Chris CoutinhoandClaude Opus 4.7
e4c552cd19
Deployer role: - Add servicediscovery actions; module always creates Cloud Map namespace and service so the policy must grant CreatePrivateDnsNamespace etc. - Make Route53 + ACM permissions unconditional. The server module always issues an ACM cert and writes Route53 records (no CloudFront default-cert path exists), so gating these on route53_zone_ids was broken. Split Route53 into hosted-zone management (always) plus record-set mutation (scoped to caller-supplied zones, falls back to *). - Remove unused cloudfront:* statement; no CloudFront resources in module. - Replace acm:* wildcard with explicit cert-management action set. Server module: - qdrant_image_tag is now nullable with default null and validated against use_external_qdrant, so external-qdrant callers can omit it instead of passing a sentinel "unused" value. - task_role_arn and efs_id outputs marked sensitive; qdrant_dns_name returns null when use_external_qdrant = true. - ALB SG now has matching IPv6 egress rule (was v4-only). - nextcloud_url validates the https:// scheme. - random_pet.subdomain keeper includes zone_name so a zone migration that preserves zone_id still triggers regeneration. - Pin required_version >= 1.9 on both modules. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
56 lines
1.5 KiB
Terraform
56 lines
1.5 KiB
Terraform
resource "random_pet" "subdomain" {
|
|
length = 2
|
|
separator = "-"
|
|
|
|
# Stable across applies; regenerate only if we point at a different zone.
|
|
# `zone_name` is in the keeper too so a zone migration that keeps the same
|
|
# zone_id (rare but possible across providers) still triggers regeneration.
|
|
keepers = {
|
|
zone_id = var.zone_id
|
|
zone_name = var.zone_name
|
|
}
|
|
}
|
|
|
|
locals {
|
|
fqdn = "${random_pet.subdomain.id}.${var.zone_name}"
|
|
}
|
|
|
|
resource "aws_acm_certificate" "this" {
|
|
domain_name = local.fqdn
|
|
validation_method = "DNS"
|
|
|
|
lifecycle {
|
|
create_before_destroy = true
|
|
}
|
|
|
|
tags = {
|
|
Name = "${var.name}-${random_pet.subdomain.id}"
|
|
}
|
|
}
|
|
|
|
resource "aws_route53_record" "cert_validation" {
|
|
allow_overwrite = true
|
|
zone_id = var.zone_id
|
|
name = one(aws_acm_certificate.this.domain_validation_options).resource_record_name
|
|
type = one(aws_acm_certificate.this.domain_validation_options).resource_record_type
|
|
records = [one(aws_acm_certificate.this.domain_validation_options).resource_record_value]
|
|
ttl = 60
|
|
}
|
|
|
|
resource "aws_acm_certificate_validation" "this" {
|
|
certificate_arn = aws_acm_certificate.this.arn
|
|
validation_record_fqdns = [aws_route53_record.cert_validation.fqdn]
|
|
}
|
|
|
|
resource "aws_route53_record" "alias" {
|
|
zone_id = var.zone_id
|
|
name = local.fqdn
|
|
type = "A"
|
|
|
|
alias {
|
|
name = aws_lb.this.dns_name
|
|
zone_id = aws_lb.this.zone_id
|
|
evaluate_target_health = true
|
|
}
|
|
}
|