What changed in the fine print

CloudTrail creates the organization trail in member accounts even if a resource validation fails; the documentation gives an incorrect bucket policy and insufficient permissions to encrypt with a KMS key as examples. A successful apply doesn't prove there is delivery. Check get-trail-status: if there is a problem with the bucket, the LatestDeliveryError field shows the S3 error (it only appears for problems with the destination bucket, not for requests that time out). Fix it with the bucket policy, or by creating another bucket and calling update-trail.

Scope of the source: the official example is a bucket owned by the organization's management account; the documentation doesn't cover a bucket in another account (such as this module's log archive account), so test it in a non-production environment. The bucket of an organization trail needs a policy that lets CloudTrail write the organization's logs: the official example has three statements (GetBucketAcl, PutObject on the management account prefix and PutObject on the AWSLogs/o-<organization id>/ prefix). The aws:SourceArn must be the ARN of a trail owned by the management account, using that account's ID. That policy doesn't give access to users in member accounts: by default, the organization's log files are accessible only to the management account. List explicitly who you want to grant read access to and don't assume member accounts can read.

If the organization trail is multi-Region and its home Region is an opt-in Region, member accounts don't send activity to the trail unless they opt into that Region; the documentation's example is Europe (Spain): only accounts that enabled it send their activity. Organization trails created in the console are multi-Region. Choose a Region that is enabled by default as the home Region, or verify that each account enabled the Region; if an account doesn't show up in the bucket, check this point.

If the trail is misconfigured (for example, the bucket is unreachable), CloudTrail attempts to redeliver the log files to the bucket for 30 days, and those delivery attempts are subject to standard CloudTrail charges. To avoid charges on a misconfigured trail you need to delete it. Fix the bucket policy and the key policy before creating the trail (in Terraform, with a depends_on of the trail on both) and check get-trail-status afterwards.

AWS strongly recommends not attaching an SCP to the root without testing its impact on the accounts: create an OU and move accounts into it one at a time, or in small groups, so you don't lock anyone out of key services. For RCPs it recommends starting with test accounts, moving up through the OUs and reviewing CloudTrail for Access Denied errors. Also, don't remove the FullAWSAccess policy without modifying it or replacing it with another that has the allowed actions: otherwise all AWS actions from member accounts fail. For an S3 policy, after each change check the effective policy of representative accounts with DescribeEffectivePolicy.

Front Door's guide for a Storage origin says that if the blob or container doesn't permit anonymous access, requests against it must be authorized, for example with shared access signatures, and lists as a common mistake not using SAS against an account that doesn't allow anonymous access. According to the same guide, public internet access to the account is disabled once the private endpoint is enabled. So you have to choose:If athe container with anonymousdoesn't blobpermit read,anonymous reachableaccess, onlydon't throughconnect the private endpoint, or SAS on requests. Decide explicitly andorigin don'twithout leaveauthorizing the container private without SAS.requests.

For signed URLs to protect the content, the origin must not grant public access: the documentation says to remove the allUsers (and allAuthenticatedUsers, if applicable) read permissions from the bucket, which is commonly left public during testing. Even without public access, anyone who already has permission on the bucket, such as OWNER, can access Cloud Storage without a signed URL. And a signed URL gives time-limited access to anyone who holds it, whether or not they have a Google Account. The same page warns that Cloud CDN doesn't block requests without a Signature query parameter or Cloud-CDN-Cookie cookie (it rejects those with invalid parameters) and that the origin must validate signatures and accept or reject unsigned requests. Check that the bucket has neither allUsers nor allAuthenticatedUsers before calling the entry closed, and sign only HTTPS URLs.

TheWhen principalSetgranting androles theto workload_identity_providerexternal youidentities passyou touse the action areproject projects/NUMBER/locations/global/...,number, not the project ID.ID: the principalSet is principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/.... Also, an IAM change usually applies within 2 minutes but can take 7 or more, so a freshly configured pipeline can fail its first run with nothing actually wrong.more.

