Terraform · IaC · AWS

Terraform consultant — infrastructure as code you can actually review.

Modular, peer-reviewed Terraform for AWS: reusable modules, remote state done right, environment promotion, and policy-as-code that blocks unsafe changes at plan time. 16+ years, CISA + AWS Solutions Architect Professional.

Book a free 30-min callEmail me

What you get

Modular IaC

  • Repos split by concern — networking, compute, data, security, observability
  • Reusable modules with clean inputs/outputs and versioning
  • DRY environments (dev/stage/prod) via workspaces or Terragrunt

Remote state, done right

  • S3 backend + DynamoDB locking, encrypted, least-privilege access
  • State isolation per environment; no shared-state blast radius
  • Import and refactor existing click-ops infrastructure into code

Policy-as-code

  • OPA/Conftest blocking public S3, open SGs, unencrypted RDS at plan time
  • Pre-merge checks in CI so bad infra never reaches apply
  • Cost + security guardrails baked into the pipeline

Migration & handoff

  • Convert existing AWS accounts to fully reproducible Terraform
  • CI/CD for plan/apply with approvals and drift detection
  • Runbooks + docs, or an ongoing retainer

Proof

11+Terraform repos run in production (fintech DevSecOps practice)
100%IaC coverage on greenfield builds
0public S3 objects — enforced at plan time
TerraformOpenTofuTerragruntAWSOPA/ConftestS3 remote stateDynamoDB lockCI/CDModules

FAQ

Do you use Terraform or OpenTofu?

Both — I default to whichever your team standardizes on. Modules and patterns are portable across Terraform and OpenTofu.

Can you refactor our existing click-ops AWS into Terraform?

Yes. I import existing resources, restructure into modules, add remote state and CI, and hand you a fully reproducible codebase.

How do you keep state safe?

Encrypted S3 backend with DynamoDB locking, per-environment isolation, and least-privilege IAM — no shared-state blast radius.

Do you add security controls?

Yes — OPA/Conftest policies block public buckets, open security groups and unencrypted storage at plan time, mapped to SOC 2/ISO 27001.

Turn your AWS into reproducible code.

Free 30-minute call — show me your current setup and I'll map the path to clean IaC.

Book a callAll AWS DevOps services →