Derive per-input applies_on (stack / build / deploy) in the compiler - #100
Open
devin-ai-integration[bot] wants to merge 22 commits into
Open
Derive per-input applies_on (stack / build / deploy) in the compiler#100devin-ai-integration[bot] wants to merge 22 commits into
devin-ai-integration[bot] wants to merge 22 commits into
Conversation
flybayer
self-requested a review
August 8, 2026 21:43
Contributor
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
Ravion Module Publish PlanDry run only. No Ravion API mutations were made.
Diffsrvn-acm-certificate 1.0.1 -> 1.0.2--- remote
+++ compiled
- id: section_aws
label: AWS account & region
type: section
- - id: aws_account_id
+ - applied_by:
+ - stack
+ id: aws_account_id
immutable: true
label: AWS account
required: true
type: string
values: $values:ravion/aws_accounts
- - description: Must be the same region as the load balancer, or us-east-1 for CloudFront.
+ - applied_by:
+ - stack
+ description: Must be the same region as the load balancer, or us-east-1 for CloudFront.
id: aws_region
immutable: true
label: Region
@@
- id: section_certificate
label: Certificate
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name prefix used for tagging the ACM certificate.
id: name
label: Name slug
@@
required: true
type: string
- add_button_label: Add domain
+ applied_by:
+ - stack
description: Fully qualified domain names for the certificate. The first domain is primary and the remaining domains are subject alternative names.
id: domains
immutable: true
@@
- id: section_validation
label: DNS validation
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Use only when the domain already has a Route53 public hosted zone and all primary/SAN validation records belong in that zone.
id: route53_validation_records_creation_enabled
immutable: true
label: Create Route53 validation records
type: boolean
- - description: Public hosted zone used for validation records. Required when Route53 validation records are enabled.
+ - applied_by:
+ - stack
+ description: Public hosted zone used for validation records. Required when Route53 validation records are enabled.
id: route53_zone_id
immutable: true
label: Route53 hosted zone ID
@@
show_when:
route53_validation_records_creation_enabled: true
type: string
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Wait for ACM to issue the certificate during apply. Enable after DNS validation can complete.
id: certificate_validation_wait_enabled
label: Wait for certificate issuance
@@
- id: section_misc
label: Misc
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId`
id: tags
label: Tags
@@
- id: section_advanced
label: Terraform settings
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override the environment's default version for this module
id: opentofu_version
label: OpenTofu version override
required: false
type: string
values: $values:opentofu/versions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
id: ravion_state_backend_workspace
immutable: true
label: Ravion Terraform workspace name
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: {}
description: Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
id: advanced_terraform_variables
label: Advanced Terraform variables
required: false
type: object
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
@@
- [AWS Certificate Manager DNS validation](https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html)
- [AWS Certificate Manager certificates for CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html)
- - [Source module](https://github.com/ravionhq/modules/tree/rvn-acm-certificate@1.0.1/security/acm_certificate)
+ - [Source module](https://github.com/ravionhq/modules/tree/rvn-acm-certificate@1.0.2/security/acm_certificate)
stack:
pipelines:
change:
@@
base_path: security/acm_certificate
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-acm-certificate@1.0.1
+ ref: rvn-acm-certificate@1.0.2
repo: https://github.com/ravionhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-aurora 1.2.0 -> 1.2.1--- remote
+++ compiled
inputs:
- - id: network
+ - applied_by:
+ - stack
+ id: network
immutable: true
label: VPC network
mapped_inputs:
- - id: section_aws
+ - applied_by: []
+ id: section_aws
label: AWS account & region
type: section
- - default: << ref.input.aws_account_id >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_account_id >>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: << ref.input.aws_region >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_region >>
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Override the VPC, subnet, and security group for Pipeline Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - id: section_vpc
+ - applied_by: []
+ id: section_vpc
label: VPC
type: section
- - default: <<ref.stack.output.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.private_subnet_ids>>
description: Used for the Aurora DB subnet group when the database is not publicly accessible. Use at least two subnets in different Availability Zones.
id: private_subnet_ids
@@
required: true
type: string_array
- add_button_label: Add public subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.public_subnet_ids>>
description: Used for the Aurora DB subnet group when Publicly accessible is enabled. AWS requires public subnets for public database access.
