Production-style AWS DevOps template

Problem and intended users

Organizations need a reference pattern for AWS infrastructure deployment that combines Terraform modularity, containerization, Kubernetes orchestration, and automated code quality checks in a single reproducible template.

Who it is for

DevOps engineers
Platform engineering teams
Infrastructure teams building on AWS
Teams adopting Kubernetes

Constraints and design considerations

Infrastructure must be defined as reusable, composable Terraform modules.
Local development must mirror production patterns using Docker Compose.
Kubernetes workloads must follow production safety patterns including Pod Identity and Secrets Manager integration.
Code quality checks must enforce standards before deployment through automated gates.
All AWS resources must be tagged consistently for cost tracking and governance.

Architecture overview

The template separates concerns into distinct layers: Terraform modules for infrastructure (VPC, EC2, EKS), Docker Compose for local multi-service development, Kubernetes manifests for workload orchestration, and SonarQube for code quality enforcement. Environment-specific configurations compose shared modules while maintaining separation between dev, stage, and production.

Layered architecture showing Terraform modules creating AWS infrastructure, Docker Compose for local dev, Kubernetes manifests for production workloads, and SonarQube quality gates — Terraform modules provision AWS resources (VPC, EC2, EKS) with environment-specific configuration. Docker Compose replicates the application stack locally. Kubernetes manifests deploy workloads with Pod Identity for secure credential management. SonarQube gates enforce code quality before deployment.

Implementation approach

The Terraform structure separates environment folders (dev, stage) from reusable modules (VPC, EKS). The Docker Compose stack includes 10 services (UI, catalog, cart, checkout, orders) with separate backing stores (DynamoDB Local, MariaDB, PostgreSQL, Redis, RabbitMQ). Kubernetes manifests deploy a catalog microservice stack with AWS Secrets Manager integration via CSI driver and Pod Identity. A pre-push hook integrates SonarQube analysis as an automated quality gate.

Operational decisions

Reliability: Declarative infrastructure and workload definitions make deployment repeatable. Documented deployment order and state management prevent infrastructure drift. Kubernetes patterns include headless services for DNS, StatefulSets for databases, and health checks for reliability.
Security: Docker containers run with privilege restrictions (no-new-privileges, dropped all capabilities). Kubernetes credentials come from AWS Secrets Manager via CSI driver, not stored in manifests. Pod Identity Agent provides temporary AWS credentials to pods. Terraform tagging enables resource tracking and cost allocation.
Cost: The template uses spot instances for Kubernetes nodes and configurable capacity sizing. Local Docker Compose development avoids cloud costs during iteration. Explicit module composition allows environments to choose their resource sizing.

Outcomes and current maturity

Current maturity: production

Established a reference pattern combining Terraform, Docker, Kubernetes, and code quality in a single template.
Demonstrated multi-layer local development that mirrors production Kubernetes patterns.
Integrated automated code quality enforcement through SonarQube pre-push gates.
Created reusable, environment-agnostic infrastructure modules.

Current limitations

The template is a reference implementation, not a production-ready platform.
CICD pipeline is minimal; full deployment automation is not included.
Observability and monitoring configuration are not comprehensive.
No multi-region or disaster-recovery patterns are demonstrated.

Roadmap

Expand Terraform modules for multi-region and cross-account deployment.
Implement full CICD pipeline with GitHub Actions or similar.
Add Helm chart wrapping for simplified Kubernetes deployments.
Include Terraform testing and infrastructure validation patterns.

Lessons learned

Separating Terraform modules from environment configuration prevents code duplication.
Local Docker Compose stacks should replicate production service dependencies to catch integration issues early.
Kubernetes manifests become maintainable when credential management is separated from application configuration.
Automated code quality gates must run before deployment, not after, to prevent bad code from reaching infrastructure.

Technologies and links

View repository