Submodules

Submodules

Every variable and output of the eleven submodules under modules/, read from each module's variables.tf and outputs.tf. The root module calls all of them and supplies their inputs, so this page matters when you read main.tf, change the wiring, or call a submodule directly from your own configuration. For the inputs you set on a normal deployment, see Inputs; for the root outputs, see Outputs.

The "Root module sets it to" column shows the expression main.tf passes. "not set (default)" means the root module leaves the submodule default in place. Descriptions are the ones written in variables.tf and outputs.tf; where a description and the code disagree, the code is described under Where descriptions and code differ.

auth

Called from the root module as module.auth.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment
callback_urls	list(string)	["http://localhost:3000/api/auth/callback/cognito"]	var.auth_callback_urls	OAuth2 callback URLs for the web application
logout_urls	list(string)	["http://localhost:3000"]	var.auth_logout_urls	Logout redirect URLs

Outputs

Name	Value	Description
user_pool_id	aws_cognito_user_pool.main.id	Cognito User Pool ID
user_pool_arn	aws_cognito_user_pool.main.arn	Cognito User Pool ARN
user_pool_endpoint	aws_cognito_user_pool.main.endpoint	Cognito User Pool OIDC endpoint
user_pool_domain	https://${aws_cognito_user_pool_domain.main.domain}.auth.${data.aws_region.current.name}.amazoncognito.com	Cognito User Pool hosted UI domain
client_id	aws_cognito_user_pool_client.web.id	Cognito App Client ID
client_secret	aws_cognito_user_pool_client.web.client_secret	Cognito App Client Secret (sensitive)
nextauth_secret	random_password.nextauth_secret.result	Generated NextAuth session secret (sensitive)
nextauth_secret_arn	aws_secretsmanager_secret.nextauth_secret.arn	ARN of the NextAuth session secret (for injection into the frontend task)
secret_arns	[aws_secretsmanager_secret.cognito_client_id.arn, aws_secretsmanager_secret.cognito_client_secret.arn, aws_secretsmanager_secret.nextauth_secret.arn]	All auth-related secret ARNs for IAM policy

containers

Called from the root module as module.containers.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment
region	string	required	var.region	AWS region
vpc_id	string	required	module.networking.vpc_id	VPC ID
public_subnet_ids	list(string)	required	module.networking.public_subnet_ids	Public subnet IDs for ALB
private_subnet_ids	list(string)	required	module.networking.private_subnet_ids	Private subnet IDs for ECS tasks
ecs_execution_role_arn	string	required	module.identity.ecs_execution_role_arn	ECS execution role ARN
ecs_task_role_arn	string	required	module.identity.ecs_task_role_arn	ECS task role ARN
api_image_tag	string	latest	var.api_image_tag	API container image tag
frontend_image_tag	string	latest	var.frontend_image_tag	Frontend container image tag
api_cpu	number	256	var.api_cpu	API task CPU units
api_memory	number	512	var.api_memory	API task memory in MiB
frontend_cpu	number	256	var.frontend_cpu	Frontend task CPU units
frontend_memory	number	512	var.frontend_memory	Frontend task memory in MiB
db_connection_string_secret_arn	string	required	module.secrets.db_connection_string_secret_arn	ARN of the database connection string secret
api_internal_secret_arn	string	required	module.secrets.api_internal_secret_arn	ARN of the API internal secret
kiosk_tokens_secret_arn	string	required	module.secrets.kiosk_tokens_secret_arn	ARN of the kiosk viewer tokens secret
nextauth_secret_arn	string	required	module.auth.nextauth_secret_arn	ARN of the NextAuth session secret (injected into the frontend container)
client_passphrase_secret_arn	string	required	module.secrets.client_passphrase_secret_arn	ARN of the client passphrase secret
api_log_group_name	string	required	module.monitoring.api_log_group_name	CloudWatch log group name for API
frontend_log_group_name	string	required	module.monitoring.frontend_log_group_name	CloudWatch log group name for frontend
database_security_group_id	string	required	module.database.security_group_id	Database security group ID to allow ECS access Declared but not referenced by any resource in this module.
public_api_url	string	required	var.public_api_url	Public URL the browser uses to reach the API. Wired into the frontend as API_BASE_URL.
demo_mode	bool	false	var.enable_demo_loop	Set NEXT_PUBLIC_DEMO_MODE on the frontend. Only true for the public demo site.
acm_certificate_arn	string	""	var.acm_certificate_arn	ACM certificate ARN for the 443 listener. Empty = HTTP on 443 (fresh-deploy only; set this for any real environment).