id: public_subnet_ids
@@
- id: section_database
label: Database
type: section
- - default: <<project.given_id>>-<<environment.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>
description: Name of the Aurora cluster and prefix for related resources.
id: name
immutable: true
@@
pattern: ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$
required: true
type: string
- - default: none
+ - applied_by:
+ - stack
+ default: none
id: restore_mode
immutable: true
label: Create or restore
@@
value: snapshot
- label: Point-in-time restore
value: point_in_time
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Name for an automatically created database on the cluster.
id: database_name
immutable: true
@@
show_when:
restore_mode: none
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: dbadmin
id: master_username
immutable: true
@@
show_when:
restore_mode: none
type: string
- - description: Snapshot identifier or ARN to restore into this new Aurora cluster.
+ - applied_by:
+ - stack
+ description: Snapshot identifier or ARN to restore into this new Aurora cluster.
id: snapshot_identifier
immutable: true
label: Snapshot to restore
@@
show_when:
restore_mode: snapshot
type: string
- - description: Source Aurora cluster identifier to restore from.
+ - applied_by:
+ - stack
+ description: Source Aurora cluster identifier to restore from.
id: point_in_time_source_cluster_identifier
immutable: true
label: Source cluster identifier
@@
show_when:
restore_mode: point_in_time
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: full-copy
id: point_in_time_restore_type
immutable: true
@@
value: full-copy
- label: Copy on write
value: copy-on-write
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Restore to the latest time AWS can recover from the selected source cluster backup.
id: point_in_time_use_latest_restorable_time
immutable: true
@@
show_when:
restore_mode: point_in_time
type: boolean
- - description: Restore to this UTC timestamp instead of the latest restorable time.
+ - applied_by:
+ - stack
+ description: Restore to this UTC timestamp instead of the latest restorable time.
id: point_in_time_restore_time
immutable: true
label: Restore time
@@
- id: section_version
label: Version
type: section
- - default: aurora-postgresql
+ - applied_by:
+ - stack
+ default: aurora-postgresql
id: engine
immutable: true
label: Engine
@@
value: aurora-postgresql
- label: Aurora MySQL
value: aurora-mysql
- - description: "Examples: 16 for Aurora PostgreSQL or 8.0 for Aurora MySQL."
+ - applied_by:
+ - stack
+ description: "Examples: 16 for Aurora PostgreSQL or 8.0 for Aurora MySQL."
id: engine_major_version
label: Engine major version
placeholder: "16"
required: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: "Optional minor engine version appended to the major version. Example: 4 becomes 16.4 for Aurora PostgreSQL; 3.08.0 becomes 8.0.mysql_aurora.3.08.0 for Aurora MySQL."
id: engine_minor_version
label: Engine minor version
placeholder: "4"
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Enable automatic minor engine version upgrades during the configured maintenance window.
id: minor_version_auto_upgrade_enabled
@@
- id: section_capacity
label: Capacity
type: section
- - default: provisioned
+ - applied_by:
+ - stack
+ default: provisioned
description: Choose fixed DB instances or Aurora Serverless v2 capacity.
id: capacity_mode
label: Capacity mode
@@
value: provisioned
- label: Serverless v2
value: serverless_v2
- - default: db.t4g.medium
+ - applied_by:
+ - stack
+ default: db.t4g.medium
description: Aurora writer instance size, such as db.t4g.medium or db.r6g.large.
id: instance_class
label: Instance class
@@
show_when:
capacity_mode: provisioned
type: string
- - default: 1
+ - applied_by:
+ - stack
+ default: 1
description: Minimum Aurora Serverless v2 capacity units. Must not exceed max capacity.
id: serverless_min_capacity
label: Min capacity (ACUs)
@@
show_when:
capacity_mode: serverless_v2
type: number
- - default: 4
+ - applied_by:
+ - stack
+ default: 4
description: Maximum Aurora Serverless v2 capacity units. Must be at least min capacity.
id: serverless_max_capacity
label: Max capacity (ACUs)
@@
- id: section_storage
label: Storage & cluster
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: aurora
id: storage_type
label: Storage type
@@
value: aurora
- label: Aurora I/O-Optimized
value: aurora-iopt1
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
id: kms_key_id
immutable: true
label: Storage KMS key ARN
placeholder: arn:aws:kms:...
