Chris CoutinhoandClaude Opus 4.7
e4c552cd19
Deployer role: - Add servicediscovery actions; module always creates Cloud Map namespace and service so the policy must grant CreatePrivateDnsNamespace etc. - Make Route53 + ACM permissions unconditional. The server module always issues an ACM cert and writes Route53 records (no CloudFront default-cert path exists), so gating these on route53_zone_ids was broken. Split Route53 into hosted-zone management (always) plus record-set mutation (scoped to caller-supplied zones, falls back to *). - Remove unused cloudfront:* statement; no CloudFront resources in module. - Replace acm:* wildcard with explicit cert-management action set. Server module: - qdrant_image_tag is now nullable with default null and validated against use_external_qdrant, so external-qdrant callers can omit it instead of passing a sentinel "unused" value. - task_role_arn and efs_id outputs marked sensitive; qdrant_dns_name returns null when use_external_qdrant = true. - ALB SG now has matching IPv6 egress rule (was v4-only). - nextcloud_url validates the https:// scheme. - random_pet.subdomain keeper includes zone_name so a zone migration that preserves zone_id still triggers regeneration. - Pin required_version >= 1.9 on both modules. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
72 lines
2.4 KiB
Terraform
72 lines
2.4 KiB
Terraform
variable "role_name" {
|
|
description = "Name of the deployer IAM role."
|
|
type = string
|
|
default = "nextcloud-mcp-deployer"
|
|
}
|
|
|
|
variable "role_path" {
|
|
description = "IAM path for the deployer role and its policy."
|
|
type = string
|
|
default = "/clients/"
|
|
}
|
|
|
|
variable "trusted_principal_arns" {
|
|
description = <<-EOT
|
|
Principal ARNs allowed to assume this role. For testing in your own
|
|
account: the user/role you want to assume from. For client deployments:
|
|
typically a single root-account ARN of the deploying party (e.g.
|
|
"arn:aws:iam::<your-account-id>:root"), with MFA or external-id
|
|
conditions added at the trust-policy level if required.
|
|
EOT
|
|
type = list(string)
|
|
validation {
|
|
condition = length(var.trusted_principal_arns) > 0
|
|
error_message = "trusted_principal_arns must contain at least one ARN."
|
|
}
|
|
}
|
|
|
|
variable "module_name_prefix" {
|
|
description = <<-EOT
|
|
The `var.name` value passed to the nextcloud-mcp-server module. Used to
|
|
scope IAM/logs/secrets ARNs. Defaults match the module default; change
|
|
only if the module is instantiated with a non-default name.
|
|
EOT
|
|
type = string
|
|
default = "nextcloud-mcp-server"
|
|
}
|
|
|
|
variable "secret_name_prefix" {
|
|
description = <<-EOT
|
|
Secrets Manager name prefix the deployer can read (and optionally
|
|
create, see `allow_secret_create`). The module accepts a secret ARN as
|
|
input; this prefix scopes the deployer's access to secrets matching
|
|
that name pattern.
|
|
EOT
|
|
type = string
|
|
default = "nextcloud-mcp"
|
|
}
|
|
|
|
variable "allow_secret_create" {
|
|
description = <<-EOT
|
|
When true, the deployer can create/update/delete Secrets Manager
|
|
secrets matching `secret_name_prefix`. Set true if the secret is
|
|
managed alongside the module in the same Terraform run; leave false if
|
|
the secret is provisioned out of band (console / separate root TF) and
|
|
only the ARN is passed in.
|
|
EOT
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
variable "route53_zone_ids" {
|
|
description = <<-EOT
|
|
Route53 public hosted zone IDs the deployer is allowed to mutate. The
|
|
server module always creates Route53 records (ALB alias + ACM DNS-01
|
|
validation), so this should be set to the zone(s) the module's
|
|
`zone_id` input points at. Leaving it empty falls back to `*` as a
|
|
convenience but is not recommended in production — scope it.
|
|
EOT
|
|
type = list(string)
|
|
default = []
|
|
}
|