Secure-by-Default Storage Module with OpenTofu

<p>At Kosh Finance (fictional), product teams create storage buckets by hand, and every audit finds the same gaps: public access, no encryption, no logs. The platform team's answer is a module: call it with a bucket name and every control comes with it.</p><p>In four lessons you learn infrastructure as code with OpenTofu (the open-source Terraform fork), variables and secure defaults, the controls a storage bucket needs (public access block, KMS encryption with rotation, TLS-only policy, versioning, access logging, protection from deletion), and policy-as-code checks that run on every plan, the way tools like Checkov and tfsec do in CI.</p><p>You write and plan the module in Bartman's in-browser IaC Lab, which parses OpenTofu and evaluates the platform policy itself, so no cloud account or credentials are needed. If you have OpenTofu installed, you can also paste a real plan's JSON. Part of the Bartman Cybersecurity track (Professional Certificate in Cybersecurity, LSBF).</p>

Tools: OpenTofu, Terraform, Infrastructure as code, Policy as code, S3, KMS