Jon Chery
42 lines
1.6 KiB
Markdown
42 lines
1.6 KiB
Markdown
# terraform/onboarding/ — Consumer deploy-role + ABAC tag grant (P20, REQ-184)
|
|
|
|
Offline-proven Terraform for the cross-account consumer deploy-role +
|
|
`nova:owner` ABAC tag grant. This is the "role grant" half of the
|
|
no-humans onboarding flow (D-113); the "request" half is P18 (Lambda
|
|
action) + P19 (env-file autogen).
|
|
|
|
## Scope (D-114)
|
|
|
|
This Terraform is **offline-proven only** in v1.16:
|
|
- `terraform validate` passes.
|
|
- `terraform plan` (with `NOVA_AWS_ACCOUNT_ID` set) produces the expected
|
|
role + policy.
|
|
- **No live apply** — `NOVA_LIFECYCLE_MODE=plan` default. Live apply is
|
|
deferred to a future feature milestone (D-113/D-114).
|
|
|
|
## Variables
|
|
|
|
| Variable | Description | Default |
|
|
|----------|-------------|---------|
|
|
| `consumer_repo` | The consumer repository (org/repo) | `acdl/consumer-a` |
|
|
| `owner_id` | The owning team (for `nova:owner` tag) | `team-a` |
|
|
| `account_id` | The consumer's AWS account ID | `000000000000` |
|
|
| `region` | AWS region | `us-east-1` |
|
|
|
|
## Resources
|
|
|
|
- `aws_iam_role.consumer_deploy` — the consumer's deploy role with a
|
|
trust policy (assumed by the consumer's CI runner).
|
|
- `aws_iam_role_policy.consumer_invoke` — inline policy granting
|
|
`lambda:InvokeFunctionUrl` on the platform Lambda, scoped via
|
|
`aws:PrincipalTag/nova:owner == var.owner_id` (ABAC).
|
|
- `aws_iam_tag.owner` — tags the role with `nova:owner` + `nova:contract`.
|
|
|
|
## Usage (offline)
|
|
|
|
```bash
|
|
cd terraform/onboarding
|
|
terraform init -backend=false
|
|
terraform validate
|
|
NOVA_AWS_ACCOUNT_ID=123456789012 terraform plan -var consumer_repo=acdl/my-app -var owner_id=team-x
|
|
``` |