Cloud Infrastructure Setup — Contractor Handover

A contractor has been setting up a new AWS environment for a startup's production workload. They completed the first phase before their contract ended. An internal engineer is taking over to finish the setup. You need to produce a document that lets the internal engineer continue without re-doing or re-investigating anything.

Completed work

• VPC created in us-east-1 with public/private subnet pairs in three availability zones
• IAM roles and policies for the application tier are defined and attached (app-role, worker-role)
• RDS PostgreSQL instance provisioned in the private subnet (db.t3.medium); master credentials stored in AWS Secrets Manager under prod/rds/master
• ECS cluster created (prod-cluster); task definitions for the api and worker services are registered (v1)
• S3 bucket for static assets created (prod-static-assets-{account-id}); bucket policy allows public read
• Route 53 hosted zone configured for app.example.com

What is not yet done

• ECS services have not been created (task definitions exist, but services — including load balancer attachment — are missing)
• SSL certificate not yet issued via ACM (needed before the load balancer can be configured)
• CloudWatch log groups and alarms are not configured
• The CDN (CloudFront) distribution in front of the S3 bucket has not been set up
• Terraform state is local (in the contractor's machine) — it has NOT been migrated to S3 remote state yet; this must happen before anyone else runs terraform apply

Open questions

• The contractor was unsure whether the RDS instance should use Multi-AZ from day one or only when load warrants it — not decided
• The worker ECS task definition assumes a specific SQS queue ARN that does not exist yet; the queue needs to be created before the service can launch

Key identifiers

• AWS account: 123456789012
• Region: us-east-1
• ECS cluster: prod-cluster
• Secrets Manager path: prod/rds/master
• Terraform working directory: infra/terraform/prod/

Prepare the handoff document so the internal engineer can take over.