GoCyc DevSecOps Infrastructure

A production-grade Infrastructure-as-Code (IaC) project implementing a comprehensive DevSecOps infrastructure on AWS. This repository contains Terraform configurations for deploying containerized Laravel applications with complete monitoring, logging, and security controls.

Overview

GoCyc DevSecOps is a complete infrastructure platform for deploying containerized applications on AWS using Terraform. It includes:

Container Orchestration: Amazon ECS with EC2 launch type
Database Management: Secure MariaDB RDS instance
Observability Stack: Prometheus, Grafana, and Loki for metrics and logs
Security: IAM roles, encrypted secrets, private networks
Infrastructure-as-Code: Fully reproducible Terraform configurations
Multi-Environment Support: Separate dev and production configurations

Key Technologies

Component	Technology	Version
IaC	Terraform	v1.0+
Container Registry	AWS ECR	-
Container Orchestration	AWS ECS	EC2 Launch Type
Database	MariaDB	11.4
Metrics	Prometheus	Latest
Visualization	Grafana	Latest
Logs	Loki	Latest
Cloud Provider	AWS	eu-west-3

Quick Start

1️⃣ Prerequisites

# Verify installations
terraform version          # v1.0+
aws --version             # v2.x+
git --version

For detailed prerequisites, see Prerequisites Section

2️⃣ Configure AWS Credentials

aws configure
# Enter your AWS Access Key ID, Secret Access Key, and set region to eu-west-3

3️⃣ Deploy Bootstrap Infrastructure

./deploy_bootstrap.sh
# Creates: S3 backend, ECR repositories, IAM roles
# Duration: 3-5 minutes

4️⃣ Deploy Main Infrastructure

./deploy_infra.sh
# Creates: VPC, ECS, RDS, Monitoring stack
# Duration: 15-20 minutes

5️⃣ Access Your Infrastructure

# Get Grafana IP
aws ec2 describe-instances --region eu-west-3 --query 'Reservations[0].Instances[0].PublicIpAddress'

# Open browser: http://<monitoring-ip>

For step-by-step deployment guide, see TECHNICAL.md → Deployment Guide

Key Features

🏗️ Infrastructure

Multi-layer Networking: Public, private, and isolated subnets across 2 availability zones
High Availability: Distributed across multiple AZs for fault tolerance
Secure Connectivity: NAT gateways for private outbound access
Flexible Scaling: Ready for auto-scaling group configuration

📦 Container Management

ECR Registries: Separate repositories for API and Admin services
Image Scanning: Automatic scanning on push for vulnerabilities
Task Definitions: Pre-configured for Laravel applications
Port Mapping: Container 8080 → Host 80 (bridge networking)

🗄️ Database

Managed RDS: MariaDB 11.4 with automatic maintenance
Encryption: Storage encryption enabled with AWS KMS
Isolation: Database in private, isolated subnets
Backup: Automated snapshots for disaster recovery

📊 Monitoring & Observability

Metrics: Prometheus scrapes container and system metrics
Visualization: Pre-configured Grafana dashboards
Logs: Loki aggregates logs from all containers
cAdvisor: Container runtime metrics collection

🔒 Security

Secrets Management: AWS Systems Manager Parameter Store for credentials
IAM Roles: Principle of least privilege for all services
Encryption: In-transit (TLS) and at-rest (KMS)
Network Isolation: Security groups implement defense in depth

🔄 State Management

Remote State: Terraform state stored in encrypted S3
Versioning: State history for rollback capability
Locking: DynamoDB-based state locking for team collaboration

Architecture

System Architecture

┌─────────────────────────────────────────────────────┐
│                    AWS Cloud                         │
│  ┌──────────────────────────────────────────────┐  │
│  │              VPC (10.0.0.0/16)               │  │
│  │                                               │  │
│  │  Public: EC2 Monitoring                      │  │
│  │  Private: ECS Container Tasks                │  │
│  │  Isolated: MariaDB RDS                       │  │
│  │                                               │  │
│  │  ┌──────────────────────────────────────┐   │  │
│  │  │  ECS Cluster                         │   │  │
│  │  │  ├─ Service API (Laravel)            │   │  │
│  │  │  └─ Service Admin (Laravel)          │   │  │
│  │  └──────────────────────────────────────┘   │  │
│  │                                               │  │
│  │  ┌──────────────────────────────────────┐   │  │
│  │  │  Monitoring Stack (EC2)              │   │  │
│  │  │  ├─ Prometheus (metrics)             │   │  │
│  │  │  ├─ Grafana (dashboards)             │   │  │
│  │  │  └─ Loki (logs)                      │   │  │
│  │  └──────────────────────────────────────┘   │  │
│  │                                               │  │
│  │  ┌──────────────────────────────────────┐   │  │
│  │  │  MariaDB RDS Instance                │   │  │
│  │  └──────────────────────────────────────┘   │  │
│  └──────────────────────────────────────────────┘  │
│           ↓                                         │
│  ┌──────────────────────────────────────────────┐  │
│  │  S3 Backend (Terraform State)                │  │
│  └──────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────┘

