Security posture for a one-person cloud: threat model, WIF gating, audit logs

## Spark

A concentrated security pass on `alunduil-infrastructure` this week (2026-05-23/30), several opened-and-closed in the same window: Cloudflare deployer tokens moved into GCP Secret Manager ([#77](https://github.com/alunduil/alunduil-infrastructure/issues/77)), WIF deployer-SA impersonation gated on `refs/heads/main` ([#81](https://github.com/alunduil/alunduil-infrastructure/issues/81)), Data Access audit logs enabled on storage + secretmanager ([#83](https://github.com/alunduil/alunduil-infrastructure/issues/83)) — plus opened threads for an OWASP/STRIDE threat model ([#85](https://github.com/alunduil/alunduil-infrastructure/issues/85)), shipping audit streams to Grafana ([#88](https://github.com/alunduil/alunduil-infrastructure/issues/88)), and migrating secrets age→1Password ([chezmoi#203](https://github.com/alunduil/alunduil-chezmoi/issues/203)).

## Why it could be interesting

The activity is "I hardened my cloud." The claim worth a post: **a solo operator's threat model is a different shape from an org's, and that shape selects a small, specific control set.** No insider threat, no SOC2, no on-call rotation — so the leverage is in credential-leak and supply-chain defense: a least-privilege CI identity (WIF that can only impersonate the deployer from `main`), secret centralization out of Terraform state, and audit logging you will actually wire to an alert rather than collect for show.

Distinct from [#100](https://github.com/alunduil/blog.alunduil.com/issues/100) (the Cloudflare→Terraform *migration* story) and [#191](https://github.com/alunduil/blog.alunduil.com/issues/191) (the "breaches are PvP" *framing* essay) — this is the concrete control set and how STRIDE prunes down to it at scale-of-one.

## Open questions

- [ ] Which STRIDE categories actually apply to a one-person estate, and which are theatre to even enumerate?
- [ ] Is gating WIF impersonation on `refs/heads/main` a real control or a speed bump? What's the bypass?
- [ ] What do audit logs buy before [#88](https://github.com/alunduil/alunduil-infrastructure/issues/88) (Grafana streaming + alerting) lands — is unread logging just liability?
- [ ] Does the threat model justify the age→1Password migration, or is that taste?

## Source material

- https://github.com/alunduil/alunduil-infrastructure/issues/77 — Cloudflare tokens → Secret Manager
- https://github.com/alunduil/alunduil-infrastructure/issues/81 — WIF impersonation gated on main
- https://github.com/alunduil/alunduil-infrastructure/issues/83 — Data Access audit logs
- https://github.com/alunduil/alunduil-infrastructure/issues/85 — OWASP/STRIDE threat model
- https://github.com/alunduil/alunduil-chezmoi/issues/203 — secrets age → 1Password
- https://read.readwise.io/read/01ksmcfcgbet1m943hrpczsfq2 — Incident Report: GCP Account Suspension
- https://read.readwise.io/read/01kn1eexy0bdgp2zh62jn0j4nx — Safeguarding Dynamic Configuration Changes at Scale