acdl/terraform/onboarding/README.md

terraform/onboarding/ — Consumer deploy-role + ABAC tag grant (P20, REQ-184)

Offline-proven Terraform for the cross-account consumer deploy-role + nova:owner ABAC tag grant. This is the "role grant" half of the no-humans onboarding flow (D-113); the "request" half is P18 (Lambda action) + P19 (env-file autogen).

Scope (D-114)

This Terraform is offline-proven only in v1.16:

• terraform validate passes.
• terraform plan (with NOVA_AWS_ACCOUNT_ID set) produces the expected role + policy.
• No live apply — NOVA_LIFECYCLE_MODE=plan default. Live apply is deferred to a future feature milestone (D-113/D-114).

Variables

Variable	Description	Default
consumer_repo	The consumer repository (org/repo)	acdl/consumer-a
owner_id	The owning team (for nova:owner tag)	team-a
account_id	The consumer's AWS account ID	000000000000
region	AWS region	us-east-1

Resources

• aws_iam_role.consumer_deploy — the consumer's deploy role with a trust policy (assumed by the consumer's CI runner).
• aws_iam_role_policy.consumer_invoke — inline policy granting lambda:InvokeFunctionUrl on the platform Lambda, scoped via aws:PrincipalTag/nova:owner == var.owner_id (ABAC).
• aws_iam_tag.owner — tags the role with nova:owner + nova:contract.

Usage (offline)

cd terraform/onboarding
terraform init -backend=false
terraform validate
NOVA_AWS_ACCOUNT_ID=123456789012 terraform plan -var consumer_repo=acdl/my-app -var owner_id=team-x