For detailed architecture diagrams, see TECHNICAL.md → Architecture

Project Structure

projet_final-devsecops/
├── README.md                    # This file
├── TECHNICAL.md                 # Comprehensive technical documentation
├── deploy_bootstrap.sh          # Bootstrap phase deployment script
├── deploy_infra.sh              # Main infrastructure deployment script
│
├── bootstrap/                   # Phase 1: State backend & core resources
│   ├── main.tf                  # S3 backend, ECR, IAM roles
│   ├── variables.tf             # Input variables
│   ├── outputs.tf               # Output values
│   ├── env/
│   │   ├── dev/terraform.tfvars
│   │   └── prd/terraform.tfvars
│   └── modules/
│       ├── S3/                  # S3 bucket for state
│       └── ECR/                 # ECR repositories
│
└── terraform/                   # Phase 2: Main infrastructure
    ├── main.tf                  # Main configuration & modules
    ├── variables.tf             # Input variables
    ├── outputs.tf               # Output values
    ├── env/
    │   ├── dev/
    │   │   ├── backend.tfbackend
    │   │   └── terraform.tfvars
    │   └── prd/
    │       ├── backend.tfbackend
    │       └── terraform.tfvars
    └── modules/
        ├── network/             # VPC, subnets, routing
        ├── IAM/                 # Roles, policies, profiles
        ├── EC2/                 # Monitoring instance
        ├── ECS/                 # Cluster, task definitions
        ├── RDS/                 # MariaDB database
        └── monitoring/          # Prometheus, Grafana, Loki

For complete directory structure, see TECHNICAL.md → Directory Structure

Prerequisites

Required Tools

Terraform: v1.0 or higher (Install)
AWS CLI: v2.x (Install)
Git: For version control
Bash: Shell interpreter

AWS Account Setup

Create AWS account or use existing one
Generate Access Key and Secret Key

Configure AWS CLI:

aws configure
# Region: eu-west-3
# Output: json

AWS Permissions Required

EC2, VPC, Subnets, Security Groups
RDS (MariaDB)
ECS, ECR
IAM (Roles, Policies, Instance Profiles)
S3, KMS, Systems Manager
CloudWatch Logs

For detailed prerequisites, see TECHNICAL.md → Prerequisites

Deployment

One-Command Deployment (Recommended)

# Step 1: Bootstrap
./deploy_bootstrap.sh

# Step 2: Main Infrastructure  
./deploy_infra.sh

Manual Deployment

# Bootstrap Phase
cd bootstrap
terraform fmt
terraform init
terraform apply -var-file=env/dev/terraform.tfvars -auto-approve

# Main Infrastructure Phase
cd ../terraform
terraform fmt
terraform init -backend-config=env/dev/backend.tfbackend
terraform apply -var-file=env/dev/terraform.tfvars -auto-approve

Verify Deployment

# Check ECS cluster
aws ecs list-clusters --region eu-west-3

# Check RDS instance
aws rds describe-db-instances --region eu-west-3

# Check EC2 instances
aws ec2 describe-instances --region eu-west-3

For detailed deployment steps, see TECHNICAL.md → Deployment Guide

Documentation

This repository includes comprehensive documentation:

Document	Purpose	Link
TECHNICAL.md	Complete technical reference	View
Architecture	System design & diagrams	View
Modules	Detailed module documentation	View
Deployment	Step-by-step deployment guide	View
Troubleshooting	Common issues & solutions	View
Commands Reference	Useful Terraform & AWS CLI commands	View

Quick Navigation

🏗️ Infrastructure Components: TECHNICAL.md → Infrastructure Components
🔧 Modules Deep Dive: TECHNICAL.md → Modules
🔒 Security: TECHNICAL.md → Security Considerations
🌐 Networking: TECHNICAL.md → Networking
📊 Monitoring: TECHNICAL.md → Monitoring & Logging

Monitoring & Logging

Access Grafana Dashboard

# Get monitoring instance public IP
aws ec2 describe-instances \
  --region eu-west-3 \
  --filters "Name=tag:Name,Values=*monitoring*" \
  --query 'Reservations[0].Instances[0].PublicIpAddress'

# Open in browser: http://<instance-ip>

Available Dashboards

Container Metrics: CPU, Memory, Network I/O
System Metrics: Node CPU, Memory, Disk
Application Logs: All container logs via Loki

Prometheus & Loki

Prometheus UI: http://<instance-ip>:9090
Loki API: http://<instance-ip>:3100

For monitoring details, see TECHNICAL.md → Monitoring & Logging

Security

Key Security Features

✅ Secrets Management: AWS Systems Manager Parameter Store ✅ Encryption: KMS encryption for RDS and secrets ✅ Network Isolation: Private subnets for ECS and RDS ✅ IAM Policies: Least privilege principle implemented ✅ Image Scanning: ECR scan on push enabled ✅ State Locking: DynamoDB-based Terraform state locking ✅ Audit Trail: S3 versioning for state history

