GuideIntermediate

Cicd And Gitops On Aws

This guide takes the Andes Cargo Terraform project, finished by hand in the Terraform and IaC Guide, and teaches you to stop running `terraform apply` from your laptop and start running it inside a pipeline. It distinguishes continuous integration, continuous delivery, and continuous deployment, defines GitOps (Git as the source of truth for infrastructure, not just code), and dissects the full anatomy of a GitHub Actions workflow. It builds the industry-standard pattern — `fmt`/`validate`/`plan` run on every Pull Request as the artifact reviewed before merging, and `apply` run automatically only when that PR merges to `main` — covers secrets management and why a long-lived AWS credential in a repository is the most-cited security antipattern in the market, shows the federated OIDC pattern in real YAML, and teaches approval environments, concurrency control, and scheduled drift detection. The rollback module teaches the infrastructure-specific pattern (revert the commit, let the same pipeline re-apply) and builds a real guardrail that fails the job if a change tries to destroy Andes Cargo's data table — revisiting the real `terraform destroy` incident from the previous guide by asking whether a pipeline would have prevented it. Everything runs $0 and reproducibly with `act`, the tool that executes real GitHub Actions YAML in local Docker, against the same LocalStack lab from the previous guides — with explicit honesty about what `act` cannot simulate (environment approvals, branch protection, real PR comments), each labeled at the exact point it appears.