Cloud DNS doesn'tuses usethe your35.199.192.0/19 VPC'srange IPsfor toall forward:customers, everyand queryit is the source of queries to aType forwarding1 targetand comesType from2 35.199.192.0/19.targets The(VPC internal IPs and on-premises firewallover mustVPN allowor UDPInterconnect). andType TCP3 53targets fromuse thatGoogle range,Public DNS source ranges, and for Type 4 the range depends on the IPs the name resolves to. For a Type 2 target, on-premises needs a return route through theto VPN35.199.192.0/19 tunnelswhose ornext Interconnecthop attachmentsis in the same VPC. With BGPVPC, that'sthrough a customCloud advertisementVPN ontunnel theor a Cloud Router.Interconnect WithoutVLAN theattachment. route,With theBGP on-premisesthat's DNSa getscustom theroute queryadvertisement andon the replyCloud isRouter's lost.BGP session.

PrivateVM Googleinstances Accessthat only letshave VMsinternal withoutIP publicaddresses IPscan use Private Google Access to reach Google APIs.APIs Toand restrictservices. That solves reachability, not origin filtering. Bucket IP filtering lets you needrestrict access to the bucket based on client IP filteringranges orand VPC Servicenetworks, Controls.and works alongside IAM.

With internal ingress, Cloud Run rejectsonly accepts requests notfrom comingsources fromsuch as VPCs in the same projectproject, (ora VPC SC perimeter)perimeter or an internal Application Load Balancer, and from otherproducts Googlesuch services,as evenCloud viaScheduler, Cloud Tasks, Eventarc, Pub/Sub or Workflows if they're in the same project or perimeter and use the default run.app URL. Other sources, including the internet, can't reach it. But IAM authentication still applies: the client must present an ID token and its service account needs roles/run.invoker.

IAM validates GitHub's certificate against its library of trusted root CAs, so thumbprint_list is optional and, in the Terraform provider, for IdPs like GitHub it's stored but not used for verification. Thumbprints only come into play if the IdP uses a certificate not signed by one of those CAs, or if AWS can't retrieve the TLS certificate or TLS v1.3 is required. Many old modules still hardcode a thumbprint "that must be rotated": for GitHub that's not what breaks login.

The VPC resolver (CIDR baseAWS +states 2)that answersforwarding resourcesprivate inDNS thequeries VPC.to AWSany statesVPC thatCIDR forwardingbase queries+ to2 itaddress from on-premises or other VPC DNS servers isn't supported and can givecause unstable results, even if it sometimes seems to work. That's what the inbound endpoint isresults. for,Instead, justAWS likerecommends Azure'susing ora GCP'sResolver inbound policy.endpoint.

The inbound endpoint resolves with what its VPC sees. IfFor the zone is associated only with application VPCs,VPC on-premisesResolver getsto NXDOMAINresolve eveninbound thoughDNS everythingqueries resolvesusing finethe fromrecords thein VMs.a Inprivate multi-accounthosted setups,zone, the zone must also be associated with the hubVPC VPC.where you created the inbound endpoint.

SinceBy default, Object Ownership is BucketOwnerEnforced and all ACLs are disabled. AWS announced that, starting in April 20232023, S3 enableswould enable Block Public Access and disablesdisable ACLs on all new buckets (Object Ownership set to BucketOwnerEnforced).buckets, It'swith no longer "the"change differencefor withexisting Azure.ones. Still declare them in IaC: existing buckets didn't change, and declaring the state prevents drift if someone edits them in the console.

The token expires after 15 minutes and is used only to authenticate: it doesn't affect the session once established, but an expired token makes a new connection request fail. An app that opens a connection per request must generate a freshif tokenyou eachtry time;to keepconnect awith poolan andexpired refreshtoken, the token when openingconnection newis connections.rejected.

