How Duke Energy enforces cloud security at scale with Terraform & Vault, and 6 lessons

Duke Energy describes how they enforced cloud security at scale using Terraform Enterprise, Sentinel, and HashiCorp Vault without slowing developer velocity.

• •Adopted Terraform Enterprise with Sentinel to evaluate infrastructure plans before deployment, blocking unsafe resources such as publicly exposed S3 buckets
• •Replaced decentralized secret sprawl with HashiCorp Vault as a central secrets store, syncing to AWS Secrets Manager and Azure Key Vault as needed
• •Eliminated long-lived IAM credentials by replacing them with short-lived, just-in-time dynamic secrets generated through Vault
• •Introduced no-code Terraform modules so developers can provision services like API Gateways or S3 buckets without writing Terraform configurations
• •