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
id: ca_certificate_identifier
label: CA certificate identifier
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: IPV4
id: network_type
label: Network type
@@
- id: section_access
label: Network access
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Keep disabled for production databases unless public access is intentional.
id: public_access_enabled
label: Publicly accessible
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: "Leave blank to use the engine default port: 5432 for PostgreSQL or 3306 for MySQL."
id: port
label: Port
@@
min: 1
required: false
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
id: security_group_creation_enabled
immutable: true
label: Security group creation
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
id: security_group_id
label: Existing security group ID
placeholder: sg-...
@@
security_group_creation_enabled: false
type: string
- add_button_label: Add security group ID
+ applied_by:
+ - stack
collapsible: true
id: allowed_security_group_ids
label: Allowed security groups
@@
security_group_creation_enabled: true
type: string_array
- add_button_label: Add CIDR block
+ applied_by:
+ - stack
collapsible: true
id: allowed_cidr_blocks
label: Allowed CIDR blocks
@@
- id: section_proxy
label: Connection pooling
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Create an RDS Proxy in front of the cluster for connection pooling and improved failover handling. Applications keep connecting to the cluster endpoint until you update their connection string to the proxy endpoint output.
id: proxy_creation_enabled
label: RDS Proxy
type: boolean
- add_button_label: Add secret ARN
+ applied_by:
+ - stack
collapsible: true
description: Secrets Manager secrets containing database credentials for the proxy. Leave blank to use the managed master user secret.
id: proxy_auth_secret_arns
@@
proxy_creation_enabled: true
type: string_array
- add_button_label: Add KMS key ARN
+ applied_by:
+ - stack
collapsible: true
description: KMS keys used to encrypt the auth secrets when using customer-managed keys. The master user secret KMS key is included automatically.
id: proxy_secret_kms_key_arns
@@
show_when:
proxy_creation_enabled: true
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Require IAM authentication for client connections to the proxy.
id: proxy_iam_auth_enabled
@@
show_when:
proxy_creation_enabled: true
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Require TLS for client connections to the proxy.
id: proxy_tls_requirement_enabled
@@
show_when:
proxy_creation_enabled: true
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Log detailed connection information, including SQL statements, to CloudWatch Logs.
id: proxy_debug_logging_enabled
@@
show_when:
proxy_creation_enabled: true
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 1800
id: proxy_idle_client_timeout
... diff truncated ...rvn-aws-alb 1.0.1 -> 1.0.2--- remote
+++ compiled
inputs:
- - id: network
+ - applied_by:
+ - stack
+ id: network
immutable: true
label: VPC network
mapped_inputs:
- - id: section_aws
+ - applied_by: []
+ id: section_aws
label: AWS account & region
type: section
- - default: << ref.input.aws_account_id >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_account_id >>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: << ref.input.aws_region >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_region >>
description: AWS region for this module. If unset in Terraform, the provider region is used.
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - id: section_vpc
+ - applied_by: []
+ id: section_vpc
label: VPC
type: section
- - default: <<ref.stack.output.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.private_subnet_ids>>
description: Required by Terraform. Used for private workloads and private load balancers.
id: private_subnet_ids
@@
required: true
type: string_array
- add_button_label: Add public subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.public_subnet_ids>>
description: Used for public load balancers. Terraform defaults to [] when no public load balancer is enabled.
id: public_subnet_ids
@@
- id: section_load_balancer
label: Load balancer
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name for the load balancer and related resources.
id: name
immutable: true
@@
pattern: ^[a-z0-9]([a-z0-9-]{0,30}[a-z0-9])?$
required: true
type: string
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Create an internal load balancer reachable only inside the VPC. Turn off for an internet-facing load balancer in the public subnets.
id: internal_load_balancer_enabled
label: Internal load balancer
type: boolean
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Prevent accidental deletion of the load balancer via the AWS API.
id: deletion_protection_enabled
label: Deletion protection
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 60
description: Seconds a connection is allowed to be idle before the load balancer closes it.
id: idle_timeout
@@
- id: section_listeners
label: Listeners
type: section
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Create an HTTP listener.
id: http_listener_enabled
label: HTTP
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 80
id: http_listener_port
label: HTTP port
@@
show_when:
http_listener_enabled: true
type: number
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Create an HTTPS listener. Select an ACM certificate when enabled.
id: https_listener_enabled
label: HTTPS
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 443
id: https_listener_port
label: HTTPS port
@@
show_when:
https_listener_enabled: true
type: number
- - description: Primary ACM certificate module for HTTPS. The certificate must use the same AWS account and region as the load balancer.