To pull the image and ship logs without internet egress, the task needs ECR (api and dkr) and CloudWatch Logs interface endpoints, plus the S3 gateway endpoint (where ECR stores layers). If it uses the awslogs log driver, it also needs the CloudWatch Logs interface endpoint. Each interface endpoint is billed hourly per AZ. The alternative (NAT Gateway) is also billed hourly and per GB.

To create an HTTPS listener you must deploy at least one SSL server certificate (from ACM or IAM). ACM requires proving domain ownership for a public certificate via DNS, email or HTTP, and cannot validate resources in a VPC private hosted zone or any other private domain, even if the ALB is internal. ACM does not validate domain ownership for imported certificates or for certificates signed by a private CA.

With manage_master_user_password = true, RDS generates the master password and stores it in Secrets Manager. The Terraform provider doesn't allow combining it with password, and RDS doesn't support it in some scenarios (for example Blue/Green deployments), so decide upfront.

Private Endpoints, VNet rules and CMK onlyrequire existPremium-tier innamespaces, Premium,which are billed per messaging unit per hour even with zero messages.unit. Standard only supports IP firewall rules. This pattern uses Standard with Entra ID-only auth: if the requirement is private networking, you have to move to Premium. In AWS, SQS connects through an interface VPC endpoint.

KEDA queriesFor the queue length on its own. Toscale haverule itto use a managed identity, the scale rule usesset the identity property instead of auth. The portal can'tdoesn't configuresupport it: use IaC or CLI.

In S3Azure youStorage scopesupports therole policyassignments tofor arn:...:bucket/incoming/*both andstorage inaccounts GCPand youblob usecontainers. IAMTo Conditionsscope by prefix. In Azure a role assignment reaches the container at minimum; to scopeprefix byor path you need ABAC conditions on the role assignment.assignment (Blob prefix and Blob path attributes). Simple alternative: a container dedicated to ingestion (what this module does).

Creating the Private Endpoint is not enough: the FQDN <account>.blob.core.windows.net must resolve to the private IP via the privatelink.blob.core.windows.net zone linked to the VNet (or your hybrid DNS). If it resolves to the public IP,IP and the serviceaccount firewallhas a firewall, it rejects the request with 403 and looks like a permissions issue.

Terraform/ARM adds Entra principals are added as administrators (azure_pg_admin,from CREATEROLE,the CREATEDB).Azure portal or the ARM API. With isAdmin=true, pgaadauth_create_principal gives them azure_pg_admin, CREATEROLE and CREATEDB. For the app identity to be a regular user, an Entra admin can run pgaadauth_create_principal('<name>', false, false). For managed identities and service principals the name is the display name. The module outputs the exact SQL.

ACA can go down to zero replicas, but PostgreSQL Flexible bills compute while it's on. Stopping it stops compute billing (not storage), but the service automatically restarts it after 7 days. For dev environments, automate the stop instead of relying on a manual one.

VNet peering is a nontransitive relationship: two spokes peered with the same hub can't see each other. For the hub to connect them, the subnets in each spoke need a UDR pointing to Azure Firewall as the default gateway, and the peerings must accept forwarded traffic. If either is missing, spoke-to-spoke traffic either doesn't arrive or doesn't go through the firewall. Make the UDR part of onboarding each spoke, not a separate manual step.

When appliance mode isn't enabled, the transit gateway keepsattempts to keep traffic in the originating AZ. With it enabled, it selects a single network interface in the inspection VPC using a flow hash for the life of the flow and uses the same one for return traffic, so bidirectional traffic is symmetric. A stateful firewall needs to see both the request and the response. Enable it on the inspection VPC's attachment (in Terraform, appliance_mode_support = "enable") and connect exactly one transit gateway to that VPC: with several, AWS doesn't guarantee flow stickiness. Changing it on an existing attachment can alter its current routing.

