# Infrastructure

AWS infrastructure for ows-coda is managed in a separate repo (`terraform-infra`). By convention, it lives as a sibling of this repo (`../terraform-infra/`). Terraform changes always go in a separate PR to that repo.

For platform-specific infrastructure (Fargate topology, DB connection strategy, monitoring, DR), see [Platform Infrastructure](platform-infrastructure.md).

## Directory layout

| Path                                                       | Contents                                                |
| ---------------------------------------------------------- | ------------------------------------------------------- |
| `terraform-infra/qa/ows-coda/`                             | Service infra (Fargate, IAM, S3, security groups, etc.) |
| `terraform-infra/shared/prod/ecr/repos/ows-coda/`          | ECR repo for the main app                               |
| `terraform-infra/shared/prod/ecr/repos/ows-coda-search/`   | ECR repo for the search service                         |
| `terraform-infra/shared/prod/ecr/repos/ows-coda-platform/` | ECR repo for the platform service                       |

## Terraform modules

All modules are org-internal (`git@github.com:theorchard/<name>`). Pin to the exact ref listed below; bump only when a new feature or fix is needed.

| Module                                   | Latest ref | Purpose                                             |
| ---------------------------------------- | ---------- | --------------------------------------------------- |
| `terraform-ecr`                          | `2.0.1`    | ECR repos with org-wide access policies             |
| `terraform-fargate`                      | `6.4.2`    | Fargate services (task def, ALB, auto-scaling)      |
| `terraform-s3//modules/s3_bucket`        | `3.15.7`   | S3 buckets (encryption, lifecycle, policies)        |
| `terraform-secrets-manager`              | `1.5.1`    | Secrets Manager entries (DB creds, API keys)        |
| `terraform-datadog//modules/service`     | `6.16.0`   | Datadog service dashboards                          |
| `terraform-datadog//modules/rds`         | `6.16.0`   | Datadog RDS monitors                                |
| `terraform-datadog//modules/elasticache` | `6.16.0`   | Datadog ElastiCache monitors                        |
| `terraform-rds`                          | `8.0.0`    | RDS instances (Aurora MySQL)                        |
| `terraform-elasticache`                  | `4.0.0`    | ElastiCache clusters (Redis)                        |
| `terraform-sentry`                       | `4.1.2`    | Sentry projects                                     |
| `terraform-default-tags`                 | `2.0.0`    | Standard resource tags (cost allocation, ownership) |
| `terraform-vpc-info`                     | `3.1.0`    | VPC data lookups (subnets, security groups)         |

## Updating module versions

1. Check the module repo for the latest tag and changelog
2. Update the `ref` in the Terraform source block
3. Run `terraform init -upgrade` to pull the new version
4. Run `terraform plan` and review the diff carefully — module bumps can change resource attributes
5. Open a PR to `terraform-infra` (not this repo)

## Environments

| Environment    | AWS Account        | Deploy trigger             | Notes                           |
| -------------- | ------------------ | -------------------------- | ------------------------------- |
| **QA**         | `989790945997`     | Auto on merge to `master`  | Jenkins builds + deploys        |
| **Production** | (separate account) | Manual / separate pipeline | Requires production deploy role |

See [Deployment](deployment.md) for the full pipeline, rollback procedures, and ephemeral environments.