DEV Community: Tej Tandel

How I Built My AWS Cloud Resume Challenge — A Complete Walkthrough

Tej Tandel — Fri, 31 Jul 2026 13:32:56 +0000

How I Built My AWS Cloud Resume Challenge 🚀

The Cloud Resume Challenge by Forrest Brazeal is one of the best hands-on projects for cloud engineers. Instead of just reading AWS docs, you build something real — a resume website with a serverless backend, all deployed through CI/CD pipelines. Here's exactly how I built mine.

Live site: tejtandel.com
Frontend repo: aws-cloud-resume-challenge
Infra repo: aws-cloud-resume-challenge-infra

Architecture Overview

Here's the full picture of what I built:

Browser → CloudFront (CDN + HTTPS)
              ↓
         S3 Bucket (Static Website Hosting)
              ↓
       JavaScript fetch()
              ↓
       API Gateway (HTTP API)
              ↓
       Lambda Function (Python 3.12)
              ↓
       DynamoDB (Visitor Counter)

I split the project into two repositories following IaC best practices:

Frontend repo — HTML/CSS/JS resume files + GitHub Actions to auto-deploy to S3
Infrastructure repo — Terraform code for all backend AWS resources + GitHub Actions to auto-apply

Part 1: The Frontend

The frontend is a clean HTML/CSS/JavaScript resume page — no frameworks, no build step. I kept it intentionally simple so the cloud infrastructure is the star of the show.

File Structure

frontend/
├── index.html
├── style.css
├── script.js
├── Profile_Picture.jpg
└── Resume.pdf

The Visitor Counter (JavaScript)

The coolest part of the frontend is the live visitor counter. On every page load, script.js makes an async call to the backend API:

async function updateVisitorCount() {
  const el = document.getElementById('counter');
  if (!el) return;
  try {
    const res = await fetch('https://api-gateway/visitorcounter', {
      method: 'GET',
      headers: { 'Content-Type': 'application/json' }
    });
    if (res.ok) {
      const data = await res.json();
      el.textContent = (data && data.visitorcounter) ? data.visitorcounter.toLocaleString() : 'N/A';
    }
  } catch (err) {
    console.error('Visitor counter error:', err);
    el.textContent = 'N/A';
  }
}
document.addEventListener('DOMContentLoaded', updateVisitorCount);

This calls the API Gateway endpoint, which triggers Lambda, which increments and returns the DynamoDB counter.

Part 2: Frontend CI/CD with GitHub Actions

Every time I push a change to the frontend/ folder, GitHub Actions automatically:

Syncs all files to the S3 bucket
Invalidates the CloudFront cache so visitors get fresh content instantly

.github/workflows/deploy-frontend.yml:

name: Deploy Frontend to S3

on:
  push:
    branches: [ main ]
    paths: [ 'frontend/**' ]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ secrets.AWS_REGION }}

    - name: Sync files to S3
      run: |
        aws s3 sync frontend/ s3://${{ secrets.S3_BUCKET_NAME }} --delete

    - name: Invalidate CloudFront
      run: |
        aws cloudfront create-invalidation \
          --distribution-id ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }} \
          --paths "/*"

The paths: ['frontend/**'] filter means this workflow only fires when frontend files change — infra changes don't trigger a pointless frontend deploy.

GitHub Secrets Required

Secret	Description
`AWS_ACCESS_KEY_ID`	IAM user access key
`AWS_SECRET_ACCESS_KEY`	IAM user secret key
`AWS_REGION`	e.g. `us-east-1`
`S3_BUCKET_NAME`	The S3 bucket name
`CLOUDFRONT_DISTRIBUTION_ID`	CloudFront distribution ID

Part 3: The Backend Infrastructure (Terraform)

The backend lives in a separate repo and is 100% managed by Terraform. No manual clicking in the AWS console — every resource is code.

What Terraform Provisions

Here's a summary of everything Terraform creates:

Resource	Purpose
`aws_lambda_function`	Python 3.12 visitor counter function
`aws_iam_role`	Lambda execution role
`aws_iam_policy`	DynamoDB GetItem + UpdateItem permissions
`aws_dynamodb_table`	PAY_PER_REQUEST table to store the counter
`aws_apigatewayv2_api`	HTTP API with CORS for `tejtandel.com`
`aws_apigatewayv2_integration`	Connects API Gateway to Lambda (AWS_PROXY)
`aws_apigatewayv2_route`	`GET /visitorcounter` route
`aws_apigatewayv2_stage`	`prod` stage with auto-deploy
`aws_lambda_permission`	Allows API Gateway to invoke Lambda