Outputs

Name	Value	Description
cluster_id	aws_ecs_cluster.main.id	ECS cluster ID
cluster_name	aws_ecs_cluster.main.name	ECS cluster name
ecr_api_repository_url	aws_ecr_repository.api.repository_url	ECR repository URL for API images
ecr_frontend_repository_url	aws_ecr_repository.frontend.repository_url	ECR repository URL for frontend images
alb_dns_name	aws_lb.main.dns_name	ALB DNS name
alb_zone_id	aws_lb.main.zone_id	ALB hosted zone ID (for Route53 alias)
api_url	http://${aws_lb.main.dns_name}/api	API URL via ALB
alb_base_url	http://${aws_lb.main.dns_name}	Base URL for in-VPC callers (demo-loop, maintenance)
frontend_url	http://${aws_lb.main.dns_name}	Frontend URL via ALB
ecs_tasks_security_group_id	aws_security_group.ecs_tasks.id	ECS tasks security group ID
api_service_name	aws_ecs_service.api.name	API ECS service name
frontend_service_name	aws_ecs_service.frontend.name	Frontend ECS service name

database

Called from the root module as module.database.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment
vpc_id	string	required	module.networking.vpc_id	VPC ID for security group
private_subnet_ids	list(string)	required	module.networking.private_subnet_ids	Private subnet IDs for DB subnet group
db_username	string	required	var.db_username	PostgreSQL admin username
db_password	string (sensitive)	required	var.db_password	PostgreSQL admin password
db_name	string	reportmate	not set (default)	Database name
instance_class	string	db.t3.micro	var.db_instance_class	RDS instance class
allocated_storage	number	32	var.db_allocated_storage	Storage in GB
allowed_security_group_ids	list(string)	[]	[module.containers.ecs_tasks_security_group_id]	Security group IDs allowed to connect to the database
multi_az	bool	false	var.db_multi_az	Provision RDS with a synchronous standby in another AZ.

Outputs

Name	Value	Description
endpoint	aws_db_instance.main.endpoint	RDS instance endpoint (host:port)
address	aws_db_instance.main.address	RDS instance hostname
port	aws_db_instance.main.port	RDS instance port
database_name	aws_db_instance.main.db_name	Database name
security_group_id	aws_security_group.database.id	Database security group ID
connection_string	postgresql://${var.db_username}:${var.db_password}@${aws_db_instance.main.address}:${aws_db_instance.main.port}/${aws_db_instance.main.db_name}	PostgreSQL connection string (sensitive)

demo-loop

Called from the root module as module.demo_loop.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment
region	string	required	var.region	AWS region
ecs_cluster_arn	string	required	module.containers.cluster_id	ARN of the ECS cluster
ecs_execution_role_arn	string	required	module.identity.ecs_execution_role_arn	ARN of the ECS execution role
ecs_task_role_arn	string	required	module.identity.ecs_task_role_arn	ARN of the ECS task role
client_passphrase_secret_arn	string	required	module.secrets.client_passphrase_secret_arn	ARN of the client passphrase secret in Secrets Manager
api_url	string	required	coalesce(var.demo_loop_api_url, module.containers.alb_base_url)	Public API URL for submitting demo payloads (e.g. https://demo.reportmate.app)
private_subnet_ids	list(string)	required	module.networking.private_subnet_ids	Private subnet IDs for task networking
security_group_ids	list(string)	required	[module.containers.ecs_tasks_security_group_id]	Security group IDs for task networking
log_group_name	string	required	module.monitoring.demo_loop_log_group_name	CloudWatch log group name
batch_size	number	15	not set (default)	Number of devices per batch refresh
batch_interval	number	120	not set (default)	Seconds between batch refreshes
full_interval	number	1800	not set (default)	Seconds between full fleet refreshes
device_count	number	300	not set (default)	Total number of demo devices

Outputs

Name	Value	Description
ecr_repository_url	aws_ecr_repository.demo_loop.repository_url	ECR repository URL for demo-loop images
service_name	aws_ecs_service.demo_loop.name	Name of the demo-loop ECS service
task_definition_arn	aws_ecs_task_definition.demo_loop.arn	ARN of the demo-loop task definition

identity

Called from the root module as module.identity.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment
secret_arns	list(string)	[]	concat(module.secrets.all_secret_arns, module.auth.secret_arns)	ARNs of Secrets Manager secrets the ECS tasks need access to
ecr_repository_arns	list(string)	[]	[module.containers.ecr_api_repository_url, module.containers.ecr_frontend_repository_url]	ARNs of ECR repositories the ECS tasks need to pull from Declared but not referenced by any resource in this module.
log_group_arns	list(string)	[]	[arn:aws:logs:${var.region}:${data.aws_caller_identity.current.account_id}:log-group:/ecs/${var.project_name}-${var.environment}/*]	ARNs of CloudWatch log groups

