Terraform code for Walkable LLC's internal dev environment on AWS, built on a starter kit by Towards The Cloud.
- The kit is deployed by running
make setup, automating S3 bucket deployment for remote state backend - Infrastructure is deployed by a GitHub Actions workflow with OIDC auth, so CI doesn't need long-lived AWS keys.
- Supports multiple environments with a clear account mapping (though a single test env is currently deployed)
- Merge gates include TFLint and Checkov, blocking deployment when code quality and vulnerability checks fail
The starter kit allows building on an existing codebase, mirroring how real infra work happens - reading, understanding, and extending.
Hand-built/agent assisted CI/CD workflows and remote state can be seen in my web app and OCI compute repos.
The following resources are managed here. This list was checked against live AWS state in us-east-1.
| Resource | Notes |
|---|---|
| S3 remote state bucket | Encrypted with AES256, versioned, and protected by native .tflock locking |
| GitHub Actions OIDC provider | Uses token.actions.githubusercontent.com and the audience sts.amazonaws.com |
| GitHub Actions IAM role | CI assumes this role through OIDC |
| AWS Budgets | Cost budgets with email and threshold alerts |
Costs are shown in AUD using the fixed rate US$1.00 = A$1.55.
Manual AWS Cost Explorer snapshot from 2026-09-18 (account-level, us-east-1):
- Current-month actual: A$0.0006 (US$0.00038 × 1.55)
- Current-month forecast: A$0.0006 (US$0.00038 × 1.55)
This is account-level data and may include AWS use outside this repository. Cost Explorer is not queried because each API call costs money. The value is a manual snapshot, refreshed as needed.
- Getting Started — set up credentials and deploy the environment.
- Architecture — understand the bootstrap stack, environments, OIDC flow, and Terraform state.
- Security — protect credentials, state, CI, and documentation.
- Verification — run checks and review the sources used.
- Module: oidc-provider — the OIDC provider and IAM role module.
- Never put credentials, tokens, private keys, AWS account IDs, ARNs, resource IDs, or state bucket names in documentation. See Repository Guidance.
- Do not commit
.tfvars; pass values through environment variables or CLI flags.
See Security details for the full guidance.