Terraform on AWS: Building Production Infrastructure from Scratch

Miasma Supply Chain Worm: Full Technical Breakdown of the Self-Replicating Credential Harvester

Comprehensive technical analysis of the Miasma (Shai-Hulud) self-replicating supply-chain worm: Phantom Gyp binding.gyp execution, AI coding agent persistence hooks, 73 Microsoft repositories compromised, 448+ artifacts across npm/PyPI, credential harvesting scope, and defensive countermeasures.

Incident Response and SRE Practices for Production Systems

How to implement SLIs, SLOs, error budgets, incident management, and postmortem culture for self-hosted and distributed infrastructure.

Infrastructure as Code (IaC) transforms how we provision and manage cloud resources. Terraform has become the de facto standard for multi-cloud infrastructure automation.

Why Terraform?

• Declarative - Describe desired state, not steps to achieve it
• Provider-agnostic - Same syntax for AWS, GCP, Azure, and more
• State management - Track what exists and what changed
• Plan before apply - Preview changes before execution
• Modular - Reusable components across projects

Project Setup

Directory Structure

Provider Configuration

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

provider "aws" {
  region = var.aws_region
}
```text

## VPC Module

```hcl
module "vpc" {
  source = "./modules/vpc"

  name               = "production"
  cidr               = "10.0.0.0/16"
  availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]

  public_subnets     = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  private_subnets    = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]

  enable_nat_gateway = true
  single_nat_gateway = false  # Use true for dev, false for prod

  tags = {
    Environment = "production"
    Terraform   = "true"
  }
}
```text

## EC2 Instances

```hcl
module "ec2" {
  source = "./modules/ec2"

  ami                    = "ami-0c55b159cbfafe1f0"
  instance_type          = "t3.medium"
  key_name               = var.key_name
  vpc_security_group_ids = [module.vpc.default_security_group_id]
  subnet_ids             = module.vpc.private_subnet_ids

  min_size = 2
  max_size = 6
  desired  = 3

  user_data = templatefile("${path.module}/user_data.sh", {
    db_host = module.rds.endpoint
  })
}
```text

## RDS Database

```hcl
module "rds" {
  source = "./modules/rds"

  identifier     = "production-db"
  engine         = "postgres"
  engine_version = "15.4"

  instance_class = "db.t3.medium"
  allocated_storage = 100

  db_name  = "appdb"
  username = var.db_username
  password = var.db_password

  multi_az               = true
  db_subnet_group_name   = module.vpc.database_subnet_group
  vpc_security_group_ids = [module.vpc.database_security_group_id]

  backup_retention_period = 7
  skip_final_snapshot     = false
}
```text

## Best Practices

### State Management

1. **Use remote state** - Never commit `.tfstate` files
2. **Enable locking** - Prevent concurrent modifications
3. **Encrypt state** - Sensitive data may be stored
4. **Back up state** - Version your state file

### Security

```hcl
# Never hardcode secrets
variable "db_password" {
  type      = string
  sensitive = true  # Marks as sensitive in logs
}

# Use AWS Secrets Manager
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod/database/password"
}
```text

### Modularization

- Create reusable modules for common patterns
- Version modules with Git tags
- Use the Terraform Registry for community modules

## Common Commands

```bash
# Initialize
terraform init

# Plan changes
terraform plan -out=tfplan

# Apply changes
terraform apply tfplan

# Destroy resources
terraform destroy
```text

## Conclusion

Terraform provides a robust foundation for infrastructure automation. Start simple, add complexity incrementally, and always use remote state with locking.