Sunset Heard

sunsetheard.dev · source on GitHub · read build notes

• Designed and deployed a serverless resume site on AWS — S3, CloudFront, ACM, API Gateway, Lambda, and DynamoDB — fully defined in Terraform across reusable modules.
• Built CI/CD with GitHub Actions using OIDC, so no long-lived AWS credentials are ever stored in GitHub, with automated tests gating every backend deploy.
• Diagnosed a GitHub Actions authentication failure that produced no useful error message by decoding the raw OIDC token to inspect its actual claims — found that GitHub's subject-claim format had changed to include account IDs, then fixed the IAM trust policy accordingly.
• Configured CloudWatch dashboards and alarms with SNS email notifications for Lambda errors and API failures.
• Kept a running, public troubleshooting log of every real issue hit during the build, from OS-level Terraform provider incompatibilities to IAM permission errors.

source on GitHub · read build notes

• Deployed a Flask guestbook app on a real three-tier architecture — VPC across 2 Availability Zones, Application Load Balancer, EC2 Auto Scaling Group, and RDS Postgres, fully defined in Terraform.
• Used SSM Session Manager instead of SSH for all admin access — no open port 22 anywhere, no SSH keys to manage.
• Resolved a circular dependency between the Auto Scaling Group and the load balancer's target group using aws_autoscaling_attachment, since neither Terraform module could directly reference the other.
• Found and fixed a real AWS IAM limitation: autoscaling:StartInstanceRefresh supports scoping to one Auto Scaling Group, but the related Describe actions silently require a wildcard resource regardless of intent.

source on GitHub · read build notes

• Containerized the same guestbook app and deployed it on ECS Fargate — no EC2 hosts to patch or manage, with the same ALB pattern as the EC2 version for a direct comparison.
• Removed the NAT Gateway entirely by placing Fargate tasks in public subnets with locked-down security groups instead — a real, documented cost/security tradeoff that cut monthly infrastructure cost by roughly a third.
• Built a CI/CD pipeline in GitHub Actions that builds and pushes Docker images entirely in CI, since Docker Desktop's current builds don't support this project's development environment.
• Injected database credentials natively via the ECS task definition's secrets field from SSM Parameter Store — discovered mid-build that these are fetched by the task's execution role, not its task role, a common point of confusion.

source on GitHub · read build notes

• Deployed the same application on EKS with a managed node group, the AWS Load Balancer Controller (installed via Helm), and plain Kubernetes YAML manifests — real kubectl practice, not infrastructure hidden behind Terraform.
• Used IRSA (IAM Roles for Service Accounts) so the Load Balancer Controller runs with zero static AWS credentials, authenticating through the cluster's own OIDC provider instead.
• Discovered that EKS's modern API-based access mode does not automatically grant the cluster creator kubectl access — unlike older EKS clusters — and fixed it with an explicit access entry.
• Diagnosed a Load Balancer Controller crash loop to a failed VPC auto-detection call via EC2 instance metadata, and fixed it by passing the VPC ID explicitly at install time.
• Scoped CI/CD access at two distinct trust levels: full cluster-admin for the human deploying infrastructure, versus namespace-scoped edit access only for the automated GitHub Actions pipeline.