{
  "markdown": "---\nlayout: \"default\"\nokf_version: \"0.1\"\ntype: \"Portal\"\ntitle: \"AWS 3-Tier Deployment for AI & Web Infra (with OpenTofu)\"\ntimestamp: 2026-08-22T08:15:00Z\ntopics: [\"aws\", \"cloud\", \"architecture\", \"readme\", \"vpc\", \"alb\", \"asg\", \"rds\", \"waf\", \"elasticache\", \"valkey\", \"jumphost\", \"bastion\", \"route53\", \"dns\", \"ssl\", \"disaster-recovery\", \"gitlab\", \"efs\", \"postgresql\", \"antigravity\", \"skills\", \"sovereignty\", \"compliance\", \"costing\"]\n---\n# AWS 3-Tier Deployment for AI & Web Infra (with OpenTofu)\n\nWelcome to the **AWS 3-Tier Deployment for AI & Web Infra** repository. This is an enterprise-grade, highly available, secure, and cost-optimized infrastructure project. It is natively deployed using **OpenTofu** and targeted at the **AWS Asia Pacific (Malaysia) region (`ap-southeast-5`)** with full support for Graviton (ARM64) compute, automated pre-baked AMIs, strict security architectures, Valkey-based session stores, and custom regional compliance solutions.\n\nThis file serves as a **comprehensive developer portal**, providing absolute alignment with our **GitHub Pages documentation site** and a complete index to our extensive technical guides, submodules, scripts, and deployment mechanisms.\n\n---\n\n## Technical Architecture Overview\n\nOur design is built on the **Zero-Trust Network Principle**, dividing components into distinct physical and logical layers:\n\n```\n                                [ INTERNET ]\n                                     │\n                                     ▼\n                               [ AWS WAFv2 ]   <-- (OWASP Top 10 + IP Rate Limiting)\n                                     │\n                                     ▼\n                       [ Application Load Balancer ]  <-- (Public Subnets)\n                                     │\n                       ┌─────────────┴─────────────┐\n                       ▼                           ▼\n                [ Frontend Nginx ]          [ Frontend Nginx ]  <-- (ASG EC2 Private Subnets)\n                       │                           │\n                       └─────────────┬─────────────┘\n                                     ▼\n                            [ ElasticCache Valkey ]     <-- (Session Caching Layer)\n                                     │\n                                     ▼\n                            [ Multi-AZ RDS PG ]         <-- (Isolated Database Subnets)\n```\n\n1. **Presentation / Web Tier (Public Subnets):**\n   - **Application Load Balancer (ALB):** Restricts incoming requests strictly to HTTP/HTTPS.\n   - **AWS WAFv2:** Filters regional requests, blocking OWASP Top-10 vulnerabilities, SQL injection attempts, and implementing active IP rate limits.\n2. **Application / Compute Tier (Private Subnets):**\n   - **Auto Scaling Groups (ASG):** Secure, isolated EC2 instances running hardened **Ubuntu 26.04 LTS** (Graviton ARM64 architecture). Direct SSH is disabled; systems are managed passwordlessly using **AWS Systems Manager (SSM)**.\n   - **Amazon ElastiCache for Valkey:** High-performance, secure, and license-compliant key-value cache layer configured for fast query/session operations.\n3. **Database Tier (Isolated Subnets):**\n   - **Multi-AZ RDS PostgreSQL:** Isolate data across multiple availability zones. Ingress is restricted exclusively to port 5432 originating from the compute tier.\n\n---\n\n## Repository Structure\n\n```\n.\n├── .github/\n│   └── workflows/\n│       ├── jekyll-gh-pages.yml   # Automates python document processing & Jekyll deploy\n│       └── opentofu.yml          # Format, lint, OIDC-based validation & deploy\n├── docs/                         # Jekyll Document System (Source of GitHub Pages Portal)\n│   ├── _layouts/                 # Jekyll theme responsive layouts\n│   ├── assets/                   # Centralized stylesheets (global.css)\n│   ├── modules/                  # Technical sub-specifications for every component\n│   └── *.md                      # Extensive engineering guide files\n├── scripts/                      # Operation and deployment utility scripts\n│   ├── deploy.sh                 # Coordinates OpenTofu linting, format, validate, and plans\n│   ├── destroy.sh                # Graceful deletion coordinator for provisioning\n│   ├── prepare_docs.py           # Pre-build Python processor prepending front-matter\n│   ├── simulate.sh               # Offline simulation runner & AST/Pytest validator\n│   └── user_data.sh              # Cloud-init bootstrapping script\n├── terraform/                    # Modularized Infrastructure as Code (IaC) configuration\n│   ├── modules/                  # Submodules encapsulating AWS resources\n│   │   ├── alb/                  # Load balancer target definitions\n│   │   ├── asg/                  # Launch templates & dynamic scaling rules\n│   │   ├── elasticache/          # Valkey cluster configuration\n│   │   ├── jumphost/             # Cyberjaya whitelisted SSH Bastion setup\n│   │   ├── rds/                  # Highly available Postgres instance configuration\n│   │   ├── route53/              # Dynamic records mapping DNS values\n│   │   ├── security_groups/      # Strict port security definitions\n│   │   ├── standalone_ec2/       # Pre-bake AMI dev / test environments\n│   │   └── vpc/                  # Multi-AZ subnet allocation structures\n│   ├── main.tf                   # Core OpenTofu file mapping variables and submodules\n│   ├── outputs.tf                # Global stack endpoints outputs\n│   ├── providers.tf              # Declarative block specifying AWS, TLS, Random, etc.\n│   ├── variables.tf              # Fully typed input variables\n│   └── terraform.tfvars.example  # Production template environment configurations\n├── .agents/                      # AI Agent Operating Laws and Spatial Memory\n│   ├── brain/                    # Persistent Agent Spatial Memory\n│   │   └── active_context_manifest.md # Active session checkpoint summaries\n│   ├── skills/                   # Specific procedurial skills\n│   │   └── jules-knowledge/SKILL.md # Compiled Google Jules engineering skill\n│   └── AGENTS.md                 # Sovereign Constitution & Agent Rulebook (Rule 29)\n├── README.md                     # Central documentation index portal (this file)\n├── AGENTS.md                     # Root Gateway file redirecting to .agents/AGENTS.md\n├── llms.txt                      # AI-optimized plain text directory pointing to resources\n├── HISTORY.md                    # Rich project narrative detailing the timeline from Day 0\n└── CHANGELOG.md                  # Semantic version history detailing milestones to v1.0.0\n```\n\n---\n\n## Documentation Portal Index\n\nOur comprehensive documentation is compiled, auto-formatted, and deployed directly via **GitHub Pages**. Use the catalog below to navigate to specific sections:\n\n### 1. Conceptual Alignment & Architecture\n* **[Start Here: Pragmatic Onboarding & Execution Standard](START-HERE.md):** Dual-audience onboarding standard for Human Engineers and Autonomous AI Agents (Diátaxis \"learn-by-doing\" ethos).\n* **[AWS Phased Adoption Roadmap & Costing Guide](docs/aws-adoption-roadmap.md):** Multi-year week-by-week and month-by-month AWS service growth plan mapped from the project Gantt chart.\n* **[Developer Design Alignment](docs/developer-design-mapping.md):** Architectural breakdown mapping fragile legacy single-VM developer architectures into enterprise-level highly available managed services.\n* **[Separation of Concerns](docs/asg-separation-of-concern.md):** Guidelines for implementing stateless ASG layers, session persistence, and comparative analysis of S3 vs. Amazon EFS.\n* **[System Architecture Details](docs/architecture.md):** Comprehensive breakdown of VPC subnetting, route tables, and Multi-AZ network architecture configurations.\n* **[OpenTofu Migration Guide](docs/opentofu-migration.md):** Migration patterns, state management comparisons, and CLI syntax transitions between legacy Terraform and OpenTofu.\n* **[Google Antigravity Skills Guide](docs/antigravity-skills.md):** Unified standard outlining how to deploy workspace-specific skills and bridge the knowledge-bases of Google Jules and Google Antigravity.\n* **[SOP: Knowledge-First Discovery](docs/SOP-KNOWLEDGE-FIRST-DISCOVERY.md):** Standard Operating Procedure outlining how AI agents perform local documentation search before probing remote targets.\n* **[Technology Stack Comparison](docs/tech-stack-comparison.md):** Architectural mapping and AWS-native options guide for the developer's containerized and external system dependencies.\n* **[Redis vs. Valkey Comparison](docs/redis-vs-valkey.md):** Strategic, licensing, and costing comparison (Baseline vs. High-Performance) of Redis OSS vs. Valkey on AWS and on-premises.\n* **[Software Licensing & Technology Risk Register (TS/MC Series)](docs/licensing-risks.md):** Complete software licensing compliance framework, technology risk registry, and mitigation plans (TS/MC Series) covering LangChain4j, self-hosted operations, Bedrock with Qwen3 models, and standalone Wazuh SIEM.