Core Infrastructure
VPCs, networking, multi-account landing zones, IAM foundations, and account bootstrapping.
Available Assets
Production VPC 3-Tier
CloudFormation: public, private, and isolated subnets across 3 AZs with NAT Gateways, VPC endpoints, and flow logs.
AWS Landing Zone Bootstrap
CloudFormation StackSet: logging account, security account, baseline SCPs, and account vending structure for multi-account AWS.
Multi-Region Active-Passive DR Stack
CloudFormation replicating core infrastructure to a second region with Route53 health check failover. RTO and RPO documented.
Transit Gateway Hub Stack
CloudFormation: central Transit Gateway with spoke VPC attachment pattern and route table isolation between environments.
EC2 Bastion with SSM Fallback
CloudFormation: bastion host with SSM Session Manager fallback. Session logging to CloudWatch, IAM-controlled access, no port 22 required.
S3 Static Site with CloudFront and WAF
CloudFormation: S3 origin with OAC, CloudFront distribution, ACM certificate automation, and WAF with AWS managed rules.
Terraform AWS Foundations Module
Opinionated Terraform root module: VPC, IAM roles, S3 remote state backend, and DynamoDB lock table with documented variable inputs.
ECS Fargate Service Stack
CloudFormation: Fargate service with ALB, target tracking autoscaling, Secrets Manager integration, and structured CloudWatch logging.
AWS Organizations SCP Pack
10 battle-tested Service Control Policies: deny non-approved regions, require encryption, prevent root usage, deny public RDS and S3.
Default VPC Cleanup Script
Bash script removing default VPCs across all enabled regions. Dry-run mode shows exactly what will be deleted. Rollback documented.