Security and best practices: secrets, least privilege, drift and tests

Objective

Make an infrastructure as code project production-worthy: no secret in Git or readable in the state, rights reduced to the strict minimum, critical resources protected against accidental destruction, drift detected automatically, and code tested before it reaches production.