\n* **[Strategic Comparative Review](docs/aws-vs-self-hosted-review.md):** Comprehensive strategic analysis and financial TCO comparison of an AWS-Native Managed Platform against a Self-Hosted / On-Premises Custom Stack in Malaysia.\n* **[Load Testing Assumptions & Sizing Guide](docs/load-test-assumptions.md):** Workload definitions, SLA metrics, architectural performance assumptions, and multi-VU sizing models from 100 to 10,000 VUs.\n* **[Context7 AI Chat Integration Guide](docs/context7.md):** Detailed guide explaining our floating AI chat widget, how to use it, and background information about Context7 and its provider Upstash.\n* **[Security Posture Assessment (SPA) Checklist](docs/audits/security-posture-assessment.md):** Comprehensive security control audit checklist, fully customized for our Java, Spring Boot, PostgreSQL, Valkey, and RAGFlow/Langfuse AI infrastructure.\n* **[Legal Notice & Disclaimer](docs/legal-notice.md):** Comprehensive policy statement and disclaimer detailing our project assumptions and liability exclusions.\n* **[Output of ASIMP](docs/audits/asimp-output.md):** Example execution output, report format, and baseline metrics generated by ASIMP.\n* **[Output of Lynis](docs/audits/lynis-output.md):** High-fidelity example of the Lynis host auditing utility scanning logs, attributes, and suggestions.\n* **[Output of OpenSCAP](docs/audits/openscap-output.md):** Detailed example of OpenSCAP CIS Level 2 scan evaluation rules, results, and generated remediations.\n* **[AWS Services vs. On-Premises Open-Source Stack Comparison](docs/aws-vs-onprem-stack-comparison.md):** Comprehensive 12-layer comparison guide mapping AWS services to self-hosted equivalents.\n* **[Google Jules AI Platform Guide](docs/jules-platform-guide.md):** Comprehensive technical showcase documenting our end-to-end development workflow, PR review collaboration, DSOM governance, and Google Antigravity integration.\n* **[OpenTofu AWS Simulation & Multi-Agent Collaboration Runbook](docs/engineering/opentofu_aws_simulation.md):** Comprehensive runbook detailing offline AWS deployment simulations, unit testing matrices, static HCL AST analysis, and multi-agent/multi-human branch/PR workflows.\n* **[Big Data Analytics Lakehouse Architecture](docs/bda-lakehouse-architecture.md):** Modernizing Big Data Analytics into a 100% open-source Lakehouse with S3 WORM Object Lock, Iceberg, Polaris, Trino, Spark/Sedona, MCP AI quarantine sandboxing, and 3 distinct infrastructure solution blueprints (Cloud, Hybrid, On-Prem Proxmox/RKE2/Ceph).\n\n### 2. Infrastructure Submodules\n* **[VPC Networking](docs/modules/vpc.md):** Dynamic subnetting allocation, NAT Gateway patterns, and Route Table linkages.\n* **[Security Groups Firewall](docs/modules/security_groups.md):** Zero-Trust ingress/egress rules and port-level component isolation.\n* **[WAF Protection](docs/modules/waf.md):** Layer-7 Web Application Firewall settings, custom rulesets, and IP rate limits.\n* **[ALB Target Routing](docs/modules/alb.md):** Target groups routing rules, SSL termination, and endpoint configurations.\n* **[ASG Compute Clusters](docs/asg-separation-of-concern.md):** Launch templates, scaling definitions, and automatic ARM64 Graviton architecture detection.\n* **[RDS Multi-AZ PostgreSQL](docs/modules/rds.md):** Database clustering, parameter group optimization, and storage encryption details.\n* **[ElastiCache Valkey](docs/modules/elasticache.md):** Ultra-fast caching cluster parameters and cost considerations.\n* **[Jumphost (SSH Bastion)](docs/modules/jumphost.md):** Secured entrypoints mapping whitelisted Cyberjaya developer offices to downstream resources.\n* **[Standalone EC2 Environments](docs/modules/standalone_ec2.md):** Dedicated testing/development servers mimicking identical RDS/S3 linkages.\n\n### 3. Advanced Operational Guides\n* **[Disaster Recovery & Sovereignty](docs/dr-options.md):** High-availability failover guidelines, AWS Elastic Disaster Recovery (AWS DRS) Strategy modeling, and Malaysian PDPA compliance pathways.\n* **[PostgreSQL Database Comparison](docs/postgresql-comparison.md):** Managed RDS PostgreSQL 17 Multi-AZ vs. self-installed Percona PostgreSQL 17 on EC2 (comparing Patroni/PgBouncer, telemetry, and local costs).\n* **[Secure Bastion & Jumphost Operations](docs/jumphost.md):** Manual detailing secure client key configurations, Windows/macOS connection commands, and ASIMP-hardened operating parameters.\n* **[Hybrid Cloud Connections](docs/hybrid-onprem.md):** Evaluation comparing high-cost VPN/Direct Connect with modern cost-optimized API-driven and MCP-proxy integration styles.\n* **[AMI Hardening Compliance](docs/ami-design.md):** Pre-baked Ubuntu 26.04 LTS AMIs using Packer, Ansible, and the ASIMP security hardening framework.