+ - applied_by:
+ - stack
+ description: Primary ACM certificate module for HTTPS. The certificate must use the same AWS account and region as the load balancer.
id: certificate
label: Certificate
mapped_inputs:
- add_button_label: Add certificate ARN
+ applied_by:
+ - stack
default:
- <<ref.stack.output.certificate_arn>>
description: ACM certificate ARNs resolved from the selected module. The first ARN is the default certificate.
@@
https_listener_enabled: true
type: $ref:rvn-acm-certificate
- add_button_label: Add certificate ARN
+ applied_by:
+ - stack
collapsible: true
default: []
description: Additional ACM certificate ARNs attached to the HTTPS listener for SNI.
@@
show_when:
https_listener_enabled: true
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: SSL policy for the HTTPS listener.
id: ssl_policy
label: SSL policy
@@
show_when:
https_listener_enabled: true
type: string
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Redirect HTTP traffic to the HTTPS listener. Applies only when both listeners are enabled.
id: http_to_https_redirect_enabled
label: Redirect HTTP to HTTPS
@@
label: Security
type: section
- add_button_label: Add CIDR block
+ applied_by:
+ - stack
collapsible: true
description: IPv4 CIDR blocks allowed to reach the load balancer. Defaults to public internet access for an internet-facing load balancer and RFC1918 private ranges for an internal load balancer. Use an empty list to allow no IPv4 ingress.
id: ingress_cidr_blocks
@@
placeholder: 0.0.0.0/0
type: string_array
- add_button_label: Add IPv6 CIDR block
+ applied_by:
+ - stack
collapsible: true
description: IPv6 CIDR blocks allowed to reach the load balancer. Defaults to public internet access for an internet-facing load balancer and no IPv6 ingress for an internal load balancer. Use an empty list to allow no IPv6 ingress.
id: ingress_ipv6_cidr_blocks
label: Ingress IPv6 CIDRs
placeholder: ::/0
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: WAFv2 Web ACL to associate with the load balancer.
id: web_acl_arn
label: WAF web ACL ARN
@@
- id: section_access_logs
label: Access logs
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Write load balancer access logs to S3.
id: access_logs_enabled
label: Access logs
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Existing S3 bucket for access logs. Leave blank to create a bucket.
id: access_logs_bucket_arn
label: Access logs bucket ARN
@@
show_when:
access_logs_enabled: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 90
description: Days to retain access logs in the created bucket.
id: access_logs_retention_days
@@
- id: section_misc
label: Misc
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId`
id: tags
label: Tags
@@
- id: section_advanced
label: Terraform settings
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override the environment's default version for this module
id: opentofu_version
label: OpenTofu version override
required: false
type: string
values: $values:opentofu/versions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
id: ravion_state_backend_workspace
immutable: true
label: Ravion Terraform workspace name
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: {}
description: Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
id: advanced_terraform_variables
@@
The load balancer intentionally serves no traffic by itself. Services that reference this module, such as EC2 services, create their own target groups and listener rules on the shared listeners.
- Terraform source: [ravionhq/modules/networking/alb](https://github.com/ravionhq/modules/tree/rvn-aws-alb@1.0.1/networking/alb)
+ Terraform source: [ravionhq/modules/networking/alb](https://github.com/ravionhq/modules/tree/rvn-aws-alb@1.0.2/networking/alb)
## Use cases
@@
base_path: networking/alb
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-aws-alb@1.0.1
+ ref: rvn-aws-alb@1.0.2
repo: https://github.com/ravionhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-aws-iam-policy 1.0.1 -> 1.0.2--- remote
+++ compiled
- id: section_aws
label: AWS account & region
type: section
- - id: aws_account_id
+ - applied_by:
+ - stack
+ id: aws_account_id
immutable: true
label: AWS account
required: true
type: string
values: $values:ravion/aws_accounts
- - id: aws_region
+ - applied_by:
+ - stack
+ id: aws_region
immutable: true
label: Region
required: true
@@
- id: section_policy
label: IAM policy
type: section
- - default: <<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<module.given_id>>
description: Name of the customer-managed IAM policy. Policy names must be unique within their path in the AWS account.
