● reference architectures · three of them

Reference architectures — three pipelines you can watch run

Serverless on AWS, containers across three clouds, and an agentic security harness. Each one is closed below; open it and it runs — stages walk, packets move, a canary shifts traffic, and an alarm can send it back.

principle the platform differs, the spine does not: scan before plan, plan before apply, dev before prod, a human on the gate

idle

DevSecOps CI/CD and monitoring for a Lambda-backed booking system. Eight GitHub Actions stages, an OIDC-only path into AWS, a canary rollout that reverses itself on alarm — and the telemetry that decides whether it should.

principle every path to prod passes a scan, a test suite, a human review, and a post-deploy alarm

ci/cd pipeline · github actions

developers

GitHub

App code · IaC (Terraform) · Workflows

push a1f9c02

01 code

Commit / PR
Code review

queued

02 build & test

Checkout
Install deps
Unit tests
Lint

queued

03 security scan

SAST (CodeQL)
Dependency scan
Secret scan
IaC scan (Checkov)

queued

04 terraform plan

terraform fmt
terraform validate
terraform plan
Upload plan

queued

05 deploy to dev

Terraform apply
Deploy Lambda
API Gateway
DynamoDB

queued

06 integration tests

Integration tests
API tests
Smoke tests

queued

07 prod approval

Manual approval
GitHub environment

queued

08 deploy to prod

Terraform apply
AWS CodeDeploy
Canary deployment

queued

artifacts · from 02

GitHub Actions → Amazon S3

Terraform state, run logs, build artifacts. Versioned bucket, SSE-KMS, no public path.

secure access · from 04

OIDC → AWS IAM role

Short-lived credentials assumed per run. No long-lived AWS keys live in GitHub.

aws runtime · serverless

What stage 08 actually ships. The request path below replays on a loop — one booking, from the phone in someone’s hand to the confirmation SMS.

clients

Mobile & Web App

POST /appointments

auth

Amazon Cognito

JWT authoriser

edge

Amazon API Gateway

HTTPS REST API

AWS WAF (optional)

aws lambda functions

Availability

GET /availability

Booking

POST /appointments

Appointment mgmt

GET/PUT/DELETE /appointments

Notification

Reminders & notifications

state

Amazon DynamoDB

Appointments · Users · Slots

schedule

Amazon EventBridge

Reminder scheduler

notify

Amazon SNS / SES

Email · SMS

prod canary deployment

aws codedeploy · lambda aliases

Linear shift with a bake window at each step. CloudWatch alarms are the abort condition, not a human watching a graph.

standby

new version 0% current version 100%

5% 25% 50% 100%

5XX · p95 · booking success rate within budget

cloudwatch alarmsabort & roll back

observability & monitoring

The canary above only has an opinion because these do. Everything here is provisioned by the same Terraform the pipeline applies — a service ships with its alarms or it does not ship.

metrics

CloudWatch

API Gateway 4XX / 5XX / latency
Lambda invocations, errors, duration, throttles
DynamoDB latency, throttles, capacity
Custom business metrics: bookings, conflicts

logs

CloudWatch Logs

Structured JSON logs
Correlation ID per request
Retention policy per log group
Logs Insights saved queries

traces

X-Ray / App Signals

End-to-end tracing
Service map
Latency analysis
Error analysis

synthetics

CloudWatch Synthetics

API health check — 5 min
Full booking flow — 15 min
Alert on failure

dashboards

CloudWatch

Service health
Business KPIs
Deployment / canary

alarms

CloudWatch Alarms

5XX error rate
Lambda errors / throttles
p95 latency
Booking success rate
DLQ messages
Canary alarms

alerting

Amazon SNS

Email
Slack
PagerDuty

security foundations

AWS IAM least privilege, per-function roles

AWS KMS customer-managed keys

AWS Secrets Manager rotated secrets, no env-var creds

VPC endpoints private access, no NAT egress

S3 + DynamoDB encryption at rest

AWS CloudTrail audit log of every API call

AWS Config drift and compliance rules

The same spine as the serverless entry, ported to a container platform and to whichever cloud the workload sits in. Six stages across two lanes, artifact signing in AWS, Azure or GCP, GitOps promotion into dev then prod, and an Argo Rollouts canary that reads Prometheus rather than a person.

