PRODUCTION WORK

What We've
Actually Built.

Real infrastructure. Real problems. Real production environments. Not demos: systems that run in production today.

05
🔐
PRJ_001

PHI/PII-Safe Logging Pipeline

100% HIPAA-Compliant Logging

Built a 3-layer defense-in-depth logging architecture for Kubernetes in a healthcare environment. Stripped URL query strings at the source using Istio Proxy, applied regex pipelines in Grafana Alloy to redact PHI/PII tokens in transit, and routed clean JSON logs into segregated retention tiers in Loki: achieving full HIPAA compliance with zero loss in developer visibility.

  • Istio: %REQ_WITHOUT_QUERY% to strip query params
  • Alloy DaemonSets with regex redaction pipelines
  • Loki storage tiers with clean JSON logs
  • Zero PHI/PII in logs · Full observability preserved
IstioGrafana AlloyLokiKubernetesHIPAA
🔑
PRJ_002

KMS Separation of Duties

Zero Access Creep on Encryption Keys

Enforced AWS KMS Separation of Duties directly at the key policy layer. Traced the complete access model: IAM roles, KMS key policies, grants, service integrations, CI/CD identities, and workload dependencies: before making any changes. Key administrators can now manage encryption keys without being able to access encrypted data, while workloads continue operating without interruption.

  • KMS key policy redesign: admin vs. workload split
  • No production disruption during migration
  • Full CloudTrail audit of all key usage
  • Terraform-managed, reproducible policy
AWS KMSIAMTerraformTerragruntEKS
🌐
PRJ_003

Centralized Egress with Istio

100% Controlled Outbound Traffic

Designed and deployed a centralized egress architecture using Istio Egress Gateway and ServiceEntries. All outbound cluster traffic now routes through audited, monitored gateways with explicit allowlists. Used REGISTRY_ONLY mode to enforce outbound restrictions while keeping the rollout production-safe and minimizing impact on existing workloads.

  • REGISTRY_ONLY outbound mode enforced
  • Explicit ServiceEntry allowlists per domain
  • All egress audited via Istio telemetry
  • Zero disruption during staged rollout
IstioServiceEntryEgress GatewaymTLSEKS
⚡
PRJ_004

Zero-Trust CI/CD with OIDC

0 Stored Credentials · 15-min Token Lifecycle

Eliminated all long-lived IAM credentials from the CI/CD pipeline by implementing OIDC-based federated authentication. Every deployment now generates a short-lived OIDC token dynamically, authenticates directly with AWS STS, assumes scoped IAM roles, executes automated SSM syncs on config masters, and verifies completion before AMI builds continue. 100% automated, zero manual steps.

  • OIDC trust + STS AssumeRole per pipeline run
  • 15-minute temporary credential lifecycle
  • 0 stored AWS credentials in any system
  • ✔ 127/127 automated deployment runs
CircleCIAWS OIDCSTSTerraformSSMSaltStack
📊
PRJ_005

Full-Stack Observability Platform

MTTR: 45min → 8min

Built and deployed the complete Grafana LGTM stack (Loki, Grafana, Tempo, Mimir) across a multi-cluster, multi-tenant environment. Unified logs, metrics, and distributed traces into a single pane of glass. Implemented Grafana Alloy as a centralized telemetry collector. Mean time to resolution dropped from 45 minutes to under 8 minutes.

  • Multi-tenant with X-Scope-OrgID isolation
  • Alloy DaemonSet for centralized collection
  • Blackbox synthetic monitoring
  • GitOps delivery via ArgoCD + Helm
GrafanaLokiMimirTempoAlloyEKS
🔒
PRJ_006

VPC CNI Pod Identity Migration

Reduced Blast Radius · Least-Privilege CNI

Discovered that the aws-node DaemonSet was silently relying on worker node IAM roles for ENI and IP management: meaning every node carried permissions intended for only one system component. Implemented EKS Pod Identity with a dedicated least-privilege IAM role for VPC CNI, associated it with the aws-node service account, and removed the CNI policy from the node IAM role entirely. Zero network disruption.

  • EKS Pod Identity for aws-node service account
  • CNI policy removed from node IAM role
  • Workload-scoped credentials, reduced blast radius
  • Zero disruption to pod networking after migration
EKS Pod IdentityIAMVPC CNITerraformKubernetes
☁️
PRJ_007

AWS PrivateLink Observability Ingestion

Zero Public Endpoints · Multi-Account Telemetry

Built a secure multi-account observability pipeline using AWS PrivateLink, allowing external AWS accounts to send logs, metrics, and traces into the platform without any public internet exposure. Internal NLBs exposed via PrivateLink endpoint services, with Route53 TXT record DNS verification and TLS termination via ACM. Fully automated with Terraform and Spacelift.

  • PrivateLink: no VPC peering or transit gateway
  • Loki / Mimir / Tempo each with dedicated endpoints
  • Route53 DNS verification for clean service domains
  • Terraform + Spacelift fully automated infrastructure
AWS PrivateLinkNLBEKSRoute53LokiMimirTempo
🚀
PRJ_008

Grafana MCP Observability Gateway

AI-Assisted Troubleshooting · Per-Org Isolation

Designed and implemented a production-grade Grafana MCP (Model Context Protocol) server on AWS EKS. Enables secure, org-scoped, read-only access to the observability stack for AI-driven troubleshooting. Access controlled via VPN + MFA, TLS-enabled ALB, org-scoped Grafana service accounts, and full Kubernetes RBAC isolation. All secrets externalized via AWS Secrets Manager.

  • One MCP instance per Grafana org: zero cross-tenant access
  • VPN + MFA + TLS-enabled ALB entry control
  • Read-only enforced (disable-write flag)
  • GitOps app-of-apps delivery via ArgoCD
EKSArgoCDGrafanaAWS Secrets ManagerExternal SecretsKEDA
🏥
PRJ_009

Clinical Notes PDF Recovery

200+ Records Recovered · Zero Downtime

Doctors couldn't open, print, or share clinical note PDFs in a production EHR system: corrupted, outdated, or out of sync with the database. Without any code deployment, used AWS SSM Session Manager on a canary EC2 instance to access the app securely, then executed a Django management command following a strict Dry Run → Verify → Wet Run pattern. 9 practice groups fixed, 200+ clinical notes regenerated.

  • AWS SSM: no SSH, no exposed ports
  • Dry Run first → Verify → Wet Run only when confident
  • No schema changes · No deployments · No downtime
  • Full audit trail logged throughout
AWS SSMDjangoEC2MySQLPython
📦
PRJ_010

Automated S3 Media Storage (Dev/QA)

Dev/QA Now Behaves Like Prod

Dev and QA couldn't properly test media workflows because environment parity was missing. Built separate S3 buckets for Dev and QA using Terraform: AES-256 encryption enforced, versioning on, public access fully blocked. Spacelift CI/CD pipelines deploy consistently across environments. No manual setup, no drift: clean, consistent, repeatable media handling.

  • Separate Dev & QA S3 buckets via Terraform modules
  • AES-256 encryption + versioning enabled by default
  • Public access fully blocked at bucket policy level
  • Spacelift pipeline for consistent cross-env deploys
TerraformAWS S3SpaceliftCI/CDAES-256