Reusable AWS Terraform Library

Consulting work starts the same way every time: a client needs a VPC, somewhere to run containers, a database, secrets, certificates and the alarms to watch it all. Writing those resources from scratch for each engagement is slow, and it makes every environment subtly different, which is where security gaps and surprises in later changes come from.

The requirement was a library that could be dropped into an engagement on day one: broad enough to cover a normal AWS footprint, consistent enough that a reviewer knows what to expect, and safe by default, so a rushed deployment still lands with encryption on and public access closed.

The library covers 57 AWS modules across ten categories, from the foundation (VPC, NAT gateways, security groups and remote state on S3 with DynamoDB locking) through compute, storage and databases, security and identity, extended networking, containers, serverless, messaging, and monitoring.

Consumers pin a module by Git tag, so an engagement upgrades on its own schedule rather than whenever the library changes. Every module has the same shape and the same standards, which makes review quick and makes composing modules predictable. AWS is complete; Azure and GCP are planned. The library is ready for its first engagement rather than deployed to a client account.

The consistency is deliberate: the standards are the product as much as the resources are.

• One module shape: every module ships main.tf, variables.tf, outputs.tf, versions.tf and a README with usage examples, so a module nobody has read before is still predictable.
• Naming and tagging: a {client}-{environment}-{resource} naming convention and a standard tag set (client, environment, managed-by and source module) applied across resources, so costs and ownership can be traced back from any resource.
• Typed inputs with validation: variables carry types, descriptions and validation blocks, so a bad role name or an out-of-range value fails at plan time with a clear message instead of failing against the AWS API.
• Secure defaults: S3 buckets block public access and enable versioning and encryption, KMS keys rotate, EKS clusters enable IRSA and ship control-plane logs to CloudWatch, and VPC flow logs create their own log group and role.
• IAM without hand-written JSON: assume-role policies are generated from lists of trusted services, accounts, roles and OIDC providers, with conditions, so the common cases are declarative and a raw policy document is only needed for the unusual ones.
• Composable by design: modules output the identifiers other modules expect, so stacks are wired together in a root module rather than by copying resource attributes.