antonbabenko.com

Talks

Recordings of my talks, the events where I have spoken and the talks I give. Events and talks come from my Sessionize profile.

Recordings

Open the playlist on YouTube

Talks I give

  • Doing serverless on AWS with Terraform for real

    More and more companies are adopting serverless technologies as the community is defining the best practices, tools, and patterns.

    Companies using Terraform as their infrastructure as a code tool are often required to reinvent the wheel when they work with serverless.

    In the talk, I will explain why managing serverless applications with Terraform is a good idea and how https://serverless.tf open-source project has started as an organic response to the accidental complexity of many existing tools used by serverless developers.

    I will demo a complete serverless application (including building and deploying it) using Terraform and open-source components.

  • Implementing Compliance in AWS with Terraform: Practical Steps That Work

    Implementing compliance doesn't have to be treated like voodoo magic (though some vendors want you to think it is). As the creator of the popular open-source Terraform AWS modules, which have been provisioned several billion times worldwide, and the newer compliance.tf project, I've spent years helping teams make their AWS infrastructure secure and compliant without burning out.

    In this talk, I'll walk through practical, hands-on ways to approach compliance in modern cloud environments using Terraform. I'll show you how to evaluate your compliance readiness for frameworks like SOC 2, ISO 27001, GDPR, and HIPAA using a mix of cloud-native services and open-source tools, such as Prowler, SteamPipe, and Checkov. Then I'll demonstrate how to write Terraform code to meet those required controls, implement compliance-as-code as part of your CI/CD pipelines, and prevent compliance drift over time, so your infrastructure stays secure as it evolves.

    This talk is packed with real-world examples, so if you're responsible for building or maintaining infrastructure and want to get compliance right from the start (or finally address what's already there), this session is for you.

  • No More Forks: Policy Transformation for Terraform at Scale

    Every org enforcing Terraform standards eventually hits the same wall: policy tools can flag issues, but they cannot fix module code. The result is a graveyard of forked modules that drift from upstream and turn upgrades into a full-time job. This talk introduces policy transformation: automatically rewriting Terraform modules at download time so teams get compliant code without maintaining forks.

    I will demo eight real transformation rules across four categories: lifecycle management (prevent_destroy, ignore tag drift, protect KMS keys), block removal (strip provisioners), attribute restriction (deny GPU or specialty instances), and content sanitization (safe regex cleanups). You will see the before-and-after HCL, plus the safety model that makes this production-ready: deterministic outputs, collision detection, preview diffs, and a four-level risk classification.

    You will leave with a practical decision framework for validate vs transform, a DIY toolkit using pre-commit, hclwrite, custom tflint rules, and plan validation, and a simple migration path from module forks to rule-based enforcement. No vendor account required to apply the patterns from this talk.

  • One Model Is a Guess. Three That Agree Is a Plan.

    The Terraform failure that costs me a day is never a syntax error. It passes terraform validate, tflint, and the HashiCorp MCP and is still wrong, and nothing disagrees.

    So I make several models disagree, with an arbiter that committed first. Deliberation runs in my agent and has it write a verdict in the transcript before any reviewer sees the plan, then sends the plan to GPT, Gemini, Grok, and any model I added, in isolated threads under different reviewer roles. It triages each objection and loops until every reviewer and the verdict agree, or reports they did not.

    The demo: no public access behind CloudFront with a WAF. The plan does that; two reviewers sign off. The Security Analyst refuses, HIGH: the execute-api endpoint is reachable on its own, so the WAF is decorative without a secret header binding CloudFront to the origin. Same shape on unenforceable IAM, a missing sts:ExternalId, and an S3 Deny that drops CloudFront. I also show how I measure which model earns its slot.

  • The Terraform Trust Gap: Engineering the Space Between Prompts and Production

    Agents can already write Terraform. That was never the hard part. The hard part is that the context going in is stale and the apply coming out is too easy to hand over, so you get code that looks right, passes your linters, even terraform plan passed, but still it quietly does the wrong thing in production.

    This talk runs one module everyone knows, terraform-aws-modules/s3-bucket, through the whole chain live. First I give the agent a real contract instead of a README and watch the hallucinated config disappear. Then I take one of the module's own examples and turn it into a fixture that fails the moment it drifts from the module. Then I let the agent plan changes but not apply them. A human has to approve the plan first, and apply only runs on the approved one. On stage the agent tries to apply by itself and you watch it get blocked.

    You leave with three things to do on Monday, every pattern working with open tooling, and an honest feedback of where the chain still breaks. No vendor account, no prompt magic.

Where I have spoken

  1. AWS re:invent 2026upcomingThe judgment gap: when Terraform scans clean but fails the audit (COM302)Las Vegas, Nevada, United States
  2. AWS Community Day Adria 2026Ljubljana, Slovenia
  3. Malta AWS Community day 2026San Ġiljan, Malta
  4. Cloud Native Days Austria 2026Vienna, Austria
  5. AWS Community Day DACH 2026Berlin, Germany
  6. AWS Community Day Poland 2026Warsaw, Poland
  7. JavaZoneLillestrøm, Norway
  8. AWS Community Day Athens 2026Athens, Greece
  9. Incontro DevOps Italia (IDI) 2026Bologna, Italy
  10. AWS Community Day Hong Kong 2025Hong Kong
  11. AWS Community Day Bulgaria 2025Sofia, Bulgaria
  12. AWS Community Day Georgia 2025Tbilisi, Georgia
  13. AWS North Community ConferenceNewcastle upon Tyne, United Kingdom
  14. AWS Community Day Nordics 2025Göteborg, Sweden
  15. AWS Community Day DACH 2025Munich, Germany
  16. AWS Community Day Poland 2025Warsaw, Poland
  17. AWS Community Day Adria 2025Sarajevo, Bosnia and Herzegovina
  18. Malta AWS Community day 2025San Ġiljan, Malta
  19. AWS Community Day Armenia 2025Yerevan, Armenia
  20. AWS Community Day CZ 2025Prague, Czechia
  21. AWS Community Day (Security Edition) Bay AreaMountain View, California, United States
  22. AWS Community Day Italy 2025Milan, Italy
  23. AWS re:invent 2024Accelerate serverless deployments using Terraform with proven patterns (SVS320)Las Vegas, Nevada, United StatesWatch the recording
  24. NIC Empower 2024Oslo, Norway
  25. AWS Community Day DACH 2024Munich, Germany
  26. AWS Community Day - Central AsiaTashkent, Uzbekistan
  27. AWS Community Day Poland 2024Warsaw, Poland
  28. HashiTalks 2024
  29. AWS Community Day Bulgaria 2023Sofia, Bulgaria
  30. DeveloperWeek CloudX 2023San Mateo, California, United States
  31. DevOpsDays Tel Aviv 2022Tel Aviv, Israel
  32. 2022 All Day DevOps
  33. NIC X EditionOslo, Norway
  34. DevOpsDays Zurich 2020Winterthur, Switzerland
  35. 2020 All Day DevOps
  36. 2019 All Day DevOps
  37. devopsdays Amsterdam 2019Amsterdam, The Netherlands
  38. NDC Oslo 2019Oslo, Norway
  39. NDC Oslo 2018

Invite me to speak

For a conference, meetup or podcast, send me the event, the date and the audience through the contact form. It opens a draft in your own mail app.

Write to me