Open to DevOps · Cloud · Platform roles

Engineering reliable cloud infrastructure through automation.

I'm Harsh Agarwal, a DevOps engineer working on Azure with Terraform. I build CI/CD pipelines that catch drift, leaked secrets and misconfiguration early, and I keep infrastructure state honest.

Explore my work Download résumé
~/ai-terraform-drift-detector 
$ terraform fmt -check -recursive
  formatting clean
$ ./scripts/run_tflint.sh && ./scripts/run_trivy_config.sh
  ✓ TFLint: no issues
  ✓ Trivy: 0 HIGH / CRITICAL (accepted risks tracked)
$ terraform plan -detailed-exitcode -out=tfplan
  exit 2 → pending changes, classification decides
$ drift-engine analyze --plan plan.json --format console
  azurerm_resource_group.main  external drift
    tags.owner: "platform" → "manual-edit"
  report written · 1 issue opened · sensitive values redacted
Illustrative session based on commands from my drift-detector repository. Not live output.

01 / about

A software engineer who now automates infrastructure.

  • Harsh Agarwal smiling, wearing sunglasses and a patterned kurta
  • Harsh Agarwal seated outdoors, laughing, in a patterned kurta and sunglasses
  • Harsh Agarwal in a pinstripe suit, leaning on a pillar and checking his phone
  • Harsh Agarwal standing in a pinstripe double-breasted suit, smiling
Harsh AgarwalUttar Pradesh, India · Azure-first

I have around 2–3 years of software engineering experience and I'm now focused on DevOps. Most of my work happens in Azure: Terraform for infrastructure, GitHub Actions for delivery, and security scanning and validation that run on every change.

I like the unglamorous parts done well. That means plans you can trust, pipeline identities with only the permissions they need, and checks that fail loudly instead of passing silently. My drift detector is where I practise this in the open, with every phase documented and backed by evidence.

Currently
Hansa Solutions India Pvt Ltd
Primary stack
Azure · Terraform · GitHub Actions
Education
B.Tech CSE, DIT University (2024)

  • Automate the repeatable

    If a check matters, it runs in CI on every push, not from memory before a release.

  • Secure by default

    OIDC over stored secrets, SHA-pinned actions, least-privilege roles and secret scanning across Git history.

  • Reliable over clever

    Deterministic results first. A failed run reports "unknown", never "no drift".

  • Keep improving

    Small reviewed pull requests, written decisions, and honest notes on what isn't built yet.

02 / skills

Toolchain

Grouped by the job they do. Everything here is used in my public repositories or listed on my GitHub profile. I don't use percentage bars.

Cloud & Azure

  • Microsoft Azure
  • Azure Resource Manager
  • VNet · Subnets · NSG
  • Entra ID & RBAC
  • Azure Policy
  • Key Vault
  • Bastion · Load Balancer · App Gateway

Infrastructure as Code

  • Terraform
  • Reusable modules
  • Remote state (azurerm backend)
  • Multi-environment layouts
  • Drift detection
  • Bicep

CI/CD & automation

  • GitHub Actions
  • OIDC workload identity
  • Azure DevOps
  • Git & GitHub
  • Bash
  • PowerShell
  • Python

DevSecOps

  • TFLint
  • Trivy (config)
  • TruffleHog
  • Gitleaks
  • SHA-pinned actions
  • Least-privilege identities

FinOps & investigation

  • Infracost
  • Azure Retail Prices API
  • Azure Activity Log
  • GitHub Issues automation

Containers, testing & AI tooling

  • Docker
  • Kubernetes (fundamentals)
  • pytest
  • Pydantic
  • LangGraph

03 / experience

Experience & path

Professional roles and independent DevOps project work are marked separately.

  1. Mar 2024 — Present Professional

    DevSecOps & Cloud Engineer · Hansa Solutions India Pvt Ltd

    Software engineering role that has moved steadily toward infrastructure work: Azure, Terraform, CI/CD workflows, security scanning and infrastructure validation.

