From 402541613b1b7c4b017e7721fd88134aab8c817c Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 21 Sep 2026 23:45:18 +0000 Subject: [PATCH] feat(infra): export attached VPC ids and lock prod to afterhours (DEV-289) Prod must keep existing_vpc_id pointed at the afterhours VPC. Outputs expose the resolved vpc_id and public subnet IDs. Co-authored-by: Adam Moussa --- terraform/data.tf | 7 +++++++ terraform/locals.tf | 3 ++- terraform/outputs.tf | 10 ++++++++++ terraform/variables.tf | 2 +- 4 files changed, 20 insertions(+), 2 deletions(-) diff --git a/terraform/data.tf b/terraform/data.tf index 33df82e..6e3d503 100644 --- a/terraform/data.tf +++ b/terraform/data.tf @@ -69,6 +69,13 @@ check "dev_has_no_custom_domain" { } } +check "prod_reuses_afterhours_vpc" { + assert { + condition = !local.is_prod || var.existing_vpc_id != "" + error_message = "Prod must set existing_vpc_id to the afterhours VPC. Do not mint 10.60." + } +} + check "existing_vpc_pair" { assert { condition = (var.existing_vpc_id == "") == (length(var.existing_public_subnet_ids) == 0) diff --git a/terraform/locals.tf b/terraform/locals.tf index a667f37..6678bdf 100644 --- a/terraform/locals.tf +++ b/terraform/locals.tf @@ -7,7 +7,8 @@ locals { github_oidc_provider_arn = "arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com" - # Created only when existing_vpc_id is empty. 10.60 is unused in 011934824531. + # Created only when existing_vpc_id is empty. Prod attaches to afterhours 10.70. + # 10.60 is the unused fallback CIDR, not a second prod VPC. manage_vpc = var.existing_vpc_id == "" vpc_cidr = "10.60.0.0/16" public_subnet_cidrs = ["10.60.0.0/24", "10.60.1.0/24"] diff --git a/terraform/outputs.tf b/terraform/outputs.tf index a28d665..766e28c 100644 --- a/terraform/outputs.tf +++ b/terraform/outputs.tf @@ -57,3 +57,13 @@ output "ecs_task_role_arn" { description = "ECS task role; paychex-checkcomponents queue policy must allow this ARN." value = aws_iam_role.ecs_task.arn } + +output "vpc_id" { + description = "VPC the ALB and Fargate tasks run in. Prod attaches to afterhours." + value = local.vpc_id +} + +output "public_subnet_ids" { + description = "Public subnet IDs for the ALB and Fargate tasks." + value = local.public_subnet_ids +} diff --git a/terraform/variables.tf b/terraform/variables.tf index e057094..7a10c92 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -93,7 +93,7 @@ variable "checkcomponents_queue_arn" { } variable "existing_vpc_id" { - description = "When set, place the ALB and Fargate tasks in this VPC instead of creating one." + description = "When set, place the ALB and Fargate tasks in this VPC instead of creating one. Prod attaches to the afterhours VPC." type = string default = "" }