Terraform Control-Plane & IDP
The internal developer platform that provisions, ships, and cost-tracks every client environment in the fleet.
- Role
- Primary author and operator
- Period
- 2026 - present
- Ownership
- 93% of commits
- Stack
- Terraform · Fastify 5 · React 18 · TypeScript · MongoDB · AWS SDK v3 · ECS Fargate
Problem
Client environments were hand-assembled: per-portal Terraform where it existed, console clicks where it did not, drift nobody could see, and an AWS bill nobody could attribute. Onboarding a tenant took days of a senior engineer's attention and produced an environment subtly unlike the last one.
Constraints
One platform engineer - me - operating ~$110K/yr of AWS across production and test fleets, alongside feature work. The platform had to be self-service enough that provisioning doesn't need its author in the room, and observable enough that drift and cost anomalies surface themselves.
Architecture
Nine Terraform stacks covering ~60 AWS resource types: Cognito user pools, ECS Fargate services, CloudFront distributions, WAFv2, Route 53, ElastiCache, KMS, Secrets Manager. Tenant environments are instantiated from templated modules - the same shape every time. The modules were imported from the fleet's earlier per-portal Terraform in March 2026 and consolidated; a colleague contributed the other 7% of commits - Entra ID SSO for the admin portal, the monitoring tab, and the production backend deploy path.
Where it stands: the control-plane state owns one live tenant, the shared ALB and WAF, and the next tenant's pre-provisioned stack. The live fleet still runs on its earlier per-portal Terraform and is being brought under the control-plane tenant by tenant, so the same environment is provisioned the same way whether it is the first or the last.
On top sits a Fastify + React dashboard that runs Terraform plans and applies, detects drift against live state, enforces tag compliance, and attributes cost per client through the Cost Explorer API. Right-sizing, the shared ALB, and Fargate Spot all came out of that same cost data.
Delivery is gated rather than trusted. Blocking Snyk scans were rolled across the portal pipelines - scan first, ahead of build and deploy - and deploys authenticate through keyless OIDC, piloted on one environment and then rolled through the test fleet and production, so the deploy path holds no long-lived AWS credentials.
The pipelines got faster while getting stricter. The admin portal's run went from about ten minutes to six by merging lint into the build and running the security scan in parallel; the core API's went from twelve to seven with esbuild transpile, cache-mounted installs and fail-fast, and the twenty-minute build hangs ended when the stale registry cache was dropped.
Outcome
- Tenant onboarding for new launches runs through the control-plane's templated modules and a written runbook; existing tenants are migrating onto the same state.
- ~$110K/yr of AWS runs with per-client cost attribution and continuous drift detection.
- Portal pipelines block on a supply-chain scan before they build, and deploys carry no long-lived AWS credentials.
- Pipeline runs dropped from about ten minutes to six on the admin portal and twelve to seven on the core API, and the twenty-minute build hangs are gone.
- 6 client launches owned end to end - environment validation, deployment, rollback planning - on the provisioning this platform consolidates.