active AWS CloudOps

Fraud Detection AWS Platform

A fraud transaction scoring platform built on AWS with a Python worker running in private EC2 subnets — no SSH, no bastion, zero inbound exposure. Operator access is exclusively through SSM Session Manager over VPC Interface Endpoints. The processing pipeline runs SQS → EC2 → DynamoDB, provisioned by 11 single-responsibility Terraform modules and deployed via OIDC-based GitHub Actions CI/CD with no static credentials (a dual-role read-only-plan / admin-apply model scoped to exact OIDC sub claims, with terraform plan posted as a PR comment). Hardened AL2023 ARM64 Golden AMIs are produced by an EC2 Image Builder pipeline with a CIS baseline and an ARM64 validation gate before ASG rolling updates, and security/observability is wired through GuardDuty, AWS Backup, and EventBridge → SNS → Lambda → Slack alerting.

aws ec2 ssm terraform dynamodb sqs guardduty github-actions oidc golden-ami zero-trust

Architecture

A Python scoring worker runs in private EC2 subnets behind an Auto Scaling group, consuming from SQS and writing scored results to DynamoDB. There is no public ingress — operators reach instances only through SSM Session Manager over VPC Interface Endpoints. Hardened ARM64 Golden AMIs flow from an EC2 Image Builder pipeline with a CIS baseline and a validation gate before ASG rolling updates. GuardDuty, AWS Backup, and EventBridge → SNS → Lambda → Slack provide threat detection, recovery, and alerting.

Architecture Diagram Open full size ↗

Fraud Detection Platform AWS architecture: a Python worker in private EC2 subnets behind an Auto Scaling group consuming from SQS and writing to DynamoDB, SSM-only access over VPC Interface Endpoints, an EC2 Image Builder Golden AMI pipeline, GitHub Actions OIDC CI/CD, and GuardDuty / EventBridge / SNS / Lambda alerting.

Screenshots

Live console captures from the running platform.

EC2 console SSM Session Manager tab connected to a private instance — Operator access via SSM Session Manager — connected to a private instance, no SSH keys and no bastion.

VPC Endpoints list showing eight interface and gateway endpoints — Eight VPC endpoints (SSM, SQS, DynamoDB, S3, CloudWatch Logs…) keep the data path fully private.

Auto Scaling group with two healthy ARM64 instances in service — Auto Scaling group of ARM64 t4g.micro scoring workers — desired 2, all healthy.

EC2 Image Builder pipeline enabled and available — EC2 Image Builder pipeline producing hardened AL2023 ARM64 Golden AMIs.

IAM role with SSM managed policy and two scoped inline policies — Least-privilege IAM — the workload role carries AmazonSSMManagedInstanceCore plus two scoped inline policies.

Amazon Inspector resource coverage for EC2 instances — Amazon Inspector enabled for agent-based vulnerability scanning of the EC2 fleet.

GuardDuty summary dashboard with runtime monitoring — GuardDuty threat detection enabled across the account with runtime monitoring.

DynamoDB scan of the fraud-decisions table showing APPROVE and DENY scores — Fraud-decisions DynamoDB table — live APPROVE/DENY scores written by the scoring worker.

GitHub Actions workflow runs all passing — GitHub Actions CI/CD — Terraform validate, Checkov and tflint passing across 82 runs.

AWS FIS experiment completed terminating one EC2 instance — AWS FIS chaos experiment — terminate one EC2 worker; the ASG self-heals in under two minutes.

EventBridge event pattern rules for operational events — EventBridge rules routing operational events: backup-job-failed, break-glass-assumed, EC2 state change, KMS key deletion.

CloudWatch alarm on worker dead-letter-queue depth in alarm state — CloudWatch alarm on the worker dead-letter-queue depth, shown in its in-alarm state.

Slack cloudops-alerts channel receiving an alarm notification — Operational alerts delivered to the #cloudops-alerts Slack channel via EventBridge → SNS → Lambda.

AWS Budgets monthly cost budget capped at 100 dollars — AWS Budgets guardrail capping the environment at $100/month.

Operational Value

Problem Solved

Scores fraud transactions on infrastructure with zero inbound exposure and no static credentials anywhere in the delivery path.

✓ Zero inbound exposure — no SSH, no bastion; SSM-only operator access over VPC Interface Endpoints
✓ 11 single-responsibility Terraform modules with OIDC-based CI/CD (no static credentials)
✓ Hardened AL2023 ARM64 Golden AMIs gated by an ARM64 validation step before reaching the fleet
✓ HIGH/CRITICAL GuardDuty findings routed to Slack via EventBridge → SNS → Lambda

Cost Impact

AWS Budgets capped at $100/month

Reliability Impact

AWS Backup with a 7-day warm / 30-day cold KMS-encrypted vault

Detailed case study documentation is in progress. See the GitHub repository for implementation details and README.