mirror of
https://github.com/Sea-Haven-Industries/shoc-backend.git
synced 2026-09-30 03:43:11 +00:00
77c3016c9d
Some checks are pending
Validate and deploy / Validate deployable source bundle (push) Waiting to run
Validate and deploy / Deploy shoc-backend-dev through Terraform (push) Blocked by required conditions
Validate and deploy / Deploy shoc-backend-staging to Elastic Beanstalk (push) Blocked by required conditions
* feat(deploy): move dev application CD through Terraform GitHub creates the immutable Elastic Beanstalk version; HCP Terraform is the only UpdateEnvironment caller via a guarded version_label run. * fix: add permissions block for dependency-review workflow Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix(terraform): stop pinning the generated dev instance SG --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
105 lines
4.7 KiB
HCL
105 lines
4.7 KiB
HCL
locals {
|
|
aws_account_id = "396287094661"
|
|
aws_region = "us-east-1"
|
|
|
|
eb_application_name = "shoc-backend"
|
|
eb_environment_name = "shoc-backend-dev"
|
|
eb_environment_id = "e-hehnrqjjrt"
|
|
eb_platform = "arn:aws:elasticbeanstalk:us-east-1::platform/.NET 8 running on 64bit Amazon Linux 2023/3.11.3"
|
|
api_domain = "api.dev.seahaven.com"
|
|
}
|
|
|
|
module "inventory" {
|
|
source = "../modules/environment-inventory"
|
|
|
|
aws_account_id = local.aws_account_id
|
|
rds_identifier = "shoc-sqlserver-shared"
|
|
certificate_domain = "*.seahaven.com"
|
|
expected_certificate_arn = "arn:aws:acm:us-east-1:396287094661:certificate/2b78e74f-7b65-4b82-a413-7a498b102f00"
|
|
hosted_zone_name = "dev.seahaven.com"
|
|
expected_hosted_zone_id = "Z07671212N75U4YLPWZR8"
|
|
}
|
|
|
|
module "environment" {
|
|
source = "../modules/environment-owned"
|
|
|
|
aws_account_id = local.aws_account_id
|
|
aws_region = local.aws_region
|
|
environment = "dev"
|
|
adoption_complete = true
|
|
manage_eb_settings = true
|
|
eb_application_name = local.eb_application_name
|
|
eb_environment_name = local.eb_environment_name
|
|
eb_environment_id = local.eb_environment_id
|
|
platform_arn = "arn:aws:elasticbeanstalk:us-east-1::platform/.NET 8 running on 64bit Amazon Linux 2023/3.11.3"
|
|
vpc_id = "vpc-0d16336143f3da25e"
|
|
instance_subnet_ids = ["subnet-02946ccd6735742e9", "subnet-0bedaa6e0c750be4f", "subnet-09eaf2bfa468d206f"]
|
|
load_balancer_subnet_ids = ["subnet-09eaf2bfa468d206f", "subnet-02946ccd6735742e9", "subnet-0bedaa6e0c750be4f"]
|
|
instance_security_group_id = null
|
|
eb_service_role_name = "shoc-eb-service-role"
|
|
shared_certificate_arn = "arn:aws:acm:us-east-1:396287094661:certificate/2b78e74f-7b65-4b82-a413-7a498b102f00"
|
|
runtime_role_name = "shoc-backend-dev"
|
|
runtime_app_config_policy_name = "shoc-dev-secrets-read"
|
|
runtime_webhook_policy_name = "shoc-procurement-webhook-hmac-read"
|
|
runtime_dynamo_policy_name = "shoc-assume-dynamo-reader"
|
|
permissions_boundary_arn = "arn:aws:iam::396287094661:policy/shoc-backend-dev-runtime-boundary"
|
|
github_deploy_permissions_boundary_arn = "arn:aws:iam::396287094661:policy/shoc-backend-dev-deploy-boundary"
|
|
app_config_secret_name = "shoc/dev/app-config"
|
|
app_config_json_keys = [
|
|
"ConnectionStrings__DefaultConnection",
|
|
"Dynamo__ExternalId",
|
|
"Dynamo__Region",
|
|
"Dynamo__SourceRoleArn",
|
|
"JWT__Secret",
|
|
"JWT__ValidAudience",
|
|
"JWT__ValidIssuer",
|
|
"SendGrid__ApiKey",
|
|
]
|
|
app_config_policy_sid = "ReadDevAppConfig"
|
|
webhook_secret_arn = "arn:aws:secretsmanager:us-east-1:011934824531:secret:workorder-ingest/shoc-webhook-hmac-puYTcB"
|
|
webhook_read_policy_sid = "ReadProcurementWebhookHmacKeyset"
|
|
webhook_decrypt_policy_sid = "DecryptWebhookSecretViaSecretsManager"
|
|
dynamo_reader_role_arn = "arn:aws:iam::328440206208:role/shoc-dynamo-reader"
|
|
dynamo_policy_sid = "AssumeDynamoReaderInMain"
|
|
github_repo = "Sea-Haven-Industries/shoc-backend"
|
|
github_environment = "dev"
|
|
github_deploy_role_name = "githubdeploy-shoc-backend-dev"
|
|
github_deploy_policy_name = "GithubDeployRoleDefaultPolicyE8F540D1"
|
|
legacy_dev_s3_policy = true
|
|
release_version_label = var.release_version_label
|
|
hosted_zone_id = "Z07671212N75U4YLPWZR8"
|
|
api_domain = local.api_domain
|
|
api_record_type = "A"
|
|
api_alias_target = {
|
|
name = "awseb--awseb-cmpb3ypfib53-1654918745.us-east-1.elb.amazonaws.com"
|
|
zone_id = "Z35SXDOTRQ7X7K"
|
|
}
|
|
metadata_before_adoption = {
|
|
runtime_role_description = "SHOC backend dev compute role (EB instance profile)"
|
|
runtime_role_tags = {
|
|
env = "dev"
|
|
project = "shoc"
|
|
}
|
|
instance_profile_tags = {
|
|
env = "dev"
|
|
project = "shoc"
|
|
}
|
|
app_config_description = "SHOC dev application config (conn string, JWT, SendGrid)"
|
|
app_config_tags = {
|
|
env = "dev"
|
|
project = "shoc"
|
|
}
|
|
deploy_role_description = "Least-privilege GitHub OIDC deploy role for shoc-backend dev. CDK-owned; application/environment/S3 are owned by Elastic Beanstalk."
|
|
deploy_role_tags = {
|
|
Component = "deploy-role"
|
|
Environment = "dev"
|
|
HcpTerraformWorkspace = "shoc-backend-dev"
|
|
ManagedBy = "cdk"
|
|
Project = "shoc-backend"
|
|
}
|
|
environment_tags = {
|
|
env = "dev"
|
|
project = "shoc"
|
|
}
|
|
}
|
|
}
|