Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,9 @@

---

## 🎯 Who This Is For
## 🎯 About This Portfolio

This portfolio is for engineering teams evaluating candidates for **Senior Cloud Engineer**, **DevSecOps Engineer**, or **Site Reliability Engineer** roles. Every project here solves a real engineering problem — not a tutorial exercise — using production-grade patterns, documented architectural decisions, and automated security validation.
This is my production engineering portfolio. Every project solves a real infrastructure or security problem using production-grade patterns, documented architectural decisions, and automated security validation — no tutorials, no toy apps.

---

Expand All @@ -30,17 +30,17 @@ This portfolio is for engineering teams evaluating candidates for **Senior Cloud
```
CloudDefense Engineering Portfolio
├── 🚀 KubeScale Platform k8s-ecommerce-project/ Grade: A+
├── 🔄 HA AWS Architecture week8-ha-deploy/ Grade: A+
├── 🛡️ S3 Secure Storage week3-s3-localstack/ Grade: A+
├── 🏛️ Enterprise Governance governance/ Grade: A+
├── ⚡ SOAR Threat Automation automation/ Grade: A+
├── 🔬 DFIR Investigation forensics/ Grade: A+
├── 🏗️ Local Deploy (w5) week5-local-deploy/ Grade: A
├── 🔍 Full Security Stack (w6) week6-deploy/ Grade: A
├── 🧩 Reusable Terraform Modules modules/ Grade: A+
├── 🔐 CI/CD Security Pipeline .github/workflows/ Grade: A+
└── 📚 Architecture Decision Records docs/adr/ Grade: A+
├── 🚀 KubeScale Platform k8s-ecommerce-project/
├── 🔄 HA AWS Architecture ha-aws-architecture/
├── 🛡️ S3 Secure Storage s3-secure-storage/
├── 🏛️ Enterprise Governance governance/
├── ⚡ SOAR Threat Automation automation/
├── 🔬 DFIR Investigation forensics/
├── 🏗️ Secure Infrastructure (IaC) aws-foundation/
├── 🔍 Full Security Stack security-stack/
├── 🧩 Reusable Terraform Modules modules/
├── 🔐 CI/CD Security Pipeline .github/workflows/
└── 📚 Architecture Decision Records docs/adr/
```

---
Expand All @@ -67,7 +67,7 @@ The flagship project. An 11-service polyglot e-commerce platform running on Kube
---

### 2. �� High-Availability AWS Architecture
**[→ View Project](./week8-ha-deploy)**
**[→ View Project](./ha-aws-architecture)**

Transforms a single server into a self-healing, multi-AZ fleet protected by WAF and monitored by GuardDuty — demonstrating the AWS Well-Architected Framework in code.

Expand Down Expand Up @@ -213,10 +213,10 @@ Formal documentation of major architectural decisions — demonstrating senior-l
│ ├── email-service/ # Custom Python microservice (Flask + gunicorn)
│ ├── finops/ # LocalStack Pro docker-compose for zero-cost AWS emulation
│ └── microservices-demo/ # Google Online Boutique source (all 11 services)
├── week8-ha-deploy/ # HA Architecture: WAF + ALB + ASG + CloudTrail + GuardDuty
├── week6-deploy/ # Full security stack: VPC + IAM + CloudTrail + GuardDuty + EC2
├── week5-local-deploy/ # Foundation: VPC + IAM + hardened EC2
├── week3-s3-localstack/ # Secure storage: S3 + KMS + TLS-only + versioning + lifecycle
├── ha-aws-architecture/ # HA Architecture: WAF + ALB + ASG + CloudTrail + GuardDuty
├── security-stack/ # Full security stack: VPC + IAM + CloudTrail + GuardDuty + EC2
├── aws-foundation/ # Foundation: VPC + IAM + hardened EC2
├── s3-secure-storage/ # Secure storage: S3 + KMS + TLS-only + versioning + lifecycle
├── governance/ # Enterprise SCPs: 3 policies at org root
├── automation/ # SOAR: Python NACL remediation + pytest test suite
├── forensics/ # DFIR: MITRE ATT&CK mapped investigation
Expand Down
2 changes: 1 addition & 1 deletion automation/auto_remediate_nacl.py
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ def find_vpc_id(ec2: boto3.client) -> str:
vpcs = response.get("Vpcs", [])
if not vpcs:
raise VPCNotFoundError(
"No VPC found. Ensure Terraform has been applied in week8-ha-deploy."
"No VPC found. Ensure Terraform has been applied in ha-aws-architecture."
)

