From 3f8d1677dfb1fb9900f6a01a3ec671dc3fd96567 Mon Sep 17 00:00:00 2001
From: aliziel <21992503+aliziel@users.noreply.github.com>
Date: Fri, 8 May 2026 18:58:30 -0700
Subject: [PATCH 1/2] feat: update certificate provisioning + load balancer
 targets for DNS changes

---
 .github/workflows/terraform.yaml |  1 +
 terraform/aws/acm.tf             | 28 +++++++++++++++++++++++++---
 terraform/aws/alb.tf             | 23 ++++++++++++++---------
 terraform/aws/cognito.tf         |  5 ++++-
 terraform/aws/ecr.tf             |  9 +++++----
 terraform/aws/ecs.tf             |  3 ++-
 terraform/aws/main.tf            |  8 ++++++++
 terraform/aws/tfvars/dev.tfvars  | 15 +++++++--------
 terraform/aws/variables.tf       | 16 ++++++++++++++++
 terraform/aws/versions.tf        |  2 +-
 terraform/aws/vpc.tf             |  3 ++-
 11 files changed, 85 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/terraform.yaml b/.github/workflows/terraform.yaml
index e14b529..0a05065 100644
--- a/.github/workflows/terraform.yaml
+++ b/.github/workflows/terraform.yaml
@@ -27,6 +27,7 @@ jobs:
       TF_VAR_chat_model__type: ${{ vars.CHAT_MODEL__TYPE }}
       TF_VAR_chat_model__size: ${{ vars.CHAT_MODEL__SIZE }}
       TF_VAR_chat_model__api_key: ${{ secrets.CHAT_MODEL__API_KEY }}
+      TF_VAR_dns_account_role_arn: ${{ vars.DNS_ACCOUNT_ROLE_ARN }}
     defaults:
       run:
         working-directory: terraform/aws
diff --git a/terraform/aws/acm.tf b/terraform/aws/acm.tf
index 8f77412..ff3c655 100644
--- a/terraform/aws/acm.tf
+++ b/terraform/aws/acm.tf
@@ -1,10 +1,12 @@
 data "aws_route53_zone" "ecs_domain" {
+  provider     = aws.dns
   name         = var.domain_name
   private_zone = false
 }
 
 module "acm" {
-  source = "terraform-aws-modules/acm/aws"
+  source  = "terraform-aws-modules/acm/aws"
+  version = "~> 6.2.0"
 
   domain_name = var.domain_name
   zone_id     = data.aws_route53_zone.ecs_domain.zone_id
@@ -13,5 +15,25 @@ module "acm" {
     "*.${var.domain_name}",
   ]
 
-  validation_method = "DNS"
-}
\ No newline at end of file
+  validation_method       = "DNS"
+  create_route53_records  = false
+  validation_record_fqdns = module.route53_validation.validation_route53_record_fqdns
+}
+
+module "route53_validation" {
+  source  = "terraform-aws-modules/acm/aws"
+  version = "~> 6.2.0"
+
+  providers = {
+    aws = aws.dns
+  }
+
+  create_certificate          = false
+  create_route53_records_only = true
+  validation_method           = "DNS"
+
+  zone_id               = data.aws_route53_zone.ecs_domain.zone_id
+  distinct_domain_names = module.acm.distinct_domain_names
+
+  acm_certificate_domain_validation_options = module.acm.acm_certificate_domain_validation_options
+}
diff --git a/terraform/aws/alb.tf b/terraform/aws/alb.tf
index 02b68da..566a53b 100644
--- a/terraform/aws/alb.tf
+++ b/terraform/aws/alb.tf
@@ -1,5 +1,6 @@
 module "alb" {
-  source = "terraform-aws-modules/alb/aws"
+  source  = "terraform-aws-modules/alb/aws"
+  version = "~> 10.3.0"
 
   name = "atlas-lb"
 
@@ -67,13 +68,17 @@ module "alb" {
     }
   }
 
-  route53_records = {
-    A = {
-      name    = "api"
-      type    = "A"
-      zone_id = data.aws_route53_zone.ecs_domain.id
-    }
-  }
-
   tags = var.tags
+}
+
+resource "aws_route53_record" "atlas_assistant_api" {
+  provider = aws.dns
+  zone_id  = data.aws_route53_zone.ecs_domain.zone_id
+  name     = var.api_subdomain
+  type     = "A"
+  alias {
+    name                   = module.alb.dns_name
+    zone_id                = module.alb.zone_id
+    evaluate_target_health = true
+  }
 }
\ No newline at end of file
diff --git a/terraform/aws/cognito.tf b/terraform/aws/cognito.tf
index 1f2e81f..30c3600 100644
--- a/terraform/aws/cognito.tf
+++ b/terraform/aws/cognito.tf
@@ -29,7 +29,10 @@ resource "aws_cognito_user_pool" "atlas_pool" {
 resource "aws_cognito_user_pool_client" "atlas_pool_client" {
   name         = "atlas-backend-client"
   user_pool_id = aws_cognito_user_pool.atlas_pool.id
-  callback_urls = jsondecode(var.cognito_redirect_urls)
+  callback_urls = concat(
+    ["https://${var.api_subdomain}.${var.domain_name}/docs/oauth2-redirect"],
+    jsondecode(var.cognito_redirect_urls),
+  )
   allowed_oauth_flows_user_pool_client = true
   allowed_oauth_flows                  = ["code"]
   allowed_oauth_scopes                 = ["openid", "email", "phone", "profile"]
diff --git a/terraform/aws/ecr.tf b/terraform/aws/ecr.tf
index cec02a9..a62f1e6 100644
--- a/terraform/aws/ecr.tf
+++ b/terraform/aws/ecr.tf
@@ -1,5 +1,6 @@
 module "ecr" {
-  source = "terraform-aws-modules/ecr/aws"
+  source  = "terraform-aws-modules/ecr/aws"
+  version = "~> 3.1.0"
 
   repository_name = "atlas"
 
