Infrastructure Design: [Platform or workload name]

Complete infrastructure design for a workload built and run with Infrastructure as Code: environments, network, compute, storage, managed services, repository and module conventions, state, CI/CD for infrastructure, secrets, identity and access, tagging and cost allocation, scaling, backup and disaster recovery, observability, security baselines with policy as code, change management and a cost estimate. Based on common industry practice for cloud infrastructure design. Replace every [bracketed] value and every row marked Example. Worked examples use a web application on a public cloud with Terraform or OpenTofu.

Document control

Approvals

Revision history

Contents

1. Introduction
2. Environments and account structure
3. Network design
4. Compute
5. Storage and data services
6. Managed and shared services
7. IaC repository structure and module conventions
8. State management
9. CI/CD for infrastructure
10. Identity and access management
11. Secrets management
12. Tagging and cost allocation
13. Scaling
14. Backup and disaster recovery
15. Observability
16. Security baselines and policy as code
17. Change management
18. Cost estimate
19. Appendices

1. Introduction

1.1 Purpose and scope

[What this design covers. Example: "Infrastructure for the customer portal: networking, compute, data stores and supporting services in three environments, provisioned entirely from the infra-portal repository."]

1.2 Requirements driving the design

1.3 Key decisions

2. Environments and account structure

Each environment is a separate account so that a mistake in one cannot change another. Ephemeral dev stacks are named dev-<branch> and destroyed after [72 hours] of inactivity.

3. Network design

3.1 Address plan

3.2 Subnets (production primary region)

Application subnets are sized for pod networking. With $p$ pods per node and $n$ nodes per zone at peak, each zone needs at least:

For $n = 20$ and $p = 58$, $N_{addr} \ge 1\,770$, so a /20 (4 096 addresses) leaves room for growth.

3.3 Topology and traffic flow

The diagram shows the production topology in one region.

3.4 Connectivity and controls

4. Compute

5. Storage and data services

6. Managed and shared services

7. IaC repository structure and module conventions

7.1 Repository layout

Reusable modules are separated from the root modules that instantiate them per environment and layer:

infra-portal/
  modules/
    network/          # VPC, subnets, routes, endpoints
    eks-cluster/      # cluster, node pools, add-ons
    postgres/         # database, parameter group, alarms
    bucket/           # object storage with policy and lifecycle
  live/
    dev/
      network/        # root module: calls modules/network
      cluster/
      data/
    stg/
    prod/
    prod-dr/
  policies/           # policy-as-code rules (section 16)
  .ci/                # pipeline definitions

7.2 Conventions

8. State management

9. CI/CD for infrastructure

The pipeline below runs for every pull request and every merge to the main branch.

10. Identity and access management

11. Secrets management

12. Tagging and cost allocation

Default tags are applied at provider level in every root module. Policy rejects resources missing required tags; shared costs (NAT, transit, logging) are allocated by [traffic share / fixed split] each month.

13. Scaling

14. Backup and disaster recovery

DR strategy: [Example: "Pilot light. Network, cluster control plane and database replica exist in the DR region; node pools scale from zero during failover."] Last DR drill: YYYY-MM-DD, measured RTO [n] hours.

15. Observability

16. Security baselines and policy as code

Policy rules live in policies/, are versioned with the IaC and have unit tests. Exceptions require an entry in 19.2 with an expiry date.

17. Change management

Freeze periods: [peak trading weeks, financial year end].

18. Cost estimate

Prices as of YYYY-MM-DD, [region], on-demand unless stated.

Monthly cost for a node pool is $C = N \times h \times p$, where $N$ is nodes, $h$ hours per month (730) and $p$ the hourly price.

19. Appendices

19.1 Glossary

19.2 Exceptions and manual resources

19.3 References

Standard and licence note

Based on common industry practice for cloud infrastructure design and Infrastructure as Code. Original text written for this collection; prices, sizes and ranges are illustrative and must be checked against your provider's current offering. Template licence: MIT.