vpc_id = vpcs[0]["VpcId"]
Expand Down
6 changes: 3 additions & 3 deletions week5-local-deploy/README.md → aws-foundation/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -62,10 +62,10 @@ Deploy a fully hardened, modular web server infrastructure using Terraform — d
## 3. Deployment

```bash
cd week5-local-deploy
cd aws-foundation

# Start LocalStack
docker-compose -f ../week3-s3-localstack/localstack-docker-compose.yml up -d
docker-compose -f ../s3-secure-storage/localstack-docker-compose.yml up -d

# Deploy
terraform init
Expand All @@ -89,4 +89,4 @@ iam_instance_profile = "local-ec2-profile"
---

**Author:** Jimoh Sodiq Bolaji
**Next Project:** [week6-deploy](../week6-deploy) — adds CloudTrail + GuardDuty security monitoring layer
**Next Project:** [security-stack](../security-stack) — adds CloudTrail + GuardDuty security monitoring layer
4 changes: 2 additions & 2 deletions week5-local-deploy/main.tf → aws-foundation/main.tf
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# week5-local-deploy/main.tf
# aws-foundation/main.tf
# First full-stack local deployment: VPC + IAM + Security + Hardened EC2.
# All four modules work together to create a production-mirrored local environment.
# Demonstrates the module composition pattern used in all subsequent projects.
Expand Down Expand Up @@ -50,7 +50,7 @@
# Inbound: HTTP from internet only
# Outbound: Restricted to VPC CIDR (defence-in-depth, prevents exfiltration)
# =============================================================================
resource "aws_security_group" "web_sg" {

Check failure on line 53 in aws-foundation/main.tf

View workflow job for this annotation

GitHub Actions / Checkov Policy-as-Code Scan

CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
name = "web-server-sg"
description = "Allow HTTP inbound; restrict egress to VPC"
vpc_id = module.vpc.vpc_id
Expand All @@ -76,7 +76,7 @@
# EC2 WEB SERVER — Hardened Configuration
# Security controls: IMDSv2, encrypted root volume, IAM role, no public IP
# =============================================================================
resource "aws_instance" "web" {

Check failure on line 79 in aws-foundation/main.tf

View workflow job for this annotation

GitHub Actions / Checkov Policy-as-Code Scan

CKV_AWS_126: "Ensure that detailed monitoring is enabled for EC2 instances"

Check failure on line 79 in aws-foundation/main.tf

View workflow job for this annotation

GitHub Actions / Checkov Policy-as-Code Scan

CKV_AWS_135: "Ensure that EC2 is EBS optimized"
ami = "ami-12345678" # LocalStack dummy AMI
instance_type = "t2.micro"
subnet_id = module.vpc.public_subnet_id
Expand All @@ -102,7 +102,7 @@
}

tags = {
Name = "Week5-Secure-WebServer"
Name = "Secure-WebServer"
Environment = "local"
ManagedBy = "Terraform"
}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# week5-local-deploy/outputs.tf
# aws-foundation/outputs.tf

output "vpc_id" {
description = "VPC ID"
Expand Down
2 changes: 1 addition & 1 deletion docs/adr/ADR-002-terraform-remote-state.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ Adopt the **S3 Remote Backend with DynamoDB State Locking** pattern for all prod
terraform {
backend "s3" {
bucket = "my-org-terraform-state" # Dedicated state bucket
key = "week8-ha-deploy/terraform.tfstate"
key = "ha-aws-architecture/terraform.tfstate"
region = "us-east-1"
encrypt = true # SSE-KMS encryption at rest
dynamodb_table = "terraform-state-lock" # Prevents concurrent applies
Expand Down
2 changes: 1 addition & 1 deletion governance/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ Denies all API actions performed by root account credentials. Root accounts shou
cd governance

# Start LocalStack Pro (organizations service required)
docker-compose -f ../week3-s3-localstack/localstack-docker-compose.yml up -d
docker-compose -f ../s3-secure-storage/localstack-docker-compose.yml up -d

# Deploy governance stack
terraform init
Expand Down
4 changes: 2 additions & 2 deletions week8-ha-deploy/README.md → ha-aws-architecture/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ This project spans **two AZs** (`us-east-2a`, `us-east-2b`) — the minimum for
## 4. Module Architecture

