Insight Marketing & Docs Portal Infrastructure — Unified Pulumi IaC with GitLab CI/CD

Owned the infrastructure and CI/CD track for the company marketing site (Insight v2) and the external-product docs portal. A single Pulumi (TypeScript) stack defines the AWS footprint for both builds, GitLab CI standardizes S3 deploys and CloudFront invalidation, and every merge request gets its own review hostname routed by an edge function. The v1 to v2 cutover swapped only the CloudFront origin, leaving domain, certificate, and DNS untouched.

Architecture

InfoGrab Tech Content Platform

2026.02 - Present

InfoGrab Insight

Tech Stack

Pulumi TypeScript AWS S3 CloudFront CloudFront Functions Route53 ACM IAM GitLab CI/CD IaC Static Site Hosting Migration Support MR Preview FinOps

Highlights

Two portals in one Pulumi stack — six S3 buckets, four CloudFront distributions, three edge functions, and two certificates declared in a single TypeScript index.ts
Per-MR review environments with their own hostname — an edge function reads the MR number from the Host header and maps it onto the origin path, while a wildcard certificate and DNS record give every MR an address; the CI post-processing that used to rewrite build output is gone
Two-layer review cleanup — closing an MR deletes its prefix immediately, with a 30-day S3 lifecycle rule as the backstop
v1 to v2 cutover — swapped only the CloudFront origin, leaving domain, certificate, and DNS untouched; rollback is the same single move
Deployment credentials moved from a human account to a dedicated AssumeRole-only role, unblocking a read-only profile, with S3 and Route53 scoped to resource ARNs
Production pipeline cleanup — replaced a 2–3 minute aws-cli install with the distro package (~2 seconds), cut before_script from 3–4 minutes to 38 seconds, and restored deploy-completion notifications
Production AWS account cost analysis — derived savings items from Cost Explorer, CloudWatch, and live cluster measurement; corrected over-provisioned node root-disk IOPS against measured peaks for $140/month

Key Tasks

Pulumi IaC (AWS)

All resources declared in a single TypeScript index.ts (single stack)
Six S3 buckets — Insight v1 / v2 prod, 30-day-expiry review, CDN, docs prod, docs review
Four CloudFront distributions (insight, review, cdn, docs) + Route53 records + ACM (us-east-1) — the review wildcard certificate is issued and validated in code, validation records included
Three CloudFront Functions — review host routing, docs trailing slash, redirects
Docs-portal response headers policy (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, CSP in Report-Only), closing a security-review finding
Shared and per-portal resources separated at the code level

Deployment Credentials and Permissions

Unblocked a read-only profile that could not create S3 buckets or change CloudFront, by standing up a dedicated deploy role
The role is entered only via AssumeRole from another account — the local credential is one profile pointing at it
S3 scoped to the bucket ARNs this stack owns, Route53 scoped to a single hosted zone
Pulumi state kept in a dedicated S3 backend

GitLab CI/CD Automation

Standard job: S3 sync → CloudFront invalidation, applied identically to both portals
Per-MR isolated review-environment auto-deploy — every MR gets its own hostname, which an edge function maps onto the matching origin path
Build output is uploaded under the MR-numbered prefix untouched — the viewer URL is resolved by hostname, so nothing inside the artifact has to be rewritten
Closing an MR deletes its review prefix immediately, with a 30-day S3 lifecycle rule behind it
Environment variables and secrets standardized via GitLab CI variables

Production Pipeline Optimization

Replaced a 2–3 minute per-run aws-cli install with the distro package (~2 seconds)
before_script cut from 3–4 minutes to 38 seconds (measured in a verification environment)
Added npm caching, pinned a floating image tag, parallelized independent jobs via DAG
Blocked concurrent deploys with a resource group; S3 sync now transfers only changed objects
Restored deploy-completion notifications that were failing on a job-name mismatch

v1 to v2 Cutover Infrastructure

Separate v1 and v2 buckets under one domain — cutover by swapping the CloudFront origin
Domain, alias, certificate, DNS, and distribution ID all left unchanged
v1 bucket retained as the rollback path rather than retired at cutover
Added the edge functions the cutover required (trailing slash, redirects) and removed the SPA fallback error response

Production Account Cost Analysis

Analyzed and reported the monthly cost structure from Cost Explorer, CloudWatch, S3 object listings, and live cluster measurement
Corrected over-provisioned node root-disk IOPS against measured peaks — IaC change through to node replacement ($140/month)
Catalogued remaining savings items with amounts — extended-support charges, Savings Plans, non-functioning log retention

삶을 기록하는 두 축

Architecture