IaC & Multi-account

compass-infra/
├── bootstrap/                     # local state, runs once
│   └── main.tf                    # creates the S3 bucket + DDB lock table
├── modules/
│   └── gfn-reports/
│       ├── main.tf                # the whole stack
│       ├── variables.tf
│       ├── outputs.tf
│       └── README.md
├── envs/
│   ├── dev/
│   │   ├── backend.tf             # S3 backend, dev key
│   │   ├── main.tf                # calls module with dev inputs
│   │   └── terraform.tfvars
│   └── prod/
│       ├── backend.tf             # S3 backend, prod key
│       ├── main.tf                # calls module with prod inputs
│       └── terraform.tfvars
└── org/                           # Organization-level (separate state)
    ├── ous.tf
    └── scps.tf

################################################################
# gfn-reports module - everything from chapters 2-11 unified
################################################################

locals {
  name = "gfn-reports-${var.environment}"
  common_tags = merge(var.tags, {
    Project     = "Compass"
    Environment = var.environment
    ManagedBy   = "terraform"
  })
}

# --- ch08: KMS key for at-rest encryption ----------------
resource "aws_kms_key" "reports" {
  description             = "CMK for ${local.name}"
  enable_key_rotation     = true
  deletion_window_in_days = 30
  tags                    = local.common_tags
}

resource "aws_kms_alias" "reports" {
  name          = "alias/${local.name}"
  target_key_id = aws_kms_key.reports.key_id
}

# --- ch02: IAM execution role ----------------------------
resource "aws_iam_role" "reports" {
  name = "${local.name}-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "lambda.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
  tags = local.common_tags
}

# --- ch05: S3 raw-telemetry bucket -----------------------
resource "aws_s3_bucket" "raw" {
  bucket = "${local.name}-raw"
  tags   = local.common_tags
}

resource "aws_s3_bucket_versioning" "raw" {
  bucket = aws_s3_bucket.raw.id
  versioning_configuration { status = "Enabled" }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "raw" {
  bucket = aws_s3_bucket.raw.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.reports.arn
    }
  }
}

# --- ch06: DynamoDB aggregated-reports table --------------
resource "aws_dynamodb_table" "reports" {
  name         = local.name
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "pk"
  attribute { name = "pk"; type = "S" }
  server_side_encryption { enabled = true; kms_key_arn = aws_kms_key.reports.arn }
  point_in_time_recovery { enabled = var.environment == "prod" }
  tags = local.common_tags
}

# --- ch07: SQS intake queue ------------------------------
resource "aws_sqs_queue" "intake" {
  name                       = "${local.name}-intake"
  visibility_timeout_seconds = 60
  kms_master_key_id          = aws_kms_key.reports.id
  redrive_policy = jsonencode({
    deadLetterTargetArn = aws_sqs_queue.intake_dlq.arn
    maxReceiveCount     = 5
  })
  tags = local.common_tags
}

resource "aws_sqs_queue" "intake_dlq" {
  name              = "${local.name}-intake-dlq"
  kms_master_key_id = aws_kms_key.reports.id
  tags              = local.common_tags
}

# --- ch08: Secrets Manager (DB / 3rd-party creds) ---------
resource "aws_secretsmanager_secret" "app" {
  name       = "${local.name}/app"
  kms_key_id = aws_kms_key.reports.id
  tags       = local.common_tags
}

# --- ch02 + ch05/6/7/8: bundled inline policy for the role -
resource "aws_iam_role_policy" "reports" {
  name = "${local.name}-inline"
  role = aws_iam_role.reports.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      { Effect = "Allow", Action = ["s3:GetObject", "s3:PutObject"],   Resource = "${aws_s3_bucket.raw.arn}/*" },
      { Effect = "Allow", Action = ["dynamodb:GetItem", "dynamodb:PutItem"], Resource = aws_dynamodb_table.reports.arn },
      { Effect = "Allow", Action = ["sqs:ReceiveMessage", "sqs:DeleteMessage"], Resource = aws_sqs_queue.intake.arn },
      { Effect = "Allow", Action = ["kms:Decrypt", "kms:GenerateDataKey"], Resource = aws_kms_key.reports.arn },
      { Effect = "Allow", Action = ["secretsmanager:GetSecretValue"], Resource = aws_secretsmanager_secret.app.arn },
      { Effect = "Allow", Action = ["logs:CreateLogStream", "logs:PutLogEvents"], Resource = "*" }
    ]
  })
}

