Secure Infrastructure Automation Project

This project provisions AWS infrastructure with Terraform, packages the child deployment configuration into S3, and then runs Ansible playbooks on the created EC2 hosts.

Security-first project notes

This repository includes sensitive infrastructure artifacts such as:

• Terraform state files
• SSH private keys
• generated inventory files
• AWS credentials and temporary deployment output

For that reason, the repo is configured with a hardened .gitignore and should never store raw secrets in Git.

Project architecture

Bootstrap overview

Deployment flow

Infrastructure layout

High-level overview

flowchart TD
    A[Bootstrap Terraform] --> B[Create VPC, subnet, security group, IAM, S3]
    B --> C[Launch EC2 bootstrap runner]
    C --> D[Install AWS CLI, Terraform, Ansible]
    D --> E[Download infrastructure.zip from S3]
    E --> F[Terraform init/apply in child project]
    F --> G[Generate Ansible inventory]
    G --> H[Run Jenkins master playbook]
    H --> I[Run agent1 playbook]
    I --> J[Run agent2 playbook]
    J --> K[Deploy services and workloads]

Loading

Security controls implemented

• SSH private keys are generated dynamically and stored locally only.
• Terraform state files are excluded from version control.
• Generated AWS credentials and temporary artifacts are ignored.
• Sensitive files such as .pem, .key, .pub, and .tfstate are excluded.
• .gitignore is designed to prevent accidental commit of deployment secrets.
• S3 bucket policy enforces HTTPS-only access.
• Public access blocking is enabled for storage resources.

File structure

• main.tf — bootstrap Terraform project
• variable.tf — bootstrap variables
• scripts/terraform_runner.sh — runner bootstrap script
• infrastructure/main.tf — child deployment infrastructure
• infrastructure/ansible/ — Ansible inventory and playbooks
• infrastructure/k8s/ — Kubernetes manifests

Execution flow

1. Run the bootstrap Terraform project.
2. The EC2 runner downloads the packaged infrastructure ZIP from S3.
3. The runner runs Terraform in the child project.
4. Terraform creates the EC2 nodes and writes the inventory file.
5. The runner executes Ansible playbooks in this order:

ansible-playbook -i ansible/inventory/hosts ansible/playbook/jenkins-master.yml
ansible-playbook -i ansible/inventory/hosts ansible/playbook/jenkins-slave.yml
ansible-playbook -i ansible/inventory/hosts ansible/playbook/kubernetes-worker.yml

Important security reminders

• Never commit .pem, .key, .tfstate, or generated inventory files.
• Rotate SSH keys and AWS credentials regularly.
• Store secrets in a secure secret manager or CI/CD secret store instead of repository files.
• Restrict IAM permissions to the minimum required for the runner.
• Use HTTPS-only S3 access and avoid public exposure of storage resources.
• Review any ignored files before force-adding them to the repository.

Current status

The project follows a secure bootstrap pattern and includes protective Git hygiene for cloud and deployment secrets. The infrastructure layer is designed to create the environment automatically, while the runner performs the configuration and orchestration steps through Terraform and Ansible.

devops-workflow-project