```
week8-ha-deploy/
ha-aws-architecture/
└── main.tf (Composes all modules)
├── ../modules/logging → S3 bucket (KMS, versioning, TLS-only, lifecycle)
├── ../modules/security → CloudTrail + GuardDuty
Expand Down Expand Up @@ -129,7 +129,7 @@ week8-ha-deploy/
- Terraform ≥ 1.5.0

```bash
cd week8-ha-deploy
cd ha-aws-architecture

# Initialise and validate
terraform init
Expand Down
2 changes: 1 addition & 1 deletion week8-ha-deploy/main.tf → ha-aws-architecture/main.tf
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# week8-ha-deploy/main.tf
# ha-aws-architecture/main.tf
# High-Availability, Fault-Tolerant AWS Web Application Infrastructure.
# Architecture: WAF → ALB (multi-AZ) → ASG (auto-scaling EC2 fleet) → CloudTrail
#
Expand Down Expand Up @@ -148,7 +148,7 @@
# SECURITY GROUP: APPLICATION LOAD BALANCER
# Internet-facing — accepts HTTP and HTTPS only
# =============================================================================
resource "aws_security_group" "alb_sg" {

Check failure on line 151 in ha-aws-architecture/main.tf

View workflow job for this annotation

GitHub Actions / Checkov Policy-as-Code Scan

CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"

Check failure on line 151 in ha-aws-architecture/main.tf

View workflow job for this annotation

GitHub Actions / Checkov Policy-as-Code Scan

CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1"
name = "ha-alb-sg"
description = "Allow Internet to ALB on HTTP and HTTPS"
vpc_id = module.vpc.vpc_id
Expand Down Expand Up @@ -183,7 +183,7 @@
# Critical pattern: only the ALB security group can reach these instances.
# Direct internet access to instances is completely blocked.
# =============================================================================
resource "aws_security_group" "instance_sg" {

Check failure on line 186 in ha-aws-architecture/main.tf

View workflow job for this annotation

GitHub Actions / Checkov Policy-as-Code Scan

CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1"
name = "ha-instance-sg"
description = "Allow HTTP inbound ONLY from ALB security group"
vpc_id = module.vpc.vpc_id
Expand Down Expand Up @@ -279,7 +279,7 @@
# =============================================================================
# APPLICATION LOAD BALANCER — Multi-AZ, Internet-Facing
# =============================================================================
resource "aws_lb" "main" {

Check failure on line 282 in ha-aws-architecture/main.tf

View workflow job for this annotation

GitHub Actions / Checkov Policy-as-Code Scan

CKV_AWS_150: "Ensure that Load Balancer has deletion protection enabled"
name = "ha-load-balancer"
internal = false
load_balancer_type = "application"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ kms_key_id = "abc123-..."
## 5. Deployment

