🧱 Infrastructure Context
The pipeline manages a production-style AWS architecture:
VPC with public and private subnets
Application Load Balancer
Auto Scaling Groups
NAT Gateways
Multi-AZ deployment
The focus is not on building the infrastructure itself —
the focus is on automating its lifecycle.
🔄 CI/CD Pipeline Architecture
Pipeline Philosophy
Terraform execution is split into clear stages:
Plan
Apply
Destroy
Each stage is automated, controlled, and auditable.
🧪 Stage 1: Terraform Plan (Pull Request)
Triggered when a pull request is created.
What Happens
Terraform initializes with remote backend
terraform validate run
TFLint checks Terraform best practices
Trivy scans Terraform code for security risks
terraform plan executes
Plan output is stored as a pipeline artifact
Key Rule
❌ No infrastructure changes happen here
This stage exists purely for:
Review
Validation
Security feedback
🚀 Stage 2: Terraform Apply (Merge)
Triggered when code is merged.
Workspace Selection
Terraform workspace is selected automatically based on branch:
Branch Workspace
dev dev
test test
main prod
This ensures:
State isolation
Environment separation
Zero cross-environment interference
Apply Behavior
Terraform apply uses the saved plan
Dev/Test can auto-apply
Production requires manual approval
This enforces change control.
🔐 Production Safety Controls
Production deployments include:
Environment-level protection rules
Manual approval gates
Explicit confirmation before apply
Audit trail of who approved what
This mirrors real enterprise governance.
🔍 Security Scanning with Trivy
Security scanning is built directly into CI.
Trivy detects issues such as:
Open SSH access (0.0.0.0/0)
Public IP exposure
Missing HTTPS
Weak networking rules
Important Outcome
Security issues fail the pipeline early, before deployment.
Security is shifted left, not added later
🧨 Terraform Destroy Pipeline
Infrastructure lifecycle is incomplete without destruction.
Day 27 includes a dedicated destroy workflow:
Manually triggered
Environment selection required
Approval enforced
Fully automated teardown
Used for:
Cost control
Testing lifecycle maturity
Safe cleanup
🔑 Secrets & State Management
Secrets
AWS credentials stored in GitHub Secrets
Injected securely at runtime
Never committed to code
State
Terraform state stored in S3
DynamoDB used for state locking
No local state files
This enables team collaboration without conflicts.
🛠 Tools Used
Terraform
GitHub Actions
AWS S3 (remote state)
DynamoDB (state locking)
TFLint
Trivy
🏁 Conclusion
Day 27 demonstrates end-to-end Terraform automation using GitHub Actions.
This is not a demo pipeline.
This is a real, production-ready infrastructure workflow.
Terraform becomes:
Predictable
Secure
Auditable
Scalable
This is how modern DevOps teams manage cloud infrastructure.