Terraform Control-Plane & Internal Developer Platform

Problem

Client environments were hand-assembled: per-portal Terraform where it existed, console clicks where it did not, drift nobody could see, and an AWS bill nobody could attribute. Onboarding a tenant took days of a senior engineer's attention and produced an environment subtly unlike the last one.

Constraints

One platform engineer - me - owning the AWS across production and test fleets, alongside feature work. The platform had to be self-service enough that provisioning doesn't need its author in the room, and observable enough that drift and cost anomalies surface themselves.

Decisions

• The live fleet is being brought under the control-plane tenant by tenant, so the same environment is provisioned the same way whether it is the first or the last.
• The supply-chain scan runs beside the build and blocks the deploy.
• Keyless OIDC deploys were piloted on one environment, then rolled to test and production.

Architecture

Nine Terraform stacks covering ~60 AWS resource types: Cognito user pools, ECS Fargate services, CloudFront distributions, WAFv2, Route 53, ElastiCache, KMS, Secrets Manager. Tenant environments are instantiated from templated modules - the same shape every time. The modules were imported from the fleet's earlier per-portal Terraform in March 2026 and consolidated; colleagues contributed the other 7% of commits - Entra ID SSO for the admin portal, the clients tab and onboarding wizard, the production backend deploy path, and per-client state isolation with a plan-approval gate.

Where it stands: the control-plane state owns one deployed tenant awaiting launch, the shared ALB and WAF, and the first migrating tenant's v2 stack, now running beside its v1. The live fleet still runs on its earlier per-portal Terraform.

On top sits a Fastify + React dashboard that runs Terraform plans and applies, detects drift against live state, enforces tag compliance, and attributes cost per client through the Cost Explorer API. The shared ALB and test-fleet Fargate Spot cut cost; per-client attribution shows it.

Delivery

Blocking Snyk scans were rolled onto the newer portal pipelines and both API repos, and deploys on four repositories authenticate through keyless OIDC, taking long-lived keys out of their deploy paths.

The admin portal's run went from about ten minutes to six in April 2026 by merging lint into the build and running the security scan in parallel; the core API's went from twelve to seven with esbuild transpile, cache-mounted installs and fail-fast, and the twenty-minute build hangs ended when the stale registry cache was dropped.

Outcome

• New tenant onboarding is provisioned through the control-plane's templated modules and a written runbook; existing tenants are migrating onto the same state.
• Per-client cost attribution, and drift detection on the stacks the control-plane owns.
• The newer portal pipelines and both APIs block on a supply-chain scan before they deploy, and OIDC deploys removed long-lived AWS keys from four repositories.
• Pipeline runs dropped from about ten minutes to six on the admin portal (April 2026) and twelve to seven on the core API, and the twenty-minute build hangs are gone.