Best Practices

Never commit secrets to version control
Use IAM roles instead of access keys
Enable MFA for AWS account access
Rotate credentials regularly
Monitor CloudTrail for API access
Review Security Groups regularly

For security details, see TECHNICAL.md → Security Considerations

Troubleshooting

Common Issues

Issue	Solution	Details
Terraform init fails	Check S3 bucket exists	TECHNICAL.md
ECS task fails to start	Check CloudWatch Logs	TECHNICAL.md
Can't access RDS	Check security groups	TECHNICAL.md
Grafana not accessible	Check monitoring instance	TECHNICAL.md
State lock stuck	Remove DynamoDB entry	TECHNICAL.md

For all troubleshooting steps, see TECHNICAL.md → Troubleshooting

Roadmap

Planned 📋

DynamoDB for the S3
Automated RDS backup strategy
Multi-region deployment support
Cost optimization with budgets and alerts

For full roadmap, see TECHNICAL.md → TODO Items

Environment Configurations

Development Environment

# Deploy to dev
export ENV=dev
./deploy_bootstrap.sh
./deploy_infra.sh

Configuration: bootstrap/env/dev/terraform.tfvars

Production Environment

# Deploy to production
export ENV=prd
# Edit terraform.tfvars to use production values
./deploy_bootstrap.sh
./deploy_infra.sh

Configuration: bootstrap/env/prd/terraform.tfvars

Useful Commands

Terraform

# Validate configuration
terraform validate

# Plan changes
terraform plan -var-file=env/dev/terraform.tfvars

# Apply changes
terraform apply -var-file=env/dev/terraform.tfvars

# Destroy infrastructure
terraform destroy -var-file=env/dev/terraform.tfvars

AWS CLI

# List ECR repositories
aws ecr describe-repositories --region eu-west-3

# View ECS cluster
aws ecs describe-clusters --clusters gocyc-dev-ecs-cluster --region eu-west-3

# Get RDS endpoint
aws rds describe-db-instances --query 'DBInstances[0].Endpoint' --region eu-west-3

# View application logs
aws logs tail /ecs/dev-service-api --follow --region eu-west-3

For more commands, see TECHNICAL.md → Useful Commands

Contributing

Development Workflow

Create feature branch: git checkout -b feature/my-feature
Make changes and test locally
Format Terraform: terraform fmt -recursive
Validate: terraform validate
Commit: git commit -am "Add my feature"
Push: git push origin feature/my-feature
Create Pull Request

Code Standards

Use consistent formatting: terraform fmt
Add descriptive comments for complex resources
Update documentation when making changes
Test in dev environment before production

Support

Getting Help

Check Troubleshooting Section
Review TECHNICAL.md documentation
Check AWS documentation for specific services
Review Terraform registry documentation

References

Project Information

Repository: SquidRings1/projet_final-devsecops
Current Branch: ECS-patch
Default Branch: main
AWS Region: eu-west-3 (Paris)
Last Updated: May 12, 2026

📖 For comprehensive technical details, see TECHNICAL.md

Name		Name	Last commit message	Last commit date
Latest commit History 100 Commits
.github/workflows		.github/workflows
bootstrap		bootstrap
terraform		terraform
.gitignore		.gitignore
README.md		README.md
SLI.md		SLI.md
TECHNICAL.md		TECHNICAL.md
deploy_bootstrap.sh		deploy_bootstrap.sh
deploy_infra.sh		deploy_infra.sh

Folders and files

Latest commit

History

Repository files navigation

GoCyc DevSecOps Infrastructure

📋 Table of Contents

Overview

Key Technologies

Quick Start

1️⃣ Prerequisites

2️⃣ Configure AWS Credentials

3️⃣ Deploy Bootstrap Infrastructure

4️⃣ Deploy Main Infrastructure

5️⃣ Access Your Infrastructure

Key Features

🏗️ Infrastructure

📦 Container Management

🗄️ Database

📊 Monitoring & Observability

🔒 Security

🔄 State Management

Architecture

System Architecture

Project Structure

Prerequisites

Required Tools

AWS Account Setup

AWS Permissions Required

Deployment

One-Command Deployment (Recommended)

Manual Deployment

Verify Deployment

Documentation

Quick Navigation

Monitoring & Logging

Access Grafana Dashboard

Available Dashboards

Prometheus & Loki

Security

Key Security Features

Best Practices

Troubleshooting

Common Issues

Roadmap

Planned 📋

Environment Configurations

Development Environment

Production Environment

Useful Commands

Terraform

AWS CLI

Contributing

Development Workflow

Code Standards

Support

Getting Help

References

Project Information

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages