# Mehdi Laruelle > Mehdi Laruelle, Platform Engineer and SRE. AWS, Terraform, HashiCorp Vault, Kubernetes and CI/CD, with a bias towards secrets management. I am a **Platform Engineer** and **SRE**. For ten years I have been building and running the platforms other engineers deploy on, mostly on **AWS**, with **Terraform**, **HashiCorp Vault** and **Kubernetes**. The subject I keep coming back to is secrets management: where to store secrets, how to distribute them and how to move them through a CI/CD pipeline without leaving them in plain text somewhere. I believe technical knowledge should stay free and available to everyone, in French as much as in English. That is why I teach, why I speak at conferences, and why I write here in both languages. I have been an **AWS Authorized Instructor** for six years, was a **HashiCorp Ambassador** from 2020 to 2025 and an **AWS Community Builder** in 2024. The articles worth starting with: - [HashiCorp Vault authentication methods and how to choose one](https://mehdilaruelle.com/posts/2018/09/how-to-choose-your-authenticate-method-with-vault/) - [Terraform on AWS with GitLab CI and Vault: dynamic credentials](https://mehdilaruelle.com/posts/2021/03/secure-your-terraform-deployment-on-aws-with-gitlab-ci-and-vault-pipeline-side/) - [Migrating an application's secrets into Vault, in three steps](https://mehdilaruelle.com/posts/2019/03/migrate-your-application-secrets-in-vault-step-1/) - [Deploying a Hugo site on AWS with Terraform and CloudFront](https://mehdilaruelle.com/posts/2023/10/deploy-your-hugo-site-on-aws-with-terraform-v2/) - [AWS IAM Identity Center with Auth0, for free](https://mehdilaruelle.com/posts/2025/04/aws-sso-with-auth0-for-free/) Everything else is on the [blog](/posts/) and there is a bit more about me on the [about page](/about/). Meme lover too, but that one sits less well on a CV. The full text of every page below: https://mehdilaruelle.com/llms-full.txt ## Posts - [AWS IAM Identity Center (AWS SSO) with Auth0 for Free](https://mehdilaruelle.com/posts/2025/04/aws-sso-with-auth0-for-free/index.md): Configure AWS IAM Identity Center (formerly AWS SSO) with Auth0 for free - [Back to HashiConf Boston 2024](https://mehdilaruelle.com/posts/2024/10/back-to-hashiconf-boston-2024/index.md): Recap of HashiConf 2024, which took place in Boston - [AWS API Gateway HTTPS Redirect with Path Preservation, Serverless](https://mehdilaruelle.com/posts/2023/12/serverless-url-redirect-with-path-preservation-through-https/index.md): Redirect one domain to another over HTTPS while keeping the path, with AWS API Gateway, a MOCK integration and a VTL template. No server, no Lambda. - [Deploy a Hugo Site on AWS with Terraform, CloudFront OAC and GitHub Actions](https://mehdilaruelle.com/posts/2023/10/deploy-your-hugo-site-on-aws-with-terraform-v2/index.md): Deploy a Hugo static site on AWS with Terraform: CloudFront with Origin Access Control, ACM, GitHub Actions and short-lived AWS credentials through OIDC. - [Back to HashiDays Paris 2023](https://mehdilaruelle.com/posts/2023/06/back-to-hashidays-paris-2023/index.md): HashiDays Paris 2023 recap: HCP Vault Secrets, the Vault Secrets Operator and the rest of what HashiCorp announced that day. - [Deploy your Hugo site on AWS with Terraform](https://mehdilaruelle.com/posts/2022/08/deploy-your-hugo-site-on-aws-with-terraform/index.md): Host a Hugo static site on AWS for a few euros a month: S3, CloudFront, Route 53 and an ACM certificate, all deployed with Terraform. - [Terraform Registry Protocol](https://mehdilaruelle.com/posts/2021/12/terraform-registry-protocol/index.md): How Terraform finds and downloads a provider: the registry protocol, network mirrors and filesystem mirrors, explained from the HTTP calls up. - [Secure your Terraform deployment on AWS with Gitlab-CI and Vault (application side)](https://mehdilaruelle.com/posts/2021/04/secure-your-terraform-deployment-on-aws-with-gitlab-ci-and-vault-application-side/index.md): Retrieve database secrets from HashiCorp Vault on the application side of a GitLab CI deployment, with Vault Agent and JWT authentication. - [Terraform on AWS with GitLab CI and Vault: Dynamic Credentials (Pipeline Side)](https://mehdilaruelle.com/posts/2021/03/secure-your-terraform-deployment-on-aws-with-gitlab-ci-and-vault-pipeline-side/index.md): Give a GitLab CI pipeline short-lived AWS credentials from HashiCorp Vault through JWT authentication, so no Terraform deployment holds a static key. - [How to reduce code dependency with Vault Agent](https://mehdilaruelle.com/posts/2021/02/how-to-reduce-code-dependency-with-vault-agent/index.md): Use Vault Agent to keep HashiCorp Vault out of your application code: auto-auth, templates and a cached token, with an AppRole example on Docker. - [Back to HashiConf 2020](https://mehdilaruelle.com/posts/2020/10/back-to-hashiconf-2020/index.md): HashiConf 2020 recap: Boundary and Waypoint, the two products HashiCorp announced, plus what changed in Terraform, Consul, Nomad and HCP. - [Migrate your application secrets in Vault (step 3)](https://mehdilaruelle.com/posts/2019/03/migrate-your-application-secrets-in-vault-step-3/index.md): Encrypt and decrypt your application's data with HashiCorp Vault, without the application ever holding a key. Step 3 of the Vault migration series. - [Migrate your application secrets in Vault (step 2)](https://mehdilaruelle.com/posts/2019/03/migrate-your-application-secrets-in-vault-step-2/index.md): Replace a static database password with credentials HashiCorp Vault generates on demand and expires on its own. Step 2 of the Vault migration series. - [Migrate your application secrets in Vault (step 1)](https://mehdilaruelle.com/posts/2019/03/migrate-your-application-secrets-in-vault-step-1/index.md): Move the secrets out of your application's configuration into HashiCorp Vault, with Terraform and without touching the code. Step 1 of the series. - [HashiCorp Vault Authentication Methods: How to Choose the Right Auth Backend](https://mehdilaruelle.com/posts/2018/09/how-to-choose-your-authenticate-method-with-vault/index.md): Every HashiCorp Vault authentication method compared: Token, AppRole, LDAP, TLS certificates, AWS, Azure, GCP, Kubernetes and which one fits which case. ## Pages - [Mentions Légales](https://mehdilaruelle.com/mentions-legales/index.md): Mentions légales du site mehdilaruelle.com : éditeur, hébergeur, propriété intellectuelle et gestion des données personnelles. - [About](https://mehdilaruelle.com/about/index.md): Mehdi Laruelle, Platform Engineer and SRE: AWS, Terraform, HashiCorp Vault, Kubernetes, CI/CD and secrets management.