Subnet routes are always exchanged (except IPv4 subnet routes using privately used public IPv4 addresses), but dynamic routes and IPv4 static routes without network tags with a next hop other than the default internet gateway aren't exported or imported by default. You enable them with --export-custom-routes on the VPC that has them and --import-custom-routes on the one that receives them. Static routes with network tags or with the default internet gateway as next hop can't be exported or imported. ATo spokeprovide thata doesn'tpath importfrom on-premises to the hub'speered routesVPC, can'tyou reachalso on-premiseshave throughto configure Cloud Router custom advertisement mode with the hub.peered VPC's subnet ranges.

NCC VPC spokes exchangecan export and import all subnet routes withfrom the other spokes on theVPC hub.spokes. You can't use VPC Network Peering between two VPC spokes that are also connected through an NCC hub, and static route exchange across VPC spokes isn't supported,supported. andYou incan thehave staran topologyNCC-connected NCCVPC doesn'tspoke connectpeered thewith a separate VPC that isn't part of NCC, and use peering between two VPC spokes in the edge group to eachof other.a Choosehub thewith modelstar beforetopology, creatingbecause theNCC VPCs,doesn't becauseconnect youthe can'tspokes mixin themthat betweengroup theto sameeach spokes.other.

A firewall endpoint is a zonal resource, and the association links it to a VPC network in the same zone. A VPC network can associate with only one endpoint per zone, organization-level or project-level. Cloud NGFW redirects traffic to the endpoint only when it matches a policy rule with the apply_security_profile_group action. ToAn coverendpoint thecan zonesbe whereattached workloadsto run,one createor onemore endpointVPC networks in the same zone, and if a VPC network spans several zones you attach one associationendpoint per zone; in a zone andwith perno VPC,endpoint andattached checkthere is no layer 7 inspection. Check that every flow to inspect has its rule.

A VM without an explicit outbound method gets a default outbound public IP. That IP is owned by Microsoft and can change without notice, so it is no good for a third-party allowlist. For the API version released after March 31, 2026, subnets in new VNets have defaultOutboundAccess set to false; existing VNets don't change, and new VMs in them keep getting the default IP unless the subnet is made private. Tools that pin an earlier API version (the doc names Terraform) leave the value as null, which allows implicit outbound access. Declare an explicit method (NAT Gateway) and set the subnet to private explicitly; existing VMs must be stopped and deallocated for the change to take effect. WithoutIn a private subnet without explicit outbound, Windows Update and Windows activation don't work.

The NAT Gateway pricing page charges resource hours and data processed (outbound and return traffic), and states that the hourly rate is charged regardless of the NAT gateway having subnets or public IPs attached; bandwidth charges also apply. Azure Firewall charges a fixed hourly fee per deployment, regardless of scale, plus a per-GB processed charge. With both in the path, both meters run. If you don't need to filter by destination, the NAT gateway alone already gives the fixed IP without the firewall.

For HTTPS, Network Firewall uses the SNI from the TLS handshake and for HTTP the Host header; it doesn't pause the connection to do DNS lookups or evaluate IPs, so it relies on what the client asserts. A domain list can't scope by port or by a single protocol: for that you need Suricata or 5-tuple stateful rules. By default inspection uses the CIDR of the firewall's VPC as HOME_NET; to filter traffic from other VPCs (for example through a transit gateway) you must set HOME_NET to include those CIDRs. With the Allow action the firewall denies non-matching traffic only if the policy uses default action order; under strict order that denial doesn't apply. If you also want to validate the domain the destination IP was resolved for, the AWS_ROUTE_53_RESOLVED_DOMAIN target exists.

Each NAT IP address offers 64,512 TCP source ports. If you don't specify the minimum ports per VM, the default applies: 64 with static allocation and 32 with dynamic, and for Public NAT the default allocation is static. With static allocation a VM can't use more than its allocated ports, even during traffic bursts. In addition, the gateway can process 1,024 simultaneous connections to each unique destination 3-tuple. The doc recommends dynamic allocation if egress usage varies, but it can't be combined with endpoint-independent mapping and, while additional ports are being allocated, you might see timeouts or latency. Dropped packets are logged only ifwhen you turn onuse Cloud NAT logging to turn on error logging. The module enables dynamic allocation and error logging.

