DevOps engineer Infrastructure in code, releases in one merge.
For teams whose AWS account grew by hand, or whose releases depend on one person remembering the steps: Terraform for the infrastructure, checks in the pipeline and releases as a workflow, so anyone on the team can ship.
Four parts of DevOps work.
Each one kept in code and changed through review.
-
Infrastructure as code
Every resource in Terraform, the old ones too.
Multi-account layouts with shared modules, importing what was created by hand instead of rebuilding it, and state moves reviewed like any other change, with the plan read in the pull request before anything is applied. A broken or compromised environment can be rebuilt from the repository.
-
CI/CD
A release is one merge.
GitHub Actions with reusable workflows shared across repositories, tests that run on what actually ships, Terraform plan and apply gated on review, Gitflow releases with release candidates, branch protection and rulesets that enforce the checks, and release automation, so a release is a workflow rather than a checklist.
-
Code quality and security
Problems found in review, not in production.
Linters and security scanners on every change: ShellCheck and the workflow, Dockerfile and Terraform linters for the pipeline itself, gitleaks and Semgrep for secrets and risky code, Trivy for images and infrastructure. OIDC federation gives CI access to AWS without stored keys.
-
Containers
The same stack on a laptop and in production.
Docker and Compose for local stacks, with emulators and mocks standing in for outside services, and images built in CI, pushed to ECR, GitHub Container Registry or Docker Hub, and run on ECS.
The tools behind DevOps work.
Bash and Python hold the pipelines and tooling together.
Infrastructure as code
- Terraform
- Reusable modules
- Multi-account layouts
- Landing zones
- Importing existing infrastructure
- Terraform refactoring
- Disaster recovery from code
- Terraform Cloud (HashiCorp's hosted Terraform runs)
- Secrets management
- EC2 (Amazon Elastic Compute Cloud: virtual servers)
- ECS (Amazon Elastic Container Service)
- ECR (Amazon Elastic Container Registry)
- Lambda (AWS Lambda: functions without servers to manage)
- CloudFront (Amazon's content delivery network)
- CloudFront Functions (Small functions that run at the CloudFront edge)
- Route 53 (Amazon's DNS service)
- IAM (AWS Identity and Access Management)
- Organizations (AWS Organizations: many accounts managed as one)
- IAM (AWS Identity and Access Management) Identity Center
- Secrets Manager
- SSM (AWS Systems Manager) Parameter Store
- KMS (AWS Key Management Service)
- Cost control
- AWS Budgets
- Cost optimization
CI/CD
- GitHub Actions
- Reusable workflows
- Gated Terraform plan and apply
- Gitflow
- Release candidates
- Release automation
- Branch protection
- Repository rulesets
- Required status checks
- Changelogs
- CodePipeline
- CodeBuild
Code quality and security
- pre-commit (Runs checks before each commit)
- ShellCheck (Linter for shell scripts)
- Infrastructure and workflow linters
- gitleaks (Finds secrets committed to git)
- Semgrep (Static analysis for risky code patterns)
- Trivy (Vulnerability scanner for container images and infrastructure code)
- OIDC (OpenID Connect) federation
Containers and scripting
- Docker
- Docker Compose
- GitHub Container Registry
- Docker Hub
- Bash
- Python
Shaded pills mark what I work with now.
The same work, seen from three other sides.
- Site reliability engineerMonitors, SLOs and alerts in code, and every change planned with a way back.
- Software architectAWS accounts laid out up front, existing systems brought under code, and progressive rewrites.
- Security advisorAccounts on least privilege, a hardened edge and a guarded delivery chain, written up and carried out in Terraform.
Need a DevOps engineer?
Tell me about your infrastructure and your pipeline.