Application
FastAPI REST API with typed Pydantic models, SQLAlchemy persistence, CRUD endpoints, process health checks, database readiness checks, Swagger, and ReDoc.
AWS · Terraform · ECS Fargate · Secure CI/CD
Cloud-Native Task Manager on AWS
A production-inspired FastAPI workload designed to demonstrate the complete cloud engineering lifecycle: application development, containerization, Infrastructure as Code, secure delivery, database migrations, observability, reliability controls, and cost-aware operations.
API documentation is available when the cost-controlled AWS environment is running.
Overview
The project uses a small task-management API as the workload while concentrating on the engineering platform required to deploy and operate it securely and repeatably.
6Terraform modules
1Availability Zones
4CloudWatch alarms
7deployment stages
Architecture
Internet traffic terminates over HTTPS at the load balancer. ECS tasks accept traffic only from the ALB security group, and PostgreSQL accepts traffic only from the ECS security group.
User / API Client→Custom API Domain→ALB · HTTPS 443→ECS Fargate · FastAPI→Private RDS PostgreSQL
GitHub Actions→AWS OIDC Role→Amazon ECR→ECS Task Definition
Terraform→VPC + Security + RDS + ALB + ECS + Monitoring→Encrypted S3 State
What I built
I designed and implemented the application, cloud infrastructure, secure deployment workflow, operational controls, and supporting documentation.
Container platform
Python 3.12 slim image with dependency-layer caching, a non-root runtime user, container health checks, and Amazon ECR image storage.
Infrastructure
Reusable Terraform modules for networking, security, database, load balancing, ECS, and monitoring, with environment-specific composition and remote state.
CI/CD deployment flow
The deployment workflow avoids persistent AWS access keys and creates traceable application revisions from each commit.
Push to main→Ruff + Pytest→Docker build→AWS OIDC
SHA-tagged image→Push to ECR→Register task definition→Run Alembic migration task
Update ECS service→Wait for stability→HTTPS /health smoke test
Security and reliability
The controls focus on identity, network isolation, secrets handling, encrypted transport, safe container execution, and automated deployment verification.
Security controls
- Repository- and branch-restricted GitHub Actions OIDC trust
- Separate ECS task and execution IAM roles
- Private, non-public RDS PostgreSQL
- ALB-to-ECS and ECS-to-RDS security-group references
- AWS Secrets Manager for database credentials
- HTTPS with ACM-managed certificates and HTTP redirection
- Encrypted, versioned Terraform state
- Non-root application container
Reliability controls
- Process health and database readiness endpoints
- Container and ALB target-group health checks
- ECS deployment circuit breaker with rollback
- One-off migration task with exit-code verification
- Service-stability waiter before smoke testing
- HTTPS smoke test with retries
- CloudWatch logs and four health alarms
- Documented recovery and rollback procedures
Engineering decisions and trade-offs
The environment is deliberately cost-controlled while preserving meaningful cloud architecture and security boundaries.
No NAT Gateway
ECS tasks run in public subnets with assigned public IPs to avoid NAT Gateway cost. They remain unreachable directly because inbound access is restricted to the ALB security group.
Terraform and deployment ownership
Terraform manages persistent infrastructure and the baseline task definition. GitHub Actions owns later application revisions so infrastructure applies do not roll the service back to its bootstrap image.
Backward-compatible migrations
Alembic migrations run before the rolling ECS update, so schema changes must remain compatible with the currently running application until the rollout completes.
Cost-controlled operations
The AWS runtime can be started for demonstrations and stopped afterward without destroying the persistent infrastructure.
Start workflow
A PowerShell script starts RDS, waits until the database becomes available, and scales the ECS service to one running task.
Stop workflow
A companion script scales ECS compute to zero and temporarily stops RDS. Networking, ALB, ECR, IAM, logs, Terraform state, and database storage remain provisioned.
Current limitations and roadmap
The project is production-inspired rather than presented as fully production-ready. The limitations are documented as explicit next steps.
Current limitations
- Single-AZ RDS and one ECS task
- No application authentication or authorization
- No WAF, autoscaling, rate limiting, or pagination
- No separate production environment
- No published coverage threshold or integrated image/IaC scanner
Planned improvements
- Add Terraform validation and dependency, image, and IaC security scanning
- Add API authentication, authorization, rate limiting, and pagination
- Publish test coverage and enforce a minimum threshold
- Add private ECS subnets, autoscaling, WAF, and a production environment
- Add structured logs, correlation IDs, metrics, and alert notifications