diff --git a/.moon/workspace.yml b/.moon/workspace.yml
index cb0706e5..604aa3bc 100644
--- a/.moon/workspace.yml
+++ b/.moon/workspace.yml
@@ -13,6 +13,7 @@
 # and cannot reference projects located outside the workspace boundary.
 projects:
   - .
+  - terraform
 
 # Configures the version control system to utilize within the workspace. A VCS
 # is required for determining touched (added, modified, etc) files, calculating file hashes,
diff --git a/moon.yml b/moon.yml
index f915cd95..fee4e3bf 100644
--- a/moon.yml
+++ b/moon.yml
@@ -1,5 +1,12 @@
 # yaml-language-server: $schema=https://moonrepo.dev/schemas/project.json
 
+project:
+  name: leaky-paywall
+  description: Storipress Leaky Paywall
+
+type: library
+language: typescript
+
 tasks:
   build:
     command:
@@ -58,6 +65,10 @@ tasks:
     deps:
       - ~:lib-analyze
     platform: node
+  deploy:
+    command: noop
+    deps:
+      - ~:minify
   size:
     command:
       - size-limit
diff --git a/terraform/.gitignore b/terraform/.gitignore
new file mode 100644
index 00000000..9b8a46e6
--- /dev/null
+++ b/terraform/.gitignore
@@ -0,0 +1,34 @@
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version 
+# control as they are data points which are potentially sensitive and subject 
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl
new file mode 100644
index 00000000..b0cff80d
--- /dev/null
+++ b/terraform/.terraform.lock.hcl
@@ -0,0 +1,25 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "5.38.0"
+  constraints = "5.38.0"
+  hashes = [
+    "h1:axFddT4mkdtZREgkDXwXdzZGm1qxheF0fLN7S7bJJX4=",
+    "zh:0d58264440fd28b6729990b48d8fd61e732f5570689d17bbbc0c5f2324d3dd00",
+    "zh:175e24a3d399495fc91da359cc30a9fe06b7eeb98804816abcf1493859f6d28e",
+    "zh:244a1f56d6710cc1a643f602a185b46d3cd064f6df60330006f92ab32f3ff60c",
+    "zh:30dd99413867b1be808b656551a2f0452e4e37787f963780c51f1f85bf406441",
+    "zh:3629d4e212c8ffd8e74c4ab9e9d22ca7fff803052366d011c014591fa65beb48",
+    "zh:521badb184bbdde5dddb1228f7a241997db52ea51c9f8039ed5a626362952cf4",
+    "zh:5580a937e1f5fa59c16c4b9802079aa45a16c7c69e5b7d4e97aebf2c0fb4bd00",
+    "zh:87b801057d492ff0adc82ce6251871d87bdf5890749fe5753f447ec6fe4710ff",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9c44e0c143f1d021440e9c448a9bc595f51a95e6cc382fcffe9db6d3b17f24c2",
+    "zh:b7e6b7b182932a3dbb6ca5f8ebb8d37befe1456f3dffaafb37cee07dc0473696",
+    "zh:d43fcf4f59cf79b1be3bec164d95fe9edc3fe39195a83226b911918a6538c8b3",
+    "zh:ec3e383ce1e414f0bd7d3fe73409ff7d2777a5da27248b70fd5df1df323d920b",
+    "zh:f729b443179bb115bbcbb0369fe46640de1c6dbd627b52694e9b3b8a41ec7881",
+    "zh:fd532b707746145d3c6d3507bca2b8d44cc618b3d5006db99426221b71db7da7",
+  ]
+}
diff --git a/terraform/main.tf b/terraform/main.tf
new file mode 100644
index 00000000..4b09bb6b
--- /dev/null
+++ b/terraform/main.tf
@@ -0,0 +1,30 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "5.38.0"
+    }
+  }
+
+  cloud {
+    organization = "Storipress"
+    workspaces {
+      name = "leaky-paywall"
+    }
+  }
+
+  required_version = "1.5.7"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = var.aws_access_key
+  secret_key = var.aws_secret_key
+}
+
+resource "aws_s3_object" "leaky_paywall" {
+  bucket      = "storipress"
+  key         = "assets/storipress/leaky-paywall.min.js"
+  source      = "../lib/leaky-paywall.min.js"
+  source_hash = filemd5("../lib/leaky-paywall.min.js")
+}
diff --git a/terraform/moon.yml b/terraform/moon.yml
new file mode 100644
index 00000000..ce51e6bd
--- /dev/null
+++ b/terraform/moon.yml
@@ -0,0 +1,27 @@
+project:
+  name: terraform
+  description: Deploy leaky-paywall to CDN
+
+type: automation
+
+dependsOn:
+  - leaky-paywall
+
+tasks:
+  fmt:
+    command:
+      - terraform
+      - fmt
+  plan:
+    command:
+      - terraform
+      - plan
+    deps:
+      - ^:deploy
+  deploy:
+    command:
+      - terraform
+      - apply
+      - -auto-approve
+    deps:
+      - ^:deploy
diff --git a/terraform/variables.tf b/terraform/variables.tf
new file mode 100644
index 00000000..11343096
--- /dev/null
+++ b/terraform/variables.tf
@@ -0,0 +1,5 @@
+variable "aws_access_key" {
+}
+
+variable "aws_secret_key" {
+}