Case study · Cloud & Infrastructure
AWS Infrastructure as Code
An AWS environment nobody applies from a laptop
A full environment in modular Terraform, with a pipeline that plans on every pull request and applies on merge.
- Terraform
- AWS
- GitHub Actions
- OIDC
- DynamoDB
What it is
A complete AWS environment defined in modular Terraform and applied by CI — VPC and networking, compute, storage, and the identity boundaries around them, with state held remotely and locked so more than one engineer can work on it safely.
The problem
Clicking through the AWS console produces an environment nobody can rebuild. The settings live in one person’s memory, staging quietly drifts from production, and a rollback turns into archaeology.
The usual fix — putting it in Terraform — only half solves it. If engineers still run apply from their own machines, you have swapped an unrepeatable environment for an unrepeatable process.
What we built
Three decisions that shaped it.
Modules, not one long file
Network, compute, storage and IAM are separate modules with their own inputs, so an environment is composed rather than copied and edited.
State that two people can share
An S3 backend with DynamoDB locking, so a second apply waits instead of corrupting the first.
The pipeline holds the credentials
GitHub Actions plans on every pull request and posts the plan back for review, then applies on merge — authenticating to AWS by OIDC rather than long-lived keys in secrets.
What it does
Six things, plainly.
Four modules, assembled per environment.
S3 backend, DynamoDB lock table.
The diff is reviewed before it exists.
One path to production, and it is audited.
No AWS credentials live in GitHub.
Stands up and comes down the same way.
Built with
- Provisioning
- Terraform
- Cloud
- AWSVPCEC2EBSS3IAM
- State
- S3 backendDynamoDB locking
- Pipeline
- GitHub Actions
- Authentication
- OIDC to an IAM role
What came out of it
The outcome.
The environment is a repository, not a memory. Anyone can stand up a copy.
Every infrastructure change arrives as a diff with its plan attached.
Credentials live in the pipeline, so the audit trail is the git history.
Built in-house, and the pattern we apply to client infrastructure.
Have a problem shaped like this one?
Describe the situation and a senior engineer will tell you what it needs.