AWS Infrastructure-as-Code modules
39 verified terraform modules for AWS, spanning AWS. Every artifact is statically validated (tofu validate + tflint + Checkov) and passes the publish gate before it appears here. Each ships an annotated terraform.tfvars.example and a perpetual licence with 12 months of updates.
38 of 39 AWS modules are live-tested - really applied to a cloud account, verified, then destroyed. The remaining 1 are static-validated, live-test pending. We never label a module “live-tested” unless it actually passed apply→verify→destroy.
All AWS modules
ACM Certificate (DNS-validated)
Requests a public, DNS-validated ACM TLS certificate that ACM auto-renews forever, outputting the validation records to publish - CT logging on, wildcards and SANs supported.
API Gateway HTTP API
HTTP API with routes, Lambda/ALB integrations, custom domain, JWT authorizers, and access logs.
API Gateway REST API (deny-by-default)
A REST API wired end to end - resource tree built from route paths, deny-by-default IAM authorization, MOCK/Lambda/HTTP integrations, deployment + stage with throttling and JSON access logs.
AWS S3 Bucket (hardened)
Private S3 bucket with encryption, versioning, public-access block, and TLS-only policy.
Application Load Balancer
ALB with HTTPS listeners, target groups, listener rules, and access logging - drop-in for ECS/EC2/Lambda targets.
Aurora Cluster (Serverless v2 ready)
Aurora PostgreSQL/MySQL cluster with instances, parameter groups, Serverless v2 scaling, and enhanced monitoring.
CloudFront Site (S3 + ACM + Route53)
Complete HTTPS site/CDN: CloudFront distribution, OAC-locked S3 origin, ACM cert, and Route53 alias records.
CloudWatch Logs, Alarm & Dashboard
A self-contained CloudWatch observability bundle - an encrypted log group with retention, a metric alarm, and a dashboard - that stands up from just a name and points at any real metric.
CodeDeploy CI/CD (EC2 / ECS / Lambda)
CodeDeploy application, deployment groups, and the platform-correct service role for automated EC2/ECS/Lambda rollouts with auto-rollback on failure.
CodePipeline + CodeBuild CI/CD
AWS-native CI/CD: CodePipeline orchestrating a CodeBuild project, with an encrypted private artifact bucket and least-privilege roles. Sources from S3 (or GitHub).
Cognito User Pool & App Client
A secure-by-default Cognito user pool and app client with optional hosted-UI domain - strong password policy, TOTP MFA, account-enumeration protection, SRP-only flows, and refresh-token revocation.
DynamoDB Table
DynamoDB table with GSIs/LSIs, TTL, streams, autoscaling or on-demand, and point-in-time recovery.
EC2 Instance
EC2 instance with IMDSv2, encrypted EBS, instance profile, and EIP - secure defaults out of the box.
EC2 Launch Template + Auto Scaling Group
EC2 launch template and Auto Scaling group with IMDSv2 enforced, encrypted gp3 root volume, an egress-only security group, and scale-to-zero defaults so it applies cleanly with no compute cost.
ECR Repository
ECR repo with lifecycle rules, scan-on-push, immutable tags, and cross-account/replication policies.
ECS Fargate Service
Full Fargate stack: cluster, task definition, service with ALB integration, autoscaling, and Cloud Map discovery.
EFS File System (encrypted, in-transit TLS)
An EFS file system with mount targets, a least-privilege NFS security group, lifecycle tiering, automatic backups, and a resource policy that enforces encryption in transit.
EKS Cluster with Managed Node Groups
Opinionated EKS cluster with node groups, core add-ons, Pod Identity, and KMS secret encryption.
ElastiCache for Redis / Valkey
A cluster-mode-disabled ElastiCache Redis/Valkey cache with encryption at rest and in transit both on, no public exposure, and the subnet group and security group created for you.
EventBridge Bus, Rule & Target
A custom EventBridge event bus, a pattern-filtered rule, and a target wired end-to-end - encryption at rest always on, least-privilege log delivery, and a 24h retry policy with optional DLQ.
IAM Roles, Policies & OIDC Trust
Least-privilege IAM roles, managed policies, and GitHub/EKS OIDC federation in one composable module.
Jenkins Controller on AWS (EC2)
Self-hosted Jenkins controller on a hardened EC2 instance - restricted security group, IMDSv2 enforced, SSM access, encrypted root volume, Jenkins auto-installed via user-data.
KMS Key with Policy Patterns
Customer-managed KMS keys with sane key policies, aliases, rotation, and multi-region replicas.
Kinesis Data Stream (on-demand)
A Kinesis Data Stream with KMS encryption at rest on by default and ON_DEMAND capacity (no shard math), plus optional enhanced fan-out consumers and IAM-only access.
Lambda Function (Packaged & Wired)
Lambda with execution role, log group, triggers, aliases, and zip/container packaging handled.
MSK Serverless (Apache Kafka)
An MSK Serverless Apache Kafka cluster with no brokers to size - SASL/IAM authentication only, encryption in transit and at rest always on, multi-AZ placement, and a locked-down security group.
Network Load Balancer (L4)
A Layer-4 Network Load Balancer with map-driven TCP/UDP/TLS listeners and target groups, modern TLS 1.3 termination from an ACM cert, and self-contained default-VPC networking.
Production VPC (Multi-AZ)
Battle-tested multi-AZ VPC with public/private/database subnets, NAT, endpoints, and flow logs.
RDS Instance (PostgreSQL/MySQL)
Single-instance or Multi-AZ RDS with subnet/parameter/option groups, backups, and monitoring wired correctly.
Redshift Cluster (encrypted, private)
A production-ready single-node Redshift cluster with encryption always on, never publicly accessible, a parameter group enforcing require_ssl, and a generated admin password stored in Secrets Manager.
Route 53 Hosted Zone & Records
A Route 53 hosted zone (public or private via vpc_ids) plus a map-driven set of records, with name normalisation and the alias-vs-rdata distinction resolved and inputs validated.
SES v2 Sending Stack
An SES v2 sending stack - a configuration set with an optional domain/email identity (Easy DKIM) - with TLS required, bounce/complaint suppression, and reputation metrics to CloudWatch.
SNS Topic with Subscriptions
SNS standard/FIFO topic with encryption, delivery policies, and SQS/Lambda/email subscriptions.
SQS Queue with DLQ
SQS standard/FIFO queue with dead-letter queue, redrive policy, SSE, and least-privilege queue policy.
SSM Parameter Store (map-driven)
Map-driven SSM Parameter Store parameters - String, StringList, and SecureString - created from a single map, with SecureString always KMS-encrypted and the free Standard tier by default.
Secrets Manager Secret
Secrets with versioning, resource policies, replication, and optional Lambda rotation scaffolding.
Security Group with Rule Presets
Security groups with named rule presets (https, postgres, redis...) using modern standalone rule resources.
Step Functions State Machine
A Step Functions state machine (STANDARD or EXPRESS) with a least-privilege execution role, a managed CloudWatch log group, X-Ray tracing, and encryption at rest - working out of the box from a single name.
WAFv2 Web ACL (managed rules + rate limit)
A WAFv2 web ACL (REGIONAL or CLOUDFRONT) with a default-allow posture, configurable AWS managed rule groups blocking by default, and a rate-based rule that throttles abusive IPs.
AWS reference architectures
All stacks →Curated stacks of these verified modules, in the order they wire together.
Compare across clouds
All solutions →See how the services AWS covers here compare on other providers.