principle the cluster runs a digest it can prove was signed by a key it trusts

devsecops pipeline · github actions

source control

GitHub

App code · Dockerfile · Helm charts · Terraform · Workflows

pull request push 7c3e91d

01 commit

Lint / format
Unit tests
SAST (SonarQube)
Secrets & keys scan
Identity & access scan
IaC scan (Checkov · tfsec)
Build container image

queued

02 test

Ephemeral test environment
Integration tests
Image vulnerability scan (Trivy)

queued

03 package & publish

Tag: commit SHA + SemVer
Push to container registry
Sign the artifact
SBOM + provenance attestation

queued

04 deploy (gitops)

Terraform provisions the platform
Actions writes the desired state
Argo CD syncs dev
Approved PR promotes to prod

queued

05 progressive delivery

Argo Rollouts canary
Analysis: error rate · latency · health
Automated rollback

queued

06 post-deploy

Smoke tests
Synthetic monitoring
Alerts & observability
Notifications

queued

artifact signing · aws · from 03

AWS Signer

Signing profile in AWS Signer, key material in AWS KMS. Amazon ECR holds the image and its signature; admission verifies the digest.

artifact signing · azure · from 03

Azure Artifact Signing

Trusted Signing account signs ACR artifacts. Certificates and keys never leave Azure Key Vault, and rotation is the platform’s problem.

artifact signing · gcp · from 03

Google Cloud KMS

Artifact Registry images signed by a Cloud KMS key. Binary Authorization admits only digests carrying a valid attestation.

environment · dev

Argo CD → dev cluster

Auto-sync, self-heal. Every merge to main lands here first.

drift reverts itself

environment · prod

Argo CD → prod cluster

Syncs on an approved promotion PR. Argo Rollouts owns the traffic shift from there.

signed digests only

argo rollouts · canary in prod

Analysis templates query Prometheus at every step. A failed run aborts the rollout and returns traffic to the stable ReplicaSet — no human in the loop.

standby

canary 0% stable 100%

20% 50% 100%

error rate · p95 latency · pod health within threshold

post-deploy · 01

Smoke tests

Job in the target namespace

post-deploy · 02

Synthetic monitoring

Probes on the real user journey

post-deploy · 03

Alerts & observability

Prometheus · Grafana · Alertmanager

post-deploy · 04

Notifications

Slack · Microsoft Teams

pipeline as code

GitHub Actions

Reusable workflows, not copy-paste YAML
OIDC federation into AWS, Azure, GCP
No long-lived cloud keys in the repo

infrastructure as code

Terraform

Reusable modules per platform primitive
Remote state with locking
plan on PR, apply on merge

security throughout

Every stage, not a gate

SonarQube — static analysis
Checkov · tfsec — IaC
Secrets, keys, identity & access scans
Trivy — image vulnerabilities
Signing + admission policy

keep pipelines fast

Feedback in minutes

Parallel jobs across the matrix
Layer and dependency caching
Cheap checks fail first

building one of these

This shape ports to most workloads

Swap Lambda for ECS or EKS and the ordering holds: nothing is applied unscanned, nothing ships unreviewed, and a rollout can undo itself without anyone being paged. I build these end to end, including the alarms that make the canary meaningful.

Book a consultation ← Back to the portfolio

Reference architectures — three pipelines you can watch run

● reference architecture · aws serverless Appointment booking — a serverless pipeline you can watch run 8 stages · github actions → lambda · canary + cloudwatch alarms

● reference architecture · containers & gitops Container delivery — a DevSecOps pipeline that signs what it ships 6 stages · signing in aws, azure or gcp · argo cd + argo rollouts

● reference architecture · agentic security review VAH — a vulnerability agent harness that never merges its own patch 8 stages · fast path on the pr + async deep pass · human gate