Salutron: Multi-Cloud Infrastructure Automation

Project Link: https://salutron.lisekarimi.comGitHub Repository: https://github.com/lisekarimi/salutron

🎯 Project Overview

A production-ready DevOps project demonstrating enterprise-level Infrastructure as Code practices across AWS, GCP, and Azure. Built to master multi-cloud deployment strategies, automated CI/CD pipelines, and modern security practices.

Key Achievement: Single-command infrastructure deployment across three major cloud providers with zero stored credentials.

🛠️ Technical Stack

• Infrastructure as Code: Terraform with workspace isolation (dev/test/prod)
• Containerization: Docker with optimized multi-stage builds
• Cloud Platforms: AWS App Runner, GCP Cloud Run, Azure Container Apps
• CI/CD: GitHub Actions with OIDC/Workload Identity Federation
• State Management: Remote backends (S3, GCS, Azure Blob Storage)
• Automation: Bash scripting + Makefiles for deployment orchestration

🚀 What Makes This Special

Multi-Cloud Parity

Identical deployment workflows across AWS, GCP, and Azure - demonstrating cloud-agnostic infrastructure design patterns.

Zero-Credential Security

Implemented OIDC and Workload Identity Federation for all three clouds, eliminating long-lived credentials and following enterprise security best practices.

One-Command Deployment

make aws-deploy-prod  # Deploy to AWS production
make gcp-deploy-dev   # Deploy to GCP development
make azure-deploy-test # Deploy to Azure testing

💡 The Journey

Challenges Faced

1. Multi-Cloud State Management

   • Problem: Each cloud has different backend requirements (S3+DynamoDB vs GCS vs Blob Storage)
   • Solution: Standardized backend configuration patterns with environment-specific state files

2. OIDC Configuration Complexity

   • Problem: Different federated identity implementations across clouds (AWS OIDC vs GCP Workload Identity vs Azure Workload Identity Federation)
   • Solution: Created environment-specific credentials (dev/test/prod) for proper GitHub Actions integration

3. Azure Free Tier Limitations

   • Problem: Only 1 Container App Environment per region in free tier
   • Solution: Documented shared environment pattern and region-based deployment strategies

4. GitHub Actions Authentication

   • Problem: Initial workflows failed due to generic credential matching (wildcard vs environment-specific)
   • Solution: Implemented granular federated credentials per environment for better security

Key Learnings

Infrastructure as Code:

• Terraform workspace management for environment isolation
• Remote state backends prevent state conflicts in team/CI scenarios
• -target flag useful for incremental resource creation (ECR → Build → Deploy pattern)

Container Registry Authentication:

• Each cloud has unique login patterns (aws ecr, gcloud auth, az acr)
• Registry URLs follow predictable naming conventions (useful for automation)

CI/CD Best Practices:

• Environment protection rules in GitHub Actions prevent accidental prod deployments
• OIDC tokens expire (~1 hour), providing automatic credential rotation
• Separate workflows for deploy/destroy add safety layer

Multi-Cloud Strategy:

• Consistent naming conventions across clouds simplify management
• Cloud-specific nuances (scaling to 0, environment limits) require documentation
• Hybrid local/CI approach balances speed and safety

Unexpected Discoveries

1. GCP Cloud Run can scale to 0 (cost optimization) but Azure Container Apps with ingress cannot - important for pricing strategy

2. Terraform state conflicts are more common in CI/CD than expected - proper backend initialization critical

3. Docker build caching in GitHub Actions significantly speeds up deployments (30s vs 3min)

4. Azure resource provider registration required before first deployment - similar to GCP API enablement but less obvious

📊 Project Metrics

• 3 Cloud Providers: AWS, GCP, Azure
• 3 Environments: dev, test, prod (per cloud)
• 6 GitHub Actions Workflows: Deploy + Destroy for each cloud
• Zero Long-Lived Credentials: 100% OIDC/Workload Identity
• ~50 Terraform Resources: Across all clouds
• Single Command Deployment: Via Makefiles

🎓 Skills Demonstrated

• Multi-cloud infrastructure design
• Terraform workspace and state management
• Docker containerization and optimization
• GitHub Actions CI/CD pipelines
• OIDC/Workload Identity Federation
• Bash scripting and automation
• GitOps workflow implementation
• Secret management best practices

---

Built with ❤️ while mastering DevOps