id: name
immutable: true
@@
pattern: ^[A-Za-z0-9+=,.@_-]{1,128}$
required: true
type: string
- - description: Optional description stored on the IAM policy. AWS does not allow this value to be changed after creation.
+ - applied_by:
+ - stack
+ description: Optional description stored on the IAM policy. AWS does not allow this value to be changed after creation.
id: description
immutable: true
label: Description
@@
- message: 1000 characters or fewer.
pattern: ^.{0,1000}$
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: /
description: IAM path for organizing the policy. Most policies should use the root path.
id: path
@@
- id: section_document
label: Policy document
type: section
- - default: structured
+ - applied_by: []
+ default: structured
description: Build the policy with structured statements or provide a complete JSON document.
id: policy_document_mode
label: Policy document format
@@
value: structured
- label: JSON document
value: json
- - default: []
+ - applied_by:
+ - stack
+ default: []
description: Define permissions this policy grants or denies. Each statement matches Action or NotAction values against Resource or NotResource ARNs and can add conditions to narrow access. Prefer explicit actions and resource ARNs over wildcards.
id: policy_statements
item_inputs:
- - description: Optional IAM statement ID.
+ - applied_by:
+ - stack
+ description: Optional IAM statement ID.
id: sid
label: SID
required: false
type: string
- - default: Allow
+ - applied_by:
+ - stack
+ default: Allow
description: Whether this statement allows or denies the listed actions.
id: effect
label: Effect
@@
value: Allow
- label: Deny
value: Deny
- - default: Action
+ - applied_by:
+ - stack
+ default: Action
description: Match the listed actions or every applicable action except those listed.
id: action_match_mode
label: Action matching
@@
- label: All except listed actions
value: NotAction
- add_button_label: Add action
+ applied_by:
+ - stack
description: IAM actions granted or denied by this statement.
id: actions
label: Actions
@@
action_match_mode: Action
type: string_array
- add_button_label: Add excluded action
+ applied_by:
+ - stack
description: IAM actions excluded from this statement's match. NotAction can create broad permissions and should be used carefully.
id: not_actions
label: Excluded actions (NotAction)
@@
show_when:
action_match_mode: NotAction
type: string_array
- - default: Resource
+ - applied_by:
+ - stack
+ default: Resource
description: Match the listed resources or every applicable resource except those listed.
id: resource_match_mode
label: Resource matching
@@
- label: All except listed resources
value: NotResource
- add_button_label: Add resource
+ applied_by:
+ - stack
description: Resource ARNs covered by this statement. Use wildcards only when the AWS service requires them.
id: resources
label: Resources
@@
resource_match_mode: Resource
type: string_array
- add_button_label: Add excluded resource
+ applied_by:
+ - stack
description: Resource ARNs excluded from this statement's match. NotResource can create broad permissions and should be used carefully.
id: not_resources
label: Excluded resources (NotResource)
@@
show_when:
resource_match_mode: NotResource
type: string_array
- - default: []
+ - applied_by:
+ - stack
+ default: []
description: Optional IAM conditions that further restrict this statement.
id: conditions
item_inputs:
- - default: StringEquals
+ - applied_by:
+ - stack
+ default: StringEquals
description: IAM condition operator used to compare the condition key and values. Common operators are listed, and custom IAM operators such as ForAnyValue:StringLike can be entered manually.
id: test
label: Condition operator
@@
value: ArnNotLike
- label: "Null"
value: "Null"
- - description: IAM context key evaluated by the condition.
+ - applied_by:
+ - stack
+ description: IAM context key evaluated by the condition.
id: variable
label: Condition key
placeholder: aws:ResourceAccount
required: true
type: string
- add_button_label: Add condition value
+ applied_by:
+ - stack
description: Allowed or matched values for the condition key.
id: values
label: Condition values
@@
show_when:
policy_document_mode: structured
type: object_array
- - description: Complete IAM policy JSON document. This is used instead of structured statements.
