# sandeepsilumula/terraform-universal-template architecture
> Architecture diagram of the GitHub repository sandeepsilumula/terraform-universal-template, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-20). It is an AI-made overview: check details against the source.
- Interactive diagram: https://gitdiagram.com/sandeepsilumula/terraform-universal-template
- Repository: https://github.com/sandeepsilumula/terraform-universal-template
## Overview
1. This repository is an AWS infrastructure-as-code template built with Terraform. The root of the repo is the orchestration layer; the actual infrastructure is split into reusable modules under `modules/`.
2. The architecture is organized into three main subsystems:
- `modules/networking` for network foundation
- `modules/security` for access control / protection boundaries
- `modules/compute` for the workload host(s), likely the EC2 layer given the SSH instructions in the README
3. The root Terraform files (`main.tf`, `variables.tf`, `outputs.tf`, `providers.tf`) act as the composition layer. They wire the modules together, define shared inputs, configure the AWS provider, and publish top-level outputs for consumers and operators.
4. `backend.tf` indicates remote state management. The README says state is stored in S3 with a DynamoDB lock table, so the infrastructure depends on external AWS services for shared state, concurrency control, and safe team usage.
5. `environments/dev/terraform.tfvars` shows the repo supports environment-specific configuration. The environment folder is the boundary for deployment-specific values, while the modules remain reusable across environments.
6. The `networking` module is the foundation layer. In a typical AWS template like this, it is where VPC-level resources, subnets, routing, and internet connectivity are defined. Other modules depend on it to attach compute into the correct network.
7. The `security` module represents the access and isolation boundary. In practice this usually means security groups and related permissions that control who can reach the compute layer and on what ports.
8. The `compute` module is the runtime workload layer. The README’s SSH instructions and public IP lookup strongly suggest it provisions at least one EC2 instance and exposes connection details through module outputs.
9. Data flow is top-down: environment variables and `terraform.tfvars` feed root variables, root configuration passes those values into the modules, modules create AWS resources, and root/module outputs surface things like instance IPs or other connection endpoints.
10. Operational flow is CI-driven. `.github/workflows/terraform.yml` indicates Terraform runs through GitHub Actions, with AWS credentials supplied via GitHub Secrets. The intended deployment path is push-to-`main`, which triggers provisioning automatically.
11. The repo also has a clear human/operator boundary: after deployment, operators retrieve the instance IP from GitHub Actions logs and connect directly by SSH. That implies the system exposes a public entry point rather than hiding compute behind an application tier.
12. For an architecture diagram, the key relationships are:
- GitHub Actions -> Terraform
- Terraform root -> remote state backend in S3/DynamoDB
- Terraform root -> networking/security/compute modules
- networking/security -> compute as dependencies
- compute -> public SSH access for operators
Main entry points: [`main.tf`](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/main.tf) (Terraform root), [`modules/compute/main.tf`](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/compute/main.tf) (Compute), [`modules/networking/main.tf`](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/networking/main.tf) (Networking), [`modules/security/main.tf`](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/security/main.tf) (Security)
## Diagram (Mermaid)
```mermaid
flowchart TD
subgraph group_g1["Orchestration"]
node_n1["Terraform root
composition
[main.tf]"]
node_n2["Providers
aws config
[providers.tf]"]
node_n3["Backend
state config
[backend.tf]"]
node_n4["Variables
inputs
[variables.tf]"]
node_n5["Outputs
exports
[outputs.tf]"]
end
subgraph group_g2["Environment"]
node_n6["Dev tfvars
env config
[terraform.tfvars]"]
end
subgraph group_g3["Modules"]
node_n8["Networking
vpc module
[main.tf]"]
node_n9["Network outputs
module outputs
[outputs.tf]"]
node_n10["Security
access module
[main.tf]"]
node_n11["Security outputs
module outputs
[outputs.tf]"]
node_n12["Compute
ec2 module
[main.tf]"]
node_n13["Compute outputs
module outputs
[outputs.tf]"]
end
subgraph group_g4["Automation"]
node_n7["GitHub Actions
ci workflow
[terraform.yml]"]
end
subgraph group_g5["External AWS"]
node_n14[("AWS state
s3+dynamodb")]
node_n15[("AWS network
vpc+subnets")]
node_n16{{"AWS security
sg+policy"}}
node_n17[("AWS compute
ec2 instance")]
end
subgraph group_g6["Operators"]
node_n18(("SSH access
operator entry"))
end
node_n7 -->|"runs"| node_n1
node_n6 -->|"fills"| node_n4
node_n1 -->|"uses"| node_n2
node_n1 -->|"stores state"| node_n3
node_n3 -->|"backed by"| node_n14
node_n1 -->|"reads"| node_n4
node_n1 -->|"publishes"| node_n5
node_n1 -->|"composes"| node_n8
node_n1 -->|"composes"| node_n10
node_n1 -->|"composes"| node_n12
node_n8 -->|"provisions"| node_n15
node_n8 -->|"exports"| node_n9
node_n10 -->|"provisions"| node_n16
node_n10 -->|"exports"| node_n11
node_n12 -->|"provisions"| node_n17
node_n12 -->|"exports"| node_n13
node_n8 -->|"feeds network"| node_n12
node_n10 -->|"guards"| node_n12
node_n13 -->|"enables"| node_n18
node_n7 -.->|"reads state"| node_n14
click node_n1 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/main.tf"
click node_n2 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/providers.tf"
click node_n3 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/backend.tf"
click node_n4 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/variables.tf"
click node_n5 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/outputs.tf"
click node_n6 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/environments/dev/terraform.tfvars"
click node_n7 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/.github/workflows/terraform.yml"
click node_n8 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/networking/main.tf"
click node_n9 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/networking/outputs.tf"
click node_n10 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/security/main.tf"
click node_n11 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/security/outputs.tf"
click node_n12 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/compute/main.tf"
click node_n13 "https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/compute/outputs.tf"
classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_n1,node_n2,node_n3,node_n4,node_n5 toneBlue
class node_n6 toneAmber
class node_n8,node_n9,node_n10,node_n11,node_n12,node_n13 toneMint
class node_n7 toneRose
class node_n14,node_n15,node_n16,node_n17 toneIndigo
class node_n18 toneTeal
```
## Components
### Orchestration
Root Terraform files that compose the stack and expose shared configuration.
