What we check
- Terraform state, modules, version pinning, drift and secrets
- IAM and network baseline
- CI/CD: plan-on-PR, gated applies, rollback
- Kubernetes versions, GitOps health, ingress, certificates, autoscaling
- Observability, SLOs, backup and DR
- Cloud cost: top 5 waste items and tagging