Outputs

Name	Value	Description
ecs_execution_role_arn	aws_iam_role.ecs_execution.arn	ECS task execution role ARN
ecs_task_role_arn	aws_iam_role.ecs_task.arn	ECS task role ARN
ecs_execution_role_name	aws_iam_role.ecs_execution.name	ECS task execution role name
ecs_task_role_name	aws_iam_role.ecs_task.name	ECS task role name

maintenance

Called from the root module as module.maintenance.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment
region	string	required	var.region	AWS region
ecs_cluster_arn	string	required	module.containers.cluster_id	ARN of the ECS cluster to run maintenance tasks
ecs_execution_role_arn	string	required	module.identity.ecs_execution_role_arn	ARN of the ECS execution role
ecs_task_role_arn	string	required	module.identity.ecs_task_role_arn	ARN of the ECS task role
db_connection_string_secret_arn	string	required	module.secrets.db_connection_string_secret_arn	ARN of the database connection string secret
private_subnet_ids	list(string)	required	module.networking.private_subnet_ids	Private subnet IDs for task networking
security_group_ids	list(string)	required	[module.containers.ecs_tasks_security_group_id]	Security group IDs for task networking
log_group_name	string	required	module.monitoring.maintenance_log_group_name	CloudWatch log group name
event_retention_days	number	30	var.event_retention_days	Number of days to retain events before cleanup

Outputs

Name	Value	Description
task_definition_arn	aws_ecs_task_definition.maintenance.arn	ARN of the maintenance task definition
schedule_arn	aws_scheduler_schedule.maintenance.arn	ARN of the EventBridge schedule
ecr_repository_url	aws_ecr_repository.maintenance.repository_url	ECR repository URL for maintenance images

messaging

Called from the root module as module.messaging.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment
api_negotiate_url	string	required	${module.containers.api_url}/v1/negotiate	URL of the API negotiate endpoint for WebSocket integration

Outputs

Name	Value	Description
websocket_api_id	aws_apigatewayv2_api.websocket.id	API Gateway WebSocket API ID
websocket_url	aws_apigatewayv2_stage.production.invoke_url	WebSocket connection URL
websocket_api_endpoint	aws_apigatewayv2_api.websocket.api_endpoint	WebSocket API endpoint (wss://)

monitoring

Called from the root module as module.monitoring.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment
log_retention_days	number	30	var.log_retention_days	CloudWatch log retention in days
alert_email	string	""	var.alert_email	Email subscribed to the alerts SNS topic. Empty disables both the email subscription and the cost budget.
daily_budget_usd	number	30	var.daily_budget_usd	Daily cost budget in USD. ACTUAL and FORECASTED notifications fire at 100%.
nat_bytes_out_alarm_gb	number	20	var.nat_bytes_out_alarm_gb	Trigger the NAT BytesOutToDestination alarm if hourly egress exceeds this many GB. Set to 0 to disable.
nat_gateway_ids	list(string)	[]	module.networking.nat_gateway_ids	NAT gateway IDs to alarm on. Pass module.networking.nat_gateway_ids.

Outputs

Name	Value	Description
api_log_group_name	aws_cloudwatch_log_group.api.name	API CloudWatch log group name
frontend_log_group_name	aws_cloudwatch_log_group.frontend.name	Frontend CloudWatch log group name
maintenance_log_group_name	aws_cloudwatch_log_group.maintenance.name	Maintenance CloudWatch log group name
demo_loop_log_group_name	aws_cloudwatch_log_group.demo_loop.name	Demo loop CloudWatch log group name
alerts_topic_arn	aws_sns_topic.alerts.arn	SNS alerts topic ARN

networking

Called from the root module as module.networking.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment
vpc_cidr	string	10.0.0.0/16	var.vpc_cidr	CIDR block for the VPC
availability_zones	list(string)	[]	not set (default)	List of AZs to use (minimum 2 for ALB)
enable_multi_az_nat	bool	false	var.enable_multi_az_nat	Provision one NAT gateway per AZ instead of a single shared NAT.
enable_vpc_flow_logs	bool	true	var.enable_vpc_flow_logs	Send VPC Flow Logs to a private S3 bucket with a 30-day lifecycle.
enable_vpc_endpoints	bool	false	var.enable_vpc_endpoints	Create interface endpoints for ECR / Logs / Secrets Manager. The S3 gateway endpoint is created unconditionally (free).
vpc_endpoint_security_group_id	string	""	not set (default)	Security group whose members are allowed to reach the interface endpoints (typically the ECS tasks SG). Required when enable_vpc_endpoints is true. Declared but not referenced by any resource in this module.