```bash
cd week3-s3-localstack
cd s3-secure-storage

# Start LocalStack
docker-compose -f localstack-docker-compose.yml up -d
Expand Down
6 changes: 3 additions & 3 deletions week3-s3-localstack/main.tf → s3-secure-storage/main.tf
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# week3-s3-localstack/main.tf
# s3-secure-storage/main.tf
# Secure-by-Design S3 storage provisioned with Terraform.
# Security controls applied:
# - KMS Customer Managed Key (CMK) with annual rotation
Expand All @@ -18,7 +18,7 @@ resource "aws_kms_key" "logs_key" {
}

resource "aws_kms_alias" "logs_key_alias" {
name = "alias/week3-logs-key"
name = "alias/s3-secure-storage-logs-key"
target_key_id = aws_kms_key.logs_key.key_id
}

Expand All @@ -29,7 +29,7 @@ resource "aws_s3_bucket" "logs" {
bucket = var.bucket_name

tags = {
Name = "week3-tf-s3"
Name = "s3-secure-storage"
Env = "dev"
ManagedBy = "Terraform"
}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# week3-s3-localstack/outputs.tf
# s3-secure-storage/outputs.tf

output "bucket_name" {
description = "Name of the created S3 bucket"
Expand Down
File renamed without changes.
File renamed without changes.
File renamed without changes.
12 changes: 6 additions & 6 deletions week6-deploy/README.md → security-stack/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,11 @@

## 🎯 Project Mission

Extend the week5 infrastructure with a **full security monitoring layer** — adding CloudTrail for API audit logging and GuardDuty for ML-powered threat detection, demonstrating the complete security stack required for production cloud environments.
Extend the **aws-foundation** infrastructure with a **full security monitoring layer** — adding CloudTrail for API audit logging and GuardDuty for ML-powered threat detection, demonstrating the complete security stack required for production cloud environments.

---

## 1. What's New in Week 6
## 1. What's Added in This Project

| Component | Added | Purpose |
| :--- | :--- | :--- |
Expand All @@ -34,7 +34,7 @@ Extend the week5 infrastructure with a **full security monitoring layer** — ad
## 2. Module Composition

```
week6-deploy/main.tf
security-stack/main.tf
├── module "logging" → S3 bucket (KMS, versioning, TLS-only)
│ Output: bucket_name, bucket_arn
├── module "security" → CloudTrail + GuardDuty
Expand Down Expand Up @@ -75,10 +75,10 @@ GuardDuty analyses the log pattern
## 4. Deployment

```bash
cd week6-deploy
cd security-stack

# Start LocalStack Pro
docker-compose -f ../week3-s3-localstack/localstack-docker-compose.yml up -d
docker-compose -f ../s3-secure-storage/localstack-docker-compose.yml up -d

terraform init
terraform apply -auto-approve
Expand All @@ -100,4 +100,4 @@ iam_instance_profile = "local-ec2-profile"
---

**Author:** Jimoh Sodiq Bolaji
**Progression:** [week5-local-deploy](../week5-local-deploy) → **week6-deploy** → [week8-ha-deploy](../week8-ha-deploy) (HA + WAF + ALB)
**Progression:** [aws-foundation](../aws-foundation) → **security-stack** → [ha-aws-architecture](../ha-aws-architecture) (HA + WAF + ALB)
4 changes: 2 additions & 2 deletions week6-deploy/main.tf → security-stack/main.tf
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# week6-deploy/main.tf
# security-stack/main.tf
# Full-stack local deployment: VPC + IAM + Security Monitoring + Hardened EC2.
# Extends week5 by adding CloudTrail audit trail and GuardDuty threat detection,
# Extends aws-foundation by adding CloudTrail audit trail and GuardDuty threat detection,
# demonstrating the "Security Layer" composition pattern.

terraform {
Expand Down
2 changes: 1 addition & 1 deletion week6-deploy/outputs.tf → security-stack/outputs.tf
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# week6-deploy/outputs.tf
# security-stack/outputs.tf

output "vpc_id" {
description = "VPC ID"
Expand Down
Loading