From 3906ad18855459db6e5864611618225417c1e7f7 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Fri, 7 Aug 2026 19:28:25 -0400 Subject: [PATCH] fix(infra): assert google-client-id SSM exists at plan time Wire the google_client_id data source into a check so apply fails closed when the OOB parameter is missing. --- terraform/data.tf | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/terraform/data.tf b/terraform/data.tf index 1b16222..0733a3f 100644 --- a/terraform/data.tf +++ b/terraform/data.tf @@ -30,3 +30,13 @@ data "aws_ssm_parameter" "app_web_acl_arn" { data "aws_ssm_parameter" "google_client_id" { name = local.google_client_id_param } + +# Fail closed if the OOB Google client ID parameter is missing or empty. The +# functions receive the parameter NAME via env; this check forces the data +# source to be evaluated so apply cannot succeed without the parameter. +check "google_client_id_present" { + assert { + condition = length(data.aws_ssm_parameter.google_client_id.value) > 0 + error_message = "SSM parameter ${local.google_client_id_param} is missing or empty; create it out of band before apply." + } +}