A curated route into the repositories that carry the architecture, delivery, security and observability controls described in the case studies.
Public repository
terraform-infra
A production multi-account AWS estate in Terraform, split across management, security and workload accounts. Service Control Policies with root-account protection, Transit Gateway hub-and-spoke networking, and CloudTrail, GuardDuty, Config and VPC Flow Logs all normalised into Security Lake in OCSF 1.1.0 with a 365-day retention. Detections run as OpenSearch monitors rather than EventBridge rules, so alerts can be query-based, thresholded and correlated the way a SOC actually works — with runbooks and MITRE ATT&CK mapping committed alongside them.
An end-to-end observability platform for containerised microservices on Amazon EKS, bringing metrics, logs, traces, dashboards and alerting into one environment. Prometheus and Grafana cover monitoring, Fluent Bit routes Kubernetes logs into Elasticsearch and Kibana, and OpenTelemetry sends custom Go and Node.js telemetry to Prometheus and Jaeger—with ServiceMonitors, PromQL alerts and load-generation scripts included for validation.
An end-to-end AWS delivery build for a containerised Node.js expense API. Layered Terraform provisions a segmented VPC, EKS on private subnets, MySQL RDS in database subnets, ACM, Route 53, an Application Load Balancer and immutable scan-on-push ECR repositories. Helm defines replica and HPA control, while Jenkins, SonarQube and Nexus cover the build, quality gate and artefact flow.
The deployment authority: one repository that is the single source of truth for staging and production, reconciled by ArgoCD through ApplicationSets and Helm. Releases are immutable artefacts tagged with the commit SHA, and a single workflow — gitops-commit.yml — is the only thing permitted to write manifests, which is what makes a rollback a Git revert rather than an incident.
Reusable CI/CD workflows every other repository calls into, so the security floor is defined once. OIDC to AWS with no static credentials, GitHub App tokens instead of PATs, and a scanning pipeline that blocks: TruffleHog for verified secrets, CodeQL and Semgrep for SAST, Trivy failing on HIGH and CRITICAL, and OWASP ZAP for a DAST baseline.