+ - applied_by:
+ - stack
+ description: Complete IAM policy JSON document. This is used instead of structured statements.
id: policy_json
label: Policy JSON
patterns:
@@
- id: section_misc
label: Misc
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId`
id: tags
label: Tags
@@
- id: section_advanced
label: Terraform settings
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override the environment's default version for this module
id: opentofu_version
label: OpenTofu version override
required: false
type: string
values: $values:opentofu/versions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
id: ravion_state_backend_workspace
immutable: true
label: Ravion Terraform workspace name
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: {}
description: Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
id: advanced_terraform_variables
label: Advanced Terraform variables
required: false
type: object
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override the execution environment for Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
@@
- [IAM managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html)
- [IAM JSON policy elements](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html)
- [IAM permissions boundaries](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
- - [Source module](https://github.com/ravionhq/modules/tree/rvn-aws-iam-policy@1.0.1/security/iam_policy)
+ - [Source module](https://github.com/ravionhq/modules/tree/rvn-aws-iam-policy@1.0.2/security/iam_policy)
stack:
pipelines:
change:
@@
base_path: security/iam_policy
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-aws-iam-policy@1.0.1
+ ref: rvn-aws-iam-policy@1.0.2
repo: https://github.com/ravionhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-aws-iam-role 1.0.1 -> 1.0.2--- remote
+++ compiled
- id: section_aws
label: AWS account & region
type: section
- - id: aws_account_id
+ - applied_by:
+ - stack
+ id: aws_account_id
immutable: true
label: AWS account
required: true
type: string
values: $values:ravion/aws_accounts
- - id: aws_region
+ - applied_by:
+ - stack
+ id: aws_region
immutable: true
label: Region
required: true
@@
- id: section_role
label: IAM role
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name of the IAM role. AWS IAM role names must be unique in the account.
id: name
immutable: true
@@
pattern: ^[A-Za-z0-9+=,.@_-]{1,64}$
required: true
type: string
- - description: Description stored on the IAM role.
+ - applied_by:
+ - stack
+ description: Description stored on the IAM role.
id: description
label: Description
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: /
description: IAM path for the role. Most roles should use the root path.
id: path
@@
pattern: ^/$|^/.*/$
required: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 3600
description: Maximum STS session duration in seconds for this role.
id: max_session_duration
@@
max: 43200
min: 3600
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Detach managed policies before destroying the role.
id: policy_force_detach_enabled
@@
label: Trust relationships
type: section
- add_button_label: Add service principal
+ applied_by:
+ - stack
default: []
description: AWS service principals that can assume this role.
id: trusted_services
@@
placeholder: ecs-tasks.amazonaws.com
type: string_array
- add_button_label: Add AWS principal
+ applied_by:
+ - stack
default: []
description: AWS account IDs or IAM ARNs that can assume this role.
id: trusted_aws_principals
@@
pattern: ^(\d{12}|arn:aws(-cn|-us-gov)?:iam::.+)$
placeholder: arn:aws:iam::123456789012:root
type: string_array
- - default: []
+ - applied_by:
+ - stack
+ default: []
description: OIDC identity providers that can assume this role, with STS condition checks.
id: trusted_oidc_providers
item_inputs:
- - description: IAM OIDC provider that issues tokens for this trust relationship.
+ - applied_by:
+ - stack
+ description: IAM OIDC provider that issues tokens for this trust relationship.
id: provider_arn
label: OIDC provider ARN
patterns:
@@
placeholder: arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com
required: true
type: string
- - default: []
+ - applied_by:
+ - stack
+ default: []
description: STS condition checks that restrict which OIDC identities can assume the role.
id: conditions
item_inputs:
- - default: StringEquals
+ - applied_by:
+ - stack
+ default: StringEquals
description: IAM condition operator used to compare the condition key and values. Common operators are listed, and custom IAM operators such as ForAnyValue:StringLike can be entered manually.
id: test
label: Condition operator
@@
value: ArnNotLike
- label: "Null"
value: "Null"
- - description: IAM context key evaluated by the condition.