- [Terraform root](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/main.tf): composition · Top-level Terraform entrypoint that wires the modules together. · `main.tf`
- [Providers](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/providers.tf): aws config · AWS provider and account/region setup. · `providers.tf`
- [Backend](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/backend.tf): state config · Remote state configuration for shared Terraform state and locking. · `backend.tf`
- [Variables](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/variables.tf): inputs · Shared root inputs passed into the stack. · `variables.tf`
- [Outputs](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/outputs.tf): exports · Top-level values published for consumers and operators. · `outputs.tf`
### Environment
Deployment-specific values for a given environment.
- [Dev tfvars](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/environments/dev/terraform.tfvars): env config · Environment-specific deployment values for development. · `environments/dev/terraform.tfvars`
### Modules
Reusable infrastructure subsystems built under modules/.
- [Networking](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/networking/main.tf): vpc module · Network foundation: VPC, subnets, routing, and connectivity boundaries. · `modules/networking/main.tf`
- [Network outputs](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/networking/outputs.tf): module outputs · Networking values consumed by downstream modules. · `modules/networking/outputs.tf`
- [Security](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/security/main.tf): access module · Access control and isolation boundary for the workload. · `modules/security/main.tf`
- [Security outputs](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/security/outputs.tf): module outputs · Security boundary values shared with compute and root outputs. · `modules/security/outputs.tf`
- [Compute](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/compute/main.tf): ec2 module · Workload host layer; likely provisions the reachable EC2 instance. · `modules/compute/main.tf`
- [Compute outputs](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/modules/compute/outputs.tf): module outputs · Connection details such as public IP or SSH endpoint. · `modules/compute/outputs.tf`
### Automation
CI workflow that runs Terraform.
- [GitHub Actions](https://github.com/sandeepsilumula/terraform-universal-template/blob/main/.github/workflows/terraform.yml): ci workflow · Automated Terraform execution on repository events. · `.github/workflows/terraform.yml`
### External AWS
AWS services used by the template and its remote state.
- **AWS state**: s3+dynamodb · Remote backend services for shared state and lock coordination.
- **AWS network**: vpc+subnets · AWS infrastructure resources created by the networking module.
- **AWS security**: sg+policy · AWS access controls created by the security module.
- **AWS compute**: ec2 instance · Provisions the reachable workload host.
### Operators
Human access path after provisioning.
- **SSH access**: operator entry · Direct operator access to the instance after deployment.
## Connections
- GitHub Actions → Terraform root: runs · GitHub Actions invokes Terraform to plan/apply the stack.
- Dev tfvars → Variables: fills · Environment tfvars provide values for root variables.
- Terraform root → Providers: uses · Root composition is built against the configured AWS provider.
- Terraform root → Backend: stores state · Root Terraform uses the remote backend for shared state.
- Backend → AWS state: backed by · State is stored in S3 and locked with DynamoDB.
- Terraform root → Variables: reads · Root module consumes shared inputs.
- Terraform root → Outputs: publishes · Root module exposes stack-level outputs.
- Terraform root → Networking: composes · Root wires in the networking subsystem.
- Terraform root → Security: composes · Root wires in the security subsystem.
- Terraform root → Compute: composes · Root wires in the compute subsystem.
- Networking → AWS network: provisions · Networking module creates the AWS network foundation.
- Networking → Network outputs: exports · Networking module exposes network identifiers and connection values.
- Security → AWS security: provisions · Security module creates AWS access controls and boundaries.
- Security → Security outputs: exports · Security module exposes boundary values for other modules.
- Compute → AWS compute: provisions · Compute module creates the workload host.
- Compute → Compute outputs: exports · Compute module exposes connection details.
- Networking → Compute: feeds network · Compute depends on the network foundation.
- Security → Compute: guards · Security boundaries control access to compute.
- Compute outputs → SSH access: enables · Compute outputs give operators the SSH target.
- GitHub Actions → AWS state: reads state · Automation relies on the remote backend during runs.