In the cloud.
Deepening AWS infrastructure — IaC, observability, and cost-aware architecture, written up publicly as I go.
// PROJECT 001 — FEATURED
andruxa.dev — this site
Static portfolio hosted on AWS with Infrastructure as Code. Terraform-managed S3 + CloudFront + Route 53, with automated deploys via GitHub Actions OIDC — no long-lived credentials.
// OTHER PROJECTS
Observability + public status page
A synthetic canary probes the platform every 10 minutes from AWS, emits custom CloudWatch metrics, and publishes a rolling results feed that powers a public, self-updating status page — all same-origin, under the strict site CSP, for roughly zero dollars a month.
FinOps: live cost dashboard
A nightly Lambda pulls spend-by-service from AWS Cost Explorer in a single API call and publishes it same-origin, so the site can show — publicly and honestly — exactly what the platform costs to run each month. No database, no backfill: Cost Explorer's own 13-month history does the work.
Automated security scorecard
A daily read-only Lambda grades the AWS account and the live site against a fixed set of security controls — no IAM users, locked-down S3, no open security groups, the full header set, a healthy TLS cert — and publishes the graded result. Any check that flips from pass to fail pages the same SNS topic the canary uses.
Event-driven media pipeline
A stranger can drop an image and get resized, EXIF-stripped variants back in a couple of seconds — routed through a real S3 → SQS → Lambda pipeline with a presigned-upload path, per-IP abuse guards, and a dead-letter queue that catches malformed files. No servers; about zero dollars at rest.
Multi-region failover (DR)
The site bucket replicates to a second region, and CloudFront wraps both origins in a failover group. To prove it, I deleted the primary bucket's policy on purpose — andruxa.dev kept serving from the us-west-2 replica with zero downtime and sub-second failover. Here's what breaking us-east-1 on purpose actually looked like.
Ephemeral PR preview environments
Every pull request gets its own throwaway deploy of the site at demos.andruxa.dev/previews/pr-<N>/, posted as a comment, and torn down when the PR closes. The interesting part isn't the preview — it's that a PR-triggered job authenticates with a dedicated OIDC role that can touch only the previews/ prefix and nothing else, and that fork PRs can never assume it.
Public 'break my site' chaos button
A button on the site that lets any visitor take down the primary region on purpose — and watch andruxa.dev survive it. One press flips us-east-1 unhealthy, CloudFront fails over to the us-west-2 replica, and an independent dead-man switch heals the primary ~5 minutes later. My failover isn't a diagram; it's a button anyone on the internet can press. Here's how it stays safe.
Six Degrees of Me — filmography graph game
Type any actor and the site finds the shortest path from them to me through shared productions, Kevin-Bacon style, with posters at every hop. A build-time job walks TMDB credits outward from my real IMDb filmography into a graph in S3; a Lambda BFS-searches it at request time. Nobody else on earth can ship this page — it only works because the dataset is my own career.
place — a live collaborative pixel canvas
A shared 128x128 canvas anyone can draw on, live. Pick a colour, click a pixel, and everyone connected watches it appear in real time. r/place in miniature: API Gateway WebSockets, a broadcast fan-out Lambda, a per-IP cooldown, and a hard connection cap — the real-time serverless stack almost no portfolio actually ships, on its own subdomain so the main site's CSP never bends.
Edge link shortener at go.andruxa.dev
Short links for the job hunt — go.andruxa.dev/gh, /li, /imdb — resolved entirely at the CDN edge. A CloudFront Function reads a CloudFront KeyValueStore and returns the 302 itself: no Lambda, no database, no origin request, sub-millisecond. Everyone builds the Lambda + DynamoDB shortener; this one runs on the cheapest compute AWS sells and costs nothing at all.
Privacy-first analytics from CDN logs
Visitor analytics for andruxa.dev with no analytics script, no cookies, no consent banner and no third party — because the measurement happens at the CDN, not in your browser. CloudFront delivers partitioned Parquet to S3 with client IPs excluded at source, Athena aggregates it nightly, and a counts-only document feeds the /traffic/ page. The privacy claim is structural: there is no IP to leak because none is ever written.
