feat(terraform/organization): add domains/organization for IAM Identity Center#31
Merged
Merged
Conversation
…ty Center
IAM Identity Center is an AWS Organization-level service. Moving its management
out of _core/shared/dev into a dedicated domain root eliminates cross-env state
dependencies and aligns with AWS recommended architecture.
Supports both single-account (all account IDs equal) and multi-account setups
via tfvars only — module logic is identical in both cases.
Apply order: domains/organization → _core/shared/{env} → domains/platform/{env}
…access.tf
Permission sets, groups, and account assignments are now managed exclusively in
domains/organization. Remove identity_center_bootstrap from dev/access.tf,
remove data.terraform_remote_state.shared_dev and identity_center_assignment
from staging/access.tf and prod/access.tf.
Also remove Identity Center outputs from staging/outputs.tf and prod/outputs.tf
that referenced the now-removed shared_dev remote state data source.
Each _core/shared/{env} root is now self-contained — no cross-env state reads.
Permission set ARNs, SSO instance ARN, and group IDs are no longer sourced from shared/dev. Remove outputs that had no consumers after the organization domain refactoring.
…emplate
_core/shared/{env} backend files were committed directly with bot tokens,
inconsistent with domains/platform which uses the backend.tf.template pattern.
Align all envs: commit the .template, gitignore the generated backend.tf.
Also fixes prod backend.tf which incorrectly referenced __AWS_ACCOUNT_ID_DEV__
instead of __AWS_ACCOUNT_ID__.
Add domains/organization to Terraform state flow, architecture tree, apply order, quick start guide, and further reading. Clarify that _core/shared now only handles CI access.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
feat(terraform/organization): add domains/organization for IAM Identity Center
IAM Identity Center is an AWS Organization-level service. Moving its management
out of _core/shared/dev into a dedicated domain root eliminates cross-env state
dependencies and aligns with AWS recommended architecture.
Supports both single-account (all account IDs equal) and multi-account setups
via tfvars only — module logic is identical in both cases.
Apply order: domains/organization → _core/shared/{env} → domains/platform/{env}
Why
Changes
path/to/file— reasonChecklist
main(git log --oneline main..HEAD)main-bound filesgrep -r "env: dev\|eu-west-3\|k8s-platform-dev\|esoIrsaRoleArn: \"\"" argocd/ kubernetes/helm/elements:)grep -r "__ENV__\|__CLUSTER_NAME__" kubernetes/manifests/ kubernetes/helm/type(scope): description)find . -name "*.yaml" -o -name "*.go" | xargs wc -l | sort -rn | head -20)git diff main --name-only | xargs grep -l "password\|secret\|token\|key" 2>/dev/null)Testing
kubectl apply --dry-run=serveron changed manifestsNotes for reviewer