AWS Infrastructure with Terraform

You will hand in

• Terraform modules: network, app (ASG + ALB), database, storage, monitoring
• envs/dev and envs/prod using the modules with different sizes
• Remote state in S3 with locking; CI that runs fmt/validate/plan on PRs
• CloudWatch dashboard and alarms (5xx rate, target health, RDS CPU/storage)

1. 1

   State and network

   Done when: Remote state bootstrapped; a VPC with public/private subnets across 2+ AZs.

   • Bootstrap an S3 state bucket (versioned, encrypted) with state locking
   • network module: VPC, subnets, IGW, NAT per AZ, route tables
   • Outputs for subnet IDs

   Prove it works

   terminalcopy cmd

   $ terraform -chdir=envs/dev apply && terraform -chdir=envs/dev output -json private_subnet_ids

   ── expected output ──

   ["subnet-0a1b...","subnet-0c2d..."]

2. 2

   App tier: launch template, ASG, ALB

   Done when: Auto-healing EC2 instances behind a load balancer.

   • Launch template with user data (install JRE, fetch JAR from S3 or run the Docker image, systemd unit)
   • ASG min 2 across private subnets with ELB health checks
   • ALB + target group + listener; security groups allowing only ALB → app

   Stuck? Hints

   • Use an instance profile with AmazonSSMManagedInstanceCore so you never need SSH.

   Prove it works

   terminalcopy cmd

   $ curl -s http://$(terraform -chdir=envs/dev output -raw alb_dns)/actuator/health

   ── expected output ──

   {"status":"UP"}

3. 3

   Data and storage

   Done when: RDS and S3 wired to the app securely.

   • database module: RDS PostgreSQL in private subnets, SG from app only, password managed in Secrets Manager
   • storage module: S3 bucket, block public access, SSE, lifecycle
   • IAM policy for the instance role: read that secret, read/write that bucket prefix only

   Prove it works

   terminalcopy cmd

   $ aws rds describe-db-instances --db-instance-identifier shoplite-dev --query 'DBInstances[0].[PubliclyAccessible,StorageEncrypted,MultiAZ]'

   ── expected output ──

   [false, true, false]

4. 4

   Monitoring and environments

   Done when: Alarms, a dashboard, and a prod environment from the same modules.

   • CloudWatch alarms: ALB 5xx > 1%, unhealthy hosts > 0, RDS free storage < 20%, CPU > 80%, notifying SNS
   • Dashboard for the golden signals
   • envs/prod: bigger instances, Multi-AZ RDS, deletion protection

   Prove it works

   terminalcopy cmd

   $ aws cloudwatch describe-alarms --alarm-name-prefix shoplite-prod --query 'MetricAlarms[].AlarmName'

   ── expected output ──

   ["shoplite-prod-alb-5xx","shoplite-prod-unhealthy-hosts","shoplite-prod-rds-cpu","shoplite-prod-rds-storage"]

5. 5

   CI for Terraform

   Done when: Plans on PRs, applies from main, with OIDC credentials.

   • GitHub Actions with OIDC to assume a role (no long-lived keys)
   • PR: fmt, validate, tflint, checkov, plan posted as a comment
   • Main: apply dev automatically; prod via a protected environment with approval

   Prove it works

   terminalcopy cmd

   $ # PR comment from the pipeline

   ── expected output ──

   Plan: 2 to add, 1 to change, 0 to destroy.

• Replace EC2 with ECS Fargate (Terraform course, Stage 3)
• Add CloudFront + WAF in front of the ALB
• Add terraform test for the modules (Infrastructure Testing guide)

Résumé bullet

Designed and provisioned a production-grade three-tier AWS architecture (VPC, ALB, EC2 Auto Scaling, Multi-AZ RDS, S3, CloudWatch) with modular Terraform, remote state, and OIDC-based CI/CD with plan review and gated prod applies.

Demo script

• Terminate an instance and watch the ASG replace it
• Show an SSM session instead of SSH
• Show a PR with a plan comment and the approval gate for prod