraform, Git Runner, and Lakebase across AWS, Azure, and GCP. FEVM supports templates and add-ons such as Lakebase, notebooks, and pre-packaged assets from UC Volumes, applies configurable time-to-live policies, and sends Slack notifications for provisioning, expiration, and deletion. It also manages shared resources independently, including catalogs that persist across workspace lifecycles, and provides administrative controls for limits and audits. At the time described, it managed more than 2,600 active deployments across three clouds and over 5,000 active users, after handling nearly 1,200 requests during one internal event. ### [Supercharging LLM application development with LLM-Kit](https://yomu.fyi/post/supercharging-llm-application-development-with-llm-kit.md) - Company: [Grab](https://yomu.fyi/company/grab.md) - Author: Boon Zhan Chew - Published: Nov 29, 2024 Grab developed LLM-Kit, a comprehensive framework for setting up production-ready Generative AI applications while addressing security, scalability, integration, monitoring, and standardisation concerns. Its pre-configured structure includes an API server, configuration management, a sample LLM Agent, tests, and an integrated stack spanning Poetry, Gunicorn, FastAPI, LangChain, LangSmith, HashiCorp Vault, Amazon EKS, and GitLab CI. Engineers submit application details through a form, which triggers GitLab project and code-scaffold generation, CI/CD setup, Terraform-based staging and production infrastructure provisioning, and secure GPT-token storage in Vault. The scaffold also includes authentication, API documentation, observability, Redis and vector-database integrations, deployment pipelines, and a cookbook with organisational examples; the post reports that it has onboarded hundreds of GenAI applications and saves an estimated 1.5 weeks before teams begin their first feature. ### [Finding the right balance of speed and security through just-in-time access to cloud resources](https://yomu.fyi/post/finding-the-right-balance-of-speed-and-security-through-just-in-time-a.md) - Company: [Ramp](https://yomu.fyi/company/ramp.md) - Author: Julien Colombain - Published: Oct 11, 2023 Ramp’s rapid growth exposed problems in its AWS access model: three broad roles created persistent production access for some senior engineers while junior engineers depended on seniors for queries. The team first reorganized permissions into more than 20 team-specific AWS Identity Center groups, each backed by permission sets and a Terraform module that presents IAM configuration through human-readable resource lists. It then introduced just-in-time access through ConductorOne by pairing each non-production role with an elevated production role, removing standing production access and provisioning entitlements through AWS SSO group membership. Team-owned requests were automatically approved, while cross-team requests went to the relevant tech lead, with temporary access and backup approval handling described in the design. The resulting model reduced exposure, preserved fast access to needed resources, and recorded production activity for accountability and audit purposes. ### [Using DNS Traffic Management to Add Resiliency to Shopify’s Services](https://yomu.fyi/post/using-dns-traffic-management-to-add-resiliency-to-shopify-s-services.md) - Company: [Shopify](https://yomu.fyi/company/shopify.md) - Author: 2023-10-18 - Published: Aug 5, 2020 Shopify consolidated several team-specific DNS traffic-management approaches that relied on manual changes, pull requests, or provider APIs and had uneven failover, redundancy, and active/active capabilities. The replacement was a fully automated, self-served system for more than 40 domains owned by more than 12 teams and handling more than 100M requests per day. It stores domain configuration in Git, deploys it to two DNS providers, and exposes spy commands for fast updates and failovers. Its traffic-management design uses regionalized matching, endpoint-status filtering, weighted sharing, and fallback layers, while globally matching endpoints ensure an existing domain receives an answer. A later provider migration demonstrated the value of centralized ownership: the team updated Terraform and tooling, moved nameservers incrementally, and kept the change transparent to application owners despite concurrent incidents.