ALB-direct deployment mode - Public Endpoint with IP filtering

[jantmer]

Terraform ECS — ALB-direct mode (no Route53/CloudFront)

Support deploying the stack without Route53 DNS or CloudFront by falling back to the Keycloak ALB DNS name directly. This enables deployments in environments where custom domains or CloudFront are not available.

• Resolve keycloak_domain to ALB DNS when both Route53 and CloudFront are disabled (main.tf, keycloak-ecs.tf)
• Derive protocol (http/https) dynamically based on TLS availability in the mcp-gateway module (locals.tf)
• Configure Keycloak for HTTP mode: set KC_HOSTNAME_STRICT_HTTPS=false, KC_HTTP_ENABLED=true, and override entrypoint with --spi-realm-default-ssl-required=NONE
• Add HTTP (port 80) security group rules for auth-server, registry, and NAT gateway ingress to the Keycloak ALB
• Enable ECS Exec on the Keycloak service for operational debugging
• Update registry_url output to fall back through CloudFront then ALB

Secrets Manager SCP compliance

Satisfy organization SCPs that require KMS encryption and automatic rotation on all Secrets Manager secrets.

• Add secrets-compliance.tf with a dedicated KMS key, key alias, no-op rotation Lambda, and rotation schedules for root-module secrets
• Add kms_key_id to every aws_secretsmanager_secret in the module (secrets.tf) and root module (documentdb.tf, keycloak-database.tf)
• Add 90-day rotation schedules for all module-level secrets
• Grant ECS tasks kms:Decrypt and kms:GenerateDataKey on the secrets key
• Pass secrets_kms_key_arn and secrets_rotation_lambda_arn into the mcp-gateway module via new variables
• Export secrets_kms_key_arn as a terraform output
• Update init-keycloak.sh to resolve and pass --kms-key-id when updating Keycloak client secrets in Secrets Manager

Auth server — JWT fallback for network-trusted mode

When the static API token doesn't match, fall through to JWT validation instead of returning 403. This allows both static tokens and JWT bearer tokens to authenticate registry API requests in network-trusted mode.

Scopes and group mappings

• Add mcp-registry-admin and mcp-servers-unrestricted to the registry-admins group_mappings in registry-admins.json
• Add mcp-servers-unrestricted group mapping in scopes.yml for M2M service accounts

DocumentDB initialization

• Re-enable load-scopes.py in run-documentdb-init.sh so that group_mappings and UI-Scopes from scopes.yml are loaded into DocumentDB at init time

init-keycloak.sh — HTTP mode realm SSL override

When Keycloak is running in HTTP mode, use ECS Exec to run kcadm.sh inside the container and set sslRequired=NONE on the master and mcp-gateway realms. This is necessary because Keycloak persists sslRequired per-realm in the database and no env var can change it retroactively.

Build tooling

• Support Finch/nerdctl as an alternative container runtime in build-images.sh via CONTAINER_RUNTIME env var
• Use #!/usr/bin/env bash for portability

Issue #, if available:

Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.