CI/CD & Delivery Pipelines

Chapter 4 of 6 — AI Cloud Engineer Roadmap

Terraform you run by hand from your laptop is still a manual process with extra steps. This chapter closes that gap: the Terraform from Chapter 3 goes behind a GitHub Actions pipeline, so infrastructure changes go through the same review and automation discipline as application code.

What you'll build: a full IaC pipeline with security scanning — terraform plan on every pull request, terraform apply on merge, with a scanning step that blocks misconfigured resources before they reach AWS.

Tools: Terraform, GitHub Actions

Where AI helps: AI scaffolds the workflow YAML and common job steps fast — you still own the things that make a pipeline trustworthy: secrets handling, approval gates before apply runs against production, and what the security scan is actually allowed to block versus warn on.

Modules in this chapter

• Git & GitHub — branches, PRs, the workflow your pipeline triggers on
• GitHub Actions — Detailed — workflows, jobs, secrets, environments

Why this matters

A pipeline is what turns "infrastructure as code" into an actual operational practice instead of a nice idea. Once terraform apply only ever runs from CI — never from a laptop — you get an audit trail, a single source of truth for what's actually deployed, and a forcing function for code review on infrastructure changes the same way you'd review application code.

---

Next: SRE, Production Readiness & RAG Capstone

Chapter 5 assumes your pipeline is shipping changes regularly, and asks the next question: how do you know when something breaks? Grafana, Prometheus, and a live incident simulation.