feat: overhaul install.sh UX, reliability, and DRY refactoring

.gitallowed

@@ -0,0 +1 @@
+123456789012

.github/workflows/validate.yml

@@ -0,0 +1,47 @@
+name: Validate
+
+on:
+  push:
+    branches: [main, 'feature/**']
+    paths:
+      - 'deploy/terraform/**'
+      - 'deploy/cloudformation/**'
+      - 'install.sh'
+      - 'uninstall.sh'
+      - '.github/workflows/validate.yml'
+  pull_request:
+    paths:
+      - 'deploy/terraform/**'
+      - 'deploy/cloudformation/**'
+      - 'install.sh'
+      - 'uninstall.sh'
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Bash syntax check
+        run: |
+          bash -n install.sh
+          bash -n uninstall.sh
+          echo "Bash syntax OK"
+
+      - name: ShellCheck
+        run: |
+          shellcheck --severity=error install.sh uninstall.sh || true
+
+      - uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform fmt check
+        run: terraform fmt -check -diff deploy/terraform/
+
+      - name: Terraform validate
+        run: |
+          cd deploy/terraform
+          terraform init -backend=false -input=false
+          terraform validate

deploy/cloudformation/template.yaml

@@ -247,6 +247,12 @@ Parameters:
     NoEcho: true
     Description: "Direct API key from your AI provider (e.g. Anthropic). Only needed when Model Access Mode is 'api-key'."
 
+  EnableBedrockForm:
+    Type: String
+    Default: 'false'
+    AllowedValues: ['true', 'false']
+    Description: "Submit the Bedrock model access use-case form. Only needed once per account — skip if Bedrock is already enabled."
+
   RequestQuotaIncreases:
     Type: String
     Default: 'false'
@@ -331,6 +337,7 @@ Conditions:
   IsPersonalAssistant: !Equals [!Ref ProfileName, 'personal_assistant']
   NeedsAdminUser: !Condition IsBuilder
   RunSecurityServices: !Not [!Condition IsPersonalAssistant]
+  RunBedrockForm: !Equals [!Ref EnableBedrockForm, 'true']
 
 # ============================================================================
 # RESOURCES
@@ -618,6 +625,7 @@ Resources:
   # --------------------------------------------------------------------------
   BedrockFormLambdaRole:
     Type: AWS::IAM::Role
+    Condition: RunBedrockForm
     Properties:
       RoleName: !Sub '${EnvironmentName}-bedrock-form-role'
       AssumeRolePolicyDocument:
@@ -648,6 +656,7 @@ Resources:
 
   BedrockFormFunction:
     Type: AWS::Lambda::Function
+    Condition: RunBedrockForm
     Properties:
       FunctionName: !Sub '${EnvironmentName}-bedrock-form'
       Runtime: python3.12
@@ -756,6 +765,7 @@ Resources:
 
   BedrockFormCustomResource:
     Type: Custom::BedrockForm
+    Condition: RunBedrockForm
     DependsOn: BedrockFormLambdaRole
     Properties:
       ServiceToken: !GetAtt BedrockFormFunction.Arn
@@ -1093,8 +1103,6 @@ Resources:
   # --------------------------------------------------------------------------
   Instance:
     Type: AWS::EC2::Instance
-    DependsOn:
-      - BedrockFormCustomResource
     CreationPolicy:
       ResourceSignal:
         Timeout: PT30M

deploy/terraform/main.tf

@@ -208,7 +208,8 @@ resource "aws_iam_instance_profile" "main" {
 # Bedrock Model Access (Lambda + invocation)
 # ============================================================================
 resource "aws_iam_role" "bedrock_form_lambda" {
-  name = "${var.environment_name}-bedrock-form-role"
+  count = var.enable_bedrock_form == "true" ? 1 : 0
+  name  = "${var.environment_name}-bedrock-form-role"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -221,13 +222,15 @@ resource "aws_iam_role" "bedrock_form_lambda" {
 }
 
 resource "aws_iam_role_policy_attachment" "bedrock_form_lambda_basic" {
-  role       = aws_iam_role.bedrock_form_lambda.name
+  count      = var.enable_bedrock_form == "true" ? 1 : 0
+  role       = aws_iam_role.bedrock_form_lambda[0].name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 }
 
 resource "aws_iam_role_policy" "bedrock_form" {
-  name = "bedrock-form"
-  role = aws_iam_role.bedrock_form_lambda.id
+  count = var.enable_bedrock_form == "true" ? 1 : 0
+  name  = "bedrock-form"
+  role  = aws_iam_role.bedrock_form_lambda[0].id
 
   policy = jsonencode({
     Version = "2012-10-17"
@@ -254,6 +257,7 @@ resource "aws_iam_role_policy" "bedrock_form" {
 }
 
 data "archive_file" "bedrock_form" {
+  count       = var.enable_bedrock_form == "true" ? 1 : 0
   type        = "zip"
   output_path = "${path.module}/.lambda_zips/bedrock_form.zip"
 
@@ -330,18 +334,20 @@ def handler(event, context):
 }
 
 resource "aws_lambda_function" "bedrock_form" {
+  count            = var.enable_bedrock_form == "true" ? 1 : 0
   function_name    = "${var.environment_name}-bedrock-form"
-  role             = aws_iam_role.bedrock_form_lambda.arn
+  role             = aws_iam_role.bedrock_form_lambda[0].arn
   handler          = "index.handler"
   runtime          = "python3.12"
   timeout          = 120
-  filename         = data.archive_file.bedrock_form.output_path
-  source_code_hash = data.archive_file.bedrock_form.output_base64sha256
+  filename         = data.archive_file.bedrock_form[0].output_path
+  source_code_hash = data.archive_file.bedrock_form[0].output_base64sha256
 
   depends_on = [aws_iam_role_policy.bedrock_form]
 }
 
 resource "null_resource" "bedrock_form_invoke" {
+  count      = var.enable_bedrock_form == "true" ? 1 : 0
   depends_on = [aws_lambda_function.bedrock_form]
 
   provisioner "local-exec" {

deploy/terraform/variables.tf

@@ -168,6 +168,17 @@ variable "request_quota_increases" {
   }
 }
 
+variable "enable_bedrock_form" {
+  type        = string
+  default     = "false"
+  description = "Submit the Bedrock model access use-case form. Only needed once per account — skip if Bedrock is already enabled."
+
+  validation {
+    condition     = contains(["true", "false"], var.enable_bedrock_form)
+    error_message = "Must be true or false."
+  }
+}
+
 variable "enable_security_hub" {
   type        = bool
   default     = true