Secure AWS Deployment with Terraform
A cross-AZ auto-scaling AWS stack in Terraform, scanned by Checkov on every pull request and deployed from GitHub Actions with zero long-lived AWS credentials via OIDC.
The reference deployment I wanted needed to be highly available across AZs and provisioned from CI without long-lived AWS keys in a secrets store. Teams usually solve these two problems separately and inconsistently.
I wrote the whole stack in Terraform: auto-scaling groups spread across availability zones behind a load balancer, with all of it scanned by Checkov on every pull request. GitHub Actions assumes an AWS role through OIDC, so no static access keys exist anywhere in the pipeline. The trust is scoped to the specific repo and branch.
The safest secret in your pipeline is the one you never had to store.
A repeatable, cross-AZ AWS deployment that ships from CI without a single long-lived credential in the loop. It fails the PR the moment Checkov spots a misconfiguration.
- Auto-scaling across multiple AZs behind an ALB, all in Terraform
- Checkov runs on every PR; misconfigurations fail before merge
- GitHub Actions authenticates to AWS via OIDC, no static keys stored