03
Projects
Project 01
AWS Three-Tier Infrastructure with Terraform
Infrastructure as Code
Problem: I built this same three-tier stack by hand in the console and it broke twice — an ALB 502 from the wrong security group, and a MySQL client that wouldn't install on AL2023. How do you make sure a bug you fixed once can never come back?
Architecture — 3-tier VPC, 2 AZs
Traffic enters through a load balancer, which spreads it across auto-scaling web servers in private subnets, backed by a Multi-AZ MySQL database. The whole stack is defined in Terraform — one command builds or destroys all 47 resources.
What I built
- 47 AWS resources as code — full teardown and rebuild in 15m36s, one command, zero console clicks
- VPC, 6 subnets, ALB, ASG, RDS MySQL 8.4 Multi-AZ — all from variables via count = length(var...)
- RDS password generated by Terraform, stored in Secrets Manager, never in code
- VPC Flow Logs, CloudTrail, and Apache logs shipped to CloudWatch
- S3 remote state — encrypted, versioned, native locking
Problems I solved
- SSM agent missing — a wildcard AMI filter matched the minimal image; diagnosed by the absence of ssm log lines
- Launch-template change didn't reach running instances — fixed with an ASG instance_refresh block
- Orphaned DB subnet group — learned terraform import is the right fix for undeletable resources
- ALB 502 and mariadb105 from the manual build — now structurally impossible in code
Project 02
AWS Serverless Tasks API
Secure REST API
Problem: How do you build a REST API where unauthenticated requests never reach the backend, malicious traffic is blocked before any code runs, and the system costs $0 when idle?
Request flow — WAF to Cognito to Lambda
Every request passes a web firewall, then a login check, before any code runs. Only authenticated, clean traffic reaches the functions and database — and it costs nothing when no one is using it.
What I built
- 4 CRUD endpoints — Lambda + API Gateway + DynamoDB, $0 idle cost
- Cognito JWT authorizer — requests rejected at gateway before Lambda
- WAF with 3 Managed Rule Groups — SQL injection, XSS blocked at edge
- 100% pass rate across all 4 endpoints via Postman
Errors I fixed
- Cognito SECRET_HASH error — HMAC-SHA256 hash generation added
- FORCE_CHANGE_PASSWORD — resolved via AWS CLI in CloudShell
- Token expiry — built getAuthToken Lambda to automate refresh
Project 03
Containerized Microservices on ECS Fargate
Docker • Microservices
Problem: How do you run two independent backend services so that if one fails, the other keeps running — with no servers to manage, each service owning its own database and scaling independently?
Path-based routing — 2 microservices, 1 ALB
One load balancer sends /products and /cart to two independent services, each with its own database. If one service goes down, the other keeps running — and there are no servers to manage.
What I built
- 2 containerized microservices (Product + Cart) on ECS Fargate across 2 AZs
- Docker images pushed to private Amazon ECR repositories
- Single ALB with path-based routing — /products and /cart to separate services
- Auto Scaling (min 1, max 4) — CPU target 50%, scale-in cooldown 120s
- CloudWatch dashboard + SNS alerts at 70% CPU / 80% memory
- 8/8 test cases passed — rolling deploy with zero downtime confirmed
Security measures
- 2 separate IAM roles per task — ecsTaskExecutionRole (ECR + logs) and ecsTaskRole (DynamoDB only)
- Containers in private subnets — ALB is the only internet-facing entry point
- Database-per-service — Cart failure had zero impact on Product Service
- Diagnosed missing port 5001 SG rule — containers healthy within 1 minute of fix
Project 04
AWS Event-Driven Order Processing
Serverless Architecture
Problem: How do you build a system where the customer gets an instant response without waiting for processing — and if processing fails, the order is never lost?
Event flow — decoupled with SQS + DLQ
The customer gets an instant confirmation while the order is processed in the background through a queue. If processing fails after retries, the order lands in a dead-letter queue instead of being lost.
What I built
- API Gateway POST /orders — confirmation in under 1 second (937ms)
- SQS decouples acceptance from fulfillment — client never waits
- Dead-Letter Queue — 0 message loss after 3 retries on failure
- End-to-end: API call to email in under 30 seconds
Security measures
- Per-Lambda IAM — order-handler SQS write only, fulfiller SQS read + SNS only
- SQS visibility timeout 30 seconds — no duplicate processing
- DLQ verified by intentionally crashing the fulfiller Lambda
Project 05
This Portfolio — S3 + CloudFront
Live Site
Problem: How do you host a static site so the S3 bucket is never publicly accessible — all traffic must route through CloudFront with HTTPS enforced at the edge?
Private bucket — CDN-only access
The storage bucket is completely private — no one can reach it directly. All traffic is served over HTTPS through CloudFront's global network, which is the only thing allowed to read from the bucket.
What I built
- S3 bucket — public access blocked entirely
- CloudFront — HTTPS enforced at the CDN edge globally
- GitHub-based version control for all deployments
Security measures
- OAC — bucket policy allows only this CloudFront distribution ARN
- Direct S3 URL returns 403 Forbidden — confirmed and verified
- IAM scoped to specific distribution only