Certified AWS DevOps engineer

Certified AWS DevOps engineer

Overview

I have a mixed AWS landscape: several services already live, several still on the drawing board. I need a clean, reproducible Amazon ECS foundation for multiple Node.js APIs and React front-end containers, fully automated delivery via GitHub Actions and Bitbucket Pipelines (our repos are split across both), and a broader set of supporting AWS services wired in correctly — messaging, data stores, DNS, edge delivery, and multi-region resilience.

This is infrastructure-as-code work end to end. Some components already exist and need to be integrated/refactored; others are green-field and need to be designed from scratch.

Scope of Work

1. Core Compute & Delivery Pipeline (GitHub Actions + Bitbucket Pipelines)


Design and provision ECS clusters (Fargate and/or EC2 launch type — your recommendation, with rationale)
VPC networking: subnets, route tables, NAT/IGW, security groups, private/public segmentation
Application Load Balancer(s) with path/host-based routing across services
IAM roles and least-privilege task/execution policies
ECR repositories, image lifecycle policies
Centralized logging (CloudWatch Logs / container insights)
Secrets management (Secrets Manager or SSM Parameter Store) — no secrets in images or plaintext env vars
CI/CD workflows across both GitHub Actions and Bitbucket Pipelines: test → build → push to ECR → deploy to ECS, with zero-downtime rollout (blue/green or canary — CodeDeploy or ECS native strategies) and rollback on failure
Pipeline logic should be kept as consistent as practical between the two platforms (shared conventions for stages, secrets/OIDC auth to AWS, naming) so onboarding a new service isn't a fundamentally different process depending on which repo host it lives in


2. Data & Messaging Layer


Amazon RDS provisioning (Postgres) — Multi-AZ, parameter groups, backup/retention policy, private subnet placement
MongoDB — either self-managed on ECS/EC2 or Atlas integration (your recommendation on tradeoffs)
RabbitMQ — Amazon MQ or containerized on ECS, with HA considerations
Amazon SQS — queue-based decoupling between services where appropriate
Amazon SES — transactional email sending, domain verification, DKIM/SPF setup


3. Storage, DNS & Edge


S3 buckets for static assets, build artifacts, and application storage (proper bucket policies, versioning, lifecycle rules)
CloudFront distribution(s) in front of S3/ALB for the React front-end and any cacheable API responses
Route 53 — hosted zones, record management, health checks, failover routing where relevant
Elastic Beanstalk — for any workloads better suited to Beanstalk than ECS (legacy or simpler services), with a clear justification of when to use which


4. Resilience & Scale


Load balancing strategy across services (ALB target groups, health checks, auto-scaling policies tied to ECS services)
Multi-region operation — at minimum, a documented and IaC-ready pattern for standing up a second region (Route 53 failover/latency routing, cross-region S3 replication or RDS read replicas, ECR replication) — full active-active is a stretch goal, not a hard requirement for v1
Cost-awareness in architecture choices — flag anything that meaningfully changes the monthly bill


5. Integration & Refactor Work


Audit existing AWS footprint and identify what should be imported into IaC vs. rebuilt
Refactor existing resources into Terraform (or CloudFormation, whichever you're fastest with) state without downtime to currently-live services
Reconcile naming, tagging, and networking conventions across old and new resources


Acceptance Criteria


One IaC repository that spins up the complete stack (ECS, networking, data layer, messaging, DNS, CDN) in my AWS account
Working pipelines on both GitHub Actions and Bitbucket Pipelines covering build, test, image publish, deploy, and rollback
Sample Node.js and React workloads successfully deployed through the pipeline, backed by RDS/MongoDB and fronted by CloudFront + Route 53
Queue (SQS) and email (SES) integration demonstrated with a working example
Documented multi-region failover pattern (even if only partially provisioned in v1)
README covering: variable reference, secrets handling, onboarding a new service, and how to extend into a second region


Nice to Have


Prior experience migrating a live production workload into IaC without downtime
Experience with ECS service auto-scaling based on custom CloudWatch metrics
Familiarity with Amazon MQ vs. self-hosted RabbitMQ tradeoffs
Experience maintaining parallel CI/CD pipelines across GitHub Actions and Bitbucket Pipelines, including shared/reusable pipeline components


Deliverables


IaC repository (Terraform or CloudFormation)
CI/CD workflows for both GitHub Actions and Bitbucket Pipelines
Architecture diagram covering all services in scope
README / onboarding documentation, including how to onboard a new service on either repo host