Ruslan Akchurin https://ruslanakchurin.dev/blog Senior platform engineer. I make risky infrastructure boring. en-au Thu, 16 Jul 2026 00:00:00 GMT The account is not the boundary https://ruslanakchurin.dev/blog/account-not-boundary https://ruslanakchurin.dev/blog/account-not-boundary Thu, 16 Jul 2026 00:00:00 GMT Porting the IaC operating model from GCP to AWS, mechanism by mechanism: account vending, grant and limit planes, regional network admission, and the readiness evidence that replaces a project-shaped handoff. Appendix B: The contract, end to end https://ruslanakchurin.dev/blog/making-iac-boring/appendix-b https://ruslanakchurin.dev/blog/making-iac-boring/appendix-b Tue, 07 Jul 2026 00:00:00 GMT One self-contained file implements the cross-tier contract: a producer publishes a typed value, a consumer names producer, key, context, and type, and a resolver returns the bound value or refuses by name. A library is not an architecture https://ruslanakchurin.dev/blog/library-not-architecture https://ruslanakchurin.dev/blog/library-not-architecture Tue, 07 Jul 2026 00:00:00 GMT The Pulumi component library I built made infrastructure easier to create before ownership, tiers, contracts, and release boundaries were explicit. The bundle is the competitor https://ruslanakchurin.dev/blog/where-secrets-go/03-the-bundle-is-the-competitor https://ruslanakchurin.dev/blog/where-secrets-go/03-the-bundle-is-the-competitor Sun, 05 Jul 2026 00:00:00 GMT The working bundle around a secret store can deliver a value; rotation, revocation, and honest proof limits are what test whether it delivers one verifiable transaction or evidence held together by convention. The green placebo https://ruslanakchurin.dev/blog/green-placebo https://ruslanakchurin.dev/blog/green-placebo Fri, 03 Jul 2026 00:00:00 GMT An autonomous coding agent ran a ratified security plan on a secrets manager and twice recommended the less-secure option, every fact correct. The green test suite certified a defence that did nothing. Here is what actually held the line, and why the human could not be removed from it. Delivery is a transaction https://ruslanakchurin.dev/blog/where-secrets-go/02-delivery-is-a-transaction https://ruslanakchurin.dev/blog/where-secrets-go/02-delivery-is-a-transaction Wed, 01 Jul 2026 00:00:00 GMT Secret delivery breaks when writes, wiring, and receipts are separate chores; the transaction is the unit that keeps partial success and proof limits visible. A secret has to arrive https://ruslanakchurin.dev/blog/where-secrets-go/01-a-secret-has-to-arrive https://ruslanakchurin.dev/blog/where-secrets-go/01-a-secret-has-to-arrive Mon, 29 Jun 2026 00:00:00 GMT Secret storage gives a value somewhere to rest; secret delivery records the route, authority, wiring, and proof that get it there. Appendix A: The shape, runnable https://ruslanakchurin.dev/blog/making-iac-boring/appendix-a https://ruslanakchurin.dev/blog/making-iac-boring/appendix-a Thu, 25 Jun 2026 00:00:00 GMT A companion repository makes the series architecture executable: four tiers, typed cross-tier contracts, and resolver probes that refuse bad composition before any provider call. Re-cut the system https://ruslanakchurin.dev/blog/making-iac-boring/05-re-cut-the-system https://ruslanakchurin.dev/blog/making-iac-boring/05-re-cut-the-system Wed, 24 Jun 2026 00:00:00 GMT Refactoring a live IaC system toward a new architecture: freeze the old boundary, publish the new contract beside it, delete only after consumers move. Fail before apply https://ruslanakchurin.dev/blog/making-iac-boring/04-fail-before-apply https://ruslanakchurin.dev/blog/making-iac-boring/04-fail-before-apply Sun, 07 Jun 2026 00:00:00 GMT An IaC contract holds only if the release path enforces it: a resolver checks type and context, then refuses invalid composition before apply. Define tier membership https://ruslanakchurin.dev/blog/making-iac-boring/03-membership https://ruslanakchurin.dev/blog/making-iac-boring/03-membership Sun, 24 May 2026 00:00:00 GMT Environment boundaries blur when workload-specific members (service accounts, IAM bindings, DNS records) accumulate in the shared environment tier. Resolve by contract https://ruslanakchurin.dev/blog/making-iac-boring/02-contract https://ruslanakchurin.dev/blog/making-iac-boring/02-contract Tue, 19 May 2026 00:00:00 GMT Cross-stack dependencies make another stack's outputs a public interface. A typed contract on a producer namespace and key is the alternative. Start with the shape https://ruslanakchurin.dev/blog/making-iac-boring/01-shape https://ruslanakchurin.dev/blog/making-iac-boring/01-shape Sun, 17 May 2026 00:00:00 GMT By the time anyone reviews an IaC codebase, its shape is already decided.