Planetek · Boardwalk Ops · CI/CD, observability & resilience

Run 01 · The morning sweep

CI/CD: plan on pull request, gated apply on main

No run opens until patrol has swept it. GitHub Actions assumes short-lived AWS credentials via OpenID Connect; there are no access keys in the repo, in GitHub secrets, or anywhere else.

pull request→ fmt · validate→ Checkov + Trivy→ terraform plan (read-only role)→ merge to main→ prod environment gate→ terraform apply

all workflow runs →

Sweep log · recent runs on main

Reading the sweep log from GitHub…

The plan role is read-only. A malicious or buggy PR can see drift, never cause it.
The apply role is only assumable through the repo's prod environment, and its IAM powers are fenced to plank-prefixed roles. Like the boundary sign says: no services beyond this point. It cannot modify its own permissions.
Checkov and Trivy fail the build on infrastructure misconfigurations and vulnerable dependencies, the way patrol does control work before the rope drops.

Two red snow groomers rebuilding a ski slope at dusk under a starry alpine sky — Grooming shift. The mountain is rebuilt every night while the town sleeps: every push to main replans and reapplies all twelve planks the same way.

Run 02 · The beacon drill

Resilience: an executable backup & restore runbook

Patrol does not assume the beacons work; they bury one and go find it, against a stopwatch. Same idea here: a Step Functions state machine snapshots the live permits table, restores it into a scratch table, verifies every item survived, tears the copy down, and publishes the timed evidence below. The button runs the real state machine in the account, not a replay.

One drill at a time; extra visitors join the drill under way. A full drill takes about five minutes, and every stage below is read live from the Step Functions execution history.

Bury the beaconsnapshot the live table

Probe linerestore to scratch table

Strikeverify item for item

Pack outdelete copy and snapshot

No drill report loaded yet. The button above runs one. awaiting first drill

DynamoDB point-in-time recovery and S3 versioning stay on continuously; the drill proves restores actually work.
The scratch table and snapshot are deleted at the end of every run. The drill leaves no tracks.

Run 03 · The closing sweep

Send patrol over every live plank, and watch

At the end of the day patrol skis every run to confirm nobody is left on the mountain. This button dispatches that sweep for real: a Lambda visits all thirteen live boardwalk sites in order, and each row below fills in as patrol reports back with status, response time, page weight, and whether the site is wearing its required security headers.

One sweep at a time; extra visitors watch the sweep under way. The whole run takes about twenty seconds.

Every check is a plain HTTPS request from the patrol Lambda: what a first-time visitor would experience, measured, not assumed.
HSTS and CSP columns prove the boardwalk's security-header policy is actually deployed on every plank, not just written in the standards.

Run 04 · The lookout

Observability: one pane over every plank

From the top of the lift you can see every run on the mountain. A CloudWatch dashboard tracks CloudFront traffic and error rates, API latency (p95), Lambda errors, DynamoDB capacity, and Bedrock usage across the whole boardwalk. Alarms on API 5xx, chat-Lambda errors, DynamoDB throttling, and canary failures radio the operator by email. Lambda and Step Functions run with X-Ray tracing enabled, and a CloudWatch Synthetics canary heartbeats every live plank. The canary is started only for demo windows, because an always-on canary is the classic way to pay real money to watch a free site.

Dashboards, alarms, and traces live in the AWS console; this page is the public, read-only view.
Everything here fits the boardwalk's standing rule: idle cost ≈ $0, spend only during demos.

Patrol hut · The season ledger

What the whole mountain costs to run

Cost discipline is an operations practice, so it gets a public board. Every resource on the boardwalk carries an env tag naming its plank; Cost Explorer reads the month to date straight off those tags. Twelve live environments, and this is the entire bill.

—

Tallying the ledger…

The tripwire budget alerts at $15/month of infrastructure spend and a hard cap budget watches $100 all-in; this board is the same discipline, posted where visitors can see it.
The expensive habit this proves out: scale-to-zero everything, deploy demos on demand, tear them down the same day, and let the ledger keep everyone honest.