Outputs

Name	Value	Description
vpc_id	aws_vpc.main.id	VPC ID
public_subnet_ids	aws_subnet.public[*].id	Public subnet IDs
private_subnet_ids	aws_subnet.private[*].id	Private subnet IDs
vpc_cidr_block	aws_vpc.main.cidr_block	VPC CIDR block
nat_gateway_ids	aws_nat_gateway.main[*].id	NAT gateway IDs (one or N depending on enable_multi_az_nat).

secrets

Called from the root module as module.secrets.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment
db_password	string (sensitive)	required	var.db_password	Database password to store
db_connection_string	string (sensitive)	required	module.database.connection_string	Full database connection string
api_internal_secret	string (sensitive)	required	var.api_internal_secret	Container-to-container auth secret
kiosk_tokens	string (sensitive)	""	var.kiosk_tokens	Comma-separated kiosk viewer tokens for read-only display sessions
client_passphrase	string (sensitive)	required	var.client_passphrase	Client device authentication passphrase

Outputs

Name	Value	Description
db_password_secret_arn	aws_secretsmanager_secret.db_password.arn	ARN of the database password secret
db_connection_string_secret_arn	aws_secretsmanager_secret.db_connection_string.arn	ARN of the database connection string secret
api_internal_secret_arn	aws_secretsmanager_secret.api_internal_secret.arn	ARN of the API internal secret
kiosk_tokens_secret_arn	aws_secretsmanager_secret.kiosk_tokens.arn	ARN of the kiosk viewer tokens secret
client_passphrase_secret_arn	aws_secretsmanager_secret.client_passphrase.arn	ARN of the client passphrase secret
all_secret_arns	[aws_secretsmanager_secret.db_password.arn, aws_secretsmanager_secret.db_connection_string.arn, aws_secretsmanager_secret.api_internal_secret.arn, aws_secretsmanager_secret.kiosk_tokens.arn, aws_secretsmanager_secret.client_passphrase.arn]	List of all secret ARNs for IAM policy

storage

Called from the root module as module.storage.

Variables

Name	Type	Default	Root module sets it to	Description
project_name	string	required	var.project_name	Project name for resource naming
environment	string	required	var.environment	Deployment environment

Outputs

Name	Value	Description
ingest_queue_url	aws_sqs_queue.ingest.url	URL of the osquery ingest SQS queue
ingest_queue_arn	aws_sqs_queue.ingest.arn	ARN of the osquery ingest SQS queue
ingest_dlq_arn	aws_sqs_queue.ingest_dlq.arn	ARN of the dead-letter queue
bucket_name	aws_s3_bucket.main.id	S3 bucket name
bucket_arn	aws_s3_bucket.main.arn	S3 bucket ARN

Where descriptions and code differ

• containers.public_api_url is set on the frontend task as both API_BASE_URL and NEXTAUTH_URL, not only API_BASE_URL.
• containers.database_security_group_id is accepted but unused. The database-side ingress rule in database (from allowed_security_group_ids) is what opens port 5432 to the ECS tasks.
• identity.ecr_repository_arns is unused. The root module passes the ECR repository URLs, not ARNs; image pulls are authorised by the AWS-managed AmazonECSTaskExecutionRolePolicy instead.
• networking.vpc_endpoint_security_group_id is unused and the root module does not set it. The interface endpoints' security group allows port 443 from the VPC CIDR.
• networking.availability_zones defaults to [], which makes the module use the first two available zones in the region.
• monitoring.daily_budget_usd mentions FORECASTED notifications. The budget resource declares only an ACTUAL notification at 100%, and is created only when alert_email is non-empty.
• demo-loop.api_url is described as a public URL. The root module sets it to demo_loop_api_url when that is non-empty and otherwise to the ALB base URL. The ALB is internet-facing, so those requests still leave the private subnets through NAT.
• auth.nextauth_secret and auth.client_secret are sensitive outputs that the root module does not re-export. Read them from Secrets Manager at <project_name>-<environment>/nextauth-secret and <project_name>-<environment>/cognito-client-secret.