Projects

Selected builds from the Sidford lab — Landing Zone security, cost governance, and AI-agent infrastructure on AWS.

AWS Landing Zone Security Incident & Response

Private

Tiered incident response platform extending an AWS Landing Zone Accelerator estate. Tier 0 automated triage captures immutable forensic evidence on a critical Security Hub finding, cross-references it against Log Archive data via Athena, and produces an AI-assisted severity assessment via Amazon Bedrock before alerting the SOC. Tier 1 provisions hardened, SSM-only forensic workstations on demand through a Cognito-gated self-service portal.

TerraformGuardDutySecurity HubStep FunctionsBedrockSES

Multi-Layer AWS Cost Anomaly Detection

Private

Three-tier spend-anomaly framework built to catch runaway cost before it reaches the bill: a ~15-second CloudTrail/EventBridge layer for known bad patterns, a CloudWatch resource-metrics layer for minutes-scale drift, and a Cost Anomaly Detection/Budgets backstop. Ships for both single-account and multi-account Landing Zone topologies.

TerraformEventBridgeCloudWatchCost Explorer

Billing & Cost MCP Server on Bedrock AgentCore

Private

Self-hosted Model Context Protocol server wrapping AWS's billing and cost tooling in a streamable-HTTP proxy, deployed inside Amazon Bedrock AgentCore Runtime. Gives Claude and other MCP-capable clients live, org-wide Cost Explorer, Compute Optimizer, and Savings Plans data through a single VPC-isolated, zero-trust endpoint.

PythonMCPBedrock AgentCoreFastMCPTerraform

AWS Landing Zone Daily Operational Checks

Private

Scheduled Lambda running pluggable checks — security posture, org health, configuration drift, cost — across an entire Landing Zone Accelerator estate, reporting out to S3, a branded HTML digest, and a self-hosted Mattermost channel. Deployed cross-account via CodePipeline with a manual approval gate.

TerraformLambdaSESMattermostCodePipeline

AWS New Service & SCP Guardrail Monitor

Private

Watches the AWS service catalogue for newly released services and proposes updates to an organisation's Service Control Policy blacklist automatically, with checksum-verified state tracking and a full CloudWatch alerting and runbook suite.

TerraformLambdaDynamoDBSCP

Security Hub Findings Digest

Public repo

Serverless daily digest of AWS Security Hub findings across a multi-account Organization — grouped by severity and delivered as a colour-coded HTML email via SES.

TerraformPythonLambdaSES

View on GitHub →

Mattermost on AWS ECS Fargate

Private

Production-ready, multi-AZ Terraform module for self-hosting Mattermost — Fargate containers behind an ALB, PostgreSQL RDS, optional WAF/SSO/Cognito, autoscaling, and a fully documented security posture.

TerraformECS FargateRDSWAFCognito

Team Leaderboard

Private

Serverless leaderboard platform built for a team competition — public real-time rankings, a Cognito-protected admin dashboard for point allocation, and an immutable audit trail, fronted by CloudFront and WAF.

TerraformDynamoDBCognitoJavaAPI Gateway

AWS Junior Engineer Training Programme

Private

A four-week reference curriculum of hands-on Terraform build exercises for junior cloud engineers — progressing from VPC networking fundamentals through compute autoscaling, serverless/event-driven patterns, to security automation.

TerraformVPCAuto ScalingServerlessSecurity

Washing Machine Notifications

Public repo

A deliberately over-engineered serverless reminder system — weekly email and push notifications with escalating daily nag messages, geo-restricted CloudFront, and Parameter Store secrets. Proof that the same rigour used on sovereign-solutions-grade platforms works just as well on household chores.

TerraformLambdaPushoverCloudFront

View on GitHub →