AWS infrastructure as code

Complete AWS infrastructure provisioned with Terraform, with multi-environment support and automated backup strategies.

Infrastructure built in a console cannot be reviewed, repeated or reliably recovered. Environments drift apart until staging no longer predicts production.

What multi-environment IaC has to deliver.

• –Environments that differ only in declared inputs
• –A reviewed plan before every apply
• –Backups that are automated and restorable

Shared modules are instantiated per environment with small input files. State is remote, locked and versioned, and is split so that one environment cannot affect another.

The decisions that shape long-term maintainability.

• –Separate state per environment, instead of workspaces sharing one backend path, so access can be separated too.
• –Modules only for patterns that have proven themselves by repeating.
• –prevent_destroy on anything holding data.

Work from the foundation upward, importing anything that already exists before changing it. An import that plans zero changes proves that the code describes reality.

Plans run on pull requests and are posted for review. Apply happens from CI with a short-lived role, using the saved plan, so what was reviewed is what runs.

State files can contain secrets, so they get encryption and tight access. Policy checks run on the plan, and credentials are issued to the pipeline only for the duration of the run.

Scheduled drift detection surfaces out-of-band changes early. Backup jobs are monitored, and restores are rehearsed, since an untested backup is only a hope.

The usual hard parts.

• –A harmless-looking attribute that forces replacement: read the plan for -/+. The Plan reader lab shows the cascade.
• –Large shared state slowing every plan: split it by blast radius.
• –Manual hotfixes during incidents: detect the drift and fold them back into code.

No verified figures are published for this project. The numbers that would prove it worked: time to provision an environment, drift events found, and a timed restore from backup.