Build a Cloud Computing Portfolio With Zero Job Experience

resource "aws_budgets_budget" "monthly" {
  name         = "practice-monthly-budget"
  budget_type  = "COST"
  limit_amount = "5"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = ["you@example.com"]
  }
}

#!/usr/bin/env bash
# Quick safety checks for a practice account
set -euo pipefail
echo "== Who am I? =="
aws sts get-caller-identity --query Arn --output text

echo "== Root MFA enabled? (1 = yes) =="
aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'

echo "== Running EC2 instances in ap-south-1 =="
aws ec2 describe-instances --region ap-south-1 \
  --filters Name=instance-state-name,Values=running \
  --query 'Reservations[].Instances[].InstanceId' --output text

resource "aws_s3_bucket" "site" {
  bucket = "yourname-portfolio-site-ap-south-1"
}

resource "aws_s3_bucket_public_access_block" "site" {
  bucket                  = aws_s3_bucket.site.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# Serve through CloudFront with origin access control so the
# bucket itself stays private (see project README for full code).
output "bucket" { value = aws_s3_bucket.site.bucket }

resource "aws_security_group" "alb" {
  vpc_id = aws_vpc.main.id
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "app" {
  vpc_id = aws_vpc.main.id
  ingress {
    from_port       = 8080
    to_port         = 8080
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]   # only from the ALB
  }
}

# Two-Tier Web App on AWS

![Architecture](diagram.png)

## Goal
Run a web app with no public access to app servers or database.

## Design decisions
- App servers and RDS in private subnets across two AZs
- ALB is the only public entry point (HTTPS)
- IAM roles instead of access keys

## Deploy / destroy
    terraform init && terraform plan
    terraform apply
    terraform destroy

## Cost note
Load balancer and NAT gateway cost money per hour; I destroy the
stack after each session.

## What I learned
Private instances need a planned route out (NAT) for updates.

# pip install diagrams  (needs Graphviz installed)
from diagrams import Cluster, Diagram
from diagrams.aws.compute import EC2
from diagrams.aws.database import RDS
from diagrams.aws.network import ELB

with Diagram("Two-tier app", filename="diagram", show=False):
    lb = ELB("ALB (public)")
    with Cluster("Private subnets (2 AZs)"):
        apps = [EC2("app-a"), EC2("app-b")]
        db = RDS("PostgreSQL")
    lb >> apps >> db
print("saved diagram.png")

Week 1    Safe account setup: MFA, admin user, budget, region
Weeks 2-3 Project 1: static site with CDN, in Terraform
Weeks 4-5 Project 2: two-tier app in a private VPC
Week 6    Project 3: container API with CI, or a serverless function
Week 7    Diagrams, READMEs, cost notes, screenshots
Week 8    Portfolio page, resume and LinkedIn links, peer review

For every project:
[ ] Goal stated in one sentence
[ ] Architecture diagram
[ ] 2-3 design decisions explained
[ ] Terraform: init, plan, apply, destroy documented
[ ] Security: no public databases, roles not keys
[ ] Cost note and teardown steps
[ ] Screenshot of the working result
[ ] 'What I learned' section

# <Name> - Cloud Portfolio

AWS | Terraform | Linux | Docker

1. **Static site with CDN** - private bucket, HTTPS, Terraform
2. **Two-tier app in a private VPC** - ALB, private EC2 and RDS, IAM roles
3. **Container API with CI** - Docker image built and deployed on push

Each project has a diagram, README and cost note.