Secure AWS Deployment with Terraform
A cross-AZ auto-scaling AWS stack in Terraform, scanned by Checkov on every pull request and deployed from GitHub Actions with zero long-lived AWS credentials via OIDC.
The reference deployment I wanted needed to be both highly available across AZs and provisioned from CI without long-lived AWS keys sitting in a secrets store, two things that are usually solved separately and inconsistently.
I wrote the whole stack in Terraform: auto-scaling groups spread across availability zones behind a load balancer, with all of it scanned by Checkov on every pull request. GitHub Actions assumes an AWS role through OIDC, so there are no static access keys anywhere in the pipeline; the trust is scoped to the specific repo and branch.
The safest secret in your pipeline is the one you never had to store.
A repeatable, cross-AZ AWS deployment that ships from CI without a single long-lived credential in the loop, and fails the PR the moment Checkov spots a misconfiguration.
- Auto-scaling across multiple AZs behind an ALB, all in Terraform
- Checkov runs on every PR; misconfigurations fail before merge
- GitHub Actions authenticates to AWS via OIDC, no static keys stored