No hardcoded credentials. No public endpoints. All provisioned with Terraform.