mirror of
https://github.com/Sea-Haven-Industries/shoc-backend.git
synced 2026-09-30 07:13:12 +00:00
24f08d3cb1
* feat(terraform): add safe backend environment adoption Introduce import-guarded environment roots and retire temporary bootstrap and POC provisioning after ownership transfer. * ci(deploy): pause dev and staging deployments Prevent application releases from racing Terraform adoption while retaining production deployment and validation. * ci(deploy): require manual environment dispatch * fix: update `required_version` from `>=1.7.0` to `>=1.9.0` The deploy-boundary check interpolates `var.aws_account_id` and `var.environment`. Terraform only allows other variables inside `validation` from 1.9.0+. CI already runs against `1.9.8` so `versions.tf` setting version as `>=1.7.0` is a breaking finding * chore(deps): add `terraform` to renovate dependency coverage * ci(deploy): drop unprovisioned prod dispatch path
100 lines
4.5 KiB
HCL
100 lines
4.5 KiB
HCL
locals {
|
|
aws_account_id = "396287094661"
|
|
aws_region = "us-east-1"
|
|
|
|
eb_application_name = "shoc-backend"
|
|
eb_environment_name = "shoc-backend-dev"
|
|
eb_environment_id = "e-hehnrqjjrt"
|
|
eb_platform = "arn:aws:elasticbeanstalk:us-east-1::platform/.NET 8 running on 64bit Amazon Linux 2023/3.11.3"
|
|
api_domain = "api.dev.seahaven.com"
|
|
}
|
|
|
|
module "inventory" {
|
|
source = "../modules/environment-inventory"
|
|
|
|
aws_account_id = local.aws_account_id
|
|
rds_identifier = "shoc-sqlserver-shared"
|
|
certificate_domain = "*.seahaven.com"
|
|
expected_certificate_arn = "arn:aws:acm:us-east-1:396287094661:certificate/2b78e74f-7b65-4b82-a413-7a498b102f00"
|
|
hosted_zone_name = "dev.seahaven.com"
|
|
expected_hosted_zone_id = "Z07671212N75U4YLPWZR8"
|
|
}
|
|
|
|
module "environment" {
|
|
source = "../modules/environment-owned"
|
|
|
|
aws_account_id = local.aws_account_id
|
|
aws_region = local.aws_region
|
|
environment = "dev"
|
|
adoption_complete = false
|
|
eb_application_name = local.eb_application_name
|
|
eb_environment_name = local.eb_environment_name
|
|
eb_environment_id = local.eb_environment_id
|
|
platform_arn = "arn:aws:elasticbeanstalk:us-east-1::platform/.NET 8 running on 64bit Amazon Linux 2023/3.11.3"
|
|
vpc_id = "vpc-0d16336143f3da25e"
|
|
instance_subnet_ids = ["subnet-02946ccd6735742e9", "subnet-0bedaa6e0c750be4f", "subnet-09eaf2bfa468d206f"]
|
|
load_balancer_subnet_ids = ["subnet-09eaf2bfa468d206f", "subnet-02946ccd6735742e9", "subnet-0bedaa6e0c750be4f"]
|
|
instance_security_group_id = "sg-0c8bb7cf2c193de57"
|
|
eb_service_role_name = "shoc-eb-service-role"
|
|
shared_certificate_arn = "arn:aws:acm:us-east-1:396287094661:certificate/2b78e74f-7b65-4b82-a413-7a498b102f00"
|
|
runtime_role_name = "shoc-backend-dev"
|
|
runtime_app_config_policy_name = "shoc-dev-secrets-read"
|
|
runtime_webhook_policy_name = "shoc-procurement-webhook-hmac-read"
|
|
runtime_dynamo_policy_name = "shoc-assume-dynamo-reader"
|
|
permissions_boundary_arn = "arn:aws:iam::396287094661:policy/shoc-backend-dev-runtime-boundary"
|
|
github_deploy_permissions_boundary_arn = "arn:aws:iam::396287094661:policy/shoc-backend-dev-deploy-boundary"
|
|
app_config_secret_name = "shoc/dev/app-config"
|
|
app_config_json_keys = [
|
|
"ConnectionStrings__DefaultConnection",
|
|
"Dynamo__ExternalId",
|
|
"Dynamo__Region",
|
|
"Dynamo__SourceRoleArn",
|
|
"JWT__Secret",
|
|
"JWT__ValidAudience",
|
|
"JWT__ValidIssuer",
|
|
"SendGrid__ApiKey",
|
|
]
|
|
app_config_policy_sid = "ReadDevAppConfig"
|
|
webhook_secret_arn = "arn:aws:secretsmanager:us-east-1:011934824531:secret:workorder-ingest/shoc-webhook-hmac-puYTcB"
|
|
webhook_read_policy_sid = "ReadProcurementWebhookHmacKeyset"
|
|
webhook_decrypt_policy_sid = "DecryptWebhookSecretViaSecretsManager"
|
|
dynamo_reader_role_arn = "arn:aws:iam::328440206208:role/shoc-dynamo-reader"
|
|
dynamo_policy_sid = "AssumeDynamoReaderInMain"
|
|
github_repo = "Sea-Haven-Industries/shoc-backend"
|
|
github_environment = "dev"
|
|
github_deploy_role_name = "githubdeploy-shoc-backend-dev"
|
|
github_deploy_policy_name = "GithubDeployRoleDefaultPolicyE8F540D1"
|
|
legacy_dev_s3_policy = true
|
|
hosted_zone_id = "Z07671212N75U4YLPWZR8"
|
|
api_domain = local.api_domain
|
|
api_record_type = "A"
|
|
metadata_before_adoption = {
|
|
runtime_role_description = "SHOC backend dev compute role (EB instance profile)"
|
|
runtime_role_tags = {
|
|
env = "dev"
|
|
project = "shoc"
|
|
}
|
|
instance_profile_tags = {
|
|
env = "dev"
|
|
project = "shoc"
|
|
}
|
|
app_config_description = "SHOC dev application config (conn string, JWT, SendGrid)"
|
|
app_config_tags = {
|
|
env = "dev"
|
|
project = "shoc"
|
|
}
|
|
deploy_role_description = "Least-privilege GitHub OIDC deploy role for shoc-backend dev. CDK-owned; application/environment/S3 are owned by Elastic Beanstalk."
|
|
deploy_role_tags = {
|
|
Component = "deploy-role"
|
|
Environment = "dev"
|
|
HcpTerraformWorkspace = "shoc-backend-dev"
|
|
ManagedBy = "cdk"
|
|
Project = "shoc-backend"
|
|
}
|
|
environment_tags = {
|
|
Name = "shoc-backend-dev"
|
|
env = "dev"
|
|
project = "shoc"
|
|
}
|
|
}
|
|
}
|