AWS Developer Platform
An internal developer platform on EKS that gives application teams a paved road: a one-line claim provisions hardened, cost-attributed, policy-compliant AWS infrastructure with no static credentials anywhere, enforcing the same controls as the governed data pipeline through a Kubernetes API instead of a CI gate.
/01Problem
Application teams should not have to hand-write S3 buckets, wire IAM, and remember every hardening checkbox to ship a service. Doing so spreads inconsistent, often insecure infrastructure across an org and makes every new service a bespoke review.
The goal was a paved road: a self-service interface where a developer declares what they need, and the platform returns a real, hardened, policy-compliant resource without ever touching cloud credentials.
/02Approach
- ArgoCD app-of-apps GitOps reconciles every platform component from Git, so the cluster's desired state is version-controlled and auditable.
- Crossplane with an IRSA-authenticated AWS provider exposes a self-service Bucket API: a developer's one-line claim provisions a real S3 bucket, no static credentials in the path.
- Buckets are hardened by default to the same control set as the governed data pipeline: a customer-managed KMS key with rotation, a TLS-only bucket policy, all four public-access-block settings, and mandatory owning-team and cost-center tags.
- Kyverno enforces attribution and baseline hardening at admission (owning-team and cost-center labels, non-root, resource limits, no :latest) and audits image signatures with cosign, so non-compliant workloads are caught at the API server.
- FinOps is enforced, not just observed: a CI gate fails a Terraform plan missing a CostCenter tag or exceeding a per-PR cost threshold, and OpenCost attributes running cluster spend by the same key.
- External Secrets Operator syncs secrets from AWS Secrets Manager over IRSA, so a developer references a secret by name and nothing plaintext lives in Git.
- A Backstage golden-path template scaffolds a service born compliant (cost-center label, resource limits, a burn-rate SLO, and a runbook) and GitOps-deployable the moment it exists.
/03Architecture
EKS, the VPC, the OIDC provider, and two scoped IRSA roles (one for Crossplane, one for External Secrets) are provisioned in Terraform with an S3 remote state backend. Both operators assume their IRSA role to act on AWS, which keeps credential material out of pods entirely.
The platform layer (ArgoCD, Crossplane with the S3 and KMS providers, Kyverno, External Secrets, OpenCost, and the Prometheus SLO stack) is itself reconciled by GitOps, so the boundary between cluster bootstrap (Terraform) and platform configuration (Git) is explicit.
/04Outcome
A developer's one-line claim yields a production-grade S3 bucket encrypted with a customer-managed KMS key, TLS-only, public-access-blocked, and tagged for cost attribution and ownership, with zero credential handling.
Verified end to end against real AWS: the claimed bucket came up SSE-KMS and TLS-only with public access blocked, Kyverno denied a non-compliant pod and admitted the compliant one, External Secrets synced a Secrets Manager secret into the cluster, and OpenCost reported spend, all before a clean teardown, demonstrating the full provision-and-destroy lifecycle rather than a screenshot.