+ - applied_by:
+ - stack
+ description: IAM context key evaluated by the condition.
id: variable
label: Condition key
placeholder: token.actions.githubusercontent.com:sub
required: true
type: string
- add_button_label: Add condition value
+ applied_by:
+ - stack
description: Allowed or matched values for the condition key.
id: values
label: Condition values
@@
required: false
type: object_array
- add_button_label: Add SAML provider
+ applied_by:
+ - stack
default: []
description: SAML provider ARNs that can assume this role.
id: trusted_saml_providers
@@
pattern: ^arn:aws(-cn|-us-gov)?:iam::\d{12}:saml-provider/.+$
placeholder: arn:aws:iam::123456789012:saml-provider/MySAMLProvider
type: string_array
- - default: []
+ - applied_by:
+ - stack
+ default: []
description: STS condition checks added to every generated trust policy statement.
id: assume_role_conditions
item_inputs:
- - default: Bool
+ - applied_by:
+ - stack
+ default: Bool
description: IAM condition operator used to compare the condition key and values. Common operators are listed, and custom IAM operators such as ForAnyValue:StringLike can be entered manually.
id: test
label: Condition operator
@@
value: ArnNotLike
- label: "Null"
value: "Null"
- - description: IAM context key evaluated by the condition.
+ - applied_by:
+ - stack
+ description: IAM context key evaluated by the condition.
id: variable
label: Condition key
placeholder: aws:MultiFactorAuthPresent
required: true
type: string
- add_button_label: Add condition value
+ applied_by:
+ - stack
description: Allowed or matched values for the condition key.
id: values
label: Condition values
@@
label: Shared trust conditions
required: false
type: object_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional complete assume role policy JSON. When set, this overrides all trust relationship inputs above.
id: custom_assume_role_policy
label: Custom assume role policy JSON
@@
label: Permission policies
type: section
- add_button_label: Add managed policy ARN
+ applied_by:
+ - stack
default: []
description: AWS managed or customer managed policy ARNs to attach to the role.
id: managed_policy_arns
@@
pattern: ^arn:aws(-cn|-us-gov)?:iam::(aws|\d{12}):policy/.+$
placeholder: arn:aws:iam::aws:policy/ReadOnlyAccess
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: {}
description: Map of inline policy names to JSON policy documents.
id: inline_policies
label: Inline JSON policies
placeholder: "s3-read: '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\"],\"Resource\":[\"arn:aws:s3:::my-bucket/*\"]}]}'"
type: object
- - default: []
+ - applied_by:
+ - stack
+ default: []
description: Structured IAM statements combined into one inline policy.
id: inline_policy_statements
item_inputs:
- - description: Optional IAM statement ID.
+ - applied_by:
+ - stack
+ description: Optional IAM statement ID.
id: sid
label: SID
required: false
type: string
- - default: Allow
+ - applied_by:
+ - stack
+ default: Allow
description: Whether this statement allows or denies the listed actions.
id: effect
label: Effect
@@
- label: Deny
value: Deny
- add_button_label: Add action
+ applied_by:
+ - stack
description: IAM actions for this statement.
id: actions
label: Actions
@@
required: true
type: string_array
- add_button_label: Add resource
+ applied_by:
+ - stack
description: Resource ARNs covered by this statement.
id: resources
label: Resources
placeholder: arn:aws:s3:::my-bucket/*
required: true
type: string_array
- - default: []
+ - applied_by:
+ - stack
+ default: []
description: Optional IAM conditions for this statement.
id: conditions
item_inputs:
- - default: StringEquals
+ - applied_by:
+ - stack
+ default: StringEquals
description: IAM condition operator used to compare the condition key and values. Common operators are listed, and custom IAM operators such as ForAnyValue:StringLike can be entered manually.
id: test
label: Condition operator
@@
value: ArnNotLike
- label: "Null"
value: "Null"
- - description: IAM context key evaluated by the condition.
