Move Access Decisions Into Code and Watch Costs Fall
PlatformEngineering.com, Friday, October 23rd, 2026
A practitioner describes replacing ticket-driven, per-person cloud permissions with role-based groups defined in Terraform.
The author describes moving an engineering organization from cloud permissions attached to individuals one ticket at a time to access decided once, in code.
Employees and job-function groups live in the identity provider, each group maps to permission sets defined in Terraform and changed through code review, and access comes only through group membership, never direct grants.
Engineers get temporary SSO credentials, and offboarding takes one step.
His advice: start with one high-volume access type, define roles before tools, and measure a baseline first, which his team failed to do.