gorillaclinic-bootstrap

Provisions the AWS foundations required by all other GorillaClinic repositories. Run this first.

Prerequisites

Tool	Version
Terraform	>= 1.10
AWS CLI	>= 2.x

AWS credentials with AdministratorAccess on your AWS account must be configured before running.

aws configure                 # or use SSO / environment variables
aws sts get-caller-identity   # verify credentials

What it creates

• S3 state bucket gorillaclinic-tfstate-<AWS_ACCOUNT_ID> — versioned, AES-256 encrypted, S3 native locking (no DynamoDB required)
• GitHub Actions OIDC provider — keyless authentication from GitHub Actions to AWS
• 5 IAM roles for GitHub Actions pipelines:
  • gorillaclinic-bootstrap-gha — AdministratorAccess
  • gorillaclinic-infra-gha — AdministratorAccess
  • gorillaclinic-platform-gha — EKS describe/access + STS (scoped)
  • gorillaclinic-app-build-gha — ECR push + STS (scoped)
  • gorillaclinic-gitops-gha — EKS describe + STS (scoped)
• ECR repository gorillaclinic-app — immutable tags, scan-on-push, lifecycle policy retains 20 images
• SSM parameters at /gorillaclinic/bootstrap/* — role ARNs, ECR URL, state bucket name

Usage

This repo has a bootstrap chicken-and-egg: it creates the S3 bucket that stores its own state.

Phase 1 — local backend (first run only):

make init    # initialise providers with local backend
make apply   # create S3 bucket, OIDC provider, IAM roles, ECR, SSM params

Phase 2 — migrate state to S3:

Edit terraform/backend.tf, replace the local block with the S3 backend (the snippet is in the file as a comment), then:

make migrate-state   # runs: terraform init -migrate-state

Commit backend.tf. The local terraform.tfstate can be deleted.

Day-to-day:

make plan    # preview changes
make apply   # apply changes

Configuration

All configurable values live in terraform/variables.tf. The only inputs normally needed:

Variable	Default	Description
aws_region	eu-central-1	AWS region for all resources
github_org	YOUR_GITHUB_ORG	GitHub org used in OIDC trust policy

CI/CD

Workflow	Trigger	Action
terraform-plan.yml	PR to main	init → fmt → validate → plan, posts plan as PR comment
terraform-apply.yml	Push to main	init → validate → plan → apply -auto-approve

Required GitHub repo secret: GHA_ROLE_ARN — the ARN of gorillaclinic-bootstrap-gha (printed by terraform output).

SSM parameters written

Parameter	Value
/gorillaclinic/bootstrap/tfstate_bucket	S3 bucket name
/gorillaclinic/bootstrap/tfstate_region	S3 bucket region
/gorillaclinic/bootstrap/oidc_provider_arn	GitHub OIDC provider ARN
/gorillaclinic/bootstrap/gha_role_infra	IAM role ARN for gorillaclinic-infra
/gorillaclinic/bootstrap/gha_role_platform	IAM role ARN for gorillaclinic-platform
/gorillaclinic/bootstrap/gha_role_app_build	IAM role ARN for gorillaclinic-app-build
/gorillaclinic/bootstrap/gha_role_gitops	IAM role ARN for gorillaclinic-gitops

Repository chain

#	Repository	Depends on
1	gorillaclinic-bootstrap ← this repo	—
2	gorillaclinic-infra	bootstrap
3	gorillaclinic-platform	infra
4	gorillaclinic-app-build	bootstrap
5	gorillaclinic-gitops	infra, platform, app-build
6	gorillaclinic-testing	infra (CloudFront URL)