GDPR-Compliant AWS Infrastructure with Terraform

💼 GDPR-Compliant AWS Infrastructure — Deploy in 10 Minutes

Set up encrypted, auditable, and production-ready AWS cloud architecture with Terraform. No guesswork. No lawyers. Just code.

Core GDPR Requirements:

- All data encrypted at rest (KMS) and in transit (TLS).

- Isolated networking (private subnets, no public RDS/ECS).

- Audit logging (CloudTrail + VPC Flow Logs + S3 access logs).

- Automated backups (RDS snapshots retained for 35 days).

- EU data residency (`eu-west-1` or eu-central-1).

Project Structure Overview

├── 📄 README.md # GDPR documentation, setup instructions

├── 📄 main.tf # Core modules (VPC, RDS, ECS, KMS, Monitoring)

├── 📄 variables.tf # Input variables with descriptions

├── 📄 outputs.tf # Endpoints, ARNs, etc.

├── 📄 terraform.tfvars.example # Example non-sensitive configs (copy to terraform.tfvars)

├── 📄 backend.tf # S3/DynamoDB remote state configuration

├── 📄 .gitignore # Git ignore file

│

├── 📁 modules/ # Reusable modules:

│ ├── 📁 vpc/ # VPC, private subnets, NAT, Flow Logs

│ │ ├── 📄 main.tf

│ │ ├── 📄 variables.tf

│ │ └── 📄 outputs.tf

│ ├── 📁 rds/ # Encrypted PostgreSQL (private, no public IP)

│ │ ├── 📄 main.tf

│ │ ├── 📄 variables.tf

│ │ └── 📄 outputs.tf

│ ├── 📁 ecs/ # Fargate w/ private subnets + IAM roles

│ │ ├── 📄 main.tf

│ │ ├── 📄 variables.tf

│ │ └── 📄 outputs.tf

│ ├── 📁 kms/ # Encryption keys (RDS, S3, Secrets)

│ │ ├── 📄 main.tf

│ │ ├── 📄 variables.tf

│ │ └── 📄 outputs.tf

│ └── 📁 monitoring/ # CloudTrail, S3 Log Bucket

│ ├── 📄 main.tf

│ ├── 📄 variables.tf

│ └── 📄 outputs.tf

│

└── 📁 scripts/

├── 📄 deploy.sh # Init + plan + apply (manual approval)

└── 📄 destroy.sh # Full destroy (GDPR data purge - with confirmation)