Work · Financial services
Bringing a hand-built AWS account under Terraform without an outage
Imported an organically-grown AWS environment into Terraform, split prod from non-prod, and added a gated deploy pipeline — with zero downtime.
Illustrative example — representative of real engagements, published as a template until client-approved write-ups replace it.
Resources under code
0% → 100%
Long-lived IAM keys
11 → 0
Time to stand up a new env
2 days → 20 min
- Everything ran in one AWS account, configured in the console, with no record of why anything was set the way it was.
- Several IAM users had broad access and static keys, some unused for months.
- A compliance review was coming and the team could not answer basic questions about their own setup.
The approach
- Inventoried the account and imported live resources into Terraform state — no destroy-and-recreate.
- Introduced a second account for non-prod and moved staging workloads across in a planned window.
- Replaced IAM users with SSO and assumed roles; wired CI to AWS via OIDC so no static keys remained.
- Added an MR pipeline that posts the Terraform plan and a manual gate for production applies.
The outcome
- The team passed the compliance review with an architecture document generated from the code.
- New environments are a variables file and a merge.
- Infrastructure changes are now reviewed like application code.
Have a project in mind?
Tell me what you are building. You get a scoping call and a fixed quote — no obligation.