Terraform AWS Infrastructure
Relevant source files
The following files were used as context for generating this wiki page:
The Terraform AWS infrastructure provides a provider-agnostic workflow to provision and manage the AtlasCleanAI Enterprise platform on Amazon Web Services. It establishes a secure, multi-tier network environment to host the AI-powered cleaning services backend, transactional PostgreSQL database, and Redis cache.
This infrastructure module automates the creation of computing resources, including ECS Fargate for containerized services, an Application Load Balancer for traffic distribution, and Auto Scaling groups to handle variable demand. It serves as an alternative to the AWS CDK implementation for teams requiring stateful plan/apply operations or integration with existing Terraform estates.
Sources: README.md:129-136, infrastructure/terraform/main.tf:1-10
Network Architecture
The infrastructure deploys a Virtual Private Cloud (VPC) spanning two Availability Zones to ensure high availability. The network is segmented into three distinct tiers using subnets with varying levels of access.
Subnet Segmentation
- Public Tier: Hosts the Internet Gateway and Application Load Balancer (ALB).
- Application Tier: Contains private subnets where ECS Fargate tasks run. Egress traffic is routed through a NAT Gateway.
- Data Tier: Houses isolated private subnets for stateful resources like RDS and ElastiCache, with no direct internet access.
Sources: infrastructure/terraform/main.tf:31-92, infrastructure/terraform/variables.tf:26-44
The diagram illustrates the flow of traffic from the internet through the load balancer to the application services, and the isolated communication between application and data tiers.
Sources: infrastructure/terraform/main.tf:31-180
Compute and Orchestration
The platform utilizes AWS ECS with the Fargate launch type to run the Node.js backend container. This serverless approach removes the need to manage underlying EC2 instances.
Service Configuration
- ECS Cluster: Enables Container Insights for observability.
- Task Definitions: Configures CPU units, memory, and environment variables including database and Redis URLs.
- Auto Scaling: Adjusts the
DesiredCountof tasks based on a Target Tracking policy that maintains 60% average CPU utilization. - Security Groups: Restricts ingress to the backend service to traffic originating only from the ALB on the specified container port (default 3000).
Sources: infrastructure/terraform/main.tf:153-172, infrastructure/terraform/main.tf:273-363, infrastructure/terraform/variables.tf:46-65
Data Persistence and Caching
The infrastructure provisions managed services for relational data and session management, ensuring encryption at rest and transit.
PostgreSQL (RDS)
A managed PostgreSQL instance serves as the primary data store. In production, it is configured with Multi-AZ deployment and deletion protection.
Sources: infrastructure/terraform/main.tf:189-217, backend/src/infrastructure/database/prisma/schema.prisma:7-10
Redis (ElastiCache)
A Redis replication group manages application caching and asynchronous workflows. It supports automatic failover in production environments.
Sources: infrastructure/terraform/main.tf:225-243, README.md:20-21
| Feature | Staging Default | Production Default |
|---|---|---|
| RDS Instance Class | db.t4g.micro | db.t4g.medium |
| RDS Storage | 100 GB (GP3) | 100 GB (Max 500 GB) |
| Redis Node Type | cache.t4g.micro | cache.t4g.small |
| Redis Clusters | 1 | 2 (with failover) |
| Multi-AZ | Disabled | Enabled |
Sources: infrastructure/terraform/main.tf:194-205, infrastructure/terraform/main.tf:230-234
Security and IAM
Security is enforced through least-privilege IAM roles and granular security group rules.
- Execution Role: Grants ECS the authority to pull images from ECR and send logs to CloudWatch.
- Task Role: Provides the application container with necessary permissions to interact with AWS services.
- Encryption: Uses AES256 for ECR repositories and enforced TLS for Redis and Load Balancer listeners.
- Secrets: Sensitive values like
db_passwordandjwt_secretare marked as sensitive in Terraform to prevent exposure in logs or terminal output.
Sources: infrastructure/terraform/main.tf:174-187, infrastructure/terraform/main.tf:293-317, infrastructure/terraform/variables.tf:85-103
Deployment Variables
The Terraform configuration uses variables to allow environment-specific overrides.
| Variable | Description | Default |
|---|---|---|
aws_region | Deployment target region | us-east-1 |
environment | Environment tag (e.g., staging, production) | staging |
vpc_cidr | Network range for the VPC | 10.40.0.0/16 |
backend_image | URI of the Docker image in ECR | node:18-alpine |
certificate_arn | ACM Certificate for HTTPS | "" (empty) |
Sources: infrastructure/terraform/variables.tf:1-83
Outputs
Upon successful application, the module provides critical endpoints for platform integration.
load_balancer_dns_name: The public entry point for the application.backend_ecr_repository_url: The destination for CI/CD container image pushes.database_endpoint: The address used for database migrations and connectivity.redis_primary_endpoint: The address for cache connection strings.
Sources: infrastructure/terraform/outputs.tf:1-46
The Terraform AWS Infrastructure module ensures a repeatable and scalable environment for AtlasCleanAI Enterprise. By utilizing managed services and automated scaling, it aligns with production-grade operational standards for AI-powered service platforms.
Sources: README.md:144-162