The Region Nuke Test: Why IaC is Your Ransomware Policy

Ask any team "do you have backups?" and the answer is yes. Ask "have you restored from them in the last 90 days?" and the answer is almost always no. Ask "can you rebuild the whole region — VPCs, IAM, KMS keys, queues, the lot — from scratch?" and you get silence.

That silence is your DR posture.

The Region Nuke Test

Pick a quarter. Pick a non-production region. Pretend it doesn't exist anymore. Then:

1. terraform apply against a fresh region using only what's in the repo.
2. Restore data from the most recent cross-region backup.
3. Cut DNS over.
4. Run the smoke tests.

If you can't do this in under 4 hours with the on-call engineer alone, you don't have DR — you have a backup policy and a prayer.

Why IaC is the ransomware control

Ransomware against a cloud account is real: stolen IAM keys, encrypted S3 buckets, deleted RDS snapshots. The thing that gets you back online is not paying — it's the Terraform repo that rebuilds the account in a different region under a different KMS key in hours.

For this to work, the repo must contain:

• Every VPC, subnet, route table.
• Every IAM role, policy, and trust relationship.
• Every KMS key alias (the key material lives in AWS, but the alias + policy lives in code).
• Every queue, topic, bucket name (with prevent_destroy lifecycle on the data ones).
• Every secret reference (with the value rotated and re-injected post-restore).

If a resource exists in production but not in Terraform, it doesn't exist for DR purposes.

The drill cadence

• Quarterly: tabletop exercise — walk through the runbook, identify gaps.
• Semi-annually: actual region rebuild in a sandbox account.
• Annually: full failover with traffic, in a maintenance window.

Treat the runbook as code. Every drill produces a PR against the runbook for the things that broke. Over a year, the runbook becomes a one-page checklist instead of a four-page novel.

What the auditor sees

• A Git history of DR drills, each with a timestamp and an outcome.
• A Terraform repo that demonstrably reconstitutes the environment.
• An RTO/RPO commitment that's based on measured drill data, not optimism.

The CFO and the CISO are asking the same question from different angles: if today goes very wrong, how fast are we back? IaC + tested drills is the only honest answer.

Further reading: AWS DR whitepaper.