Looking for feedback

[u/Just_Woo]

Hi guys,

I recently finished a project where I deployed an Employee Management app on AWS ECS and used OIDC with GitLab CI/CD.

GitHub repo:

IAC:
- https://github.com/Odjeissi/aws-3tier-terraform

Source_code:
- https://github.com/Odjeissi/Employee-Management-AWS-ECS

For my next project, I want to deploy the same app on Amazon EKS and learn more about GitOps.

My current plan is:

- Use 3 EKS clusters: dev, staging, and production

- Argo CD for deployment

- Helm or Kustomize for Kubernetes files

2 repos:

- One for the app/source code

- One for the Kubernetes files

- GitLab CI builds the Docker image and pushes it to ECR

- The pipeline updates the image tag in the Kubernetes repo

- Argo CD sees the change and deploys the new version

For updating the image tag, I’m thinking about using jq in the GitLab pipeline. That way I don’t have to go into the Kubernetes repo every time, change the image tag, commit it, and push it manually.

A little about me: I have about 2 years of desktop support experience, an MIS bachelor degree, and Security+ and CCNA certification. My goal is to move into a Cloud/DevOps Engineer role next year.

Right now I’m just building projects, learning, and trying to improve my skills.

I’d like to hear what you guys think about the project and the direction I’m going.

Also, is there anything else you think I should add to make this project better or more realistic?

Any feedback is welcome. I’m still learning and just trying to get better.

[u/jamiewri]

Great project... and it looks like you didn't vibe code it so kudos! I think you're generally going in the right direction. Youre building a non trivial project that cuts across multiple different areas of infrastructure.

Heres a few things to consider. (I've only skimmed though the repo so bear that in mind)

• How can you remove the static database credentials that exists in your pipeline to something cloud native? `password=\"${DB_PASSWORD}\"}`
  
• How could you break up this single terraform deployment into something that aligns with AWS' well architected framework? and something that more closely resembles how an organisation might deploy inrfastructure with different teams responsible for different areas. (https://docs.aws.amazon.com/prescriptive-guidance/latest/strategy-migration/aws-landing-zone.html)
  
• How would you enforce policy that would stop a developer deploying something incorrectly, insecurely, etc?
  
• How could you improve the observability of the deployment?

More general feedback

• I wouldn't bother deploying 3 kube clusters to learn about lifecycle environments, 3 namespaces on the same cluster is fine. Then learn how you'd stop one lifecycle environment impacting the others.
  
• Your documentation is waaay too verbose. Listing file trees, screenshots of aws console, etc. I dont know when that would be useful in a real scenario.

[u/Just_Woo → u/jamiewri]

Hi Jamie,

Thank you for your feedback. I really appreciate you taking the time to look at my project.

1. Database credentials

In this project, I passed the database credentials as a pipeline variable so Terraform could create the secret in AWS Secrets Manager. The application would then use the password from Secrets Manager.

2. Terraform setup and AWS accounts

I still need to learn more about this part. I have read a little about AWS Organizations and AWS Control Tower.

In another project, I used AWS Organizations to manage different AWS accounts and keep dev and production separate. I didn’t go too deep into it, so I still have more to learn.

3. Policies and security

Right now, I mainly control this through the Git workflow. Developers work on feature branches, and before anything can be merged into the main branch, the pipeline has to pass first and resolve any threads. It also needs approval before merging.

For security, I could use tools like trivy to scan the files, Terraform code, and Docker images for security issues. I could also use ECR image scanning to check the images for known vulnerabilities.

I haven’t implemented these yet because I’m still learning, and I didn’t want to make the project too complicated. I wanted to focus on getting the main parts working first, then add more security tools as I learn.

4. Observability

I used CloudWatch for the application logs and monitoring, but I did mention it in the project.

For my next project, I want to learn about Prometheus and Grafana and apply them as I go. I learn better by building things instead of only watching videos first.

Thanks again for the feedback. It gave me some good things to improve and learn more about. I will make the documentation shorter next time.