Changes to our security group code used to come with a sense of dread.

Any small tweak—one rule, one CIDR—could scale across environments, impacting potentially hundreds of resources. Each change had invisible consequences—we just didn’t know where they’d land. And without feedback or validation, every change felt risky—because nothing told us it wasn’t.

Eventually, the pain became impossible to ignore. We were forced to modularize our Terraform code—untangling duplication, restoring clarity, and rebuilding confidence in our changes. But that refactor came late, after years of slow degradation and mounting complexity.

So when we inherited a new internal system for managing security groups—complete with large configuration files, a brand-new structure, and no built-in tooling—we knew what could happen if we didn’t act early.

Because we’d been here before.

The Lean Startup

- 9 mins read


Build, Measure, Learn — three simple words that forever changed how I approach my work as a technologist.

The Lean Startup taught me to identify and assess my riskiest assumptions with a sense of urgency. Which assumption of mine - if wrong - radically changes what I do … tomorrow? After lunch?

How long do I want put energy into projects that are doomed - because they are based on faulty assumptions?