Cloud Infra
How the AWS estate is built: 39 infrastructure repos define everything from account foundations to the ECS services themselves. Each functional area (phenix, payments, public, cx, data, notifications) follows the same layering: a foundation repo, a platform infrastructure repo, and a tc-apps repo declaring one Terraform module per service. These repos are deliberately outside the platform health score: they are definitions, not deployed services. Scanned 2026-07-28; regenerate with scripts/scan-cloud-infra.py.
What the Terraform declares
Resource types across all scanned files. The service layer itself lives in shared modules, so ECS services appear once in aws-terraform-modules and are stamped out per service.
Risks and recommendations
20 No validation pipeline — most infra repos apply changes without a plan/validate pipeline gating them. Recommendation: a shared terraform plan pipeline on pull requests, starting with the tc-apps repos where service changes land weekly.
12 No change in over a year — no change in over a year. Fine for stable foundations, but worth confirming they still reflect what runs.
5 Candidate for archival — demos, sandboxes and pre-ECS scripts. Archive them so the infra estate stays readable.
5 State backend not detected in scan — the scan (capped per repo) did not see a remote state backend; verify state is in S3, not local.
2 Possible secrets in Terraform — literal credentials matched in Terraform files. Move to SSM or the secrets manager and rotate.
Which infra repo deploys which service
The tc-apps repos carry one module block per service, each naming its application repo. This is the live wiring between the cloud infrastructure and the service estate; service names link to their Platform Evolution pages where assessed.
The infrastructure estate
Foundations (5)
Account-level groundwork per functional area: state, roles and the base each area builds on.
| Repo | Terraform | Providers | Last commit | Pipelines | Risks |
|---|---|---|---|---|---|
| aws-cx-infra-base | 6 files | aws | 2026-04-28 | none | No validation pipeline |
| aws-data-infra-base | 6 files | aws | 2025-02-28 | none | No validation pipelineNo change in over a year |
| aws-notifications-infra-base | 7 files | aws | 2026-04-28 | none | No validation pipeline |
| aws-payments-infra-base | 6 files | aws | 2026-04-28 | none | No validation pipeline |
| aws-public-infra-base | 6 files | aws | 2026-04-28 | none | No validation pipeline |
Platform infrastructure (13)
Networks, logging, ECR registries, EventBridge and the per-area infrastructure the services run on.
| Repo | Terraform | Providers | Last commit | Pipelines | Risks |
|---|---|---|---|---|---|
| aws-cx-infra | 50 files | aws, newrelic, null, tfe | 2026-07-28 | none | No validation pipeline |
| aws-data-infra | 27 files | aws | 2026-07-24 | 1 | none |
| aws-event-bridge | 0 files | 2024-10-24 | none | No change in over a year | |
| aws-interconnectivity | 0 files | 2026-07-01 | 2 | none | |
| aws-logging | 28 files | aws, azurerm, tfe | 2026-04-28 | none | No validation pipeline |
| aws-logging-base | 0 files | 2022-03-08 | none | No change in over a year | |
| aws-networking | 7 files | aws | 2022-05-10 | none | No validation pipelineNo change in over a yearPossible secrets in TerraformState backend not detected in scan |
| aws-notifications-infra | 32 files | aws, tfe | 2026-05-15 | none | No validation pipeline |
| aws-payments-infra | 62 files | aws, newrelic, null, tfe | 2026-07-07 | none | No validation pipeline |
| aws-phenix-infra | 143 files | 2026-07-28 | none | No validation pipelineState backend not detected in scan | |
| aws-phenix-infra-eips | 6 files | aws | 2026-04-28 | none | No validation pipeline |
| aws-public-infra | 55 files | aws, tfe | 2026-07-28 | none | No validation pipeline |
| aws-shared-services-ecr-repos | 102 files | aws | 2026-07-06 | none | No validation pipelineState backend not detected in scan |
Service definitions (6)
The tc-apps repos: one Terraform module block per service, wiring each application repo onto ECS via the shared modules.
| Repo | Terraform | Providers | Last commit | Pipelines | Risks |
|---|---|---|---|---|---|
| aws-cx-tc-apps | 73 files | aws, tfe | 2026-07-07 | none | No validation pipelinePossible secrets in Terraform |
| aws-data-tc-apps | 17 files | aws, tfe | 2026-05-15 | none | No validation pipeline |
| aws-notifications-tc-apps | 27 files | aws, tfe | 2026-05-15 | none | No validation pipeline |
| aws-payments-tc-apps | 95 files | aws | 2026-07-07 | 1 | State backend not detected in scan |
| aws-phenix-tc-apps | 92 files | mongodbatlas | 2026-07-27 | 1 | State backend not detected in scan |
| aws-public-tc-apps | 46 files | aws, random, tfe | 2026-05-15 | none | No validation pipeline |
Shared modules (1)
The reusable Terraform modules (ecs_web_api and friends) every service definition consumes.
| Repo | Terraform | Providers | Last commit | Pipelines | Risks |
|---|---|---|---|---|---|
| aws-terraform-modules | 164 files | aws | 2026-07-02 | none | No validation pipeline |
Lambdas and functions (8)
Standalone functions: log transformers, metrics emitters, image proxy, media conversion.
| Repo | Terraform | Providers | Last commit | Pipelines | Risks |
|---|---|---|---|---|---|
| aws-accom-metrics-lambda | 0 files | 2024-10-24 | 1 | No change in over a year | |
| aws-image-proxy | 0 files | 2025-06-26 | 1 | No change in over a year | |
| aws-log-transformer-lambda | 0 files | 2025-05-19 | 1 | No change in over a year | |
| aws-media-convert | 0 files | 2022-03-24 | none | No change in over a year | |
| aws-phenix-metrics-lambda-functions | 0 files | 2026-03-11 | 3 | none | |
| aws-provider-mapping | 0 files | 2022-01-31 | none | No change in over a year | |
| aws-ui-ssm-access-lambda | 0 files | 2025-11-18 | 1 | none | |
| aws-ui-zip-deployment-lambda | 0 files | 2026-04-24 | 1 | none |
Legacy and sandbox (5)
Experiments, demos and pre-ECS era scripts; candidates for archival.
| Repo | Terraform | Providers | Last commit | Pipelines | Risks |
|---|---|---|---|---|---|
| aws-debug-iam-users | 31 files | aws, tfe | 2026-05-14 | none | Candidate for archival |
| aws-helloworld-demo | 0 files | 2024-10-24 | 1 | No change in over a yearCandidate for archival | |
| aws-sandbox | 53 files | aws, elasticsearch, http, tfe | 2026-04-28 | none | Candidate for archival |
| dcos-aws-terraform-ansible-scripts | 3 files | 2018-05-01 | none | No change in over a yearCandidate for archival | |
| kafka-aws-terraform-ansible-scripts | 5 files | aws | 2018-08-01 | none | No change in over a yearCandidate for archival |
Other (1)
Everything else.
| Repo | Terraform | Providers | Last commit | Pipelines | Risks |
|---|---|---|---|---|---|
| terraform-managed-service-users | 21 files | aws, azuread, elasticsearch, http, snowflake | 2026-07-09 | none | No validation pipeline |