The Lambda Function (Python 3.12)

import boto3
import json
from botocore.exceptions import ClientError

dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('visitor-counter')

def lambda_handler(event, context):
    try:
        response = table.update_item(
            Key={'id': 'visitorcounter'},
            UpdateExpression='ADD #c :inc',
            ExpressionAttributeNames={'#c': 'count'},
            ExpressionAttributeValues={':inc': 1},
            ReturnValues='UPDATED_NEW'
        )
        return {
            'statusCode': 200,
            'headers': {
                'Access-Control-Allow-Origin': '*',
                'Access-Control-Allow-Methods': 'GET',
                'Access-Control-Allow-Headers': 'Content-Type'
            },
            'body': json.dumps({'visitorcounter': int(response['Attributes']['count'])})
        }
    except ClientError as e:
        return {'statusCode': 500, 'body': json.dumps({'error': 'Database operation failed'})}

The key operation is ADD #c :inc on the DynamoDB item — this atomically increments the counter by 1 and returns the new value in a single API call.

Terraform File Structure

infra/
├── main.tf          # All AWS resources
├── provider.tf      # AWS provider + S3 backend config
├── variables.tf     # Variable definitions
├── outputs.tf       # Output values (API URL, etc.)
└── lambda/
    └── lambda_function.py

The Lambda code is zipped by Terraform using archive_file data source:

data "archive_file" "zip" {
  type        = "zip"
  source_dir  = "${path.module}/./lambda/"
  output_path = "${path.module}/visitor-counter-lambdafn.zip"
}

This means you don't need any external tooling — Terraform handles packaging the Lambda on every apply.

Part 4: Infrastructure CI/CD with GitHub Actions

The infra repo has two workflows:

Deploy Infrastructure

Triggers automatically when .tf files or the Lambda code changes:

name: Deploy Infrastructure
on:
  push:
    branches: [ main ]
    paths: [ 'infra/*.tf', 'infra/lambda/**' ]
  workflow_dispatch:

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: hashicorp/setup-terraform@v3
      with:
        terraform_version: 1.5.0
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ secrets.AWS_REGION }}
    - name: Terraform Init
      working-directory: infra
      run: terraform init -reconfigure -backend-config="bucket=terraform-state-bucket"
    - name: Terraform Format
      working-directory: infra
      run: terraform fmt
    - name: Terraform Plan
      working-directory: infra
      run: terraform plan
    - name: Terraform Apply
      working-directory: infra
      run: terraform apply -auto-approve

Terraform state is stored remotely in an S3 bucket (terraform-state-bucket), making it safe for CI/CD pipelines.

Destroy Infrastructure

A manually-triggered workflow_dispatch workflow runs terraform destroy -auto-approve — useful for tearing everything down to avoid costs when not needed.

Part 5: AWS Services Summary

Service	Role
S3	Hosts the static resume website files
CloudFront	CDN, HTTPS termination, global edge caching
Route 53	Custom domain DNS (`tejtandel.com`)
ACM	Free SSL/TLS certificate
API Gateway	HTTP API endpoint for the visitor counter
Lambda	Serverless function (Python 3.12)
DynamoDB	NoSQL database for the counter (PAY_PER_REQUEST)
IAM	Least-privilege roles and policies
S3 (Terraform State)	Remote state storage for Terraform

Key Lessons Learned

1. Separate your frontend and infra repos. It makes CI/CD pipelines simpler — each repo only deploys what it owns.

2. Use path filters in GitHub Actions. Without paths: ['frontend/**'], every commit to any file would trigger a frontend deploy.

3. Terraform remote state is essential for CI/CD. Local state files don't work in GitHub Actions runners — always use an S3 backend.

4. CORS must be configured in two places. I set CORS in both the API Gateway resource in Terraform and in the Lambda response headers to be safe.

5. DynamoDB PAY_PER_REQUEST is perfect here. A resume visitor counter has completely unpredictable traffic — on-demand billing means you pay only for the requests you get, which is pennies per month.

Deploy a Secure EC2 Web Server with Terraform, Multi-AZ, and Remote State on AWS

Tej Tandel — Tue, 17 Jun 2025 21:55:41 +0000

Deploy a Secure EC2 Web Server with Terraform, VPC, and Remote State on AWS

Are you looking to automate your AWS infrastructure and deploy a web server with best practices? In this guide, you'll learn how to use Terraform to:

Provision a secure VPC with public/private subnets
Launch an EC2 instance running Apache with a sample website
Manage SSH keys and security groups
Store your Terraform state remotely in S3 for safety and collaboration

Let's get started!

What Does This Project Do?

