Infrastructure Development

Infrastructure Development Skill

Enterprise-grade infrastructure patterns for secure, scalable AWS deployments

Overview

This skill provides patterns and best practices for infrastructure development in enterprise environments requiring network isolation, security, and compliance. Focus on AWS VPC with PrivateLink, ECS Fargate, and Terraform infrastructure-as-code.

Core Patterns

VPC Network Isolation

# Zero-egress VPC pattern
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "${var.project_name}-vpc"
    Environment = var.environment
  }
}

# No internet gateway - PrivateLink only
# Private subnets in multiple AZs
resource "aws_subnet" "private" {
  count             = length(var.availability_zones)
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${count.index + 1}.0/24"
  availability_zone = var.availability_zones[count.index]

  tags = {
    Name = "${var.project_name}-private-${count.index + 1}"
    Type = "Private"
  }
}

PrivateLink Endpoints Pattern

# Essential VPC endpoints for air-gapped deployment
locals {
  vpc_endpoints = {
    s3 = {
      service_name = "com.amazonaws.${var.region}.s3"
      type         = "Gateway"
    }
    bedrock = {
      service_name = "com.amazonaws.${var.region}.bedrock-runtime"
      type         = "Interface"
    }
    secrets_manager = {
      service_name = "com.amazonaws.${var.region}.secretsmanager"
      type         = "Interface"
    }
    ecr = {
      service_name = "com.amazonaws.${var.region}.ecr.dkr"
      type         = "Interface"
    }
    opensearch = {
      service_name = "com.amazonaws.${var.region}.opensearch-serverless"
      type         = "Interface"
    }
  }
}

resource "aws_vpc_endpoint" "endpoints" {
  for_each = local.vpc_endpoints

  vpc_id              = aws_vpc.main.id
  service_name        = each.value.service_name
  vpc_endpoint_type   = each.value.type
  subnet_ids          = each.value.type == "Interface" ? aws_subnet.private[*].id : null
  security_group_ids  = each.value.type == "Interface" ? [aws_security_group.vpc_endpoints.id] : null

  tags = {
    Name = "${var.project_name}-${each.key}-endpoint"
  }
}