Tencent Cloud audit-ready Terraform GitHub ↗

Personal project · released Nov 2026 PF-03 · Tencent · IaC Role: Design and implementation

Tencent Cloud modules that define CloudAudit tracks per service, so risky changes land in a COS bucket.

Scale: 18 modules · 3 examples

Overview

Problem

Changes on Tencent Cloud needed a per-service record of who did what. The provider also ships on an irregular cycle, so a new version could change a plan without any code change.
Approach

CloudAudit tracks are defined per service in code for CAM, CVM, CBS, and VPC, and each stores to its own COS prefix. Every module pins the provider to = 1.81.163.
Result

Permission, server, disk, and security group changes reach COS through the tracks defined in code, including risky events such as CreateApiKey and AttachUserPolicy.
What I learned

With audit logs, making them readable later mattered more than keeping them at all. Instead of mixing events into one stream, separate tracks and COS prefixes for CAM, CVM, CBS, and VPC let a reviewer read one kind of change at a time, such as permissions or servers, and set retention per kind. I also learned that pinning the provider to an exact version is not just habit but an audit safeguard: it keeps a plan from changing while the code stays the same. And a passing scan means only as much as the rules behind it, so on Tencent Cloud, where scanners have few rules, I had to decide for myself what to record in code.