In the cloud.
Deepening AWS infrastructure — IaC, observability, and cost-aware architecture, written up publicly as I go.
// PROJECT 001 — FEATURED
andruxa.dev — this site
Static portfolio hosted on AWS with Infrastructure as Code. Terraform-managed S3 + CloudFront + Route 53, with automated deploys via GitHub Actions OIDC — no long-lived credentials.
// OTHER PROJECTS
Observability + public status page
A synthetic canary probes the platform every 10 minutes from AWS, emits custom CloudWatch metrics, and publishes a rolling results feed that powers a public, self-updating status page — all same-origin, under the strict site CSP, for roughly zero dollars a month.
FinOps: live cost dashboard
A nightly Lambda pulls spend-by-service from AWS Cost Explorer in a single API call and publishes it same-origin, so the site can show — publicly and honestly — exactly what the platform costs to run each month. No database, no backfill: Cost Explorer's own 13-month history does the work.
Automated security scorecard
A daily read-only Lambda grades the AWS account and the live site against a fixed set of security controls — no IAM users, locked-down S3, no open security groups, the full header set, a healthy TLS cert — and publishes the graded result. Any check that flips from pass to fail pages the same SNS topic the canary uses.
Event-driven media pipeline
A stranger can drop an image and get resized, EXIF-stripped variants back in a couple of seconds — routed through a real S3 → SQS → Lambda pipeline with a presigned-upload path, per-IP abuse guards, and a dead-letter queue that catches malformed files. No servers; about zero dollars at rest.
Multi-region failover (DR)
The site bucket replicates to a second region, and CloudFront wraps both origins in a failover group. To prove it, I deleted the primary bucket's policy on purpose — andruxa.dev kept serving from the us-west-2 replica with zero downtime and sub-second failover. Here's what breaking us-east-1 on purpose actually looked like.
Ephemeral PR preview environments
Every pull request gets its own throwaway deploy of the site at demos.andruxa.dev/previews/pr-<N>/, posted as a comment, and torn down when the PR closes. The interesting part isn't the preview — it's that a PR-triggered job authenticates with a dedicated OIDC role that can touch only the previews/ prefix and nothing else, and that fork PRs can never assume it.
Public 'break my site' chaos button
A button on the site that lets any visitor take down the primary region on purpose — and watch andruxa.dev survive it. One press flips us-east-1 unhealthy, CloudFront fails over to the us-west-2 replica, and an independent dead-man switch heals the primary ~5 minutes later. My failover isn't a diagram; it's a button anyone on the internet can press. Here's how it stays safe.
Six Degrees of Me — filmography graph game
Type any actor and the site finds the shortest path from them to me through shared productions, Kevin-Bacon style, with posters at every hop. A build-time job walks TMDB credits outward from my real IMDb filmography into a graph in S3; a Lambda BFS-searches it at request time. Nobody else on earth can ship this page — it only works because the dataset is my own career.
place — a live collaborative pixel canvas
A shared 128x128 canvas anyone can draw on, live. Pick a colour, click a pixel, and everyone connected watches it appear in real time. r/place in miniature: API Gateway WebSockets, a broadcast fan-out Lambda, a per-IP cooldown, and a hard connection cap — the real-time serverless stack almost no portfolio actually ships, on its own subdomain so the main site's CSP never bends.
Edge link shortener at go.andruxa.dev
Short links for the job hunt — go.andruxa.dev/gh, /li, /imdb — resolved entirely at the CDN edge. A CloudFront Function reads a CloudFront KeyValueStore and returns the 302 itself: no Lambda, no database, no origin request, sub-millisecond. Everyone builds the Lambda + DynamoDB shortener; this one runs on the cheapest compute AWS sells and costs nothing at all.
Privacy-first analytics from CDN logs
Visitor analytics for andruxa.dev with no analytics script, no cookies, no consent banner and no third party — because the measurement happens at the CDN, not in your browser. CloudFront delivers partitioned Parquet to S3 with client IPs excluded at source, Athena aggregates it nightly, and a counts-only document feeds the /traffic/ page. The privacy claim is structural: there is no IP to leak because none is ever written.
Nightly Terraform drift detector
A scheduled plan that tells me when live AWS stops matching the committed code — running as a read-only role that physically cannot change anything. On its first real run it found four genuine bugs, including one where it reported 'clean' while the plan underneath said twenty-one resources had changed. The write-up is mostly about that: a detector that is green and wrong is worse than no detector.
Contact form + email security stack
A working contact form with no CAPTCHA, no third-party form service and no new CSP origin — plus the SPF, DKIM and DMARC configuration that makes mail from this domain provably mine. The interesting parts are SPF alignment (a default SES setup passes SPF while failing DMARC), choosing to stay in the sandbox on purpose, and the discovery that the address this site advertised for months could never receive mail at all.
Applying Terraform from CI, not from my laptop
The last hand-operated step in an otherwise fully automated platform was me running terraform apply on a Windows machine. That had already reverted production security hardening once, and it made the nightly drift detector measure my laptop instead of the infrastructure. This is the fix: a dispatch-only workflow, a fourth OIDC role broad enough to apply the whole stack, and the explicit-Deny guardrails that make handing that much power to CI defensible.
Available for
cloud roles.
Reliability-first infrastructure, built with the same discipline as on set.