DevOps & Infra
Dayonai
Sole DevOps Engineer — Built a SOC 2-Ready AWS Foundation from Scratch
- Role
- Sole DevOps engineer
- Timeline
- Greenfield build
- Team
- Supporting a 20-engineer org
- 20
- engineers supported
- 3
- identity platforms unified
- 3
- protected environments
- 100%
- Terraform-defined estate
The problem
A 20-engineer organization needed a cloud foundation built to withstand a SOC 2 audit from day one rather than retrofitted under deadline: centralized identity, least-privilege access that could be evidenced, network isolation, separated environments with controlled promotion, a durable audit trail, and the entire estate as code. There was no existing infrastructure — this was greenfield.
My approach
Identity & access management
Single sign-on across AWS, Google Workspace, and GitHub so access is granted and revoked centrally. Lambda functions on EventBridge schedules sync users between Google Workspace and the identity directory automatically.
Network & managed workstations
A VPC so internal services communicate without public internet exposure, with AWS WorkSpaces and centrally governed Group Policy Objects and Organizational Units.
Infrastructure as Code
The entire estate in Terraform — every control reviewable in a pull request and reproducible from scratch.
CI/CD & environment segregation
A complete GitHub Actions pipeline segregating Dev, Staging, and Production with protection rules. OIDC between GitHub and AWS eliminates long-lived cloud credentials; secrets live in AWS Secrets Manager.
Audit trail & database security
CloudTrail with S3 log delivery for a tamper-evident record; row-level security at the database layer; a reviewed migration workflow for schema changes.
System shape
Backend
Vercel
Data
AWS Secrets Manager
Infra
AWS IAM Identity Center, Amazon VPC, AWS Lambda, AWS CloudTrail, Terraform, GitHub Actions
Stack
Backend
- Vercel
Data
- AWS Secrets Manager
Infra
- AWS IAM Identity Center
- Amazon VPC
- AWS Lambda
- AWS CloudTrail
- Terraform
- GitHub Actions
Result
A greenfield, fully reproducible cloud estate built to SOC 2 expectations — centralized identity, network-isolated services, protected environments, credential-free CI/CD, a durable audit trail, and a documented onboarding path — all defined in Terraform.