← ProjectsTerraform · AWS · Platform Engineering

Building immutable AWS infrastructure with Terraform

End-to-end platform engineering project demonstrating how secure, versioned and immutable AWS infrastructure can be designed, deployed and operated with Terraform and GitHub Actions.

TerraformAWSGolden AMIAuto ScalingRDSOIDCGitHub Actions
View repository ↗Contact
01 — Overview

What I built.

I designed a production-inspired AWS platform around reusable versioned Terraform modules, environment-specific live configuration, immutable compute and controlled deployment identities. The platform combines multi-tier VPC networking, AWS Image Builder and Golden AMIs, an Auto Scaling Group behind an Application Load Balancer, private PostgreSQL RDS, security guardrails, GitHub Actions with OIDC and scheduled Terraform drift detection.

TerraformVersioned reusable modules
Golden AMIImmutable EC2 compute
RDSPrivate PostgreSQL tier
OIDCGitHub Actions to AWS
02 — Architecture

How the platform fits together.

Architecture & delivery flow

Platform architecture

Switch between the workload request path and the immutable infrastructure delivery path.

03 — Implementation

How it was implemented.

  1. 01Separated reusable infrastructure modules from environment-specific live configuration so modules could be versioned independently and consumed through explicit Git references.
  2. 02Built shared security, guardrail, IAM, monitoring and cost-control layers alongside environment-specific VPC configurations.
  3. 03Implemented multi-tier VPC networking with public, private application and database subnets, routing, NAT and VPC Flow Logs.
  4. 04Used AWS Image Builder to create a Golden AMI, then consumed the latest approved image through a launch template and Auto Scaling Group behind an Application Load Balancer.
  5. 05Added a private PostgreSQL RDS layer with KMS encryption, backups, Secrets Manager credentials and security-group-to-security-group access.
  6. 06Configured GitHub Actions to authenticate to AWS through OIDC, run Terraform formatting, validation, TFLint and Trivy checks, create reviewed plans and apply the exact saved plan artifact after approval.
  7. 07Added scheduled Terraform drift detection across development, staging and production VPC/state targets using -detailed-exitcode.
terraform · security · ci/cd
▋
04 — Troubleshooting

Issues resolved.

01IAM permissions

Least-privilege roles blocked required operations

ProblemTerraform and CI refresh operations exposed permissions that were genuinely required, including read access for infrastructure such as the Application Load Balancer.

FixExpanded permissions only where evidence showed they were needed rather than falling back to broad administrator access.

02Security controls

Scanner findings required infrastructure changes

ProblemSecurity scanning identified gaps around encryption, logging, public-access protection, state resources and permissions.

FixChanged the Terraform configuration to address the findings rather than suppressing the controls.

03Immutable state

Image Builder produced Terraform drift

ProblemAWS Image Builder normalised parts of the image configuration, creating Terraform differences that could look like unexpected drift.

FixInvestigated the AWS-side normalisation and treated the resulting state deliberately rather than automatically overwriting it.

Outcome.

The completed platform demonstrates versioned Terraform modules, separated environment state, immutable AMI-based compute, ALB and Auto Scaling, private PostgreSQL RDS, OIDC-based GitHub Actions deployment identities, security guardrails, reviewed-plan deployment and automated drift detection. Development contains the full workload implementation, while staging and production establish the networking and protected deployment pattern for later expansion.