Cloud infrastructure & DevSecOps

Patricio Lumbe

Cloud Engineer | AWS & DevOps

I build AWS infrastructure the way I would want to inherit it: defined in Terraform, deployed through GitHub Actions, and locked down enough that one leaked laptop does not turn into one leaked AWS account.

  • Cloud architecture & automation VPC · EKS · Lambda · Terraform · CloudFormation
  • CI/CD & cloud security GitHub Actions · OIDC · Docker · Kubernetes
Start a conversation See the code on GitHub
AWS certifications
2×
Languages spoken
PT · EN · FR
Infrastructure as code
100%
Availability
Remote
Portrait of Patricio Lumbe

Currently preparing

AWS Solutions Architect Professional

In progress

About

I build cloud systems that hold up under load and audit.

I learned cloud engineering by building real systems on my own time and fixing them when they broke. In my Terraform and Kubernetes projects I was both the builder and the person debugging it at 3am when something failed. That is how I earned my AWS certifications: by proving good habits hold up in real systems, not just on paper.

I'm looking to bring that same discipline to a team, remote or on site. I speak Portuguese, English and French, which comes in handy more often than you'd expect when a technical decision needs to be explained clearly, whatever language the room is in.

Technical stack

Cloud & infrastructure

  • Serverless

Automation & delivery

  • GitOps

Security & operations

What I do

Where I can help

Six problems I can help your team solve. Each one links to a real project behind it, the diagram, the repository, and a video walkthrough on the way.

  • Architecture diagram: multi-AZ AWS infrastructure with load balancing and auto scaling. Video coming soon

    Resilient infrastructure & auto scaling

    Systems built to survive a bad day, not just a demo day. Multi AZ by default, traffic handled automatically as it grows or drops, so a spike doesn't mean a 3am phone call.

    VPC · Load Balancing · Auto Scaling

    View project →
  • Architecture diagram: AWS security layer with WAF and threat detection. Video coming soon

    Cloud security, without the 90 page PDF

    Least privilege access, secrets that never touch source control, a firewall in front of anything public, and active threat detection. You get a short list of what actually matters, not a wall of findings nobody reads.

    IAM · WAF · GuardDuty · Secrets Manager

    View project →
  • Architecture diagram: Terraform managed infrastructure on Google Cloud with budget alerts. Video coming soon

    Infrastructure as code & cost control

    Your entire environment defined in Terraform, rebuildable from nothing if it ever needs to be. Budget alerts wired in from day one, so cost stays predictable instead of becoming a surprise at the end of the month.

    Terraform · Budget Alerts · Secret Manager

    View project →
  • Architecture diagram: EKS GitOps platform with ArgoCD driven deployments. Video coming soon

    CI/CD & GitOps automation

    A Git commit is the only way anything reaches production. No one runs a manual command against a live environment, and no long lived AWS key ever sits in a pipeline waiting to leak.

    GitHub Actions · ArgoCD · OIDC

    View project →
  • Architecture diagram: Kubernetes cluster with KEDA autoscaling and IRSA. Video coming soon

    Kubernetes, run by your team afterwards

    An EKS cluster handed over the way it should be: clear namespaces, workloads that scale down to zero when idle so you stop paying for nothing, and no step that only I know how to do.

    EKS · KEDA · IRSA · Helm

    View project →
  • Full demo below ↓

    AI assisted operations & monitoring

    Alarms that explain themselves in plain English instead of a wall of logs, with a human always approving the fix before anything changes. Monitoring tied to what users actually feel, not to a CPU graph nobody reads.

    Claude AI · Step Functions · CloudWatch

    View project →

Need one of these solved on your own infrastructure? Tell me about the project →

Portfolio

Projects, with the code and a walkthrough

Every project links to the real repository. Most also have a short Loom walkthrough and a one page PDF summary you can download and share internally.

Flagship project · AI + AWS · Serverless

AI Ops Serverless Platform

When something breaks in the cloud at 3am, this system does the noticing, the figuring out and the explaining automatically. Claude reads the alarm and writes a plain English diagnosis, then waits for a human to click "approve" before anything runs. Every possible action is pre approved in Terraform, never decided by the AI.

🇬🇧 Watch in English 🇫🇷 Regarder en Français 🇪🇸 Ver en Español 🇵🇹 Assistir em Português

You can watch the full video walkthrough end to end. Just click one of the buttons above in your preferred language.

AI Ops Serverless Platform

Technical case study · PDF

View & download PDF
View the code on GitHub →
Architecture diagram: Production Ready AWS Infrastructure, Multi-AZ networking, load balancer, auto scaling and security services. Demo video coming soon

Infrastructure & Security · Multi-AZ · Zero static keys

Production Ready AWS Infrastructure

An AWS environment built the way real products run: it survives a full zone outage, rolls back a bad deploy on its own before it becomes an incident, and runs CI/CD without a single stored AWS key anywhere.

Five disciplines in one repo: infrastructure as code, architecture, CI/CD, security, and reliability engineering. Not a demo that only works once.

