Regulated SaaS client
Six-Environment Terraform and GovCloud Management
Commercial AWS and FedRAMP GovCloud had to share platform patterns, not copy-pasted Terraform.
Situation
The client operates a regulated SaaS product on AWS commercial and GovCloud partitions. The product needed the same deployment discipline in both, multiple environments, strict change control, and FedRAMP-aligned infrastructure, without maintaining two unrelated Terraform codebases.
Risk or constraint
Copy-paste between commercial and GovCloud would guarantee drift. A single mistaken deploy across partitions could expose compliance gaps or take down a production tenant. Manual credentials in CI were a non-starter for a regulated workload.
Diagnosis
The team didn't need more Terraform files, they needed a platform shape: shared modules with environment-specific overlays, partitioned state, OIDC-federated deploys, and an explicit gate before production changes landed.
Work completed
- Designed a modular Terraform platform spanning multiple environments with shared core modules and environment-specific variable layers
- Configured GitHub Actions CI/CD with OIDC-federated AWS credentials, no long-lived keys in secrets
- Added a manual production approval gate so commercial and GovCloud prod deploys require explicit sign-off
- Delivered a FedRAMP-aligned GovCloud deployment with cross-partition Bedrock integration
- Implemented cross-region disaster recovery for the GovCloud partition
Measurable result
- Multi-env
- Terraform platform with OIDC deploys
- FedRAMP
- GovCloud deployment to production
- OIDC
- Short-lived CI credentials, no static keys
Architecture or technologies
- Terraform
- GitHub Actions (OIDC)
- AWS GovCloud
- AWS Bedrock
- Lambda
- Aurora
- CloudFront
- IAM
What I would improve next
- Automated drift detection between commercial and GovCloud module versions
- Policy-as-code checks (OPA/Sentinel) on Terraform plans before apply
- Centralized module registry with semver so environment promotion is explicit
Request an environment assessment
If this pattern matches what you're seeing, describe your situation, not a job spec. I'll reply within 48 hours with an honest read.