🏗️ AWS Terraform Modules Library

Production-grade, reusable Terraform modules for AWS infrastructure. Built and battle-tested at enterprise scale across 15+ microservices.

---

📊 Impact in Production

Metric	Result
🚀 Provisioning errors	↓ 70% across all teams
⏱️ Time per environment cycle	8 hours saved per cycle
📦 Modules published	12 production modules
🏢 Services using these modules	15+ microservices
🔒 Compliance	PCI-DSS aligned
🌍 Environments	Dev · Staging · Production

---

📦 Available Modules

Module	Description	Status
vpc	Production VPC with public/private subnets, NAT Gateway, VPC Flow Logs	✅ Stable
eks-cluster	EKS cluster with IRSA, KMS encryption, managed node groups	✅ Stable
rds-multi-az	MySQL RDS Multi-AZ with PITR, 99.99% SLA	✅ Stable
alb	Application Load Balancer with HTTPS, WAF, access logs	✅ Stable
asg	Auto Scaling Group with launch templates, mixed instances	✅ Stable
s3-secure	S3 bucket with encryption, versioning, lifecycle, block public access	✅ Stable
efs	EFS file system with encryption, mount targets, access points	✅ Stable
karpenter	Karpenter autoscaler with Spot adoption, ~30% cost reduction	✅ Stable
irsa	IAM Roles for Service Accounts — least privilege pod access	✅ Stable
security-group	Reusable security groups with least privilege rules	✅ Stable
nat-gateway	NAT Gateway with Elastic IP and route table management	✅ Stable
vpc-endpoints	VPC Endpoints for S3, ECR, Secrets Manager (no internet needed)	✅ Stable

---

🚀 Quick Start

Use a single module

module "vpc" {
  source  = "github.com/kiransurya-devops/aws-terraform-modules//modules/vpc"

  name               = "production"
  cidr               = "10.0.0.0/16"
  availability_zones = ["ap-south-1a", "ap-south-1b", "ap-south-1c"]
  private_subnets    = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets     = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway   = true
  single_nat_gateway   = false  # One per AZ for HA
  enable_vpn_gateway   = false
  enable_flow_logs     = true

  tags = {
    Environment = "production"
    Team        = "platform"
    ManagedBy   = "terraform"
  }
}

Deploy a complete EKS platform

cd examples/complete-eks-platform
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars with your values
terraform init
terraform plan
terraform apply

---

🏛️ Module Design Principles

All modules follow these standards:

• Idempotent — safe to run multiple times
• Least privilege — IAM policies grant minimum required permissions
• Encrypted — all data encrypted at rest with KMS
• Tagged — consistent tagging for cost allocation
• Documented — every variable and output has a description
• Tested — CI validates syntax, format, and security on every PR
• Versioned — semantic versioning with changelogs

---

🔒 Security Standards

Every module enforces:

• ✅ Encryption at rest (KMS)
• ✅ Encryption in transit (TLS)
• ✅ No public access by default
• ✅ CloudTrail logging enabled
• ✅ Security scanning with Checkov on every PR
• ✅ CIS AWS Benchmark aligned

---

📁 Repository Structure

aws-terraform-modules/ ├── modules/ # All reusable modules │ ├── vpc/ # Networking foundation │ ├── eks-cluster/ # Kubernetes platform │ ├── rds-multi-az/ # Database layer │ ├── alb/ # Load balancing │ ├── asg/ # Compute autoscaling │ ├── s3-secure/ # Object storage │ ├── efs/ # Shared file storage │ ├── karpenter/ # EKS autoscaling │ ├── irsa/ # Pod IAM access │ ├── security-group/ # Network security │ ├── nat-gateway/ # Outbound internet │ └── vpc-endpoints/ # Private AWS access │ ├── examples/ # Complete working examples │ ├── complete-eks-platform/ # Full EKS deployment │ └── complete-networking/ # VPC + NAT + Endpoints │ ├── .github/workflows/ # CI/CD pipeline └── docs/ # Documentation

📋 Usage Pattern

# Step 1: Networking
module "vpc" { source = "./modules/vpc" ... }

# Step 2: Compute
module "eks" {
  source             = "./modules/eks-cluster"
  vpc_id             = module.vpc.vpc_id
  private_subnet_ids = module.vpc.private_subnet_ids
}

# Step 3: Database
module "rds" {
  source             = "./modules/rds-multi-az"
  vpc_id             = module.vpc.vpc_id
  private_subnet_ids = module.vpc.private_subnet_ids
}

# Step 4: Load Balancer
module "alb" {
  source           = "./modules/alb"
  vpc_id           = module.vpc.vpc_id
  public_subnet_ids = module.vpc.public_subnet_ids
}

---

👤 Author

Kiran S — Senior DevOps & Platform Engineer LinkedIn | GitHub | Email

These modules are extracted from real enterprise production deployments. Every module has been used in systems serving 99.99% SLA requirements.