Nightly Terraform drift detector
A scheduled plan that tells me when live AWS stops matching the committed code — running as a read-only role that physically cannot change anything. On its first real run it found four genuine bugs, including one where it reported 'clean' while the plan underneath said twenty-one resources had changed. The write-up is mostly about that: a detector that is green and wrong is worse than no detector.
Contact form + email security stack
A working contact form with no CAPTCHA, no third-party form service and no new CSP origin — plus the SPF, DKIM and DMARC configuration that makes mail from this domain provably mine. The interesting parts are SPF alignment (a default SES setup passes SPF while failing DMARC), choosing to stay in the sandbox on purpose, and the discovery that the address this site advertised for months could never receive mail at all.
Applying Terraform from CI, not from my laptop
The last hand-operated step in an otherwise fully automated platform was me running terraform apply on a Windows machine. That had already reverted production security hardening once, and it made the nightly drift detector measure my laptop instead of the infrastructure. This is the fix: a dispatch-only workflow, a fourth OIDC role broad enough to apply the whole stack, and the explicit-Deny guardrails that make handing that much power to CI defensible.
Multi-region serverless DR
A live API running in two regions over a DynamoDB Global Table, behind one DNS name that fails over automatically when a region dies and fails back when it recovers. Every response names the region that served it, so you can watch the failover happen. Measured: users move in 90 seconds — and the alarm telling me about it arrives three minutes later.
Event-driven order pipeline
A public demo you can actually use: submit an order and it runs a real pipeline — API Gateway, Lambda, DynamoDB Streams, SQS, a dead-letter queue and an EventBridge Pipe. It is also the project where the course's own architecture turned out to be broken, because a Pipe sharing a queue with a worker silently eats the worker's messages.
Three ways to survive a region failure — measured
DNS failover, anycast withdrawal and a blue/green listener swap, all built and timed against real traffic. Anycast moved regions in 25 seconds against DNS's 60–80, but a third of requests still failed while it noticed. The finding is that neither mechanism prevents the outage — both are bounded below by how fast they can detect one, and any RTO claim that ignores that window is wrong.
What a deploy actually costs in dropped requests
Blue/green and rolling deployments on one fleet, with a request loop running throughout. Both planned changes lost nothing. An abrupt instance termination lost 4% — and the difference is entirely deregistration. Also: 'instant rollback' isn't instant, and a rolling deploy serves two versions at once by definition.
DMS migrates rows, not databases
A MySQL migration to RDS that reported complete success and left the application unable to connect. Every row arrived. Zero users, grants, stored procedures or triggers did. Proven by killing the source database after cutover — which is the only way to know the cutover was real.
Proving a private service is actually private
Three isolated VPCs sharing one internal service over PrivateLink. Showing the consumers can reach it is the easy half — the claim worth testing is that they reach it while the provider has no internet gateway, no peering, and an address they cannot touch. Seven assertions, four of them negative. Also: the private instance couldn't install its own web server.
Four planted faults, found without reading the answer
A CloudFormation stack deliberately broken in four places, debugged live without opening the template. Worked outside-in as a diagnosis log — symptom, hypothesis, evidence, fix — then diffed against the template afterwards to check for both misses and false positives. Four found, zero invented.
The server answered 200. The client never saw it.
Security groups and network ACLs do different things, and the difference is usually explained rather than shown. Denying only outbound traffic to one address produced an Apache log line reading 200 55 while the client hung and timed out. The same rule in a security group does nothing at all. Ten tests across five phases, every result observed.
Path-based and host-based routing on one load balancer
Two instances, one load balancer, and the same fleet addressed two different ways — first by URL path, then by host header. Short project, but it's the vocabulary the deployment and troubleshooting work depends on, and the health-check detail is the part people get wrong.
Available for
cloud roles.
Reliability-first infrastructure, built with the same discipline as on set.