CI/CD platforms

Problem

Manual Terraform applies, ClickOps in the Console, AWS estate sprawl, Lack of allow-listing for GitHub-hosted runners

Approach and Outcome

• Workflow CI:
  • Protected main branch
  • Terraform Linting tflint, terraform fmt and terraform validate, IaC Security Scanning checkov and trivy, and Speculative Plan terraform plan on Pull Request.
• Approval Gate: PR merge to main requires approval and status checks.
• Workflow CD: Terraform Apply only on approved-PR merge and Deployment review
• In-Boundary Actions: GitHub Actions on CodeBuild-backed runners deployed in in-boundary VPCs
• IAM: GitHub OIDC to scoped AWS roles, no long-lived keys