IaC Bazaar

AWS Production Landing Zone

Tiered foundation, one apply — toggle on edge, compute, and data.

A tiered, toggle-driven AWS landing zone. The foundation is always on: a multi-AZ VPC (single NAT), three security tiers, a KMS key that encrypts everything, logs + artifacts buckets, CloudWatch with SNS alerting, Secrets Manager, SSM parameters, and IAM. Flip enable_edge for Route 53 + ACM + CloudFront + WAF, enable_compute for an ALB in front of ECS Fargate, and enable_data for Aurora Serverless v2 + ElastiCache. tofu validate is clean with everything off and everything on.

AWS17 modules16 live-tested$1,035.00 a-la-carte

How it composes

Foundation (always on): the VPC carries three security tiers; the KMS key encrypts S3, CloudWatch, Secrets Manager, SSM, Aurora and the cache; CloudWatch alarms page through SNS. enable_edge adds Route 53 + ACM + a CloudFront/WAF front; enable_compute adds an ALB wired to an ECS Fargate service (HTTPS from ACM when edge is on); enable_data adds Aurora Serverless v2 and ElastiCache in the isolated database subnets, reachable only from the app tier.

Composed root - live-tested 2026-08-04

This stack ships a single OpenTofu/Terraform root module that wires its modules together, statically validated with tofu validate. Set your domain and CIDRs in terraform.tfvars, then tofu init && tofu apply. We also ran the root itself through a real apply → verify → destroy cycle. Foundation tier (all toggles off): 79 resources applied against a real AWS account, every foundation output verified, and everything destroyed back to an empty state.

Modules in this stack

  1. 1Production VPC (Multi-AZ)✓ live-testedBattle-tested multi-AZ VPC with public/private/database subnets, NAT, endpoints, and flow logs.$59.00
  2. 2Security Group with Rule Presets✓ live-testedSecurity groups with named rule presets (https, postgres, redis...) using modern standalone rule resources.$29.00
  3. 3KMS Key with Policy Patterns✓ live-testedCustomer-managed KMS keys with sane key policies, aliases, rotation, and multi-region replicas.$29.00
  4. 4AWS S3 Bucket (hardened)✓ live-testedPrivate S3 bucket with encryption, versioning, public-access block, and TLS-only policy.$0.00
  5. 5SNS Topic with Subscriptions✓ live-testedSNS standard/FIFO topic with encryption, delivery policies, and SQS/Lambda/email subscriptions.$29.00
  6. 6CloudWatch Logs, Alarm & Dashboard✓ live-testedA self-contained CloudWatch observability bundle - an encrypted log group with retention, a metric alarm, and a dashboard - that stands up from just a name and points at any real metric.$59.00
  7. 7Secrets Manager Secret✓ live-testedSecrets with versioning, resource policies, replication, and optional Lambda rotation scaffolding.$29.00
  8. 8SSM Parameter Store (map-driven)✓ live-testedMap-driven SSM Parameter Store parameters - String, StringList, and SecureString - created from a single map, with SecureString always KMS-encrypted and the free Standard tier by default.$29.00
  9. 9IAM Roles, Policies & OIDC Trust✓ live-testedLeast-privilege IAM roles, managed policies, and GitHub/EKS OIDC federation in one composable module.$29.00
  10. 10Route 53 Hosted Zone & Records✓ live-testedA Route 53 hosted zone (public or private via vpc_ids) plus a map-driven set of records, with name normalisation and the alias-vs-rdata distinction resolved and inputs validated.$0.00
  11. 11ACM Certificate (DNS-validated)✓ live-testedRequests a public, DNS-validated ACM TLS certificate that ACM auto-renews forever, outputting the validation records to publish - CT logging on, wildcards and SANs supported.$29.00
  12. 12CloudFront Site (S3 + ACM + Route53)static-validatedComplete HTTPS site/CDN: CloudFront distribution, OAC-locked S3 origin, ACM cert, and Route53 alias records.$59.00
  13. 13WAFv2 Web ACL (managed rules + rate limit)✓ live-testedA WAFv2 web ACL (REGIONAL or CLOUDFRONT) with a default-allow posture, configurable AWS managed rule groups blocking by default, and a rate-based rule that throttles abusive IPs.$59.00
  14. 14Application Load Balancer✓ live-testedALB with HTTPS listeners, target groups, listener rules, and access logging - drop-in for ECS/EC2/Lambda targets.$59.00
  15. 15ECS Fargate Service✓ live-testedFull Fargate stack: cluster, task definition, service with ALB integration, autoscaling, and Cloud Map discovery.$179.00
  16. 16Aurora Cluster (Serverless v2 ready)✓ live-testedAurora PostgreSQL/MySQL cluster with instances, parameter groups, Serverless v2 scaling, and enhanced monitoring.$179.00
  17. 17ElastiCache for Redis / Valkey✓ live-testedA cluster-mode-disabled ElastiCache Redis/Valkey cache with encryption at rest and in transit both on, no public exposure, and the subnet group and security group created for you.$179.00
Browse the full catalogHow we verify