PR Code - Chris Pateman

“Drift detection” sounds like one of those must-have features in modern infrastructure. It’s baked into tools, marketed heavily, and often treated as a best practice, but do we really need it? In most well-structured environments, drift shouldn’t be something you detect, it should be something you prevent. Drift Is a Symptom, Not the Problem Terraform drift happens when your real infrastructure…

Terraform’s external data source is a useful escape hatch when you need to call out to a script to fetch data that isn’t available via a provider. However, it comes with a sharp edge that often catches people out: Terraform expects the result to be a flat map of string → string values. If your script returns a nested object, Terraform will fail with a fairly unhelpful error message. In this…

Microsoft shifted the Azure Purview to be Tenant aligned, but the AzureRM Provider hasn’t made that move yet, so if you are deploying your Azure infrastructure using Terraform you need to do some alternative changes to get it to work, especially when you’re trying to deploy Purview securely using private networking. After a few painful attempts I reverse engineered the ARM Templates to determine…

Most Databricks MLOps guidance assumes you can train and develop directly inside a production Unity Catalog. In many organisations, that’s simply not possible, whether for compliance, data‑security, tenancy boundary or governance reasons. So this post outlines a design concept I created that stays aligned with official Databricks and Azure MLOps guidance while enabling safe, isolated, scalable…

AI‑assisted pull request (PR) reviews are quickly becoming standard practice in modern software delivery. GitHub users already benefit from Copilot being deeply embedded into their workflow, offering immediate feedback on code quality, readability, and potential issues at the moment of review. For teams using Azure DevOps, that experience simply doesn’t exist today. There is currently no native…

In the world of continuous integration and continuous delivery (CI/CD), Azure DevOps agents are key resources. These agents are the compute resources that execute your pipeline whether it’s compiling code, running tests, or deploying applications. Without them, your DevOps pipelines are just scripts waiting to be run. Azure DevOps offers two types of agents: Microsoft-hosted and self-hosted.…

Terraform has become the standard for managing cloud infrastructure, and with good reason. It provides consistent, repeatable deployments and integrates with almost every cloud provider. But there’s one piece that’s often overlooked until it causes problems: the Terraform state file.  Your terraform.tfstate file is more than just metadata — it’s the single source of truth about everything…

Test-driven development (TDD) isn’t just for application code anymore; Terraform has a native testing framework that lets you plan/apply infrastructure from tests, make assertions in HCL, and even run post-deployment checks that behave like smoke tests. In this post I’ll show you how to do TDD with Terraform (TTD), when to use plan vs apply inside tests, and how to add lightweight “checks” that…

In cloud-native engineering, securely connecting Azure DevOps pipelines to private GitHub repositories is essential — especially when working with Terraform modules that define your infrastructure. This guide walks through how to establish that connection using PowerShell Core, ensuring a secure and maintainable setup. 🛠️ Prerequisites Before you begin, make sure you have: An Azure DevOps…

When developing APIs for consumption from many callers you can’t just throw in new major or minor updates without impacting how they are calling the API. Doing this can cause major issues so you would normally develop APIs in things like Azure Web Applications with versioning. The callers of the APIs can then reference these versions to be certain they will not shift. When the caller is ready to…

When deploying any code you want to validate it as much as you can before deploying. However with APIs in the APIM you can’t validate the XML Policy or the API logic until it is deployed into the API Management Service (APIM). This means you are limited to the options to validate the code, before checking into the main branch and deploying. In this post I go through some of the options with focus…

Learning new skills can be hard and when working with complex technology like coding it can be confusing. Over the years as I have learnt more technologies, I have found an approach that has helped keep learning simple. This is something I was taught before when I first started and continue to pass on to my mentees as a senior. The approach is the elevator effect and in this post I will breakdown…

When developing some resource in Terraform you develop a large complex map or list of entries. This can become hard to manage, difficult to read and worst to maintain. An easier method is to convert these items into a Comma Separated Values (CSV) file. This will condense something that could be 100’s of lines down to 10’s of lines. In this example I will create an Azure Network Security Group…

Documentation on Databricks Grants, Permissions and Entitlement can get complex fast, especially switching between AWS, Azure and Databricks versions. When I was then looking into implementing the RBAC design for Databricks, I started looking into the different access approaches for groups. I found you needed to be a full functioning Data Engineer using this product to understand the difference…

Using PowerShell to automate the requesting of Azure PIM access.

Privileged Identity Management (PIM) is made to be a secure authentication method to assign user permissions via groups and monitor the access.  This enables short time requests for the permissions that can require fields like reason for access, how long to have access and who is having access. This can typically be used for engineers’ access to higher environments, normally only needed for…

Terraform Modules are great for isolated components you can reuse and plug-in to your main Infrastructure as Core code base. They can then also be shared and used by multiple other teams at the same time to reduce repeated code, complexity and increase compliance. However, as they are isolated, they are harder to test, maintain and support with multiple teams working on them. In this post I will…