\n* **[GitLab CI/CD & Persistent EFS Storage](docs/gitlab-efs-cicd.md):** GitLab pipeline automation mounting EFS, tuning performance with `open_file_cache`, and managing dynamic Nginx paths.\n* **[Route 53 & Dynamic DNS Troubleshooting](docs/route53.md):** Domain names matching, certificate auto-validation, and extensive research on ASG dynamic resolver cache issues.\n* **[Wazuh Standalone Cloud Installation & Costing](docs/wazuh.md):** Architectural guide outlining the cheapest standalone Wazuh cloud deployment strategies, security whitelisting, and isolated USD/MYR costing plans.\n* **[Wazuh SIEM & XDR Deep-Dive Guide](docs/wazuh-detailed.md):** In-depth functional breakdown of Wazuh SIEM & XDR capabilities, deployment modes (cloud/on-prem), and critical operational guidance regarding Antivirus coexistence, passive mode configuration, and Windows Defender integration.\n\n### 4. Financial Cost Estimations\n* **[Cost Analysis Guide](docs/costing.md):** Comprehensive price modeling in USD and MYR tailored for the `ap-southeast-5` (Malaysia) region. Includes:\n  - **Baseline Cost-Optimized Plan (~$426.75 USD/mo):** Budget-oriented layout leveraging shared instances, Valkey caching, and single NAT routing.\n  - **High-Performance Enterprise Plan (~$1,064.46 USD/mo):** High-availability layout leveraging multi-NAT, large compute families, and extensive backup limits.\n\n---\n\n## Getting Started\n\n### Prerequisites\n* Linux OS (Ubuntu, Debian, RHEL, Fedora, Arch, Amazon Linux) or macOS with bash environment.\n* [OpenTofu](https://opentofu.org/downloads.html) >= 1.6.0 installed on your local control node (optional for offline simulation testing).\n* [AWS CLI](https://aws.amazon.com/cli/) configured with a least-privilege deployment role targeted to `ap-southeast-5` covering only declared VPC, EC2, IAM, RDS, ElastiCache, ALB, WAF, and Route 53 operations (with narrowly scoped `iam:PassRole` permissions for instance profiles required by `scripts/deploy.sh`). Role credentials must be validated (`aws sts get-caller-identity`) prior to deployment.\n* Python >= 3.10 & Pytest (to run build/prepare and simulation automation).\n\n### Local Execution Pipeline on Any Linux System\n1. **Initialize & Sync Repository:**\n   ```bash\n   git clone https://github.com/songketmail/aws-3tier-deployment-for-ai-infra.git\n   cd aws-3tier-deployment-for-ai-infra\n   ```\n2. **Setup Environment Variables & Remote State:**\n   ```bash\n   cp terraform/terraform.tfvars.example terraform/terraform.tfvars\n   ```\n   *Edit the tfvars configuration with protected credentials and office IP ranges (`*.tfvars` is gitignored). Prior to live deployment, operators must configure an encrypted, access-controlled remote state backend (S3 bucket with SSE-KMS encryption and DynamoDB state locking as declared in `terraform/providers.tf`), as local state files (`terraform.tfstate`) retain sensitive database credentials in plaintext.*\n3. **Execute Offline Simulation Test Suite:**\n   Run the offline simulation runner to test OpenTofu code and any newly added scripts without AWS credentials:\n   ```bash\n   ./scripts/simulate.sh\n   ```\n4. **Execute Automated Deployment Script:**\n   The `scripts/deploy.sh` handles linting, auto-formatting, syntax validation, and displays proposed AWS resource creation:\n   ```bash\n   ./scripts/deploy.sh\n   ```\n5. **Teardown Clean-up:**\n   To safely remove and de-provision AWS resources:\n   ```bash\n   ./scripts/destroy.sh\n   ```\n\n---\n\n## CI/CD Deployment with GitHub Actions\n\nThe repository integrates a secure deployment pipeline in `.github/workflows/opentofu.yml` utilizing **AWS OIDC (OpenID Connect)**.\n\n### Pipeline Features\n* **Conditional Triggers:** OpenTofu plan/apply executions are dynamically bypassed in fork pull-requests where AWS secrets are restricted. This avoids standard deployment failures while maintaining full local verification.\n* **Jekyll Compilation Pages:** The `.github/workflows/jekyll-gh-pages.yml` automatically executes the `scripts/prepare_docs.py` before building and publishing our responsive documentation portal.\n\n---\n\n## Contact & Maintenance\n\nFor questions regarding development parameters, AMI baking steps, or local security policies, consult [AGENTS.md](AGENTS.md) or open an issue on the centralized repository.\n",
  "bytes": 18030,
  "sha": "e0005ccdb079d3e37f704fb40fe9b3847431093d5af3663d45729af026702032",
  "repo_slug": "songketmail/aws-3tier-deployment-for-ai-infra",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/okf_songketmail_aws_3tier_deployment_for_ai__415e2631/readme"
}