mirror of
https://github.com/Sea-Haven-Industries/meal-order-manager.git
synced 2026-09-30 08:53:13 +00:00
26a92a2f62
Some checks failed
Build Lambda Layer / build (push) Has been cancelled
* feat(auth): accept portal Cognito ID tokens * fix(auth): distinguish portal verification outages * docs(auth): document Cognito workspace variables
64 lines
2.5 KiB
HCL
64 lines
2.5 KiB
HCL
variable "aws_region" {
|
|
description = "Region every resource in this configuration is created in."
|
|
type = string
|
|
default = "us-east-1"
|
|
}
|
|
|
|
variable "domain_name" {
|
|
description = "Custom domain served by the CloudFront distribution when attach_custom_domain is true. An ISSUED ACM certificate for this domain must already exist in us-east-1 (see acm.tf)."
|
|
type = string
|
|
default = "orders.seahaven.com"
|
|
}
|
|
|
|
variable "attach_custom_domain" {
|
|
description = "When true, attach domain_name as a CloudFront alias with the ACM viewer certificate. Keep false until DNS cutover so the prod distribution can exist while orders.seahaven.com still points at mgmt."
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
variable "slack_bot_secret_arn" {
|
|
description = "ARN of the Secrets Manager secret holding the Slack bot token. The secret and its value are managed out-of-band; only the ARN enters this configuration."
|
|
type = string
|
|
|
|
validation {
|
|
condition = can(regex("^arn:aws:secretsmanager:", var.slack_bot_secret_arn))
|
|
error_message = "slack_bot_secret_arn must be a Secrets Manager ARN."
|
|
}
|
|
}
|
|
|
|
variable "slack_channel_id" {
|
|
description = "Slack channel ID for meal order notifications. Written to /meal-order-manager/slack-channel-id."
|
|
type = string
|
|
}
|
|
|
|
variable "portal_cognito_issuer" {
|
|
description = "Exact issuer URL for the portal Cognito user pool whose ID tokens meal-order-manager accepts."
|
|
type = string
|
|
|
|
validation {
|
|
condition = can(regex("^https://cognito-idp\\.[a-z0-9-]+\\.amazonaws\\.com/[A-Za-z0-9_-]+$", var.portal_cognito_issuer))
|
|
error_message = "portal_cognito_issuer must be an exact Cognito user-pool issuer URL without a trailing slash."
|
|
}
|
|
}
|
|
|
|
variable "portal_cognito_audience" {
|
|
description = "Portal Cognito app client ID required in accepted ID-token aud claims."
|
|
type = string
|
|
|
|
validation {
|
|
condition = length(trimspace(var.portal_cognito_audience)) > 0
|
|
error_message = "portal_cognito_audience must not be empty."
|
|
}
|
|
}
|
|
|
|
variable "checkcomponents_queue_url" {
|
|
description = "paychex-checkcomponents SQS URL. Empty skips the weekly SendMessage."
|
|
type = string
|
|
default = "https://sqs.us-east-1.amazonaws.com/011934824531/paychex-checkcomponents"
|
|
}
|
|
|
|
variable "checkcomponents_queue_arn" {
|
|
description = "paychex-checkcomponents SQS ARN for aggregate-orders SendMessage."
|
|
type = string
|
|
default = "arn:aws:sqs:us-east-1:011934824531:paychex-checkcomponents"
|
|
}
|