Pulumi AWS Infra
Production-grade scalable AWS infrastructure as code with Pulumi
Problem
Production AWS infrastructure should be reproducible, version-controlled, and deployable without clicking through the console.
Built
Two-repo Pulumi project (backend infra and client infra) defining highly available multi-AZ AWS infrastructure. VPC, subnets, ALB, EC2 Auto Scaling, RDS, S3, Route53, and ACM, all as Python code.
multi-AZ
high availability
auto-scaling
capacity
IaC,
fully reproducible
separate
client + backend repos
The build
[Idea]
This project's reason to exist is in the problem statement. Production AWS infra should be reproducible. Click-ops doesn't scale, doesn't review, and doesn't survive a real outage at 2 AM. The Pulumi script (Python) provisions everything you'd expect a production-grade AWS environment to need. A VPC (10.10.0.0/16) with public subnets in 2 AZs and private subnets in 3, an Internet Gateway, a NAT Gateway and Elastic IP, public and private route tables, four layered security groups, a key pair, an Auto Scaling Group plus ALB for the Django app, and four manually-created EC2 instances outside the ASG for non-scaling workloads.
[Framing]
The split into two repos, backend infra and client infra, was deliberate. Separate IAM boundaries, separate blast radius, separate release schedule. The flow is. SSH from local into the Bastion server (public subnet), SSH into private instances, traffic hits ALB, ALB routes to Django app instances in private subnets, and the DB connection to PostgreSQL is also in a private subnet. The ASG handles traffic spikes by scaling app instances across the private subnets.
[Build]
What's missing and obvious in retrospect. There's no RDS (Postgres is on EC2), no ACM for HTTPS termination even though the security group allows 443, no centralized logging, no CI/CD on the infra itself, and no Secrets Manager. The next iteration would fix each of those in order. RDS first (data persistence deserves it), then HTTPS (no excuse in 2024), then CloudWatch and alarms, then a true pipeline so the infra is testable.
[Deploy]
The pattern I want to reuse is defense-in-depth subnet isolation and the Bastion pattern for any private resource. Pulumi over Terraform or CloudFormation because I prefer real programming languages over DSLs. Python lets me write loops, helpers, and unit tests for the infra code itself.
Stack
4 techs · grouped by layerInfrastructure
- Docker
- AWS
- Nginx
- Pulumi
Also used
Links
Related writing
1 post reference Pulumi AWS Infra- AWS Networking 101: By Deploying a Bastion Server (For Dummies)
medium · 9 min read · aws · networking · bastion · vpc