feat: complete AWS CI/CD Pipeline Infrastructure for Bolt AI on AWS using Terraform

[gafitescu]

🚀 Add Complete AWS CI/CD Pipeline Infrastructure for Bolt AI

Overview

This PR introduces a comprehensive AWS CI/CD pipeline using Terraform to automate the build, deployment, and scaling of Bolt AI on AWS infrastructure. The pipeline leverages GitHub webhooks, CodeBuild, ECR, and ECS Fargate for a fully managed, scalable deployment solution.

🏗️ Infrastructure Resources Created

Core Infrastructure & Networking

• VPC: Main virtual private cloud (10.0.0.0/16) with DNS support
• Internet Gateway: Public internet access for resources
• Public Subnets: 2 subnets across availability zones for high availability
• Route Tables: Public routing configuration with IGW association
• Security Groups:
  • ALB security group (ports 80/443 ingress)
  • ECS tasks security group (port 5173 from ALB only)

Load Balancing & Traffic Management

• Application Load Balancer: Internet-facing ALB for traffic distribution
• Target Group: Health check configuration for ECS tasks (port 5173)
• Load Balancer Listener: HTTP traffic forwarding to target group

Container Registry & Storage

• ECR Repository: Private Docker image registry with vulnerability scanning

• ECR Lifecycle Policy: Automated cleanup (5 production, 3 development images)
• S3 Bucket: CodePipeline artifacts storage with versioning and encryption
• S3 Lifecycle Policy: 30-day artifact retention with 7-day version cleanup

Compute & Container Orchestration

• ECS Cluster: Fargate-based cluster with Container Insights enabled

• ECS Task Definition: Container specs (2048 CPU, 4096 MiB memory)

• ECS Service: Managed service with auto-scaling (2-10 instances)
• Auto Scaling: Target tracking policy based on CPU utilization (80% threshold)

CI/CD Pipeline

• CodeBuild Project: Docker build environment with ECR integration

• CodePipeline: 2-stage pipeline (Source from GitHub → Build & Deploy)

• GitHub Integration: OAuth-based source code integration

Security & Configuration Management

• IAM Roles:
  • ECS task execution role
  • ECS task role
  • CodeBuild service role
  • CodePipeline service role
• SSM Parameter Store: Secure storage for GitHub token, Docker credentials

• CloudWatch Log Group: Centralized logging for ECS tasks

Monitoring & Alerting

• CloudWatch Alarms:
  • High CPU utilization (>80%)
  • High memory utilization (>80%)
  • Unhealthy target detection
• SNS Topic: Alert notification system

🔄 CI/CD Pipeline Flow

1. Source Stage

• GitHub webhook triggers on commits to specified branch
• Source code pulled via OAuth token from GitHub repository
• Artifacts stored in S3 bucket for next stage

2. Build Stage

• CodeBuild project spins up build environment
• Docker Hub authentication using stored credentials
• ECR authentication for AWS registry access
• Multi-stage Docker build:
  • Base image: Node.js 20.18.0
  • Development target: bolt-ai-development
  • Production target: bolt-ai-production
• Image tagged and pushed to ECR repository

3. Deploy Stage

• ECS service automatically updated with new image
• Rolling deployment with zero-downtime
• Health checks ensure successful deployment
• Auto-scaling policies maintain desired capacity

Final result:

🛠️ Key Features

Multi-Environment Support

• Environment-specific configurations (dev/staging/prod)
• Configurable resource sizing and scaling parameters
• Environment-specific image tagging strategy

Security Best Practices

• Private subnets for ECS tasks with NAT gateway access
• Least privilege IAM policies
• Encrypted S3 storage and ECR repositories
• Secure credential management via Parameter Store

Cost Optimization

• Fargate Spot capacity providers for cost savings
• Automated resource cleanup via lifecycle policies
• Efficient Docker layer caching in CodeBuild

Monitoring & Observability

• Container Insights for ECS metrics
• CloudWatch alarms for proactive monitoring
• Centralized logging with configurable retention

📁 Files Added/Modified

• terraform.tf - Complete infrastructure as code
• terraform.tfvars.example - Configuration template
• buildspec.yml - CodeBuild build specification
• Dockerfile - Multi-stage container build

🚀 Deployment Instructions

1. Copy terraform.tfvars.example to terraform.tfvars
2. Fill in required credentials and configuration values
3. Run terraform init && terraform plan && terraform apply
4. Pipeline will automatically trigger on next GitHub commit

🔧 Configuration Options

• Scaling: Adjustable CPU/memory allocation and auto-scaling thresholds
• Networking: Configurable VPC CIDR and subnet allocation
• Storage: Customizable retention policies for logs and artifacts
• Monitoring: Configurable alarm thresholds and notification preferences

🎯 Benefits

• Fully Automated: Zero-touch deployments from code commit to production
• Highly Available: Multi-AZ deployment with automatic failover
• Scalable: Auto-scaling based on demand with cost optimization
• Secure: Defense-in-depth security with encrypted storage and network isolation
• Observable: Comprehensive monitoring and alerting capabilities

This infrastructure provides a production-ready foundation for Bolt AI with enterprise-grade reliability, security, and scalability.

[radumalica]

I suggest decoupling the big terraform.tf file into more files where you can have separate variables.tf, ecs.tf , versions.tf etc so it's easier to manage. there might be users who will want to use this as a module, so they can use later terragunt for deploying to various environments.