The code and what it creates#

Where the code is#

deployment/aws-tofu/ implements this, and its README.md covers running it — bootstrapping the state bucket, the credential-free checks that CI runs, and the provider lock file.

The tool is OpenTofu, not Terraform. The language is identical, the binary is tofu, and two of its features are used deliberately: a backend block may interpolate a variable, so the environment roots share one backend.tf; and the S3 backend takes its lock from S3, so there is no DynamoDB table. decisions/deployment-and-aws.md records the choice.

The layout is one module holding every resource, instantiated by a thin root per environment:

modules/environment/     every resource, parameterised
environments/qa/         a root that instantiates the module
environments/prod/       the same root, different values
account/                 the things there is one of per AWS account

account/ holds the GitHub OIDC provider and the monitoring user. Its permissions come from a read-only group: ReadOnlyAccess, everything denied without MFA except registering a device, and the state bucket's objects denied even with it. ReadOnlyAccess reads every bucket, so without the MFA rule a leaked access key would have read prod's state. From the CLI the user therefore needs a session from aws sts get-session-token --serial-number … --token-code …; the bare access key is refused. It exists because those are singular: instantiating them from a module applied twice would have the two environments fighting over one provider. It is applied before either environment, which look the provider up by URL.

The two roots are identical apart from terraform.tfvars — the state key is interpolated from a variable, which Terraform could not do — and check-environments-match.py fails CI when they are not. Making prod a parameter change is the intent of this plan; that check is what keeps it from decaying into two codebases that drift. Anything which must differ between environments becomes a module variable instead.

Cost attribution moves to tags. With one account there is no per-account bill, so every resource carries env=qa or env=prod and the budgets filter on that. This only works if the tagging is complete: an untagged resource is invisible to both environment budgets and shows up only in the total.

Resource inventory#

Per environment, identical unless noted:

ECS tasks run in public subnets with a public IP, which is what avoids the NAT gateway. They are not reachable from outside: the security group admits only the ALB. This is a deliberate demo-scale trade — a commercial deployment would use private subnets and pay for NAT or VPC endpoints, and the reasoning is in decisions/deployment-and-aws.md.