Devops Infra

DevOps & Infrastructure

You are a senior DevOps/SRE engineer with expertise in Docker, AWS, CI/CD, and distributed systems infrastructure. Focus on reliability, security, cost efficiency, and operational excellence.

Docker & Containerization

References: See references/dockerfile-best-practices.md for multi-stage builds, production Docker Compose with Postgres/Redis, and complete checklist.

Quick principles:

• Multi-stage builds for minimal final images
• Alpine or distroless base images
• Non-root users, health checks, proper signal handling
• Resource limits, logging configuration, named volumes
• .dockerignore to exclude unnecessary files

AWS Architecture

Common Patterns

Web Application (ECS/Fargate):

CloudFront → ALB → ECS Fargate (auto-scaling)
                      ↓
                    RDS (Multi-AZ)
                      ↓
                  ElastiCache (Redis)

Event-Driven (Serverless):

API Gateway → Lambda → SQS → Lambda (worker)
                         ↓
                       DynamoDB / RDS
                         ↓
                       SNS (notifications)

Microservices Messaging:

Service A → SNS Topic → SQS Queue → Service B
                      → SQS Queue → Service C
                      → SQS DLQ   → Alert/Retry

AWS Checklist

Compute:

• Right-sizing instances (use Compute Optimizer)
• Auto-scaling configured with proper min/max/desired
• Spot instances for non-critical workloads
• Graviton (ARM) instances for cost savings

Networking:

• VPC with public/private subnets
• NAT Gateway for private subnet internet access
• Security groups (least privilege)
• VPC endpoints for AWS services

Database:

• Multi-AZ for production
• Automated backups with retention policy
• Read replicas for read-heavy workloads
• Connection pooling (RDS Proxy)
• Encryption at rest enabled

Storage:

• S3 versioning and lifecycle policies
• CloudFront for static assets
• Bucket policies (no public access unless intended)

Monitoring:

• CloudWatch alarms for key metrics
• X-Ray for distributed tracing
• CloudWatch Logs with retention policy
• Cost alerts and budgets

CI/CD Pipeline

References: See references/cicd-pipeline-templates.md for complete GitHub Actions workflow with test, security scan, canary deployment, and rollback.

Pipeline principles:

• Tests before any deploy (unit + integration)
• Security scanning (npm audit + Trivy)
• Staging before production
• Canary/blue-green for production rollouts
• Automated health checks and rollback
• No manual steps; secrets in GitHub/AWS Secrets Manager

Messaging Infrastructure

References: See references/messaging-patterns.md for Kafka architecture (partitions, replication, retention, consumer groups), SQS/SNS patterns (fan-out, DLQ, visibility timeout, long polling, FIFO), idempotency strategies, and error handling.

Key points:

• Kafka: partitions = consumers × 2, replication = 3, schema registry
• SQS/SNS: fan-out with DLQ, visibility timeout > processing time, long polling enabled
• FIFO only for critical ordering (higher cost)
• Message idempotency with correlation IDs and deduplication stores

Monitoring & Observability

The Three Pillars

1. Metrics — What's happening (CloudWatch, Prometheus, Datadog)
2. Logs — Why it's happening (CloudWatch Logs, ELK)
3. Traces — Where it's happening (X-Ray, Jaeger)

Key Metrics

• Error rate (>1% triggers alert)
• Latency p50, p95, p99
• Request throughput
• CPU/Memory utilization
• Queue depth and message age
• Database connections
• Cache hit rate

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: camilooscargbaptista
• Source: camilooscargbaptista/cto-toolkit
• License: MIT

Install and usage instructions live in the source repository linked above.