Terraform Control-Plane & IDP
The internal developer platform that provisions, ships, and cost-tracks every client environment in the fleet.
- Role
- Sole author and operator
- Period
- 2023 - present
- Ownership
- Sole author
- Stack
- Terraform · Fastify 5 · React 18 · TypeScript · MongoDB · AWS SDK v3 · ECS Fargate
Problem
Client environments were hand-assembled: console clicks, tribal knowledge, drift nobody could see, and an AWS bill nobody could attribute. Onboarding a tenant took days of a senior engineer's attention and produced an environment subtly unlike the last one.
Constraints
One platform engineer - me - operating ~$110K/yr of AWS across production and test fleets, alongside feature work. The platform had to be self-service enough that provisioning doesn't need its author in the room, and observable enough that drift and cost anomalies surface themselves.
Architecture
Nine Terraform stacks covering ~60 AWS resource types: Cognito user pools, ECS Fargate services, CloudFront distributions, WAFv2, Route 53, ElastiCache, KMS, Secrets Manager. Tenant environments are instantiated from templated modules - the same shape every time.
On top sits a Fastify + React dashboard that runs Terraform plans and applies, detects drift against live state, enforces tag compliance, and attributes cost per client through the Cost Explorer API. Right-sizing, the shared ALB, and Fargate Spot all came out of that same cost data.
Outcome
- Tenant onboarding went from days of manual assembly to a templated, repeatable workflow.
- ~$110K/yr of AWS runs with per-client cost attribution and continuous drift detection.
- 6 client launches shipped through the platform - environment validation, deployment, rollback planning.