The ShopLite Build Log

Set up the ShopLite repo, create your first real AWS resource with Terraform, learn to read a plan like a reviewer, and make the config reusable.

+ ShopLite gains:a Terraform repo, an S3 assets bucket with versioning and public access blocked, and variables/outputs — all created by terraform apply

Open Terraform's memory, move it off your laptop into S3 with locking, reconcile drift and adopt existing resources, and rename things without destroying them.

+ ShopLite gains:a bootstrap config for a versioned, encrypted state bucket; remote state with S3-native locking; an imported CloudWatch log group; safely renamed resources

Build ShopLite's VPC in code: subnets generated with for_each and cidrsubnet, internet and NAT routing, tiered security groups, and a probe instance that proves it all works.

+ ShopLite gains:a two-AZ VPC with public, private, and database subnets, an internet gateway, toggleable NAT, an S3 gateway endpoint, and ALB → app → DB security groups

Ship the ShopLite API: an image in ECR, an Application Load Balancer with optional HTTPS, ECS Fargate tasks with least-privilege roles, autoscaling, and versioned deploys.

+ ShopLite gains:the ShopLite API on ECS Fargate behind an ALB with a public URL, images in ECR, optional HTTPS with ACM + Route 53, autoscaling, and versioned deploys via image_tag

Give ShopLite a Postgres database without a password ever touching your code or state, protect stateful resources from accidental destruction, and add private uploads with least-privilege IAM.

+ ShopLite gains:RDS Postgres in the database subnets with an AWS-managed master secret, the API reading its credentials from Secrets Manager, lifecycle guardrails and health checks, and a private uploads bucket with presigned uploads

Turn ShopLite's growing pile of .tf files into reusable modules — extracted with zero downtime, designed with typed interfaces, versioned, and instantiated with for_each.

+ ShopLite gains:a network module, an ecs-service module running the API and a new worker, git-tagged module versions, and services defined as a single map

Run the same ShopLite code as isolated dev and prod environments: separate state, separate tfvars, separate AWS accounts with guards against applying to the wrong one, and a safe way to share outputs.

+ ShopLite gains:per-environment backends and tfvars behind a small wrapper script, a prod environment in its own AWS account with allowed_account_ids, a us-east-1 provider alias for billing alarms, and outputs published to SSM for other teams

Take Terraform off laptops: plans on every pull request, gated applies from CI with no stored keys, tests and static analysis, policy checks on plans, and the day-2 routines that keep it all healthy.

+ ShopLite gains:a GitHub Actions pipeline (plan on PR, gated apply on merge) using OIDC roles, tflint + trivy + terraform test, an OPA policy gate on plans, nightly drift detection, and a documented teardown