For Public NAT, the pricing page defines the total cost as the gateway's hourly cost plus the cost per GiB processed by the gateway, the hourly cost of the external IP addresses it uses and the cost of outbound data transfer. The gateway's hourly price depends on the number of VMs using it and is capped at 32 VMs. When budgeting, add up all four parts: with static IPs reserved for the allowlist, each IP is charged hourly. Separately, the Cloud NGFW pricing page says that when a traffic flow is evaluated by a rule containing Cloud NGFW Standard features you are charged for data processing, and it lists FQDN objects among those features.

Cloud NGFW periodically resolves each FQDN object to IPs, following the VPC's Cloud DNS name resolution order. It doesn't support wildcards (`*`) or top-level domains. Each FQDN object maps to a maximum of 32 IPv4 and 32 IPv6 addresses, and the extra ones are dropped. If the answer is NXDOMAIN, has no usable IP or the DNS server is unreachable, the object is ignored. The doc says to avoid A records with a TTL under 90 seconds and notes that most Google domain names, such as googleapis.com, fall under these situations: it recommends IP addresses or address groups. It also can't be used if the VPC has an outbound server policy.policy with an alternative name server. A DNS query can return different answers depending on the client's location, so the programmed IPs may not include every address of the domain. Use FQDNs for third-party APIs with stable DNS and check each domain's TTL.

The Cloud NAT doc says that traffic sent to Google APIs and services is routed through Private Google Access, even when the VM uses Public NAT. Those calls don't leave with the NAT IPs, so a control that depends on the egress IP doesn't apply to those destinations. Don't expect to see the NAT IP on those calls, and treatTreat Google domains separately in the egress rules.

For the VNet to reach the vault through the Private Endpoint you need a private zone named exactly privatelink.vaultcore.azure.net, linked to that VNet and holding the vault's A record. If the zone isn't linked, the query returns the public IP. With public network access disabled and no firewall allow-list, the service rejects every request at that ingress, so the symptom is an access error, not public traffic.ingress. From on-premises you need conditional forwarders for vault.azure.net and vaultcore.azure.net to a resolver with access to Azure resolution (see the hybrid private DNS pattern). The vault name still resolves in public DNS even when the vault is private: don't put environment or customer in the name if that's part of your threat model.

Thirty days before a secret's expiration date, Key Vault publishes the SecretNearExpiry event to Event Grid. To rotate, you have to create the event subscription and provide the function that creates the new version in the vault and updates the external service. Microsoft's tutorial shows it for a SQL Server password. Between those two steps there can be a lag during which the vault's secret doesn't authenticate, and if a step fails Event Grid retries for two hours. The event depends on the secret having an expiration date. If the vault is private, the function has to reach it: the two-credential tutorial's template asks for a Premium plan only when the vault is behind a firewall.

Key Vault stores all secrets as encrypted data, with a service-owned key hierarchy, and the documentation states that this encryption is transparent and requires no action from you. The keys you store in Key Vault serve, for example, as a wrapping key (BYOK) to encrypt Azure Storage data. In AWS, when you create a secret you can pick a KMS customer managed key, and in GCP a Cloud KMS key (CMEK). If a compliance requirement demands controlling the key of the secrets store itself, check that Key Vault covers it before choosing it; the key role in this pattern is partial in Azure.

Secrets Manager charges based on the number of secrets stored and API calls made. A replica counts as a distinct secret and is billed separately; creating new versions when rotating isn't charged and neither is a secret marked for deletion. Each KMS key you create has a monthly cost (prorated hourly), and the interface endpoint is billed for each hour it stays provisioned in each AZ. Use one subnet per AZ you actually need, one secret per credential, and replicas only if another region requires them. Each GetSecretValue is a billable call: read the secret at startup or cache the value.

