Repository navigation
Add the provision module - #15
Merged
Merged
Conversation
Merged
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new Terraform module (terraform/modules/platform/provision) to define the “provision” Lambda (image-based, VPC-attached) and its IAM role/policy, and extends the repo README with operational notes around stage lifecycle and proof stability.
Changes:
- Introduces
modules/platform/provisionwith inputs for stage/network/db/OpenBao/chain config plus outputs for the Lambda and role. - Adds an IAM role/policy allowing the Lambda to write/read stage-scoped SSM parameters and read the RDS master secret.
- Expands
README.mdwith destroy-survivorship behavior, why proofs aren’t rewritten every apply, and guidance on re-running provision phases.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| terraform/modules/platform/provision/variables.tf | Defines module inputs for stage, networking, DB/OpenBao, chain config, and logging. |
| terraform/modules/platform/provision/main.tf | Creates the image-based Lambda, VPC config, env vars, and CloudWatch log group. |
| terraform/modules/platform/provision/iam.tf | Defines the Lambda assume-role policy and grants SSM/KMS/Secrets Manager access. |
| terraform/modules/platform/provision/outputs.tf | Exposes Lambda name/ARN and role ARN to callers. |
| README.md | Documents destroy behavior, proof determinism constraints, and planned work around forcing re-runs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
bajtos
force-pushed
the
stack/14-provision-module
branch
from
August 17, 2026 16:59
9533e44 to
00cfd68
Compare
bajtos
force-pushed
the
stack/14-provision-module
branch
from
August 19, 2026 08:04
00cfd68 to
6732f48
Compare
bajtos
force-pushed
the
stack/14-provision-module
branch
from
August 19, 2026 09:24
6732f48 to
21004f0
Compare
bajtos
force-pushed
the
stack/14-provision-module
branch
from
August 19, 2026 09:24
21004f0 to
e67c8ed
Compare
bajtos
force-pushed
the
stack/14-provision-module
branch
from
August 19, 2026 09:41
e67c8ed to
ff88145
Compare
bajtos
force-pushed
the
stack/14-provision-module
branch
from
August 19, 2026 09:41
ff88145 to
eda0d59
Compare
bajtos
force-pushed
the
stack/14-provision-module
branch
from
August 19, 2026 09:58
eda0d59 to
b212701
Compare
bajtos
force-pushed
the
stack/14-provision-module
branch
from
August 19, 2026 10:32
b212701 to
3c36f6b
Compare
Wraps the provision Lambda and its aws_lambda_invocation seed/vault triggers, so an apply mints secrets without ever moving money. Assisted-by: Claude <noreply@anthropic.com>
bajtos
force-pushed
the
stack/14-provision-module
branch
from
August 19, 2026 11:30
3c36f6b to
60600d6
Compare
The header claimed the module holds the two phased invocations, which the note at the foot of the same file contradicts: they live in the calling root, because each phase takes a different depends_on. Assisted-by: Claude:claude-opus-5 Signed-off-by: Miroslav Bajtoš <oss@bajtos.net>
Nothing tied the function to its log group, so the first invocation could reach AWS before Terraform created it. AWS then makes the group itself, with retention set to never expire, and the log group resource collides with what is already there. logging_config points the function at the group by name, which both orders the two and keeps the retention setting. Assisted-by: Claude:claude-opus-5 Signed-off-by: Miroslav Bajtoš <oss@bajtos.net>
DescribeParameters ignores resource-level permissions, so listing it under the stage parameter ARN grants nothing. The Lambda calls only GetParameter and PutParameter, so nothing loses an API it uses. Assisted-by: Claude:claude-opus-5 Signed-off-by: Miroslav Bajtoš <oss@bajtos.net>
The empty default reads as a way to mint hilt's AppRole without CIDR bounds. The vault phase rejects an empty list, so the default only serves a stage that never runs that phase. Assisted-by: Claude:claude-opus-5 Signed-off-by: Miroslav Bajtoš <oss@bajtos.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 14 of 19. Builds on #14 (ingress + OpenBao).
Adds
terraform/modules/platform/provision, which wraps the provision Lambda (from #6-#10) and itsaws_lambda_invocationseed/vault triggers, so an apply mints secrets without ever moving money. README gains "what survives a destroy", "why proofs are not rewritten every apply", and "forcing a provision phase to re-run".Verified with
terraform init -backend=false && terraform validateandterraform fmt -check -recursive.Generated by Claude Code