feat(#503): implement infrastructure as code with Terraform#578
Open
Mystery-CLI wants to merge 1 commit into
Open
feat(#503): implement infrastructure as code with Terraform#578Mystery-CLI wants to merge 1 commit into
Mystery-CLI wants to merge 1 commit into
Conversation
Complete AWS IaC covering all required components for the Brain Storm platform:
VPC & Networking
- VPC with 2 public and 2 private subnets across AZs
- NAT gateways, route tables, Internet Gateway
- VPC flow logs with CloudWatch (enable_flow_logs variable)
RDS PostgreSQL
- PostgreSQL 16.3 on gp3 encrypted storage with auto-scaling
- Enhanced monitoring (60s interval), Performance Insights in prod
- Multi-AZ support (rds_multi_az variable), deletion protection in prod
- IAM role for enhanced monitoring agent
ElastiCache Redis
- Redis 7.1 replication group with encryption at rest and in transit
- Fixes deprecated replication_group_description → description
- Multi-AZ and automatic failover enabled in prod; single node in dev/staging
- CloudWatch slow-log delivery
ECS Fargate
- Cluster with Container Insights, FARGATE + FARGATE_SPOT capacity providers
- Backend and frontend Fargate services with deployment circuit breakers
- Secrets Manager injection for DB password, JWT, and Stellar key
- ECS Execute Command enabled in non-prod for debugging
- lifecycle { ignore_changes } on task_definition and desired_count for CI/CD
ALB
- Internet-facing ALB with access logs to S3
- Path-based routing: /api/*, /health, /v1/* → backend; default → frontend
- Optional HTTPS listener with TLS 1.3 policy; HTTP→HTTPS redirect when cert provided
- alb_security_group_id output for downstream use
ECR (new module)
- Backend and frontend repositories with image scanning on push
- Lifecycle policies: retain 10 tagged images, expire untagged after 14 days
- Repository policies granting ECS pull and GitHub Actions push access
Auto-scaling (new module)
- Application Auto Scaling targets for both ECS services
- CPU (70%) and memory (80%) target-tracking policies
- CloudWatch alarms for high CPU on each service
- Configurable min/max capacity per service
Security Groups & IAM
- All security groups use parameterised vpc_cidr instead of hardcoded 10.0.0.0/16
- ECS execution role extended with secretsmanager:GetSecretValue and kms:Decrypt
- ECS task role with least-privilege CloudWatch Logs and ECR pull permissions
Other
- Root main.tf wires all modules including new ECR and autoscaling
- Complete variables.tf with validation on environment values
- Comprehensive outputs.tf with ECR repo URLs and secrets ARNs
- Updated terraform.tfvars.example documenting every variable
- Updated README with architecture diagram and two-step bootstrap guide
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
@Mystery-CLI Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #503
Summary
replication_group_descriptionargument/api/*→ backend, default → frontend), access logs to S3, optional HTTPS with TLS 1.3, HTTP→HTTPS redirectvpc_cidroutput instead of hardcoded10.0.0.0/16variables.tfwith environment validation, updatedoutputs.tfwith ECR URLs and secret ARNs, comprehensiveterraform.tfvars.example, updated README with architecture diagram and two-step bootstrap guideTest plan
terraform initsucceeds with the S3/DynamoDB backendterraform validatepasses with no errorsterraform plan -var-file=terraform.tfvarsshows expected resource count (no unexpected diffs)terraform applyon a freshdevenvironment provisions all resources/api/healthto the backend target groupNEXT_PUBLIC_API_URLfromapi_base_urlvariable🤖 Generated with Claude Code