Fountain Life Notebook Infra

Terraform foundation for deploying the Fountain Life Notebook interview app to AWS.

This repo is intentionally inert until someone provides AWS credentials and runs Terraform. Do not run terraform apply or deploy workflows without explicit approval.

GCP Mental Model Map

GCP pattern	AWS shape in this repo
Cloud Build	GitHub Actions
Artifact Registry	Amazon ECR
Cloud Run service	ECS Fargate service behind an Application Load Balancer
Static frontend hosting	S3 private bucket with CloudFront
Firebase/Auth or Identity Platform	Cognito User Pool and hosted UI
Secret Manager	AWS Secrets Manager injected into ECS task env
Cloud Run HTTPS frontend-to-backend	CloudFront serves the SPA and proxies /api/* to the backend ALB

What Terraform Creates

• VPC with two public subnets for a low-friction demo deployment.
• Private ECS subnets with outbound internet through one NAT gateway.
• ECR repository for the backend Docker image.
• ECS cluster, Fargate task definition, service, CloudWatch log group, and ALB.
• S3 document bucket used by DOCUMENT_STORAGE_PROVIDER=s3.
• Private S3 frontend bucket plus CloudFront distribution.
• CloudFront /api/* behavior to avoid browser mixed-content and CORS issues.
• Cognito user pool with admin-created users only.
• Secrets Manager placeholder for the MongoDB Atlas URI.
• ECS task-role permission for Amazon Bedrock model invocation.
• GitHub OIDC role for backend/frontend deploy workflows on approved branch refs.

First Deploy Sequence

1. Create the AWS account and choose a region, defaulting to us-east-1.

2. Pick a globally unique Cognito domain prefix and copy terraform.tfvars.example to terraform.tfvars.

3. Run Terraform locally with approved AWS credentials:

   terraform init
   terraform plan
   terraform apply

4. Put the MongoDB secret value after the secret placeholder exists:

   aws secretsmanager put-secret-value \
     --secret-id "$(terraform output -raw mongodb_secret_name)" \
     --secret-string "mongodb+srv://..."

5. Enable Bedrock model access for the configured bedrock_model_id in the selected AWS region.

6. Copy the github_backend_repository_variables output into the backend repo variables.

7. Copy the github_frontend_repository_variables output into the frontend repo variables.

8. Run the backend Deploy Backend workflow once to publish a real image, roll ECS, and scale the service up.

9. Set backend_desired_count = 1 in terraform.tfvars after the first successful backend deployment if Terraform should preserve one running task on future applies.

10. Run the frontend Deploy Static Site workflow to publish build/client to S3/CloudFront.

11. Create demo users manually in Cognito with AdminCreateUser or the AWS console.

The first Terraform apply uses the bootstrap backend image tag and backend_desired_count = 0, so ECS does not try to pull a nonexistent image. The backend deploy workflow pushes the first real image and scales the service up.

Notes

• MongoDB Atlas is the fastest database path for this milestone. DocumentDB remains a later AWS-native option.
• Bedrock model access must be enabled in the selected AWS region before notebook answers can use the deployed LLM provider.
• Fargate tasks run in private subnets. The public ALB accepts HTTP only from CloudFront origin-facing edge locations.
• CloudFront-to-ALB origin traffic is still HTTP until an ACM certificate and custom API origin domain are added. Do not handle PHI or production patient data before enabling HTTPS origin traffic.
• Custom domains and ACM are deferred. CloudFront's default HTTPS domain is enough for the first deployed demo and Cognito callback.
• Terraform state can start local for the first account bootstrap. Use backend.tf.example to move to S3 state with DynamoDB locking before team use.