You're auditing and refactoring a Brazilian EdTech platform's AWS infrastructure -- four environments built by different developers over three years, none of it modular, none of it consistent, and nobody can explain why the bill climbs 15% every month.
The discipline skills: creating reusable Terraform modules with clean interfaces (inputs, outputs, no hardcoded values), running security scanning tools against AI-generated infrastructure, interpreting and prioritising the findings, estimating infrastructure cost from Terraform code before deploying, and investigating actual AWS spend to find waste.
The AI-direction lesson: AI's infrastructure mistakes are not random. Run checkov against a single AI-generated module and it reports fifteen findings -- but most are variations of the same patterns you've been catching manually since P1: overly permissive IAM policies, missing lifecycle protections, hardcoded values that should be parameterised. The tool doesn't replace your judgment. It reveals that what felt like individual mistakes are actually systematic categories of failure. You still decide which findings are critical for this platform and which can wait. Meanwhile, AI generates Infracost configurations and cost estimates without flagging what the tool can't see -- usage-based costs like data transfer and log ingestion. You're learning to use tools that extend your verification and to recognise the boundaries of what those tools cover.
Your Role
You're the cloud engineer. Rafael needs his infrastructure organised into modules his team of four can maintain, security gaps identified before the board asks harder questions, and a clear picture of where the money is going.
This is the first time the scaffolding thins. In the last three projects, architecture decisions and cost estimates were provided for you. Now you get templates and a brief with requirements, but you fill in the architecture decision records and cost estimates yourself. You've seen enough of these artifacts to know what good ones look like. The templates give you structure. You provide the reasoning.
What's New
Last time you containerised a PHP application, pushed to ECR with image scanning and lifecycle policies, and set up CloudWatch metrics for a German auto parts retailer.
Three new tools this time. tflint catches provider-specific issues that terraform validate misses. checkov scans Terraform against a library of security policies and reports findings by severity. Infracost estimates what your infrastructure will cost before you deploy it. All three extend verification into territory that manual review alone can't cover efficiently.
The hard part is prioritisation. checkov will report many findings on AI-generated modules. Not all of them are urgent. Some are critical security gaps -- wildcard IAM policies, missing encryption. Some are informational -- missing tags, deprecated attributes. Distinguishing the two for a platform serving 400,000 monthly users is the work, not just running the scan.
Tools
- Claude Code -- directing module creation, security scanning, and cost analysis
- Terraform CLI --
init,fmt,validate,plan,apply,destroy - tflint -- Terraform linter with AWS-specific checks (new)
- checkov/tfsec -- security scanning against policy libraries (new)
- Infracost -- pre-deployment cost estimation from Terraform code (new)
- AWS CLI -- resource verification and cost data
- AWS Console -- visual verification
- AWS Cost Explorer -- cost analysis
- Docker and ECR -- holding from last time
- CloudWatch -- holding from last time
- Git and GitHub -- version control
- VS Code + Terraform extension -- code editor
Materials
In the project folder:
- Rafael's email (
first-contact.md) -- four inconsistent environments, a competitor breach, a climbing bill, and gaps you'll need to ask about. - Existing Terraform (
existing-terraform/) -- the infrastructure code across four environments. Realistic, messy, built by different people at different times. This is what you're auditing and refactoring. - Architecture decision template (
architecture-decision-template.md) -- structure for documenting design choices. You fill it in. - Cost data (
cost-data/) -- six months of AWS spending. The 15% increase is in there. - Cost estimation template (
cost-estimation-template.md) -- structure for the cost analysis document.