$ terraform apply # AWS labs, with a runner

AWS infrastructure defined in Terraform. scripts/run-lab.sh runs each lab end to end: init → validate → apply → exercise against the live API → destroy, always destroying even when a step fails, and writes a Markdown evidence report. Guardrails: a budget alarm, tag-based orphan sweep, and a nuke for anything left behind. Labs are sized to cost well under a dollar per run.

$ gh run view 36888842277 # lab 06, the flagship

A containerized API on ECS Fargate behind an ALB, deployed by GitHub Actions that assume an AWS role through OIDC (no long-lived keys). Lint → validate → build and push → plan → a human approval gate → apply → a smoke test against the live endpoint. Then a separate destroy workflow counts survivors from the owning services, not a tagging index.

lint ✓validate ✓build + push (OIDC) ✓ plan ✓approval ✓apply ✓smoke ✓ lab 06 · GitHub Actions run 36888842277 · 2026-10-01

$ bash ./exercise.sh evidence
PASS: ALB /healthz returned 200 {"status":"ok"}
PASS: 2 healthy targets (desired 2)
PASS: service runningCount == desiredCount (2)
PASS: every running task runs the ECR digest for tag bf99413a… (sha256:486cd195…)
PASS: /version reports the deployed tag (bf99413a…)
$ gh workflow run lab06-destroy.yml   # 34 resources destroyed · survivors by owning services: 0 · ~1.5 h up ≈ $0.15

$ ls labs/ # each one applied, exercised, destroyed

Loading labs…

★ Full labs repo on GitHub ↗

⇄ Networking labs

Linux + Raspberry Pi + AWS networking labs — each a study-grade write-up with topology, key steps, and an honest "be ready to explain" list.

▶ Building next (ranked by what 34 current entry-level cloud postings ask for)

06 · Flagship: containerized API on ECS Fargate, deployed by GitHub Actions — shipped 2026-10-01, see the run above. Python 18/34 · Terraform 17/34 · CI/CD 10/34 · Docker 11/34
07 · fleet-ops: the production fleet as a public repo — published 2026-10-01: systemd unit/timer patterns, self-heal + watchdog design, alerting pipeline, five postmortems (symptom → diagnosis → fix → prevention). github.com/ravikus1457/fleet-ops troubleshooting 26/34 · incident/RCA 21/34 · runbooks 21/34
08 · Python + boto3 operations toolkit, with tests — published 2026-10-01: idle-resource reporter, IAM key-age audit, snapshot janitor, alarm bootstrapper, tag sweep that verifies each ARN with its owning service, Telegram notifier; 65 tests under moto, dry-run always wins over any mutate flag. github.com/ravikus1457/aws-ops-toolkit scripting 18/34 · cost/FinOps 12/34
09 · Networking in cloud terms — multi-VPC with Transit Gateway and peering, VPC endpoints, Route 53 private zones, ALB/NLB TLS, flow-log analysis; three troubleshooting write-ups (DNS, TLS handshake, asymmetric routing). networking 27/34 · firewall 10/34 · DNS 6/34
10 · Containers at scale + observability — shipped 2026-10-01 as lab 07, green on real AWS (run 36904319402, 11/11 smoke assertions incl. the alert firing on fault injection): an ephemeral EKS cluster (managed nodes, IRSA, access entries), a Helm chart for the lab 06 app with HPA and PDB, kube-prometheus-stack with alert rules and a Grafana dashboard, its own OIDC pipeline with an approval gate and a nightly destroy. Validated offline with terraform validate, tflint, helm lint and kubeconform, then applied, exercised and destroyed by CI. Kubernetes 18/34 · monitoring 22/34 · Grafana 9/34

Counts: postings containing the term, out of 34 entry/mid cloud postings open on 2026-09-30 (support, CloudOps, Cloud Engineer I/II, junior DevOps/SRE, NOC). Certs named: SAA 3, CCP 2, CloudOps 1; CompTIA 1; ITIL 0.

$ ./market-scan # what cloud postings ask for, auto-updated

A demand signal from — job postings my own job-search agent has collected, blended with current AWS and networking hiring trends. An agent on my Pi regenerates this weekly and turns uncovered skills into the "building next" list above.