# --- ch04: Lambda worker --------------------------------
resource "aws_lambda_function" "worker" {
  function_name = "${local.name}-worker"
  role          = aws_iam_role.reports.arn
  handler       = "app.handler"
  runtime       = "python3.12"
  filename      = var.lambda_zip_path
  timeout       = 30
  memory_size   = 512
  environment {
    variables = {
      TABLE_NAME  = aws_dynamodb_table.reports.name
      QUEUE_URL   = aws_sqs_queue.intake.url
      SECRET_NAME = aws_secretsmanager_secret.app.name
    }
  }
  tags = local.common_tags
}

# --- ch09: CloudWatch alarm on DLQ depth ----------------
resource "aws_cloudwatch_metric_alarm" "dlq_depth" {
  alarm_name          = "${local.name}-dlq-depth"
  metric_name         = "ApproximateNumberOfMessagesVisible"
  namespace           = "AWS/SQS"
  statistic           = "Maximum"
  period              = 60
  evaluation_periods  = 3
  threshold           = 5
  comparison_operator = "GreaterThanThreshold"
  dimensions          = { QueueName = aws_sqs_queue.intake_dlq.name }
  alarm_actions       = var.alarm_sns_topic_arns
  tags                = local.common_tags
}

# --- ch11: API Gateway HTTP API -------------------------
resource "aws_apigatewayv2_api" "reports" {
  name          = local.name
  protocol_type = "HTTP"
  tags          = local.common_tags
}

resource "aws_apigatewayv2_integration" "worker" {
  api_id                 = aws_apigatewayv2_api.reports.id
  integration_type       = "AWS_PROXY"
  integration_uri        = aws_lambda_function.worker.invoke_arn
  payload_format_version = "2.0"
}

# --- ch10: EKS deployment (rendered as a kubernetes_manifest) -
# In the real module this lives behind var.use_eks. For brevity,
# see modules/gfn-reports/eks.tf in the repo.

terraform {
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
  backend "s3" {
    bucket         = "compass-tfstate-prod"
    key            = "envs/prod/gfn-reports.tfstate"
    region         = "us-east-1"
    dynamodb_table = "compass-tfstate-lock"
    encrypt        = true
  }
}

provider "aws" {
  region = "us-east-1"
  # Assumes prod account via the SSO profile
  profile = "compass-prod"
  default_tags { tags = { Environment = "prod", Project = "Compass" } }
}

module "reports" {
  source          = "../../modules/gfn-reports"
  environment     = "prod"
  region          = "us-east-1"
  lambda_zip_path = "../../build/worker.zip"
  alarm_sns_topic_arns = ["arn:aws:sns:us-east-1:333333333333:oncall-pager"]
}

Terraform will perform the following actions:

  # module.reports.aws_kms_key.reports will be created
  + resource "aws_kms_key" "reports" {
      + arn                     = (known after apply)
      + description             = "CMK for gfn-reports-prod"
      + enable_key_rotation     = true
      + key_usage               = "ENCRYPT_DECRYPT"
    }

  # module.reports.aws_iam_role.reports will be created
  + resource "aws_iam_role" "reports" {
      + name = "gfn-reports-prod-role"
      + assume_role_policy = jsonencode({ ... })
    }

  # module.reports.aws_s3_bucket.raw will be created
  + resource "aws_s3_bucket" "raw" {
      + bucket = "gfn-reports-prod-raw"
    }

  # module.reports.aws_dynamodb_table.reports will be created
  # module.reports.aws_sqs_queue.intake will be created
  # module.reports.aws_sqs_queue.intake_dlq will be created
  # module.reports.aws_secretsmanager_secret.app will be created
  # module.reports.aws_iam_role_policy.reports will be created
  # module.reports.aws_lambda_function.worker will be created
  # module.reports.aws_cloudwatch_metric_alarm.dlq_depth will be created
  # module.reports.aws_apigatewayv2_api.reports will be created
  # module.reports.aws_apigatewayv2_integration.worker will be created

Plan: 12 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + api_endpoint     = (known after apply)
  + intake_queue_url = (known after apply)
  + kms_key_arn      = (known after apply)
  + raw_bucket_name  = "gfn-reports-prod-raw"
  + role_arn         = (known after apply)
  + table_name       = "gfn-reports-prod"