Infrastructure as Code at Enterprise Scale with Terraform
From 25 days to 25 minutes: how four platform engineers replaced the ticket queue with golden paths, and made the secure way the lazy way.
The old process was a museum piece: a developer who needed a database filed a ticket, the ticket grew approvals like barnacles, and twenty-five days later — if nothing bounced — infrastructure appeared. Nobody designed that system. It accreted. And every day of those twenty-five, the business was paying salaries for people to wait.
Today the same request takes about twenty-five minutes, end to end, with stricter security than the ticket queue ever enforced. The platform engineering team that operates this — thousands of active multi-cloud resources — is four engineers. Not forty. The trick is that we stopped doing the work and started encoding it.
Golden paths: paved, lit, and patrolled
Everything deploys through HashiCorp Terraform Cloud. The heart of the system is a Private Module Registry — our "golden paths." When a team consumes the storage module or the database module, they inherit our security posture whether they think about it or not: private endpoints only, encryption at rest, audit logs streaming to Splunk. The secure configuration isn’t documented in a wiki nobody reads; it is the default output of the only path that exists.
Culture is what happens by default. If the secure way takes three extra days, your real security policy is "insecure, mostly."
Policy as code, enforced where developers live
Guardrails run as Policy-as-Code — Sentinel and Open Policy Agent — evaluated inside the pull request itself. A resource that violates security baseline or blows past its cost budget is blocked before merge, with a message explaining why, in the same UI where the developer is already working. No committee meeting, no security review scheduled three weeks out. The review happens in seconds, every time, identically.
The 99.9% cycle-time reduction is the headline, but the second-order effect is the one I’d defend in front of a board: when provisioning is instant and safe, experiments become cheap. Teams try architectures they would never have burned a 25-day ticket on. Some of those experiments became ElancoGPT’s serverless backbone. Platform engineering isn’t a cost-saving function that happens to enable innovation — it is an innovation function that happens to save cost.
- Make the golden path the easiest path, then the only path.
- Put policy verdicts inside the pull request, not inside a meeting.
- Measure the queue you’re replacing; "25 days to 25 minutes" moved more executives than any architecture slide.