v2.2.0 — infrastructure as code

The infrastructure-as-code release: everything the API needs on AWS is created, deployed and destroyed by Terraform, from a pipeline.

Terraform

• terraform/ holds one file per service: network rules, ECR, RDS PostgreSQL, SSM Parameter Store, S3, IAM, CloudWatch Logs, an Application Load Balancer and ECS Fargate.
• The database password is generated by Terraform and reaches the container from an encrypted parameter, never through the task definition.
• The state lives in S3 with native locking, so a deploy from the pipeline can be destroyed from anywhere.
• terraform destroy leaves nothing behind: the registry, the bucket and the database are allowed to go with their contents.

Pipeline

• Infrastructure workflow, run on demand with apply or destroy.
• apply builds the API image tagged with the commit, deploys it, waits until it is healthy, seeds the database with a one-off task and smoke-tests /health/ready.
• Measured: about 9 minutes to deploy, about 6 to destroy.

See terraform/README.md to run it.