Project: deploy a secure web app in the cloud

Goal and requirements

The goal is a small but realistic deployment, for example a simple notes or booking app, that follows the security pillar of the cloud providers' well-architected frameworks. The app itself can be tiny; the security design is the point.

• Infrastructure as code (IaC): everything created with Terraform or OpenTofu, so it can be rebuilt and destroyed.
• Network: public load balancer only; app and database in private subnets.
• Data: TLS (Transport Layer Security) on the public endpoint, encryption at rest, automated backups.
• Identity: MFA on all human accounts; the app uses a role or managed identity, never stored keys.
• Cost and safety: a budget with alerts before you start, a single region, and terraform destroy at the end of every session.

Design

Build plan

1. Write a short threat model: assets, entry points and the top five threats, with a control for each (see threat modelling).
2. Write Terraform modules for network, database, app and edge. Keep variables for region and names; no secrets in files.
3. Scan the IaC and container image before deploying, and fix high findings.
4. Deploy, then test: HTTPS works, HTTP redirects, the database has no public endpoint, WAF blocks a harmless test pattern you add as a custom rule.
5. Collect evidence (screenshots, scan reports, log entries), then destroy.

terraform init
terraform fmt -check
terraform validate
trivy config .
trivy image <your-registry>/notes-app:1.0
terraform plan -out tfplan
terraform apply tfplan
curl -I http://<your-domain>
curl -I https://<your-domain>
terraform destroy

Warning: load balancers, NAT gateways, managed databases and WAFs are billed by the hour. Build, test and destroy in one sitting, and check the bill the next day. Keep Terraform state out of public repositories; it can contain secrets.

Deliverables and how to present it

• Architecture diagram, threat model and a controls table mapping each threat to a control.
• The Terraform repository with a README, CI that runs format, validate and IaC scanning.
• A test evidence pack and a teardown confirmation.
• A one-page cost estimate per hour and how you kept it low.

On a CV: "Deployed a three-tier web app on AWS with Terraform: private subnets, WAF, TLS, Secrets Manager and IaC scanning in CI; documented threat model and controls." Interviewers will ask about trade-offs, such as why the database is private and how secrets reach the app.