Ground Station

Diego Mendoza

Cloud & DevOps Engineer

Building scalable, automated AWS infrastructure.

Terraform AWS CI/CD Python
GitHub LinkedIn
Pipeline Layer

Projects

Infrastructure I've designed, codified, and shipped. Each one is defined in Terraform and deployed through an automated pipeline.

Global Static Site Architecture

● Live

Automated deployment of a serverless architecture using S3, CloudFront, ACM, and Route 53. Content is served from edge locations worldwide with HTTPS enforced end-to-end.

  • Terraform
  • S3
  • CloudFront
  • ACM
  • Route 53
  • GitHub Actions
Source ↗ Deep-dive ↓

Containerized API Pipeline

● Building

CI/CD pipeline that builds Docker images, scans them for vulnerabilities, pushes to ECR, and rolls out to ECS Fargate with zero-downtime blue/green deployments.

  • Docker
  • ECR
  • ECS Fargate
  • ALB
  • GitHub Actions
  • Python
Source ↗

Event-Driven Cost Watchdog

● Planned

Serverless Python functions triggered by EventBridge that monitor AWS spend, tag drift, and idle resources, then post alerts to Slack via SNS.

  • Lambda
  • EventBridge
  • SNS
  • Cost Explorer
  • Python
  • Terraform
Source ↗
Stratosphere

How This Site Works

This page has no servers. The request path is fully managed and fully codified:

DNS via Route 53 diegomendoza.cloud
CloudFront OAC edge cache + TLS (ACM)
Private S3 Bucket origin, no public access
  1. Route 53 holds the hosted zone and an alias record pointing the apex domain at the CloudFront distribution.
  2. CloudFront terminates TLS with an ACM certificate, caches assets at the edge, and redirects HTTP to HTTPS.
  3. Origin Access Control (OAC) signs requests to S3, so the bucket policy only trusts this one distribution.
  4. S3 stays fully private. Block Public Access is on, and the only reader is CloudFront.
  5. Terraform defines every piece above. A push to main runs plan and apply and syncs the static files.
main.tf 
# Private origin — only CloudFront may read
resource "aws_s3_bucket" "site" {
  bucket = "diegomendoza.cloud"
}

resource "aws_cloudfront_origin_access_control" "oac" {
  name                              = "site-oac"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

resource "aws_cloudfront_distribution" "cdn" {
  enabled             = true
  default_root_object = "index.html"
  aliases             = ["diegomendoza.cloud"]

  origin {
    domain_name              = aws_s3_bucket.site.bucket_regional_domain_name
    origin_id                = "s3-site"
    origin_access_control_id = aws_cloudfront_origin_access_control.oac.id
  }

  viewer_certificate {
    acm_certificate_arn = aws_acm_certificate.site.arn
    ssl_support_method  = "sni-only"
  }
}