    • Azure
    • Terraform
    • CI/CD
    • Security scanning
  2. 2026 Independent projects

    DevOps engineering in public

    • Built and released Level 1 of the AI-powered Terraform drift detector (tag level1-v1.0.0, Oct 2026). Each completed phase was closed on evidence from real CI runs and Azure tests.
    • Built a modular Azure landing zone in Terraform: nine modules, preprod and prod environments, and a bootstrap → plan → apply pipeline.
    • Writing about Azure governance and Terraform at scale on Medium.
  3. Graduated 2024 Education

    B.Tech, Computer Science & Engineering · DIT University

    CGPA 8.56 / 10. Built a foundation in Java, data structures, SQL and web development.

  4. 2023 Virtual internships

    Oasis Infobyte & Bharat Intern

    Completed internship task tracks: Java applications (ATM interface, reservation system, library management, online examination) and front-end tasks. All source code is public on my GitHub.

04 / projects

Featured engineering

Real repositories. Numbers come from each project's own CI records, and anything not built yet is labelled as such.

terraform · azure · python · github actions level1-v1.0.0 released

AI-powered Terraform drift detector

Finds out when Azure no longer matches Terraform and explains what changed, who changed it and what it costs. It never runs apply.

Problem: manual portal edits, failed deployments and policy overrides make real infrastructure drift silently away from code and state.

  • 2,885automated tests
  • 98.85%drift-engine coverage
  • 135end-to-end scenarios
  • 6required checks on main
Repository

// detection flow (read-only)

  1. schedule · daily 02:00 UTC or manual
  2. terraform plan -detailed-exitcode OIDC
  3. drift engine → classified report redacted
GitHub issue AI report cost
terraform · azurerm 4.x public repo

Azure infrastructure landing zone

Nine reusable Terraform modules composed into separate preprod and prod environments, with remote state in Azure Storage.

Problem: copy-pasted resource blocks drift apart between environments, and you can't review them as one design.

  • resource_group
  • virtual_network
  • subnet
  • public_ip
  • bastion
  • key_vault
  • virtual_machine
  • load_balancer
  • app_gateway
Repository
html · css · javascript · github actions this site

Portfolio as code

The site you're reading. It's a framework-free static site with a strict Content Security Policy and no client-side secrets, checked in CI before it deploys.

Problem: the old version shipped an email-service token in browser JavaScript. I removed it and moved delivery to a provider-side form service.

  • link & asset checker
  • secret pattern scan
  • node --test
Repository

More experiments and learning repositories are on my GitHub.

05 / architecture

From pull request to Azure

The Terraform delivery flow I build toward on Azure. Each node says where it runs today. Solid nodes are implemented in my repositories, and dashed nodes are the intended next step. Select a node for details.

  • Implemented
  • Key control
  • Planned
  • Supporting service

Change delivery · left to right

Supporting services

06 / pipeline explorer

Inside a Terraform pipeline run

Go through the stages a pull request passes before it can reach Azure. Pick a stage to see what it checks, what fails it, and example output.

    Illustrative demo with example output. It is not connected to live CI data.

    terraform fmt

    passed

    fails the run when
    why it matters
    $ terraform fmt -checkexample output
    
            
    
          
    
        
    
      
    
    
    

    
    
    
      
    
        
    
          
    07 / learning
    
          
    Certifications, writing & what's next
    
          
    I learn by building something and writing it up. I don't list cloud certifications here because I haven't earned any yet.
    
        
    

        
    
          

          

          
    
            
            
    Currently building
    
            
    
              Drift detector Level 2: a local-first CLI (aitdd) that reuses the
              Level 1 drift engine and checks it produces identical reports. It's in a private repository while it's in progress.
            
    
            
    Also on the list: human-approved remediation (specified, not built) and moving the landing-zone pipeline to OIDC behind an approval environment.
    
          
    
        
    
      
    
    
    

    
    
    
      
    
        
    
          
    
            
    08 / contact
    
            
    Let's build something reliable.
    
            
    Hiring for DevOps, cloud or platform engineering, or want to talk Terraform? Send a message or reach me directly.
    
          
    
          
        
    

        
    
          
    
            
            

            
    
              
              
              
    
            
    

            
    
              
              
              
    
            
    

            
    
              
              
              
    
            
    

            
    
              
              
              
    At least 20 characters.
    
              
    
            
    

            
    

            
    
              
    Your message goes only to my inbox. Nothing is tracked or shared.
    
              
            
    
          
    
        
    
      
    
    
    
  
    

  

  
    
  

  
  
    
    
      
    
        
    Project