Chris CoutinhoandClaude Opus 4.7
e4c552cd19
Deployer role: - Add servicediscovery actions; module always creates Cloud Map namespace and service so the policy must grant CreatePrivateDnsNamespace etc. - Make Route53 + ACM permissions unconditional. The server module always issues an ACM cert and writes Route53 records (no CloudFront default-cert path exists), so gating these on route53_zone_ids was broken. Split Route53 into hosted-zone management (always) plus record-set mutation (scoped to caller-supplied zones, falls back to *). - Remove unused cloudfront:* statement; no CloudFront resources in module. - Replace acm:* wildcard with explicit cert-management action set. Server module: - qdrant_image_tag is now nullable with default null and validated against use_external_qdrant, so external-qdrant callers can omit it instead of passing a sentinel "unused" value. - task_role_arn and efs_id outputs marked sensitive; qdrant_dns_name returns null when use_external_qdrant = true. - ALB SG now has matching IPv6 egress rule (was v4-only). - nextcloud_url validates the https:// scheme. - random_pet.subdomain keeper includes zone_name so a zone migration that preserves zone_id still triggers regeneration. - Pin required_version >= 1.9 on both modules. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
53 lines
1.4 KiB
Terraform
53 lines
1.4 KiB
Terraform
output "url" {
|
|
description = "Public HTTPS URL of the MCP server"
|
|
value = "https://${local.fqdn}"
|
|
}
|
|
|
|
output "subdomain" {
|
|
description = "Generated random subdomain (label only, without the zone)"
|
|
value = random_pet.subdomain.id
|
|
}
|
|
|
|
output "fqdn" {
|
|
description = "Fully-qualified domain name"
|
|
value = local.fqdn
|
|
}
|
|
|
|
output "ecs_cluster_name" {
|
|
value = aws_ecs_cluster.this.name
|
|
}
|
|
|
|
output "ecs_service_name" {
|
|
value = aws_ecs_service.this.name
|
|
}
|
|
|
|
output "efs_id" {
|
|
description = "EFS file-system ID. Marked sensitive — surfacing it in CI logs invites enumeration of mount targets."
|
|
value = aws_efs_file_system.this.id
|
|
sensitive = true
|
|
}
|
|
|
|
output "log_group_name" {
|
|
value = aws_cloudwatch_log_group.this.name
|
|
}
|
|
|
|
output "task_role_arn" {
|
|
description = "Task role ARN. Marked sensitive — knowing the ARN is the first step to abusing it via SSRF/role-confusion."
|
|
value = aws_iam_role.task.arn
|
|
sensitive = true
|
|
}
|
|
|
|
output "alb_dns_name" {
|
|
value = aws_lb.this.dns_name
|
|
}
|
|
|
|
output "qdrant_service_name" {
|
|
description = "Qdrant ECS service name (null when use_external_qdrant = true)"
|
|
value = var.use_external_qdrant ? null : aws_ecs_service.qdrant[0].name
|
|
}
|
|
|
|
output "qdrant_dns_name" {
|
|
description = "Internal DNS name where mcp-server reaches qdrant (null when use_external_qdrant = true)."
|
|
value = var.use_external_qdrant ? null : "qdrant.${aws_service_discovery_private_dns_namespace.this.name}"
|
|
}
|