Skip to content
  • nomenclature
  • systems
  • platform engineering

Platform Engineering

Platform Engineering (plt) owns the foundational infrastructure: identity, workspace governance, cloud platforms, and automation. This page covers naming patterns specific to platform engineering work.

Shared Admin Accounts

Section titled “Shared Admin Accounts”

For SaaS platforms that require a shared admin identity (rather than individual role-based access), we use:

prv-plt-admin-{vendor}@{domain}
AccountPurpose
prv-plt-admin-awsAWS root/admin account
prv-plt-admin-glGitLab instance admin
prv-plt-admin-tfTerraform Cloud org admin
prv-plt-admin-datadogDatadog org admin
prv-plt-admin-op1Password org admin

Governance

Section titled “Governance”
  • Shared admin accounts are owned by prv-plt-team (or the relevant sub-team).
  • Credentials stored in 1Password (or equivalent vault) with restricted access.
  • Access logged and reviewed quarterly.
  • Two-person rule for sensitive operations (especially prv-plt-admin-aws).

Display Name

Section titled “Display Name”
[ PRV ] PLT Admin – {Vendor Title}

The bracket prefix makes admin accounts visually distinct in directories.

Fleet Resources

Section titled “Fleet Resources”

Customer infrastructure fleet resources use the flt team identifier:

prv-flt-{qualifier}
ResourcePurpose
prv-flt-monitoring-prdProduction fleet monitoring
prv-flt-dns-mgmtFleet DNS management
prv-flt-cert-rotationCertificate rotation automation
prv-flt-backup-orchestratorBackup orchestration
prv-flt-patch-mgmtPatch management automation

Fleet Alerts

Section titled “Fleet Alerts”
prv-flt-alerts-{system}[-{scope}][-{env}]
AlertPurpose
prv-flt-alerts-monitoring-prdProduction fleet monitoring alerts
prv-flt-alerts-dns-prdDNS health alerts
prv-flt-alerts-cert-expiryCertificate expiry warnings

Platform Role Groups

Section titled “Platform Role Groups”

Platform Engineering manages the broadest set of role groups because PLT governs org-wide infrastructure:

Identity & Access

Section titled “Identity & Access”
RolePurpose
prv-plt-role-wks-user-adminWorkspace user provisioning
prv-plt-role-wks-groups-adminWorkspace groups management
prv-plt-role-wks-drive-adminDrive/storage administration
prv-plt-role-aws-idc-prd-adminAWS Identity Center production
prv-plt-role-aws-org-adminAWS Organizations management

Infrastructure

Section titled “Infrastructure”
RolePurpose
prv-plt-role-tf-cloud-adminTerraform Cloud org admin
prv-plt-role-gl-org-adminGitLab instance administration
prv-plt-role-op-vault-admin1Password vault management
prv-plt-role-slack-adminSlack workspace admin
prv-plt-role-zm-adminZoom account admin

Drive Management

Section titled “Drive Management”
RolePurpose
prv-plt-role-wks-sd-create-adminShared Drive creation authority
prv-plt-role-wks-sd-collab-managerCOLLAB drive root manager
prv-plt-role-wks-sd-team-managerTEAM drive root manager
prv-plt-role-wks-sd-strict-managerSTRICT drive root manager

Platform Automation Accounts

Section titled “Platform Automation Accounts”
AccountPurpose
prv-plt-auto-wks-syncDirectory sync automation
prv-plt-auto-wks-gamGAM bulk operations runner
prv-plt-auto-tf-planTerraform plan executor
prv-plt-auto-gl-ci-runnerCI/CD runner identity
prv-plt-auto-backup-agentBackup automation

Platform Alerts

Section titled “Platform Alerts”
Alert GroupSourcePurpose
prv-plt-alerts-aws-prdAWS CloudWatchProduction infrastructure alerts
prv-plt-alerts-wks-adminGoogle WorkspaceAdmin event alerts
prv-plt-alerts-tf-prdTerraform CloudPlan/apply failures
prv-plt-alerts-gl-infraGitLabRunner health, storage alerts

Domain Conventions

Section titled “Domain Conventions”
Domain TypePatternPurpose
Platform/infra*.{org}.cloudGitLab SM, registries, runners, charts
Sandbox/community*.{brand}.devEphemeral previews, workshops, OSS demos

Rules

Section titled “Rules”
  • .dev is HSTS-preloaded. Keep it for sandbox/community.
  • Don’t host production GitLab on .dev.
  • Scope cookies per host (avoid Domain= to parent).
  • Wildcard certs acceptable for *.{org}.cloud.