AWS infrastructure provisioning (Terraform) plus an AWS account inventory tool (Go).

This repository assumes you are authenticated via the AWS CLI. No AWS credentials are stored in this repo.

Repository layout

• bootstrap/ creates the Terraform remote state backend (S3) using local state.
• infra/ provisions the infrastructure.
• scripts/aws-inventory/ is the Go inventory tool.
• out/ is generated output (gitignored).

Prerequisites

• AWS CLI installed and authenticated:
  • aws sts get-caller-identity
• Terraform >= 1.6
• Go >= 1.23
• Domain managed in Cloudflare (for example example.com)
• Cloudflare scoped API token for your zone (create at https://dash.cloudflare.com/profile/api-tokens):
  • Template: Edit zone DNS
  • Permissions: Zone:DNS:Edit, Zone:DNS:Read
  • Zone Resources: Include -> Specific zone -> <your-domain>

Pre-commit

Enable pre-commit hooks:

pre-commit clean
pre-commit install
pre-commit run --all-files

Disable pre-commit hooks:

rm .git/hooks/pre-commit

Auth compatibility

If you authenticated with aws login using browser-based authentication for a non-SSO account, see Appendix: AWS CLI authentication at the end of this document.

1) Bootstrap the Terraform backend

Bootstrap creates:

• S3 bucket for Terraform state

terraform -chdir=bootstrap init
terraform -chdir=bootstrap apply -auto-approve

Create infra/backend.hcl from bootstrap outputs

Terraform backends cannot consume normal Terraform variables, so backend parameters are provided via a local, gitignored backend.hcl file.

Run this once after bootstrap:

STATE_BUCKET=$(terraform -chdir=bootstrap output -raw state_bucket_name)
cat > infra/backend.hcl <<EOF
bucket         = "$STATE_BUCKET"
use_lockfile   = true
EOF

2) Configure local secrets

Create a local, gitignored secrets file:

cp infra/secrets.auto.tfvars.example infra/secrets.auto.tfvars

Fill in at minimum:

• domain_name
• cloudflare_api_token

Optional:

• owner (if omitted, owner tag defaults to the AWS caller identity ARN)
• ami_id_override (optional AMI ID to use instead of the default lookup)

3) Provision infrastructure

terraform -chdir=infra init -backend-config=backend.hcl
terraform -chdir=infra apply -auto-approve

4) Verify

The application is served at:

• https://app.<domain_name>

It returns a simple page that includes the instance hostname.

curl -s https://app.<domain_name>

Run it multiple times to observe hostname changes behind the load balancer.

5) Run the AWS inventory tool

go run -C scripts/aws-inventory .

Optional concurrency override:

go run . --concurrency 8
# or
AWS_INVENTORY_CONCURRENCY=8 go run .

Output:

• human-readable summary to stdout
• JSON report written to out/report.json

Canonical specification

All architecture, decisions, invariants, and tradeoffs are documented in:

• docs/ARCHITECTURE.md

---

Teardown

Destroy in reverse order so the backend bucket is removed last:

terraform -chdir=infra destroy -auto-approve
terraform -chdir=bootstrap destroy -auto-approve -var=force_destroy_state_bucket=true

Appendix: AWS CLI authentication

Terraform relies on the AWS SDK credential chain. Some AWS CLI authentication methods, especially aws login (browser-based authentication), work for the AWS CLI but are not visible to Terraform by default.

When this happens, Terraform fails with:

No valid credential sources found

Required setup when using aws login

Step 1: Authenticate via AWS CLI

aws login --profile login

This command:

• authenticates you via the browser
• automatically creates or updates a [profile login] section in ~/.aws/config
• stores credentials in the AWS CLI internal cache (not in config files)

You do not need to manually edit the login profile.

Step 2: Update the default profile (required)

Terraform reads credentials from the default AWS profile unless told otherwise. To allow Terraform to reuse the credentials obtained by aws login, add the following to the default profile in ~/.aws/config:

[default]
credential_process = aws configure export-credentials --format process --profile login

That's the only required change.

If region already exists under [default], keep it. If not, it is recommended (but not required) to add the same region used during aws login.

Example (optional but recommended):

[default]
region = il-central-1
credential_process = aws configure export-credentials --format process --profile login

What this does

• aws login authenticates you and caches temporary credentials
• Terraform cannot read that cache directly
• credential_process instructs Terraform to:
  • execute the AWS CLI and retrieve credentials on demand
  • aws configure export-credentials --format process outputs credentials in a standard JSON format understood by Terraform
• No static credentials are written to disk
• AWS CLI and Terraform now share the same authenticated session

When this is not required

This setup is not needed if you use:

• IAM access keys in ~/.aws/credentials
• EC2 / ECS IAM roles
• Standard AWS SSO (aws configure sso + aws sso login)

It is only required for AWS CLI authentication flows that Terraform cannot consume directly.

Back to top