Multi-client AWS infrastructure and CI/CD

Problem

The clients ran production workloads on AWS estates that were partly hand-built, carried hardcoded configuration and credentials, lacked monitoring, and had no reproducible way to stand up new environments or deploy safely.

Solution

The team imported existing AWS resources into Terraform, externalised configuration into environment variables, built CI/CD pipelines that push container images to ECR and redeploy ECS services behind load balancers, added CloudWatch alarms, implemented a blue-green front-end deployment with CloudFront, and built a separate production environment with TLS, private subnets and a tested database migration.

Key features

• Terraform modules for VPC, subnets, NAT gateways, security groups, S3, CloudFront, ECR and ECS/Fargate
• Terraform import of a live AWS estate with a dedicated remote state bucket
• CloudWatch CPU, memory and disk alarms via the CloudWatch agent on database instances
• Blue-green front-end deployment across two S3/CloudFront distributions with ACM certificates and Route 53 records
• GitHub Actions pipeline building, tagging and pushing images to private ECR with forced ECS redeploys
• ALB health-check endpoint and RDS Postgres for a containerised payments service
• Hardcoded URLs, regions, bucket names and database settings moved into environment variables
• Production environment build with nginx, certbot TLS, private subnets and CI for front end and back end
• MySQL dump-and-restore migration from dev to prod
• Architecture, network, resource and traffic-flow diagrams

Tech stack

• ACM
• ALB
• AWS
• Amazon MQ
• Ansible
• Bitbucket
• Bitbucket Pipelines
• CWAgent
• CloudFront
• CloudWatch
• Composer
• Django
• Docker
• EC2
• ECR
• ECS
• Fargate
• GitHub
• GitHub Actions
• GitLab
• Google OAuth
• Helm
• IAM
• JWT
• Kubernetes
• MongoDB
• MySQL
• PHP-FPM
• PostgreSQL
• RDS
• React
• Redis
• Route 53
• S3
• SES
• Terraform
• Vue 3
• certbot
• docker-compose
• kubeadm
• minikube
• nginx