Open-source — Deploy-ready
Cloud-native
Terraform
Patterns.
A curated library of fully-baked infrastructure patterns.
Modify variables, not modules. Deploy in minutes, expand as needed.
Open source · AWS-native · Multi-region ready
Patterns
Production-ready infrastructure, organized as reusable Terraform modules.
01
Serverless
No servers to provision. Lambda scales to zero between requests — ideal for variable traffic.
02
Multi-Region
Primary in us-east-1, DR in us-west-2. CloudFront origin groups fail over automatically on 5xx.
03
SSL & DNS
ACM certificates provisioned and renewed automatically. Route53 records managed by Terraform.
04
Infrastructure as Code
One Terraform module. Pass four variables, get a production-grade SSR platform.
Built with
- Nuxt 3
- AWS Lambda
- CloudFront
- DynamoDB
- Terraform
- GitHub Actions
01
No Static Keys
Eliminate long-lived AWS credentials. Use short-lived tokens issued via OIDC for secure authentication.
02
Scoped IAM Roles
Fine-grained permission boundaries. Each workload gets exactly the permissions it needs, nothing more.
03
GitHub Integration
Native GitHub Actions support. Authenticate workflows to AWS without storing secrets in GitHub.
04
Identity Provider
Complete OIDC identity provider setup with customizable claims and audience validation.
Built with
- AWS IAM
- OIDC
- GitHub Actions
- Terraform
- Certificate-based Auth
01
Email-First Defaults
Required and auto-verified email schema by default to reduce per-app Cognito drift.
02
Auth Flow Ready
App client ships with password, SRP, and refresh flows enabled for SSR/API backends.
03
Lambda Env Outputs
Exports `lambda_env_vars` so SSR/API Lambdas can consume pool ID, client ID, and region directly.
04
Configurable Security
MFA mode, password policy, and token validity are configurable without rewriting Cognito resources.
Built with
- Amazon Cognito
- JWT
- Lambda
- Terraform
- OIDC-Friendly Auth
01
VCS-Driven
Automatically trigger runs on git push. Branch-based workflows for dev, staging, and production.
02
Dynamic Credentials
Optional OIDC integration. Each workspace authenticates with short-lived, scoped credentials.
03
Team Management
Pre-configured team access patterns. Control who can plan vs apply with simple variables.
04
Notification Channels
Slack/Teams integration built-in. Get notified of runs, failures, and cost estimates.
Built with
- Terraform Cloud
- GitHub
- OIDC
- Slack
- Teams
01
Cognito Auth
Built-in Cognito integration. JWT validation, user pools, and fine-grained field-level authorization.
02
Flexible Data Sources
DynamoDB for persistence, Lambda for business logic. Choose the right tool for each resolver.
03
X-Ray Tracing
End-to-end request tracing. Debug performance bottlenecks across your entire API stack.
04
Subscriptions
Real-time WebSocket subscriptions out of the box. No additional infrastructure needed.
Built with
- AWS AppSync
- GraphQL
- Cognito
- DynamoDB
- Lambda
- X-Ray
01
Shared Foundation
A standalone bus layer for multi-service architectures. Producers and consumers stay independently deployable.
02
Event Archive
Optional event archive with configurable retention. Replay historical traffic for debugging and recovery.
03
Schema Registry
Built-in schema registry in primary region to document contracts and reduce accidental breaking event changes.
04
DR Routing
Optional cross-region forwarding keeps DR event bus warm for resilience and failover scenarios.
Built with
- EventBridge
- Schema Registry
- Event Archive
- Cross-Region Routing
- Terraform
01
Per-Service Isolation
Each service owns its own subscription and queue. No shared consumer bottlenecks across teams.
02
Reliable Buffering
SQS absorbs bursts and decouples producer throughput from processing speed.
03
Optional Lambda
Enable Lambda wiring only when needed. Keep queue-only consumers lightweight by default.
04
Operational Guardrails
DLQ, retry controls, and alarms ship as first-class defaults for production reliability.
Built with
- EventBridge
- SQS
- Lambda
- CloudWatch
- DLQ
- Terraform
01
Primary + DR
Supports single-region tables or optional cross-region replica with provider aliases for deterministic routing.
02
Schema Flexibility
Hash/range key schema, custom attributes, and configurable GSIs let services model access patterns cleanly.
03
Data Protection
Built-in toggles for SSE/KMS, PITR, TTL, and deletion protection to match workload risk profiles.
04
Migration Safety
Designed for non-destructive migrations using moved/import workflows and no-destroy plan guardrails.
Built with
- DynamoDB
- Global Tables
- KMS
- PITR
- TTL
- Terraform
09
Edge Auth
S3 + CloudFront + Lambda@Edge. JWT-gated static sites — no server required.
Beyond the module
Small building blocks. Bigger systems.
See how root modules connect delivery, identity, compute, data, and events into complete cloud platforms.
Explore architectures ↗