The latest alias points to the most recently added version. Google describes it as convenient for development but problematic for some production workloads, because a bad value can be rolled out immediately and cause a service-wide outage. The best practices guide asks to reference secrets by version number and deploy changes through your release process, and to disable a version before destroying it so the step is reversible. Every rotation adds a version and moves latest:version: resolve the number when rotating, store it in the deploy configuration and read it at startup.

AccessSecretVersion requires a DATA_READ permission and generates a Data Access audit log. Those logs are disabled by default for all services except some BigQuery ones, so you have to enable them explicitly. In the meantime, AdminOperations Activitythat logsmodify recordversions changes(add, todisable, thedestroy) secretare butADMIN_WRITE notand whogo readto theAdmin value.Activity. The best practices guide recommends enabling data access logs to analyze AccessSecretVersion requests, and doing it at the folder or organization level so you don't configure it in every project.

Private Google Access is a per-subnet setting: it lets VMs that only have an internal IP reach the external IPs of Google APIs, and has no effect on instances with an external IP. If you disable it, those VMs lose access. It doesn't support regional and multi-regional endpoints, the ones ending in rep.googleapis.com. Secret Manager's regional service is accessed through a regional endpoint (secretmanager.<location>.rep.googleapis.com in the documentation's examples) and its secrets can only be accessed from that region. ForGoogle thatdocuments youhow needto ause Private Service Connect endpointendpoints to thereach regional endpoints.

Private Endpoints, VNet rules and CMK only exist in Premium, billed per messaging unit per hour even with zero messages. Standard only supports IP rules. This pattern uses Standard with Entra ID-only auth: if the requirement is private networking, you have to move to Premium. In AWS, SQS supportsconnects through an interface endpoint without changingVPC tier.endpoint.

Private Endpoints, VNet rules and CMK only exist in Premium, billed per messaging unit per hour even with zero messages. Standard only supports IP rules and also has a monthly base charge.rules. This pattern uses Standard with Entra ID-only auth: if the requirement is private networking, the cost floor changesyou byhave anto ordermove ofto magnitude.Premium. In AWS, SQS supports an interface endpoint without changing tier.

Onscaling_config.maximum_concurrency alimits messagehow spikemany Lambdaconcurrent scalesinstances fastof andthe function the queue can overwhelminvoke. It's an event source mapping setting, independent of the downstreamfunction's databasereserved orconcurrency API.and scaling_config.maximum_concurrencyfree limitsof howcharge, manyand concurrentit invocationskeeps theone queue triggers,from withoutusing all of the sidereserved effectsconcurrency ofor the function'saccount's concurrency quota. Note: the reserved concurrency (whichmust canbe alsogreater causethan throttlingor andequal retries).to the sum of the maximums of all the function's event sources; otherwise Lambda might throttle your messages.

Pub/Sub considers the message processed when the endpoint responds 2xx. Ifwith the102, worker200, takes201, longer202 thanor the204; ackany deadlineother (maxcode 600is s),a Pub/Subnack redeliversand itPub/Sub whileresends it'sthe stillmessage. running.The Alignsame ack_deadline_secondshappens withif the Cloudworker Runtakes servicelonger timeoutthan and,the forack longdeadline: jobs,Pub/Sub useredelivers pullit orwhile Cloudit's Runstill Jobs.running.

It's the only one ofPub/Sub thesupports pattern'sexactly-once threedelivery servicesonly with native exactly-once delivery,pull butsubscriptions: push (what triggers Cloud Run) doesn't support it. Withit, push,because asthe withclient Servicedoesn't Busknow andwhether SQSPub/Sub Standard,received the workerresponse mustand beprocessed idempotent.it.

Creating a second provider for token.actions.githubusercontent.com in the same account failsfails: withIAM EntityAlreadyExists.doesn't let you register the same URL twice in an account. If each repo ships its own Terraform stack with the provider inside, the second apply breaks. Create it once (in the account stack) and reference it with the data source; the module supports that with create_oidc_provider = false.

