mirror of
https://github.com/Sea-Haven-Industries/shoc-backend.git
synced 2026-09-30 14:13:12 +00:00
24f08d3cb1
* feat(terraform): add safe backend environment adoption Introduce import-guarded environment roots and retire temporary bootstrap and POC provisioning after ownership transfer. * ci(deploy): pause dev and staging deployments Prevent application releases from racing Terraform adoption while retaining production deployment and validation. * ci(deploy): require manual environment dispatch * fix: update `required_version` from `>=1.7.0` to `>=1.9.0` The deploy-boundary check interpolates `var.aws_account_id` and `var.environment`. Terraform only allows other variables inside `validation` from 1.9.0+. CI already runs against `1.9.8` so `versions.tf` setting version as `>=1.7.0` is a breaking finding * chore(deps): add `terraform` to renovate dependency coverage * ci(deploy): drop unprovisioned prod dispatch path
32 lines
1.6 KiB
Python
32 lines
1.6 KiB
Python
"""Canonical managed-resource addresses for Terraform environment imports."""
|
|
|
|
COMMON_RESOURCES = {
|
|
"module.environment.aws_elastic_beanstalk_environment.this": "aws_elastic_beanstalk_environment",
|
|
"module.environment.aws_iam_instance_profile.runtime": "aws_iam_instance_profile",
|
|
"module.environment.aws_iam_role.github_deploy": "aws_iam_role",
|
|
"module.environment.aws_iam_role.runtime": "aws_iam_role",
|
|
"module.environment.aws_iam_role_policy.github_deploy": "aws_iam_role_policy",
|
|
"module.environment.aws_iam_role_policy.runtime_app_config": "aws_iam_role_policy",
|
|
"module.environment.aws_iam_role_policy_attachment.web_tier": "aws_iam_role_policy_attachment",
|
|
"module.environment.aws_secretsmanager_secret.app_config": "aws_secretsmanager_secret",
|
|
}
|
|
|
|
REQUIRED_RESOURCES = {
|
|
"dev": {
|
|
**COMMON_RESOURCES,
|
|
"module.environment.aws_iam_role_policy.runtime_dynamo[0]": "aws_iam_role_policy",
|
|
"module.environment.aws_iam_role_policy.runtime_webhook[0]": "aws_iam_role_policy",
|
|
"module.environment.aws_route53_record.api_alias[0]": "aws_route53_record",
|
|
},
|
|
"staging": {
|
|
**COMMON_RESOURCES,
|
|
"module.environment.aws_iam_role_policy.runtime_webhook[0]": "aws_iam_role_policy",
|
|
"module.environment.aws_route53_record.api_cname[0]": "aws_route53_record",
|
|
},
|
|
"tf-poc": {
|
|
**COMMON_RESOURCES,
|
|
"aws_acm_certificate.poc": "aws_acm_certificate",
|
|
"aws_route53_zone.poc": "aws_route53_zone",
|
|
"module.environment.aws_route53_record.api_cname[0]": "aws_route53_record",
|
|
},
|
|
}
|