View on GitHub
Architecture diagram: EKS GitOps Platform, ArgoCD, KEDA autoscaling, IRSA and a two service Kubernetes workload. Demo video coming soon

Kubernetes & GitOps · Scales to zero · No kubectl in prod

EKS GitOps Platform

A Kubernetes platform where the only way to deploy is a Git commit, nobody types kubectl against production. A worker service scales down to zero pods when there is no work, so idle time costs nothing.

Authentication happens through short lived tokens, never a stored key. Every design decision, including what was rejected, is written up as an ADR.

View on GitHub
Architecture diagram: Cloud Portfolio Platform, Cloudflare DNS, Firebase Hosting, Cloud Storage, Secret Manager, Cloud Monitoring and a Terraform driven CI/CD pipeline on Google Cloud. Demo video coming soon

Google Cloud · Multi-cloud proof · Live right now

Cloud Portfolio Platform

The website you are looking at right now is itself a Google Cloud project. Firebase Hosting for global delivery, Cloud Storage for video assets, secrets kept in Secret Manager, an uptime check every five minutes, and a budget alert so cost never surprises anyone. Every piece is defined in Terraform.

The AWS projects on this page show what I build. This one shows how I run it: monitored, budgeted, and provisioned entirely as code, on a second cloud.

Visit patriciolumbe.com (live) View on GitHub

More infrastructure, automation and lab projects on github.com/Lumbenlengo →

Case studies

The full story behind selected projects

Longer walkthroughs and full write ups: the problem, the trade offs, and what changed after. Useful if you are deciding whether to bring me onto a real project.

Next case study

Next deep dive in production

The next full write up lands here once recorded: context, problem, approach, measurable result, and the PDF version.

Deep dive

How the environment is built

The four decisions that matter most in that repository, and why I made them.

  1. Private by default

    Application and database tiers live in private subnets across two availability zones. The only public entry point is the load balancer, sitting behind WAF rules. Nothing else is reachable from the internet, including the machines I administer it from.

    Demo video coming soon

  2. No long lived AWS keys

    GitHub Actions assumes an IAM role through OIDC federation, scoped to this repository and branch. There is no AWS_SECRET_ACCESS_KEY to leak, rotate, or accidentally commit. That is the most common way small teams get breached.

    Demo video coming soon

  3. Plan before apply, always

    Pull requests run terraform plan and post the diff for review. Only a merge to main runs apply, against remote state with locking so two pipelines can never fight over the same resources.

    Demo video coming soon

  4. Recoverable, not just backed up

    Backups nobody has restored are a rumour, not a recovery plan. Because the whole environment is code, rebuilding it is a documented, repeatable procedure instead of an improvisation on the day of an incident.

    Demo video coming soon

Want the full write up with cost breakdown, trade offs and failure modes? Ask me for it →

Certifications

Verified, not just listed

Every credential links to its public verification page. The next one is already in progress.

  • AWS Certified

    Solutions Architect Associate

    Designing resilient, cost aware architectures on AWS. This is the certification behind the reference environment on this page.

    Verify on Credly →

  • AWS Certified

    Cloud Practitioner

    The AWS foundation: core services, the security model, and the pricing decisions that keep bills predictable.

    Verify on Credly →

  • In progress

    Solutions Architect Professional

    The professional level AWS architecture certification: complex organisations, large migrations and advanced design.

Journey

Built in public, one system at a time

Since early 2023 I have been learning the hard parts of AWS in the open, then proving each step with something that actually runs. No bootcamp certificates without code behind them. Everything below is public and you can check it yourself.

  1. Foundation · Early 2023

    AWS Cloud Practitioner certified

    I started where most people skip: understanding how AWS charges you and how it protects you, before touching automation. That is why I can look at an architecture today and tell you what it will cost to run and where it is exposed.

  2. Architecture

    AWS Solutions Architect Associate certified

    The step from using AWS to designing on it. Multi AZ so one datacentre going down is not your problem, least privilege so a leaked key is not a disaster, and systems that stay up on a bad day instead of only on a good one.

  3. Shipped · Open source

    Shipped a production ready AWS environment, publicly

    Empty AWS account to running application, fully in Terraform. Private by default networking, pipelines that authenticate without any long lived keys, and a plan reviewed before anything is applied. The whole thing is on GitHub, so you can read exactly how I work before you ever hire me.

  4. Shipped · AI + Ops

    Built an incident response platform with AI in the loop

    A serverless system that notices an alarm, explains the root cause in plain English, and waits for a human to approve before it changes anything. Built on Lambda and Step Functions, every possible action locked down in Terraform. It runs for under a euro a month when nothing is happening.

  5. Next

    AWS Solutions Architect Professional

    Currently studying for it, alongside the next public build. The professional level covers multi account organisations and large migrations, which is the work I want to be doing next.

Contact

Let's build something that stays up.

Cloud architecture reviews, infrastructure automation, CI/CD pipelines, or a second pair of eyes on an AWS account you inherited. Tell me what is breaking. I usually reply within a few hours.

contact@patriciolumbe.com

Elsewhere

Get a quote

Tell me about the project