Cloud Computing · intermediate

Keyless Container Deploys: ECS Fargate with Terraform and GitHub OIDC

A containerized web service deployed to AWS ECS Fargate entirely from code — Terraform builds the infrastructure, GitHub Actions builds and ships the image, and the pipeline authenticates with short-lived OIDC tokens instead of stored cloud keys.

Project overview

Long-lived cloud keys in CI are the root cause of a steady stream of breaches, and "no static credentials" is now an explicit requirement in cloud and DevOps job descriptions. Showing a full pipeline that never stores a secret is a concrete answer to a question every hiring manager asks.

Real-world use case

A startup needs to deploy its API on every merge to main, with reviewers able to see exactly what infrastructure changed and no AWS keys sitting in GitHub secrets.

Tools and technologies

• Terraform
• AWS ECS Fargate
• Amazon ECR
• GitHub Actions OIDC
• Application Load Balancer
• Docker

Skills you can demonstrate

Infrastructure as Code, CI/CD Pipelines, Container Orchestration, IAM Trust Policies, Cloud Networking

Build roadmap

1. Containerize a small service
   Write a tiny HTTP API with a health endpoint, Dockerize it, and run it locally. Keep the app boring — the infrastructure is the project.
2. Write the Terraform
   Define a VPC with public and private subnets, an ECR repository, an ECS cluster, a Fargate task definition, a service, and an ALB. Apply it from your laptop first.
3. Set up GitHub OIDC
   Create the OIDC identity provider in IAM and a deploy role whose trust policy is scoped to your repo and branch. Use the AI prompt to get the conditions exactly right.
4. Build the pipeline
   Write a workflow that assumes the role, builds the image, pushes to ECR, and forces a new ECS deployment. Confirm the repo has no AWS secrets at all.
5. Add a Terraform plan step
   On pull requests, run terraform plan and post the output as a PR comment so infrastructure changes are reviewed like code.
6. Prove it and document it
   Merge a change, watch it roll out with zero downtime behind the ALB, and write a README with the architecture diagram and the security rationale.

Ways to extend the project

Add a preview environment per pull request — a separate ECS service and ALB listener rule created on PR open and destroyed on close.

How to showcase your work

• GitHub: Terraform modules, the workflow file, an architecture diagram, and a link to the live endpoint behind the load balancer.
• LinkedIn: Show the GitHub Actions run succeeding with zero secrets configured in the repo settings — that screenshot tells the whole story.
• Resume: Use the language of the job posts: "Provisioned ECS Fargate infrastructure with Terraform and built a keyless OIDC-authenticated CI/CD pipeline."