Blog
Thoughts on engineering, design, and building great products.
Foundation: IAM Service Roles and the S3 Artifact Bucket
Before building the pipeline you need two foundations: IAM service roles that let AWS services act on your behalf, and an S3 bucket to hold artifacts. This article dissects how service roles and trust policies work — why a service assumes a role for temporary credentials instead of storing keys — then creates the role for CodeBuild and the artifact bucket (versioning enabled) with the AWS CLI.
What CI/CD Is and the AWS Developer Tools Suite
Series opener: why deploying by hand eventually breaks, how CI and CD differ, and which AWS services let you build a pipeline — CodeCommit, CodeBuild, CodeDeploy, CodePipeline, CodeArtifact. How the pieces assemble into a chain that carries code from commit to running on EC2, all driven by the AWS CLI.
Capstone: A Complete Multi-Tier Web Infrastructure
The final article assembles everything in the series into a complete web infrastructure: VPC, ALB, an Auto Scaling Group running nginx, RDS PostgreSQL and S3 — organized into three connected modules. Apply for real, access the application through the ALB, verify the DB password never leaks into state, then a clean teardown. Closes with a roadmap for what to learn next.
Testing: terraform test, mock_provider, and Terratest
Test Terraform code before it stands up real infrastructure. terraform test (GA since 1.6) with .tftest.hcl files runs run/assert to check logic, mock_provider (1.7) lets tests run without real AWS. Real demo of three passing tests and one failing test, then an introduction to Terratest for deep integration testing.
CI/CD for Terraform: GitHub Actions, OIDC, and Quality Scanning
Put Terraform into a pipeline: automatic plan on pull requests, apply on merge, AWS authentication via OIDC with no stored access key. Bolt the quality scanners fmt, validate, tflint, Trivy and Checkov into the pipeline — with real output showing what holes they catch.
Advanced Lifecycle and Providers
Features that control resource and provider lifecycle: create_before_destroy, prevent_destroy, ignore_changes, replace_triggered_by; provider alias to run multi-region in one configuration; terraform_data replacing null_resource; provisioners as a last resort; and the check block that only warns. Each feature comes with a real demo.
Reading Another State and Refactoring: remote_state, moved, removed
When you split infrastructure across multiple states, terraform_remote_state lets one config read the output of another. And when reorganizing code, the moved block renames a resource without destroy-recreate, the removed block drops a resource from state without destroying it — both declared right in the configuration instead of the manual state mv/rm commands from Article 7.