@@ -29,10 +30,10 @@ module "ecr" {
         rulePriority = 2,
         description  = "Keep last 5 tagged images",
         selection = {
-          tagStatus   = "tagged",
+          tagStatus     = "tagged",
           tagPrefixList = ["sha-"],
-          countType   = "imageCountMoreThan",
-          countNumber = 5
+          countType     = "imageCountMoreThan",
+          countNumber   = 5
         },
         action = {
           type = "expire"
diff --git a/terraform/aws/ecs.tf b/terraform/aws/ecs.tf
index eff2265..22f3e7b 100644
--- a/terraform/aws/ecs.tf
+++ b/terraform/aws/ecs.tf
@@ -1,5 +1,6 @@
 module "ecs" {
-  source = "terraform-aws-modules/ecs/aws"
+  source  = "terraform-aws-modules/ecs/aws"
+  version = "~> 6.10.0"
 
   cluster_name = "atlas-cluster"
 
diff --git a/terraform/aws/main.tf b/terraform/aws/main.tf
index 8b8e945..01a9eff 100644
--- a/terraform/aws/main.tf
+++ b/terraform/aws/main.tf
@@ -3,6 +3,14 @@ provider "aws" {
   default_tags { tags = var.tags }
 }
 
+provider "aws" {
+  # Provider reference for account that owns Route 53 records
+  alias = "dns"
+  assume_role {
+    role_arn = var.dns_account_role_arn
+  }
+}
+
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 data "aws_availability_zones" "available" {}
diff --git a/terraform/aws/tfvars/dev.tfvars b/terraform/aws/tfvars/dev.tfvars
index 85c297e..49d3b62 100644
--- a/terraform/aws/tfvars/dev.tfvars
+++ b/terraform/aws/tfvars/dev.tfvars
@@ -1,12 +1,11 @@
-environment          = "dev"
-region               = "us-east-1"
-state_bucket         = "tfstate-atlas"
-domain_name          = "atlas-assistant.ds.io"
+environment           = "dev"
+region                = "us-east-1"
+state_bucket          = "tfstate-atlas"
+domain_name           = "adaptationatlas.cgiar.org"
+api_subdomain         = "atlas-assistant-api"
 cors_origins          = "[\"https://adaptationatlas.github.io\"]"
-cognito_redirect_urls = "[\"https://api.atlas-assistant.ds.io/docs/oauth2-redirect\",\"https://adaptationatlas.github.io/adaptation-atlas-assistant/\", \"http://localhost:5173\"]"
-embeddings_directory = "/app/data/embeddings"
+cognito_redirect_urls = "[\"https://adaptationatlas.github.io/adaptation-atlas-assistant/\", \"http://localhost:5173\"]"
+embeddings_directory  = "/app/data/embeddings"
 tags = {
   project = "atlas-assistant"
-  owner   = "orbaco"
-  client  = "cgiar"
 }
diff --git a/terraform/aws/variables.tf b/terraform/aws/variables.tf
index 4bfbfab..91b4071 100644
--- a/terraform/aws/variables.tf
+++ b/terraform/aws/variables.tf
@@ -37,6 +37,22 @@ variable "domain_name" {
   EOT
 }
 
+variable "api_subdomain" {
+  type        = string
+  default     = ""
+  description = <<-EOT
+  Load balancer target for API backend
+  EOT
+}
+
+variable "dns_account_role_arn" {
+  type        = string
+  default     = ""
+  description = <<-EOT
+  Role to assume in DNS account to add certificate validation and load balancer reference on `domain_name` hosted zone.
+  EOT
+}
+
 variable "chat_model__type" {
   type        = string
   default     = ""
diff --git a/terraform/aws/versions.tf b/terraform/aws/versions.tf
index 0bb5ecc..63702b0 100644
--- a/terraform/aws/versions.tf
+++ b/terraform/aws/versions.tf
@@ -10,7 +10,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 6.0"
+      version = "~> 6.0"
     }
   }
 }
\ No newline at end of file
diff --git a/terraform/aws/vpc.tf b/terraform/aws/vpc.tf
index 14a8dd4..4068fca 100644
--- a/terraform/aws/vpc.tf
+++ b/terraform/aws/vpc.tf
@@ -1,5 +1,6 @@
 module "vpc" {
-  source = "terraform-aws-modules/vpc/aws"
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "~> 6.5.0"
 
   name = "atlas-vpc"
   cidr = local.vpc_cidr

From 3c46f98e3c5eb6d6c3ca26dc124c521e8864b83c Mon Sep 17 00:00:00 2001
From: aliziel <21992503+aliziel@users.noreply.github.com>
Date: Fri, 8 May 2026 22:51:39 -0700
Subject: [PATCH 2/2] fix: increment secret

---
 terraform/aws/secretsmanager.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/terraform/aws/secretsmanager.tf b/terraform/aws/secretsmanager.tf
index d5cc00e..4586d3e 100644
--- a/terraform/aws/secretsmanager.tf
+++ b/terraform/aws/secretsmanager.tf
@@ -5,5 +5,5 @@ resource "aws_secretsmanager_secret" "backend_secrets" {
 resource "aws_secretsmanager_secret_version" "backend_secrets" {
   secret_id                = aws_secretsmanager_secret.backend_secrets.id
   secret_string_wo         = jsonencode(local.application_env)
-  secret_string_wo_version = 7
+  secret_string_wo_version = 8
 }