Project Brief — Three-Tier App Fully in IaC with CI Gate — Infrastructure as Code

The Course 2 capstone project integrates every concept from Modules 1-5 into a production-grade, end-to-end IaC pipeline. You will provision and configure a complete three-tier cricket analytics platform — web tier (Nginx + ALB), application tier (EC2 with Auto Scaling), and data tier (RDS PostgreSQL Multi-AZ) — entirely through IaC, with a GitHub Actions CI/CD pipeline that runs all quality gates (fmt, validate, tflint, Checkov, plan) on PRs and applies on merge to main. The deliverable is a Git repository with a passing CI pipeline and a live deployment that you can demonstrate. This project is the practical proof that you can build, secure, test and operate cloud infrastructure to a professional standard.

Analogy🏏Cricket

🏏 Think of it like cricket: The capstone is the World Cup — every skill learned in training, every technique refined in practice matches, every strategic concept studied comes together in a single high-stakes tournament. The three-tier infrastructure is the World Cup team: the web tier (Nginx/ALB) is the bowling attack that faces the world (internet traffic), the application tier (EC2 ASG) is the middle-order batsmen who do the heavy scoring (business logic processing), and the data tier (RDS) is the wicketkeeper — the critical specialist who holds everything together behind the scenes. The CI/CD pipeline is the ICC's match management system that ensures every change is reviewed, certified, and applied according to official procedures.

Architecture and Requirements

The capstone architecture has eight components that must be provisioned by Terraform and configured by Ansible. The VPC module (from M2) provides the networking foundation: public subnets for the ALB and NAT Gateways, private subnets for EC2 instances, and data subnets for RDS, all across three Availability Zones. The ALB (Application Load Balancer) in the public subnets receives internet traffic, terminates TLS using an ACM certificate, and forwards to the EC2 Auto Scaling Group. The EC2 ASG deploys the cricket analytics API application on Amazon Linux 2023 instances, with the cricket_nginx and cricket_common Ansible roles applied via a user data script or a post-provision Ansible run. The RDS PostgreSQL Multi-AZ instance in the data subnets stores the application's data, encrypted with KMS and accessible only from the app tier security group. The S3 bucket stores application artifacts and match data, with versioning, encryption, and lifecycle rules. CloudWatch provides monitoring with alarms on 5xx error rates, ASG CPU, and RDS connection counts. The IAM roles follow least-privilege principles. All of this is wrapped in a GitHub Actions pipeline that implements the CI/CD quality gate from M3.

Analogy🏏Cricket

🏏 Think of it like cricket: The eight-component architecture is a full international venue, and walking the mapping fixes the design in memory. The VPC module is the stadium's zoning plan: public stands where spectators are welcome (public subnets holding the ALB and NAT gateways), the players-and-officials zone behind accreditation (private subnets for the EC2 application tier), and the vault level where the trophies and records live, reachable only from inside (isolated data subnets for RDS, with no route to the internet at all). The ALB is the ticketed main gate — every spectator enters through it, it checks tickets (terminates TLS), and it distributes the crowd across open stands (routes across healthy instances in multiple AZs). The Auto Scaling Group is the flexible seating policy that opens extra stands for a World Cup final and closes them for a Tuesday tour match (scales instances with demand, replaces any stand that fails inspection). RDS Multi-AZ is the official record room with a synchronised duplicate in a second building across town (synchronous standby replica in another AZ) — if the main building burns, the records survive to the minute. S3 is the long-term archive warehouse, and the IAM roles threaded through everything are the accreditation system deciding exactly which staff open which doors. Eight components, one venue — and the capstone asks you to build it so any part can be rebuilt from the drawings alone (entirely from code, with nothing hand-crafted in the console).