mirror of
https://github.com/Sea-Haven-Industries/shoc-backend.git
synced 2026-09-30 04:53:11 +00:00
77c3016c9d
Some checks are pending
Validate and deploy / Validate deployable source bundle (push) Waiting to run
Validate and deploy / Deploy shoc-backend-dev through Terraform (push) Blocked by required conditions
Validate and deploy / Deploy shoc-backend-staging to Elastic Beanstalk (push) Blocked by required conditions
* feat(deploy): move dev application CD through Terraform GitHub creates the immutable Elastic Beanstalk version; HCP Terraform is the only UpdateEnvironment caller via a guarded version_label run. * fix: add permissions block for dependency-review workflow Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix(terraform): stop pinning the generated dev instance SG --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
49 lines
2 KiB
Markdown
49 lines
2 KiB
Markdown
# Terraform deployment infrastructure
|
|
|
|
Terraform adopts the environment-owned Sea Haven backend infrastructure while
|
|
keeping shared and Elastic Beanstalk-generated resources outside state.
|
|
|
|
## Roots
|
|
|
|
- `live/dev/` imports the existing dev environment-owned resources.
|
|
- `live/staging/` imports the existing staging environment-owned resources.
|
|
- `live/tf-poc/` manages the retained import-rehearsal environment after its
|
|
completed transfer from CloudFormation.
|
|
|
|
Shared RDS, application, VPC, subnet, service-role, shared-certificate, and
|
|
Elastic Beanstalk-generated inventory remains data-only or provider-managed.
|
|
Secret metadata is managed, but secret values are never authored in Terraform
|
|
configuration. Elastic Beanstalk receives secret values through
|
|
`environmentsecrets` ARN/key references.
|
|
|
|
## HCP credentials
|
|
|
|
Org-baseline CloudFormation owns the HCP Terraform plan/apply roles and their
|
|
manager tags. The retired `shoc-backend-bootstrap` workspace and backend
|
|
bootstrap root were removed after the four dev/staging roles transferred
|
|
without replacement.
|
|
|
|
## Environment adoption
|
|
|
|
Follow [`live/README.md`](live/README.md). For each dev/staging adoption, the
|
|
first plan must import the environment-owned resources with zero create,
|
|
update, delete, or replacement actions. The second reviewed phase may update
|
|
only explicitly allowlisted ownership metadata and the narrowed dev deploy S3
|
|
policy.
|
|
|
|
The GitHub Environment secret `AWS_DEPLOY_ROLE_ARN` retains the existing role
|
|
ARN throughout adoption.
|
|
|
|
## Local validation
|
|
|
|
```bash
|
|
terraform -chdir=terraform fmt -check -recursive
|
|
terraform -chdir=terraform/live/dev init -backend=false
|
|
terraform -chdir=terraform/live/dev validate
|
|
terraform -chdir=terraform/live/staging init -backend=false
|
|
terraform -chdir=terraform/live/staging validate
|
|
terraform -chdir=terraform/live/tf-poc init -backend=false
|
|
terraform -chdir=terraform/live/tf-poc validate
|
|
python scripts/test-terraform-import-plan-check.py
|
|
python scripts/test-terraform-release-plan-check.py
|
|
```
|