README
Enterprise IaC Scaffold
A structured Infrastructure as Code scaffold for enterprise AWS deployments, built on Terraform, Bitbucket Pipelines, and OPA policy governance.
Tools
| Tool | Version | License | Used In | Purpose |
|---|---|---|---|---|
| Terraform | 1.5.4+ | BSL 1.1 | Local, CI | Provisions and manages AWS infrastructure via declarative HCL |
| OPA | 0.68.2 | Apache-2.0 | Local, CI | Validates Terraform plans against Rego policies before apply |
| tflint | 0.62.1 | MPL-2.0 | Local, CI | Static analysis of Terraform code to catch errors before planning |
| terraform-docs | 0.24.0 | MIT | Local, CI | Generates module documentation from Terraform source |
| Python | 3.12+ | PSF | CI | Powers all pipeline scripts |
| PowerShell | 5.1+ | MIT | Local | Developer tooling and local workspace scripts |
Repository Layout
| Repository | Purpose |
|---|---|
iac-policies |
OPA Rego policy rules enforced across all infrastructure repositories. Versioned and released via git tags. |
iac-modules |
Reusable composite Terraform modules consumed by environments and platform stacks. |
iac-environments |
Workload infrastructure organized by environment. Each environment contains independently deployable Terraform units. |
iac-core |
Foundational AWS infrastructure — account management, networking, security, and archival. |
Pipeline Flows
iac-policies
PR opens → OPA policy tests → peer review → merge → publish bundle to Artifactory
iac-modules
PR opens → terraform fmt --check → tflint (advisory) → terraform-docs staleness check → peer review → merge → publish module to Artifactory
iac-environments
PR pipeline
PR opens → terraform init + fmt --check + validate → tflint (hard fail) → OPA policy evaluation (hard fail) → terraform plan saved to S3 → post plan summary to PR
Apply pipeline
Retrieve plan from S3 → terraform apply → post apply result to PR
iac-core
Same flow as iac-environments. Higher blast radius — stricter reviewer requirements.
Gates
| Repository | Merge Gate |
|---|---|
iac-policies |
PR approval by platform leads |
iac-modules |
PR approval by platform leads |
iac-environments |
PR approval + passing pipeline required |
iac-core |
PR approval + passing pipeline required |