ZeroDrift

Terraform for a small AWS environment, where every infrastructure change is reviewed as a pull request before it is applied.

Status: In progress

The problem

Infrastructure changed by hand, or applied from a laptop, is hard to review and easy to break. I wanted the same rules for infrastructure that code already has: a pull request, a visible diff, and one place where changes are applied.

What it builds

A VPC with a public subnet, internet gateway and routing, a security group that allows SSH only from approved IP addresses, and one Ubuntu EC2 instance with a key pair.

How the code is organized

main.tf          wires the modules together
variables.tf
outputs.tf
modules/
  networking/    VPC, subnet, routing, security group
  compute/       key pair and EC2 instance
.github/workflows/
  terraform-workflow.yml

Networking and compute are separate modules with their own variables and outputs. The root module passes the subnet and security group from one to the other, so each part can be reused and reviewed on its own.

How a change ships

1. I open a pull request that changes a .tf file.
2. The pipeline checks formatting, validates the code and runs a plan.
3. I read the plan before approving anything.
4. Merging to main runs the apply.
5. Nothing is applied from my laptop.

Evidence

What I am fixing next

• Move state to S3 with locking, so CI runs share one state.
• Replace stored AWS keys with GitHub OIDC and a short-lived role.
• Post the plan to the pull request as a readable comment.
• Stop a new Ubuntu image from replacing the server on the next plan.
• Add a Checkov scan to the pipeline and document any accepted findings.
• Bring the README in line with the code.

What I learned