Production PortfolioArchitect: Ajit Dev (@ajitdev01) · CTO @ BrainzimaKatihar, Bihar, India

Cloud Security & DevSecOps Portfolio

Zero Trust cloud architectures, multi-tier AWS network isolation, IAM least-privilege automation, container runtime security, and CIS Benchmark compliance implemented by Ajit Dev.

AWS Multi-AZ VPC Isolation

IAM Least-Privilege Hardening

Shift-Left SAST/DAST Automation

Zero Trust Network Architecture

1. Multi-Tier AWS VPC Zero-Trust Network Topology

Network Segmentation & Egress Control

In production environments designed by Ajit Dev, workloads are strictly partitioned across multiple Availability Zones to eliminate single points of failure (SPOF) and enforce zero-trust lateral isolation:

// AWS Multi-AZ VPC Network Layout (Production Hardened)

Internet Traffic (HTTPS 443) │ ▼ [ AWS WAF ] ──▶ Rate Limiting, OWASP Top 10 Rules, Geo-blocking │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ Public Subnet (us-east-1a / us-east-1b) │ │ ├── Application Load Balancer (ALB) [TLS 1.3 Termination] │ │ └── Managed NAT Gateways (Outbound Internet Egress Only) │ └────────────────┬────────────────────────────────────────────────┘ │ (Internal HTTPS only — Security Group restricted) ▼ ┌─────────────────────────────────────────────────────────────────┐ │ Private Compute Subnet (No Public IP Assignment) │ │ ├── ECS Fargate / Kubernetes Worker Nodes │ │ │ └── Next.js 16 Web Apps & Node.js REST Controllers │ │ └── IAM Role Sessions (Short-lived AWS STS Tokens) │ └────────────────┬────────────────────────────────────────────────┘ │ (Port 5432 / 27017 only from Compute SG) ▼ ┌─────────────────────────────────────────────────────────────────┐ │ Isolated Database Subnet (Zero Internet Ingress / Egress) │ │ ├── Amazon Aurora PostgreSQL (Multi-AZ Cluster Encrypted) │ │ └── AWS Secrets Manager / KMS Key Rotation │ └─────────────────────────────────────────────────────────────────┘

Public Layer

Only the Application Load Balancer (ALB) and NAT Gateways reside here. Direct SSH/RDP ports are forbidden.

Compute Layer

Node.js and Next.js microservices run inside private subnets without public IPv4 addresses, routing through NAT.

Data Layer

Database instances have zero internet route tables, accepting traffic exclusively from compute security groups.

2. Tested Terraform IaC: Subnet & Security Group Isolation

Automated Security Guardrails via Terraform

Below is an extract of the declarative Terraform module implemented by Ajit Dev, provisioning an isolated security group that prevents lateral privilege escalation:

// main.tf — Hardened Security Group with Least Privilege Ingress

resource "aws_security_group" "app_compute" { name = "ajitdev-prod-compute-sg" description = "Enforce ingress only from Application Load Balancer" vpc_id = aws_vpc.production.id # Ingress: Only HTTP from ALB Security Group ingress { description = "Allow HTTP traffic from ALB security group" from_port = 3000 to_port = 3000 protocol = "tcp" security_groups = [aws_security_group.alb.id] } # Egress: Restricted to HTTPS outbound via NAT Gateway egress { description = "Allow HTTPS outbound for package updates and AWS APIs" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } tags = { Environment = "Production" ManagedBy = "Terraform" Security = "ZeroTrust-Layer4" Owner = "Ajit Dev (@ajitdev01)" } }

3. AWS IAM Least-Privilege Policies with Enforced TLS

Cryptographic Verification & In-Transit Protection

Every IAM policy engineered by Ajit Dev mandates encrypted transit (`aws:SecureTransport: true`) and restricts actions strictly to explicit bucket ARNs:

// iam-s3-vault-policy.json — Mandating TLS 1.3 Transport

{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAppAccessToVaultObjects", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::ajitdev-secure-vault/*" }, { "Sid": "DenyInsecureTransportRequests", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "arn:aws:s3:::ajitdev-secure-vault", "arn:aws:s3:::ajitdev-secure-vault/*" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] }

4. Production Case Study: Brainzima Cloud Security Hardening

Real Projects, Tested Tools, and Verified Results

As CTO at Brainzima Innovation Institute in Katihar, Bihar, Ajit Dev led the comprehensive security hardening of the institutional cloud infrastructure and student platforms:

Challenge

Mitigating automated credential stuffing, securing JWT token lifetimes, and preventing container vulnerability propagation in production Next.js apps.

Architecture Solution

Integrated GitHub Actions CI/CD with Trivy container audits, enforced AWS WAF rate-limiting rules, and implemented automated secret rotation via AWS Secrets Manager.

Critical CVEs

99.9%

Uptime SLA

A+

SSL Labs Rating

100%

TLS 1.3 Coverage

Next In DevSecOps

Explore Automated DevSecOps CI/CD Pipelines

Inspect how Trivy, GitLeaks, Semgrep, and OWASP ZAP are integrated into GitHub Actions pipelines to block vulnerable pull requests before deployment.