IAM validates GitHub's certificate against its library of trusted root CAs, so thumbprint_list is optional and, in the Terraform provider sinceprovider, 5.0for and,IdPs iflike set,GitHub it's stored but not used for verification. Thumbprints only come into play if the IdP uses a certificate not signed by one of those CAs, or if AWS can't retrieve the TLS certificate or TLS v1.3 is required. Many old modules still hardcode a thumbprint "that must be rotated": for GitHub that's not what breaks login.

The principalSet and the workload_identity_provider you pass to the action are projects/NUMBER/locations/global/..., not the project ID: with the ID, the token exchange fails.ID. Also, an IAM change usually applies within 2 minutes but can take 7 or more, so a freshly configured pipeline can fail its first run with nothing actually wrong.

If a VPC has a FORWARD rule for corp.example.com and also a corp.example.com private hosted zone, the rule wins. Among rules the most specific wins, and a SYSTEM rule excludes a subdomain from forwarding. In Azure it's the other way around: the linked private zone is checked before the ruleset.

Cloud DNS doesn't use your VPC's IPs to forward: every query to a forwarding target comes from 35.199.192.0/19. The on-premises firewall must allow UDP and TCP 53 from that range, and on-premises needs a return route through the VPN tunnels or Interconnect attachments in the same VPC and region.VPC. With BGP that's a custom advertisement on the Cloud Router. Without the route, the on-premises DNS gets the query and the reply is lost: it looks like a timeout.lost.

AVPC peeredNetwork VPCPeering doesn't seeautomatically privateshare zonesDNS orinformation, forwardingso zonesa authorizedpeered onlyVPC fordoesn't resolve the hub VPC.VPC's zones on its own. In hub-and-spoke, each spoke needs a DNS peering zone to the hub, and transitive DNS peering only goes one hop. That's the difference from Azure, where a ruleset links to VNets that aren't even peered.

Creating the Private Endpoint is not enough: the FQDN <account>.blob.core.windows.net must resolve to the private IP via the privatelink.blob.core.windows.net zone linked to the VNet (or your hybrid DNS). If it resolves to the public IP, withthe publicservice accessfirewall disabledrejects the request fails with 403 and looks like a permissions issue.

S3 queues expirations and can take days to physicallyprocesses delete.them Unlikeasynchronously: Azure,anywhere youfrom don'tdays payto storageweeks forcan anpass expiredbetween objectthe evenexpiration ifdate itand stillthe showsactual updeletion. inYou're listings.not Samecharged asfor the otherexpiration clouds:or it'sfor notthe astorage securitytime control,of thean object remains readablethat untilhas it'salready deleted.expired.

PartsS3 fromkeeps the parts of a multipart upload thatuntil neveryou completedcomplete takeor upstop storageit, and don'ttheir showstorage upis whenbilled listingthe objects.whole time. Always add an AbortIncompleteMultipartUpload rule; ingestion bucketsrule: areaborting wherethe theyupload piledeletes upthe most.parts.

Private Google Access only lets VMs without public IPs reach Google APIs. The bucket still accepts authenticated requests from the internet. To restrict origin you need bucket IP filtering or VPC Service Controls; the latter is organization-level and often out of reach for an application team.Controls.

ACA can go down to zero replicas, but PostgreSQL Flexible bills compute while it's on. Stopping it stops compute billing (not storage), but the service automatically restarts it after 7 days. For dev environments, automate the stop instead of relying on a manual one.

To pull the image and ship logs without internet egress, the task needs ECR (api and dkr) and CloudWatch Logs interface endpoints, plus the S3 gateway endpoint (where ECR stores layers). Each interface endpoint is billed hourly per AZ: it's the fixed cost that doesn't exist in ACA or Cloud Run.AZ. The alternative (NAT Gateway) is also billed hourly and per GB.

Private services access is implemented with VPC Network Peering to Google's network. AnotherIt VPConly peeredallows withconnections yoursfrom can'tone reachVPC, theand database,peering anddoesn't forprovide on-premisestransitive yourouting: mustanother exportVPC custompeered routeswith onyours can't reach the peering.database. If your topology is hub-and-spoke, consider Private Service Connect instead of PSA.

