Jon Chery
9f9d971287
VERIFY: structural — Terraform + docs + tests; behavioral — terraform validate + 3 tests + CI PASS; quality — offline-proven only (D-114), nova: ABAC tags. ---ci--- project: acdl phase: 20 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-184] partial: [] ---/ci---
terraform/onboarding/ — Consumer deploy-role + ABAC tag grant (P20, REQ-184)
Offline-proven Terraform for the cross-account consumer deploy-role +
nova:owner ABAC tag grant. This is the "role grant" half of the
no-humans onboarding flow (D-113); the "request" half is P18 (Lambda
action) + P19 (env-file autogen).
Scope (D-114)
This Terraform is offline-proven only in v1.16:
terraform validatepasses.terraform plan(withNOVA_AWS_ACCOUNT_IDset) produces the expected role + policy.- No live apply —
NOVA_LIFECYCLE_MODE=plandefault. Live apply is deferred to a future feature milestone (D-113/D-114).
Variables
| Variable | Description | Default |
|---|---|---|
consumer_repo |
The consumer repository (org/repo) | acdl/consumer-a |
owner_id |
The owning team (for nova:owner tag) |
team-a |
account_id |
The consumer's AWS account ID | 000000000000 |
region |
AWS region | us-east-1 |
Resources
aws_iam_role.consumer_deploy— the consumer's deploy role with a trust policy (assumed by the consumer's CI runner).aws_iam_role_policy.consumer_invoke— inline policy grantinglambda:InvokeFunctionUrlon the platform Lambda, scoped viaaws:PrincipalTag/nova:owner == var.owner_id(ABAC).aws_iam_tag.owner— tags the role withnova:owner+nova:contract.
Usage (offline)
cd terraform/onboarding
terraform init -backend=false
terraform validate
NOVA_AWS_ACCOUNT_ID=123456789012 terraform plan -var consumer_repo=acdl/my-app -var owner_id=team-x