mirror of
https://github.com/Sea-Haven-Industries/meal-order-manager.git
synced 2026-09-30 07:43:13 +00:00
44c79fdefd
* feat(infra): add lightweight meal-order-manager-dev (PLAT-210) Parameterize the HCP root for seahaven-dev with schedules, PITR, alarms, and Paychex gated off so a second env does not clone production cost or side effects. * fix(infra): drop prod-only authorizer import so dev can create it (PLAT-210) The PLAT-102 import is already in meal-order-manager-prod state. A shared import block fails in seahaven-dev because the permission does not exist there. * fix(iam): allow creating the weekly-menu githubdeploy role in seahaven-dev (PLAT-210) Prod imported that role. A new account needs CreateRole on tf-managed/githubdeploy-meal-order-manager-weekly-menu.
70 lines
2.7 KiB
HCL
70 lines
2.7 KiB
HCL
data "aws_caller_identity" "current" {}
|
|
|
|
# Resource names in locals.tf embed the account ID. If the workspace is ever
|
|
# pointed at another account, fail the plan here rather than creating a parallel
|
|
# set of oddly-named resources somewhere else.
|
|
check "correct_account" {
|
|
assert {
|
|
condition = data.aws_caller_identity.current.account_id == local.account_id
|
|
error_message = "This configuration targets account ${local.account_id} (${var.environment}), but the credentials resolve to ${data.aws_caller_identity.current.account_id}."
|
|
}
|
|
}
|
|
|
|
# Alarm sink owned by seahaven-org-baseline, not by this configuration.
|
|
# Looked up only in prod because CloudWatch alarms are skipped in dev.
|
|
data "aws_sns_topic" "site_alerts" {
|
|
count = local.is_prod ? 1 : 0
|
|
name = "site-alerts"
|
|
}
|
|
|
|
moved {
|
|
from = data.aws_sns_topic.site_alerts
|
|
to = data.aws_sns_topic.site_alerts[0]
|
|
}
|
|
|
|
# Shared CloudFront WAF WebACL (audit M-17), published to Parameter Store by the
|
|
# org baseline. aws_cloudfront_distribution.web_acl_id takes the WAFv2 ARN
|
|
# despite the attribute name.
|
|
data "aws_ssm_parameter" "app_web_acl_arn" {
|
|
name = "/seahaven/waf/app-web-acl-arn"
|
|
}
|
|
|
|
# Google OAuth client ID used by submit-order and the admin authorizer. The
|
|
# parameter is created and rotated out-of-band because it varies per
|
|
# environment; this lookup only asserts that it exists before an apply wires
|
|
# functions that read it at runtime. Its NAME, not its value, is what reaches
|
|
# the functions.
|
|
data "aws_ssm_parameter" "google_client_id" {
|
|
name = local.google_client_id_param
|
|
}
|
|
|
|
# Fail closed if the OOB Google client ID parameter is missing or empty. The
|
|
# functions receive the parameter NAME via env; this check forces the data
|
|
# source to be evaluated so apply cannot succeed without the parameter.
|
|
check "google_client_id_present" {
|
|
assert {
|
|
condition = length(data.aws_ssm_parameter.google_client_id.value) > 0
|
|
error_message = "SSM parameter ${local.google_client_id_param} is missing or empty; create it out of band before apply."
|
|
}
|
|
}
|
|
|
|
check "dev_has_no_paychex" {
|
|
assert {
|
|
condition = local.is_prod || var.checkcomponents_queue_url == ""
|
|
error_message = "checkcomponents_queue_url must be empty in non-prod so aggregate-orders cannot send to the prod Paychex queue."
|
|
}
|
|
}
|
|
|
|
check "checkcomponents_pair" {
|
|
assert {
|
|
condition = (var.checkcomponents_queue_url == "") == (var.checkcomponents_queue_arn == "")
|
|
error_message = "checkcomponents_queue_url and checkcomponents_queue_arn must both be set or both be empty."
|
|
}
|
|
}
|
|
|
|
check "dev_has_no_custom_domain" {
|
|
assert {
|
|
condition = local.is_prod || !var.attach_custom_domain
|
|
error_message = "attach_custom_domain must be false in non-prod; use the CloudFront distribution domain."
|
|
}
|
|
}
|