KEDA queries the queue length on its own. IfTo thehave namespaceit hasuse locala authmanaged disabled,identity, the scale rule must useuses the managed identity (identity_id on the rule); a connectionproperty stringinstead won'tof work.auth. The portal can't configure it: use IaC or CLI.

Contributor lacksdoes Microsoft.Authorization/roleAssignments/write.not allow assigning roles in Azure RBAC (it excludes Microsoft.Authorization/*/Write). If your Terraform assigns roles (say, an app's identity on a Key Vault), applyContributor failsis withnot AuthorizationFailed.enough. The quick fix is giving the pipeline Owner or User Access Administrator, which is exactly what you don't want. The right fix is Role Based Access Control Administrator with a condition limiting which roles it can assign (and excluding privileged ones).

GitHub buildsincludes the subenvironment in prioritythe order:sub environment,when thenthe pull_request,job references one; pull_request and the ref only thenappear if the ref.job doesn't reference an environment. A job on main with environment production presents repo:org/repo:environment:production, so a trust policy expecting repo:org/repo:ref:refs/heads/main rejects AssumeRoleWithWebIdentity. Same on Azure and GCP; here the error is "Not authorized to perform sts:AssumeRoleWithWebIdentity".

In S3 you scope the policy to arn:...:bucket/incoming/* and in GCP you use IAM Conditions by prefix. In Azure a role assignment reaches the container at minimum; to scope by path you need ABAC conditions on the role assignment. Simple alternative: a container dedicated to ingestion (what this module does).

Since April 2023 new buckets are createdS3 withenables Block Public Access and disables ACLs on andall Objectnew buckets (Object Ownership set to BucketOwnerEnforced.BucketOwnerEnforced). It's no longer "the" difference with Azure. Still declare them in IaC: olderexisting buckets didn't change, and declaring the state prevents drift if someone edits them in the console.

Terraform/ARM adds Entra principals as administrators (azure_pg_admin, CREATEROLE, CREATEDB). For the app identity to havebe leasta privilege,regular user, an Entra admin mustcan run pgaadauth_create_principal('<name>', false, false) and then the GRANTs.false). For managed identities and service principals the name is the display name. The module outputs the exact SQL.

TheTo create an HTTPS listener needs anyou ACMmust certificate.deploy Aat publicleast ACMone certificateSSL isserver validatedcertificate via(from DNSACM or emailIAM). forACM arequires realproving domain evenownership iffor thea ALBpublic iscertificate internal;via theDNS, alternativeemail isor AWSHTTP, Privateand CA,cannot whichvalidate hasresources in a monthlyVPC fee.private Inhosted ACAzone andor Cloudany Runother theprivate platformdomain, manageseven if the defaultALB domain'sis certificate.internal.

With manage_master_user_password = true, RDS generates the master password and stores it in Secrets Manager: it never goesManager. throughThe variablesTerraform orprovider Terraformdoesn't state.allow It'scombining incompatibleit with passing apassword, passwordand manually,RDS anddoesn't isn'tsupport supportedit in some scenarios (for example Blue/Green deployments), so decide upfront.

With internal ingress, Cloud Run rejects requests not coming from VPCs in the same project (or VPC SC perimeter) or from other Google services, even via the run.app URL. On top of that, byBut defaultIAM itauthentication requiresstill run.routes.invoke:applies: the client must sendpresent an ID token from an identity with roles/run.invoker. In ACA and the internal ALB the network is the only control unless you addits authservice inaccount theneeds app.roles/run.invoker.

The VPC resolver (CIDR base + 2) answers resources in the VPC. AWS states that forwarding queries to it from on-premises or other DNS servers isn't supported and can give unstable results, even if it sometimes seems to work. That's what the inbound endpoint is for, just like Azure's or GCP's inbound policy.