I whipped everything up yesterday in Terraform. Going to do some initial failover testing for the session state and other DBs. I'll be serving it out of US-East-1 (Ashburn, VA) to start, but will regionalize East/West for faster load times.
terraform/
├── providers.tf — AWS provider + S3 backend config
├── variables.tf — All input variables
├── main.tf — Root module wiring all modules together
├── outputs.tf — Key endpoint/ID outputs
├── terraform.tfvars.example
└── modules/
├── networking/ — VPC, 3-AZ public/private/DB subnets, NAT GWs, VPC endpoints
├── secrets/ — Secrets Manager (DB password autogen, Stripe keys)
├── aurora/ — PostgreSQL Serverless v2, writer + reader instances
├── redis/ — ElastiCache Redis 7 (TLS encrypted)
├── opensearch/ — t3.small domain, VPC-private, fine-grained access control
├── s3_cloudfront/ — Frontend bucket, raw-uploads, processed-photos, CloudFront dist
├── lambda/ — Photo processor (S3 trigger, placeholder zip, VPC)
├── cognito/ — User Pool (email/MFA), App Client, Identity Pool (S3 upload scope)
├── ses/ — Domain identity, DKIM/SPF/DMARC records, config set
├── route53/ — Hosted zone, apex/www/api records, ACM certs
├── ecs/ — Cluster, Fargate task def, ALB, autoscaling (CPU+memory), ECS Exec
├── waf/ — Regional WAF (ALB) + CloudFront WAF, rate limits on API + auth
├── security/ — GuardDuty, AWS Config, Security Hub (CIS + Foundational standards)
└── monitoring/ — CloudWatch alarms (ECS/ALB/Aurora/Redis), dashboard, SNS alerts