cloud & devops engineer

Hi, I'm Francis Egenti.

Building secure, production-style AWS infrastructure in public — one project at a time. ECS Fargate, Terraform, and CI/CD pipelines where security scanning is a gate, not an afterthought.

// work

Projects

secure-pipeline-aws Flagship Project

A Flask REST API deployed on AWS ECS Fargate through a security-first CI/CD pipeline. GitHub Actions authenticates to AWS via OIDC — no stored access keys — and every push must clear automated tests, Trivy container scanning, and tfsec infrastructure scanning before deploy runs.

git push GitHub Actions OIDC SECURITY GATE Trivy scan tfsec scan pass required ECR ECS Fargate
  • Least-privilege IAM roles for both the ECS task execution role and GitHub OIDC deploy role, scoped to specific actions and resource ARNs
  • Documented .trivyignore policy — every suppressed CVE justified against the Debian Security Tracker rather than silently disabled
  • Diagnosed a live AssumeRoleWithWebIdentity failure via CloudTrail event analysis — root cause was a GitHub sub-claim ID-suffix mismatch in the trust policy
  • Force-redeploy step ensures ECS actually pulls the newly built image on every push, not just on infrastructure changes
AWS ECS Fargate Terraform GitHub Actions Trivy tfsec OIDC Flask
View on GitHub →
TaskForge 04

A DevOps-driven task management platform built to demonstrate a complete production-style workflow end to end: containerization, CI/CD, Kubernetes orchestration via Helm, infrastructure as code, and monitoring — wrapped around a lightweight frontend, since the deployment pipeline is the point of the project, not the app.

  • Packaged and deployed the app to Kubernetes (AWS EKS) using a custom Helm chart, rather than raw manifests
  • Provisioned the VPC and EKS cluster with Terraform
  • GitHub Actions pipeline builds the Docker image and pushes it to GitHub Container Registry on every push to main
  • Nginx ingress routes traffic into the cluster; Prometheus and Grafana monitor the running service
Kubernetes (EKS) Helm Terraform GitHub Actions Prometheus Grafana Nginx
View on GitHub →
trovemart-eks-kubernetes 03

A full-stack e-commerce platform running on Kubernetes via AWS EKS, with PostgreSQL persistence through RDS and JWT-based authentication for API access. Observability is built in from the start.

  • PostgreSQL persistence layer provisioned through RDS, wired into the EKS cluster
  • JWT-based authentication securing API access across services
  • Prometheus and Grafana dashboards tracking cluster health and application performance in real time
AWS EKS PostgreSQL / RDS Prometheus Grafana JWT Auth
View on GitHub →
CloudTaskAPI 02

A Flask REST API on AWS ECS Fargate backed by DynamoDB, with all infrastructure — networking, IAM, container orchestration — provisioned through Terraform.

  • All infrastructure provisioned as code, including networking, IAM roles, and container orchestration
  • Refined after external review to correct infrastructure and code issues, improving deployment reliability
AWS ECS Fargate DynamoDB Terraform Docker
View on GitHub →
Skycast 01

A real-time weather application with an automated GitHub Actions CI/CD pipeline handling continuous testing and deployment on every push.

GitHub Actions Docker CI/CD
View on GitHub →
// tooling

Skills & Tools

Infrastructure as Code

  • Terraform (modular design)
  • Remote state (S3, native locking)
  • AWS (EKS, ECS Fargate, VPC, IAM)

Containers & Orchestration

  • Kubernetes (EKS)
  • Helm
  • Docker
  • AWS ECS Fargate

CI/CD & Security

  • GitHub Actions
  • OIDC keyless authentication
  • Trivy & tfsec scanning
  • IAM least-privilege design
  • Image build & push pipelines

Cloud Platforms

  • AWS (ECS, ECR, EKS, RDS)
  • AWS (IAM, VPC, CloudWatch)
  • DynamoDB, S3

Monitoring & Data

  • Prometheus
  • Grafana
  • PostgreSQL
  • DynamoDB

Systems

  • Linux
  • Bash / shell tooling
  • Nginx
// connect

Get in Touch

Open to Cloud & DevOps roles — happy to walk through any of these projects, the debugging decisions behind them, or how a specific piece of infrastructure was built.