Windsor Harlow Start a conversation

Case study · Cloud & Infrastructure

AWS Infrastructure as Code

An AWS environment nobody applies from a laptop

A full environment in modular Terraform, with a pipeline that plans on every pull request and applies on merge.

What it is

A complete AWS environment defined in modular Terraform and applied by CI — VPC and networking, compute, storage, and the identity boundaries around them, with state held remotely and locked so more than one engineer can work on it safely.

Type
Infrastructure as code
Applied by
GitHub Actions
Auth
OIDC, no stored keys

The problem

Clicking through the AWS console produces an environment nobody can rebuild. The settings live in one person’s memory, staging quietly drifts from production, and a rollback turns into archaeology.

The usual fix — putting it in Terraform — only half solves it. If engineers still run apply from their own machines, you have swapped an unrepeatable environment for an unrepeatable process.

What we built

Three decisions that shaped it.

01

Modules, not one long file

Network, compute, storage and IAM are separate modules with their own inputs, so an environment is composed rather than copied and edited.

02

State that two people can share

An S3 backend with DynamoDB locking, so a second apply waits instead of corrupting the first.

03

The pipeline holds the credentials

GitHub Actions plans on every pull request and posts the plan back for review, then applies on merge — authenticating to AWS by OIDC rather than long-lived keys in secrets.

What it does

Six things, plainly.

Composed environments

Four modules, assembled per environment.

Remote locked state

S3 backend, DynamoDB lock table.

Plan on every PR

The diff is reviewed before it exists.

Apply on merge

One path to production, and it is audited.

OIDC, not stored keys

No AWS credentials live in GitHub.

Reproducible teardown

Stands up and comes down the same way.

Built with

Provisioning
Terraform
Cloud
AWSVPCEC2EBSS3IAM
State
S3 backendDynamoDB locking
Pipeline
GitHub Actions
Authentication
OIDC to an IAM role

What came out of it

The outcome.

Rebuildable

The environment is a repository, not a memory. Anyone can stand up a copy.

Reviewable

Every infrastructure change arrives as a diff with its plan attached.

No laptop applies

Credentials live in the pipeline, so the audit trail is the git history.

Built in-house, and the pattern we apply to client infrastructure.

All work

Have a problem shaped like this one?

Describe the situation and a senior engineer will tell you what it needs.

Scope an engagement