Add AWS Terraform recipes extracted from bootstrapper#37
Open
paribaker wants to merge 17 commits into
Open
Conversation
Declare 3 assertions for extracting generic AWS infrastructure scripts from tn-spa-bootstrapper into tn-cli justfile recipes: VPC recipe (aws-setup-vpc), 6 script recipes (ecs-exec, stream-logs, tf-setup-backend, tf-init-backend, setup-oidc, setup-secrets), and recipe group listing under [aws-terraform]. Cross-repo dependency from bootstrapper's aws-fargate-infra-refactor spec. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Extract 6 scripts from tn-spa-bootstrapper template into reusable justfile recipes under [aws-terraform] group. All recipes accept parameters instead of cookiecutter template variables and contain no jinja syntax. Recipes added: - aws-ecs-exec: Interactive ECS container exec session - aws-stream-logs: CloudWatch log streaming - aws-tf-setup-backend: S3 + DynamoDB backend creation - aws-tf-init-backend: Terraform backend initialization - aws-setup-oidc: GitHub OIDC role provisioning - aws-setup-secrets: S3 secrets bucket creation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Script Recipes: Six Extracted Operations Exist as tn-cli Recipes
- Add aws-setup-vpc recipe for idempotent shared VPC creation - Reorder aws-terraform recipes: VPC > backend > OIDC/secrets > ops tools - Use --unsorted in default list for source-order display - All 7 recipes grouped under [aws-terraform] Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Per-project OIDC roles and repo-scoped trust policies for aws-setup-oidc. Assertions 1 & 3 active, resource scoping (2) draft.
Add required `service` parameter to `aws-setup-oidc` recipe. Role name now follows `github-actions-<service>-<environment>` pattern, giving each project its own isolated IAM role. Policy names updated accordingly. Output prints role ARN for environments.json. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
OIDC Role Is Per-Project-Per-Environment
Scope OIDC trust policy to specific GitHub repo instead of entire org. - Add optional `repo` parameter to aws-setup-oidc (defaults to github_org/service) - Trust policy StringLike condition now uses `repo:<org>/<repo>:*` instead of `repo:<org>/*:*` - Existing role updates append repo conditions additively (idempotent) - Output confirms which specific repo was added to trust policy Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
aws-setup-secrets used `github-actions-${ENVIRONMENT}` but aws-setup-oidc
creates `github-actions-${SERVICE}-${ENVIRONMENT}`. This caused
"Invalid principal" when PutBucketPolicy tried to reference a non-existent
role ARN.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Role ARNs go in .github/environments.json, not as separate per-environment GitHub Actions variables. The old pattern (DEVELOPMENT_AWS_ROLE_ARN, etc.) is no longer used by the deploy workflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub OIDC tokens now include numeric IDs in the sub claim: repo:org@12345/repo@67890:ref:refs/heads/main Use wildcards (org*/repo*) to match both old and new formats. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace heredoc with printf to avoid inconsistent leading whitespace that breaks just's recipe parser. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tn-spa-bootstrappertemplate into reusable justfile recipes under[aws-terraform]groupaws-setup-vpcrecipe for idempotent shared VPC creation with tagged resources[aws-terraform]in logical order: VPC > backend > OIDC/secrets > operational toolstn --listnow uses--unsortedto preserve source orderingRecipes
aws-setup-vpcaws-tf-setup-backendaws-tf-init-backendaws-setup-oidcaws-setup-secretsaws-ecs-execaws-stream-logsTest Plan
tn --listshows all 7 recipes under[aws-terraform]groupspekk next)Specs Addressed
🤖 Generated with Claude Code