homeexamplesterraform-multi-env-aws

Multi-Environment AWS Infrastructure – Terraform

Published Oct 20, 2025
⋅
3 minutes read

I built a multi-environment AWS infrastructure project to demonstrate Terraform workspace management and environment-specific configurations. It focuses on clean separation of concerns, automated CI/CD, and AWS Free Tier compliance while showcasing production-ready patterns.

Terraform workspace management
Multi-environment infrastructure with Terraform workspaces

Project goals

Architecture overview

The project creates environment-specific AWS infrastructure using Terraform workspaces:

Environment configuration

The core of the project uses Terraform's locals block for environment-specific configurations:

locals {
  workspace_config = {
    dev = {
      vpc_cidr           = "10.0.0.0/16"
      instance_count     = 1
      ssh_access_cidr    = "0.0.0.0/0"
      environment_tag    = "dev"
    }
    stage = {
      vpc_cidr           = "10.1.0.0/16"
      instance_count     = 1
      ssh_access_cidr    = var.allowed_ip_cidr
      environment_tag    = "stage"
    }
    prod = {
      vpc_cidr           = "10.2.0.0/16"
      instance_count     = 2
      ssh_access_cidr    = var.vpn_cidr
      environment_tag    = "prod"
    }
  }
  
  config = lookup(local.workspace_config, terraform.workspace, local.workspace_config["dev"])
  
  common_tags = {
    Environment = local.config.environment_tag
    Project     = "terraform-multi-env-aws"
    ManagedBy   = "terraform"
  }
}

Security implementation

Security groups implement environment-specific access controls:

resource "aws_security_group" "web" {
  name_prefix = "${local.config.environment_tag}-web-"
  vpc_id      = aws_vpc.main.id
 
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [local.config.ssh_access_cidr]
  }
 
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  tags = merge(local.common_tags, {
    Name = "${local.config.environment_tag}-web-sg"
  })
}

CI/CD pipeline

GitHub Actions workflow provides automated planning and manual deployments:

name: Terraform Deploy
 
on:
  push:
    branches: [main]
    paths: ['terraform/**']
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy'
        required: true
        default: 'dev'
        type: choice
        options:
          - dev
          - stage
          - prod
 
jobs:
  terraform-plan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
 
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
 
      - name: Terraform Init
        run: terraform init -backend=false
        working-directory: ./terraform
 
      - name: Terraform Validate
        run: terraform validate
        working-directory: ./terraform
 
  terraform-apply:
    runs-on: ubuntu-latest
    needs: terraform-plan
    if: github.event_name == 'workflow_dispatch'
    steps:
      - name: Select or Create Workspace
        run: |
          terraform workspace new ${{ github.event.inputs.environment }} 2>/dev/null || true
          terraform workspace select ${{ github.event.inputs.environment }}
          echo "Active workspace:"
          terraform workspace show
        working-directory: ./terraform
 
      - name: Terraform Apply
        run: terraform apply -auto-approve
        working-directory: ./terraform
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

State management

Terraform state is managed with S3 backend and DynamoDB locking:

terraform {
  backend "s3" {
    bucket         = "BUCKET_NAME"
    key            = "terraform.tfstate"
    region         = "eu-central-1"
    encrypt        = true
    dynamodb_table = "TABLE_NAME"
  }
}

Operational concerns

Workspace management

The project demonstrates proper Terraform workspace usage:

# List available workspaces
terraform workspace list
 
# Create new environments
terraform workspace new dev
terraform workspace new stage
terraform workspace new prod
 
# Switch between environments
terraform workspace select dev
 
# Deploy specific environment
terraform plan
terraform apply

Security and compliance

Performance and scalability

Trade-offs and decisions

Running the project

Future enhancements

Cost analysis

Notes

This project demonstrates infrastructure-as-code best practices in a compact, educational format. The patterns (workspace management, environment isolation, and automated CI/CD) mirror how I approach larger infrastructure projects. The focus on AWS Free Tier compliance makes it accessible for learning while maintaining production-ready practices.

previousServerless QR Code Generator – AWS Lambda with TerraformnextDocker Visitor Greeting - Multi-Container Demo