Creates a VPC with public and private subnets across multiple Availability Zones
Sets up an Internet Gateway and routing for public subnets
Launches an EC2 instance in a public subnet
Configures a Security Group for SSH and HTTP access
Manages SSH Key Pairs for secure access
Provisions Apache Web Server with a sample website using a shell script
Stores Terraform state remotely in an S3 bucket for collaboration and safety

Prerequisites

Terraform installed
AWS CLI installed and configured (aws configure)
An AWS account with permissions to create EC2, VPC, and S3 resources

File Overview

Provider.tf: AWS provider configuration
vpc.tf: VPC, subnets, internet gateway, and route tables
Instance.tf: EC2 instance definition and provisioning
KeyPair.tf: SSH key pair resource
SecurityGroup.tf: Security group for SSH/HTTP access
vars.tf: Variables for region, AMI, zones, etc.
backend.tf: Remote state backend (S3)
web.sh: Script to install Apache and deploy a sample website
.gitignore: Ignore sensitive files and Terraform state
terraform-vpc-ssh-key / .pub: SSH keys (do not commit private key!)

Quick Start

# 1. Clone the repo
git clone https://github.com/tej6667/terraform-aws-vpc-ec2-webserver.git

# 2. Initialize Terraform
terraform init

# 3. Review the plan
terraform plan

# 4. Apply the configuration
terraform apply
# Type 'yes' when prompted

# 5. Destroy resources when done
terraform destroy
# Type 'yes' when prompted

Customization

Region & Zones: Edit vars.tf for your preferred AWS region and availability zones.
AMI: Update the amiID map in vars.tf for your region.
Security Group: Change allowed IPs in SecurityGroup.tf.
S3 Backend: Set your S3 bucket name in backend.tf.
SSH Key: Replace with your own key in KeyPair.tf and upload your public key.

Notes & Best Practices

Never commit AWS credentials or private keys.
Review security group rules before applying.
Remote state in S3 is critical for team collaboration and disaster recovery.
Remember to destroy resources to avoid AWS charges.

Learn More

Questions?

Drop a comment below or check out the GitHub repo for more details!

"Automate EC2 Web Server Deployment on AWS with Terraform and Remote S3 State: true

Tej Tandel — Tue, 17 Jun 2025 21:11:30 +0000

Automate EC2 Web Server Deployment on AWS with Terraform and Remote S3 State

Managing infrastructure manually is error-prone and inefficient. In this project, I use Terraform to automate the provisioning of an EC2 instance that serves a static website — with terraform state pushed to S3.

What This Project Does

This Terraform project sets up:

An EC2 instance
Security Group allowing HTTP & SSH
User-data to install and serve a website
S3 bucket for Terraform state storage
IAM Role & Policy for EC2 access to S3

Step-by-Step Breakdown

1. Initialize AWS Provider

provider "aws" {
  region = "us-east-1"
}

2. Create S3 Bucket

resource "aws_s3_bucket" "web_backup" {
  bucket = var.bucket_name
}

Used to store Terraform state.

3. Security Group

resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Allow HTTP and SSH"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["your-ip/32"]
  }

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

4. Launch EC2 Instance + User Data Script

resource "aws_instance" "web_server" {
  ami                    = var.ami
  instance_type          = var.instance_type
  key_name               = var.key_name
  security_groups        = [aws_security_group.web_sg.name]
  user_data              = file("web_install.sh")
  iam_instance_profile   = aws_iam_instance_profile.s3_profile.name
}

The web_install.sh script:

Installs Apache
Deploys static site from website/ directory
Uploads a backup to S3 using AWS CLI

5. IAM Role to Access S3

resource "aws_iam_role_policy" "s3_access" {
  name = "s3-access-policy"
  role = aws_iam_role.ec2_role.name

  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Action   = ["s3:PutObject"],
      Effect   = "Allow",
      Resource = "arn:aws:s3:::${var.bucket_name}/*"
    }]
  })
}

This gives the EC2 instance permission to upload files to your bucket.

How to Deploy

Run the following commands:

terraform init
terraform plan
terraform apply

After deployment, Terraform will output:

Public IP of the EC2 instance
S3 bucket name
Live website hosted on EC2 (via Apache)

What I Learned

Terraform resource structuring for real-world infrastructure
Using user-data to bootstrap EC2 after provisioning
Connecting EC2 and S3 securely with IAM
Uploading backups automatically to S3
Practical usage of AWS CLI in automation scripts

Git Repository

https://github.com/tej6667/terraform-ec2-web-s3

Clone it, customize it, and deploy your own cloud-hosted website in minutes.

About Me

I'm Tej Tandel, a Cloud & DevOps enthusiast building hands-on AWS projects and sharing my journey.

Let’s build the cloud — one project at a time ☁️