DevOps & Infra
Dayonai
Sole DevOps Engineer: Built a SOC 2-Ready AWS Foundation from Scratch
- Role
- Sole DevOps engineer
- Timeline
- Greenfield build
- Team
- Supporting a 20-engineer org
- 20
- engineers supported
- 3
- identity platforms unified
- 3
- protected environments
- 100%
- Terraform-defined estate
The problem
A 20-engineer organization needed a cloud foundation built to withstand a SOC 2 audit from day one rather than retrofitted under deadline: centralized identity, least-privilege access that could be evidenced, network isolation, separated environments with controlled promotion, a durable audit trail, and the entire estate as code. There was no existing infrastructure; this was greenfield.
My approach
Identity & access management
Single sign-on across AWS, Google Workspace, and GitHub so access is granted and revoked centrally. Lambda functions on EventBridge schedules sync users between Google Workspace and the identity directory automatically.
Network & managed workstations
A VPC so internal services communicate without public internet exposure, with AWS WorkSpaces and centrally governed Group Policy Objects and Organizational Units.
Infrastructure as Code
The entire estate in Terraform, so every control is reviewable in a pull request and reproducible from scratch.
CI/CD & environment segregation
A complete GitHub Actions pipeline segregating Dev, Staging, and Production with protection rules. OIDC between GitHub and AWS eliminates long-lived cloud credentials; secrets live in AWS Secrets Manager.
Audit trail & database security
CloudTrail with S3 log delivery for a tamper-evident record; row-level security at the database layer; a reviewed migration workflow for schema changes.
System shape
Backend
Vercel
Data
AWS Secrets Manager
Infra
AWS IAM Identity Center, Amazon VPC, AWS Lambda, AWS CloudTrail, Terraform, GitHub Actions
Stack
Backend
- Vercel
Data
- AWS Secrets Manager
Infra
- AWS IAM Identity Center
- Amazon VPC
- AWS Lambda
- AWS CloudTrail
- Terraform
- GitHub Actions
Result
A greenfield, fully reproducible cloud estate built to SOC 2 expectations: centralized identity, network-isolated services, protected environments, credential-free CI/CD, a durable audit trail, and a documented onboarding path, all defined in Terraform.