Inputs

Inputs

Every input variable on the root module, from variables.tf. Submodule variables are on Submodules — the root module supplies all of them.

General

Name	Type	Default	Required	Description
region	string	ca-central-1	no	AWS region. Also passed to the containers, maintenance, and demo-loop modules for awslogs-region.
environment	string	prod	no	Deployment environment. Second half of every resource name prefix and the Environment default tag.
project_name	string	reportmate	no	First half of every resource name prefix.

Networking

Name	Type	Default	Required	Description
vpc_cidr	string	10.0.0.0/16	no	CIDR for the VPC. Subnets are carved with cidrsubnet(cidr, 8, n).
domain_name	string	reportmate.app	no	Declared but not referenced by any resource in the module.
enable_custom_domain	bool	false	no	Declared but not referenced by any resource. There is no CloudFront, ACM, or Route 53 resource in this repo.
enable_vpc_flow_logs	bool	true	no	Send VPC Flow Logs to a private S3 bucket with a 30-day expiry.
enable_vpc_endpoints	bool	false	no	Create interface endpoints for ecr.api, ecr.dkr, logs, and secretsmanager. Billed per endpoint per AZ. The S3 gateway endpoint is created regardless.
enable_multi_az_nat	bool	false	no	One NAT gateway per AZ instead of one shared. Doubles NAT hourly cost; removes the single-AZ egress dependency and cross-AZ NAT transfer.

Database

Name	Type	Default	Required	Description
db_username	string	reportmate	no	RDS master username.
db_password	string (sensitive)	—	yes	RDS master password. Also stored in Secrets Manager and embedded in the connection-string secret.
db_instance_class	string	db.t3.micro	no	RDS instance class.
db_allocated_storage	number	32	no	Allocated storage in GB, gp3.
db_multi_az	bool	false	no	Synchronous standby in a second AZ. Roughly doubles instance and storage cost.

The database name itself is not a root variable; the database submodule defaults it to reportmate.

Containers

Name	Type	Default	Required	Description
api_image_tag	string	latest	no	Tag appended to the API ECR repository URL in the task definition.
frontend_image_tag	string	latest	no	Tag appended to the frontend ECR repository URL.
api_cpu	number	256	no	Fargate CPU units for the API task. 1024 = 1 vCPU.
api_memory	number	512	no	Fargate memory in MiB for the API task.
frontend_cpu	number	256	no	Fargate CPU units for the frontend task.
frontend_memory	number	512	no	Fargate memory in MiB for the frontend task.

Fargate only accepts specific CPU/memory pairs. The maintenance and demo-loop tasks are fixed at 256/512 and are not configurable.

Auth and secrets

Name	Type	Default	Required	Description
api_internal_secret	string (sensitive)	—	yes	Shared secret for frontend-to-API calls. Injected into both containers as API_INTERNAL_SECRET.
kiosk_tokens	string (sensitive)	""	no	Comma-separated label:token pairs that /kiosk exchanges for a read-only session. Empty disables kiosk sessions.
client_passphrase	string (sensitive)	—	yes	Passphrase endpoint agents authenticate with. Injected as REPORTMATE_PASSPHRASE.
auth_callback_urls	list(string)	["http://localhost:3000/api/auth/callback/cognito"]	no	Cognito app client callback URLs. Change this for any real deployment.
auth_logout_urls	list(string)	["http://localhost:3000"]	no	Cognito app client logout redirect URLs.

The NextAuth session secret is not an input — Terraform generates it.

Monitoring

Name	Type	Default	Required	Description
log_retention_days	number	30	no	Retention on all four CloudWatch log groups.
alert_email	string	""	no	Subscribed to the SNS alerts topic. Empty also skips creating the cost budget entirely, not just the email.
daily_budget_usd	number	30	no	Daily AWS Budget limit. The variable description mentions FORECASTED notifications; the resource declares only an ACTUAL notification at 100%, because AWS Budgets does not support FORECASTED on a daily budget.
nat_bytes_out_alarm_gb	number	20	no	Alarm threshold on each NAT gateway's hourly BytesOutToDestination. Set to 0 to create no alarms.

Maintenance

Name	Type	Default	Required	Description
event_retention_days	number	30	no	Passed to the maintenance container as EVENT_RETENTION_DAYS.

Public URL and TLS

Name	Type	Default	Required	Description
public_api_url	string	—	yes	The URL the browser uses. Set on the frontend task as both API_BASE_URL and NEXTAUTH_URL.
acm_certificate_arn	string	""	no	Certificate for the port 443 listener. Empty means the 443 listener speaks plain HTTP, which only makes sense on a first apply.

Demo loop

Name	Type	Default	Required	Description
enable_demo_loop	bool	false	no	Provision the synthetic-data generator service. Also sets NEXT_PUBLIC_DEMO_MODE on the frontend. Intended only for a public demo deployment.
demo_loop_api_url	string	""	no	Where the demo loop posts. Empty falls back to the ALB base URL, http://<alb-dns>, bypassing any CDN in front. The ALB is internet-facing, so the requests still leave the private subnets through NAT.

The demo-loop batch size, interval, and device count are submodule variables (15, 120s, 1800s, 300 devices) and are not surfaced on the root module.