Prerequisites

Prerequisites

What you need in place before running terraform init on this module.

Tooling

Tool	Constraint	Where it comes from
Terraform	>= 1.5	versions.tf required_version
AWS provider	~> 5.0	versions.tf required_providers
Random provider	~> 3.1	versions.tf required_providers
AWS CLI	any recent version	Used by the scripts in scripts/ and for ECR login
Docker	any recent version	Only needed to push images to ECR

The bootstrap/ module pins the same Terraform and AWS provider constraints but does not use the random provider.

AWS account

You need credentials for an account where you can create VPCs, RDS instances, ECS clusters, ECR repositories, IAM roles, Cognito user pools, API Gateway APIs, S3 buckets, SQS queues, Secrets Manager secrets, EventBridge Scheduler schedules, and AWS Budgets. In practice this is close to administrator access on a dedicated account.

Two kinds of name are global across all AWS accounts, so they collide on a second deployment with the same names:

• The Cognito hosted-UI domain, which is <project_name>-<environment> — globally unique across all AWS accounts.
• S3 bucket names. The storage bucket is <project_name>-<environment>-storage and the bootstrap state bucket is <project_name>-terraform-state, both globally unique. The VPC Flow Logs bucket appends your account id, so it does not collide.

Change project_name or environment to deploy more than one copy.

Service quotas and region

The default region in variables.tf is ca-central-1. Whatever region you pick must have at least two availability zones — the networking module takes the first two AZs returned by aws_availability_zones unless you override availability_zones in the networking submodule, and an ALB requires two.

State backend

versions.tf declares an S3 backend with no inline configuration, so terraform init needs bucket, key and region supplied, plus dynamodb_table for state locking. The bootstrap/ module creates the bucket and the lock table. See State-and-Backends.

Required variables

Four root variables have no default and must be supplied before any plan will succeed:

Variable	Why
db_password	RDS admin password; also written to Secrets Manager
api_internal_secret	Shared secret for frontend-to-API calls
client_passphrase	Passphrase endpoint agents authenticate with
public_api_url	The hostname the browser uses to reach the API

public_api_url is a chicken-and-egg problem on a first apply: it is baked into the frontend task definition as API_BASE_URL and NEXTAUTH_URL, but the ALB DNS name does not exist until after the apply. See Getting-Started.

Container images

The module creates the ECR repositories but the ECS services will not become healthy until images exist in them. You need pull access to the published API image (ghcr.io/reportmate/reportmate-api) and a way to build the frontend image from reportmate-app-web.