Platform & Infrastructure Engineer — your first job

Remote state & locking

Author a real S3 backend with DynamoDB locking and watch real Terraform init, lock, and store state — exactly where the free track ends.

Modules

Author and compose local modules with real namespaced state, then instantiate them twice — the unit of reuse on every team.

Import & refactor

Adopt hand-made infrastructure with config-driven import blocks, and rename resources safely with moved blocks.

A production capstone

Ship a stack from a written brief — backend, module, variables, and dependent resources — validated end to end by real Terraform.

Real AWS workflows

Real init / plan / apply against a sandboxed AWS endpoint: genuine provider behavior, no bill, no blast radius.

Multiple environments

Promote one parameterized configuration across dev and prod — validated variables, environment-keyed config, and why directories beat workspaces.

CI/CD for Terraform

Run the pipeline's jobs yourself — plan as the pull-request review gate, apply on merge — through shared state and locking, plus OIDC and saved-plan mechanics.

Testing & policy-as-codecoming soon

terraform test, policy-as-code (OPA/Sentinel), and secrets management.

Redirection & streams

stdout vs stderr, 2>&1 (and why order matters), /dev/null, tee, and process substitution.

Files, links & inodes

Safe mkdir/cp/rm, stat and inodes, hard links vs symlinks, and the release-symlink swap.

Find files & search trees

find by name/type, grep -r through contents — names vs contents.

Permissions & ownership

Read an ls -l mode, chmod (symbolic + octal), and fix the execute-bit gotcha.

Transform text

sed substitution, awk columns, and cut / sort | uniq -c / tr in a pipeline.

Bulk operations

xargs (-I {}, NUL-safe find -print0 | xargs -0) to act on whole file sets.

Archives & compression

tar create/list/extract, --exclude, gzip levels, and dated, checksummed backups.

fstab & mounts

findmnt, the six fstab fields, adding a disk by UUID with nofail, and fixing a line before it breaks the boot.

Disk & system health

df, du, find big files, free vs cgroup limits, load and top processes, a one-line report.

Processes & top

Read top's summary, catch CPU and memory hogs, stop a runaway with signals, and renice instead of kill.

Reading logs

/var/log, tail and grep by level and time window, SSH brute force in auth.log, zgrep, tail -f, journalctl.

Environment & PATH

export and inheritance, per-command variables, PATH lookup, ~/bin, aliases vs functions.

Log-triage capstone

Build one pipeline that finds the worst-offending endpoint in a real log.

Functions & arguments

Reusable functions, positional params, and getopts flag parsing.

Arrays & parameter expansion

Safe "${arr[@]}" iteration and in-shell string surgery.

Pattern matching

case dispatch, nullglob-safe globs, [[ =~ ]] with BASH_REMATCH, and numeric version compares.

Reading files line by line

IFS= read -r, CSV and config parsing, the pipe-subshell trap, and mapfile.

Associative arrays

declare -A lookups, key checks with defaults, and one-pass counting with sorted output.

Strict mode & exit codes

set -euo pipefail, $?, and the contract CI uses to pass or fail.

Debugging scripts

bash -n, bash -x with a line-numbered PS4, ERR traps, and a real word-splitting bug fixed.

Safe unattended scripts

mktemp + cleanup traps, atomic writes via mv, flock against overlapping runs, idempotency.

Processes & signals

Background jobs, $!, wait, and trap-based cleanup you'd run unattended.

Build-a-script capstone

A strict-mode, data-driven health-check script from a brief.

Undo & rewrite history

Reset, revert, amend — get out of trouble without panic.

Resolve merge conflicts

Read conflict markers and finish a real merge by hand.

Remotes

push/clone against a remote (taught offline via a local bare repo).

Rebase & cherry-pick

Diverge → rebase → fast-forward, and pick a single commit across branches.

.gitignore

Ignore patterns + check-ignore so the wrong files never get committed.

Capstone

Drive a realistic multi-step Git workflow from a brief.

Functions & test-driven Python

Write functions and make an in-file assert suite pass.

pytest

Make a real pytest suite green, then write parametrize + pytest.raises tests.

JSON & CSV

Parse and emit the two formats infra data actually arrives in.

Regex parsing

re findall/search/sub over real log lines.

Errors & exit codes

try/except, raising on bad input, and signaling failure to the OS.

subprocess & CLIs

Shell out safely with subprocess, and build argparse CLIs with dataclasses.

Capstone

A small, tested Python tool built from a brief.

Keys & digital signatures

Ed25519, ECDSA and RSA keys; sign, verify, and catch a tampered release.

HS256 from scratch

Sign and verify a JWT with only openssl, then cross-check it with PyJWT.

Validating claims

Algorithm allow-list, aud/iss, expiry with leeway, required claims, and scopes.

JWT attacks

Forge alg:none and RS256→HS256 key-confusion tokens, crack a weak secret, then fix the verifier.

JWKS & key rotation

ES256 with kid, a published JWKS, and rotating keys without downtime.

Certificates up close

Subject, SANs, key usage, expiry checks, fingerprints, and PEM/DER/PKCS#12.

Build your own CA

Root → intermediate → leaf with openssl, and why chains break.

The TLS handshake, live

TLS 1.3 message by message with s_client, TLS 1.2, SNI and ALPN.

Debugging broken TLS

Expired, wrong host, missing intermediate, self-signed, key mismatch: diagnosed from the error.

Mutual TLS & revocation

Client certificates, a CRL the server enforces, and a live OCSP responder.

SSH keys & host verification

Ed25519 keys, authorized_keys, known_hosts, and a simulated man-in-the-middle.

SSH config, agents & jump hosts

~/.ssh/config, ssh-agent, ProxyJump through a bastion, and the agent-forwarding risk.

SSH tunnels & file transfer

-L, -R and -D forwarding, scp/sftp, and ControlMaster multiplexing.

SSH hardening & certificates

sshd -T audits, forced-command keys, and SSH user and host certificates.

Capstone

Secure a service end to end: private CA, TLS, ES256 JWTs with a JWKS, and SSH-only access.

IAM & policies

Users + least-privilege policies, attached and verified.

EC2 & networking

VPC → subnet → run-instances; the compute & networking mental model.

DynamoDB

create-table, put/get, and scan a NoSQL table.

Messaging (SQS & SNS)

Queue round-trips and SNS→SQS pub/sub fan-out, proven end to end.

Multi-service capstone

Wire an S3 + DynamoDB + IAM backbone from a brief.

Idempotency

Desired-state tasks that converge a machine and are safe to re-run.

Variables, facts & templates

vars, gathered facts, and Jinja2 templates rendered to config.

Loops & conditionals

loop + when to do one task across many items, only where it applies.

Handlers & notify

Trigger a restart only when something actually changed.

Roles

Package automation into reusable roles and parameterize per environment.

Capstone

Configure a service end to end — vars, template, loop, handler — from a brief.