CloudExpire

Temporary cloud environments outlive their purpose, creating unnecessary cost and a wider security surface. CloudExpire is a serverless lifecycle engine: it provisions short-lived EC2 instances with a time to live of 1 to 24 hours, tracks the expiry state in DynamoDB and terminates expired resources from a scheduled Lambda.

• On-demand provisioning: request an EC2 instance over a REST API with a configurable TTL of 1 to 24 hours.
• TTL tracking: DynamoDB keeps the creation timestamp, expiry window and active state of every resource.
• Automated cleanup: EventBridge triggers a cleanup Lambda every five minutes to terminate expired instances.
• Safety guardrails: destruction is disabled by default (dry run) and ownership tags are validated before any termination.
• State reconciliation: stale unprovisioned requests are recovered, and resources move through REQUESTED, ACTIVE, CLEANUP_PENDING, CLEANED or FAILED.
• Infrastructure as code: the whole AWS footprint is defined and provisioned with Terraform.
• Observability: structured execution summaries and metrics go to CloudWatch with 14-day retention.

• A FastAPI application behind API Gateway and Lambda handles requests; DynamoDB stores creation and expiry timestamps with the resource metadata in a single table.
• EventBridge invokes a separate cleanup Lambda every five minutes. Cleanup evaluates expiry timestamps itself instead of relying on DynamoDB TTL deletion.
• Ownership tags (Project, ManagedBy, ResourceId) are validated before any termination; EC2 launch and termination stay disabled unless enabled through explicit environment flags.
• Stale requests without an instance are marked FAILED after a grace period, so the table never fills with ghosts.
• The cleanup role restricts ec2:TerminateInstances with tag conditions; DynamoDB is on demand and the API bearer token lives in SSM Parameter Store as a SecureString.
• Terraform ignores the Lambda code hash so the cleanup package can be deployed from CI independently of the infrastructure.

API Gateway

Public REST interface forwarding to the FastAPI Lambda

Lambda (API)

FastAPI application handling resource requests and auth

DynamoDB

Single-table resource metadata, status and TTL

EventBridge

Cron rule invoking cleanup every five minutes

Lambda (cleanup)

Scans expired records, checks EC2 tags, terminates

EC2

Temporary instances launched with ownership tags

SSM Parameter Store

Bearer token for API authentication

CloudWatch Logs

14-day execution logs and operational metrics

Backend and API

Python 3.12, FastAPI, Pydantic v2, Uvicorn

Cloud services

EC2, DynamoDB, Lambda, EventBridge, API Gateway, SSM, CloudWatch

IaC and tooling

Terraform, Docker, pytest, GitHub Actions

• GET/healthPublic service health check
• POST/resourcesRegister and provision a temporary resource
• GET/resourcesList all tracked resources
• GET/resources/{id}Resource details and lifecycle status

CloudExpire automatically cleans up expired resources while checking ownership tags before termination. A planned next step is cross-account provisioning through IAM roles and STS, so users could have resources created in their own AWS accounts.