+ - applied_by:
+ - stack
+ description: IAM context key evaluated by the condition.
id: variable
label: Condition key
required: true
type: string
- add_button_label: Add condition value
+ applied_by:
+ - stack
description: Allowed or matched values for the condition key.
id: values
label: Condition values
@@
label: Inline policy statements
required: false
type: object_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional permissions boundary policy ARN for the role.
id: permission_boundary_arn
label: Permission boundary ARN
@@
- id: section_instance_profile
label: Instance profile
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Create an IAM instance profile for EC2 instances to use this role.
id: instance_profile_creation_enabled
immutable: true
label: Create instance profile
type: boolean
- - description: Instance profile name. Defaults to the role name when empty.
+ - applied_by:
+ - stack
+ description: Instance profile name. Defaults to the role name when empty.
id: instance_profile_name
immutable: true
label: Instance profile name
@@
show_when:
instance_profile_creation_enabled: true
type: string
- - description: IAM path for the instance profile. Defaults to the role path when empty.
+ - applied_by:
+ - stack
+ description: IAM path for the instance profile. Defaults to the role path when empty.
id: instance_profile_path
immutable: true
label: Instance profile path
@@
- id: section_misc
label: Misc
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId`
id: tags
label: Tags
@@
- id: section_advanced
label: Terraform settings
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override the environment's default version for this module
id: opentofu_version
label: OpenTofu version override
required: false
type: string
values: $values:opentofu/versions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
id: ravion_state_backend_workspace
immutable: true
label: Ravion Terraform workspace name
type: string
- - collapsible: true
+ - applied_by:
+
... diff truncated ...rvn-aws-network 1.0.1 -> 1.0.2--- remote
+++ compiled
- id: section_aws
label: AWS account & region
type: section
- - id: aws_account_id
+ - applied_by:
+ - stack
+ id: aws_account_id
immutable: true
label: AWS account
required: true
type: string
values: $values:ravion/aws_accounts
- - description: Recommend anything but us-east-1 as it has the most outages.
+ - applied_by:
+ - stack
+ description: Recommend anything but us-east-1 as it has the most outages.
id: aws_region
immutable: true
label: Region
@@
- id: section_vpc
label: VPC config
type: section
- - default: <<project.given_id>>-<<environment.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>
description: Name prefix for all resources created by this module.
id: name
immutable: true
@@
pattern: ^[a-z0-9]([a-z0-9-]{0,34}[a-z0-9])?$
required: true
type: string
- - default: 10.0.0.0/16
+ - applied_by:
+ - stack
+ default: 10.0.0.0/16
description: The IPv4 CIDR block for the VPC.
id: vpc_cidr
immutable: true
label: VPC CIDR
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Leave empty to create up to 3 public/private subnet pairs, capped by the availability zones available in the selected region and AWS account.
id: subnet_count
label: Subnet pairs
@@
- id: section_nat
label: NAT gateway
type: section
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Needed if you want to access the internet from within private subnets
id: nat_gateway_enabled
label: NAT gateway
type: boolean
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: High availability adds NAT Gateway to every AZ. Otherwise single NAT gateway serves all AZs.
id: nat_gateway_high_availability_enabled
label: NAT gateway high availability
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: null
description: |-
A list of pre-allocated Elastic IP allocation IDs (for example from the
@@
- id: section_soc2
label: SOC 2
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Enable VPC Flow Logs for network traffic monitoring. Required for SOC 2.
id: flow_logs_enabled
label: Flow logs
@@
- id: section_misc
label: Misc
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId`
id: tags
label: Tags
@@
- id: section_peering
label: VPC peering
type: section
- - description: |
+ - applied_by:
+ - stack
+ description: |
Connect this VPC to other VPCs
NOTE: For cross-account or cross-region peerings, this module cannot manage the
@@
return routes pointing at the peering connection.
id: vpc_peering_connections
item_inputs:
- - description: The ID of the existing VPC to peer with.
+ - applied_by:
+ - stack
+ description: The ID of the existing VPC to peer with.
id: peer_vpc_id
label: Peer VPC ID
required: true
type: string
- - description: CIDR blocks of the peer VPC. Routes will be added in this VPC's route tables for each CIDR pointing at the peering connection.
+ - applied_by:
+ - stack
+ description: CIDR blocks of the peer VPC. Routes will be added in this VPC's route tables for each CIDR pointing at the peering connection.
id: peer_cidr_blocks
label: Peer CIDR blocks
required: true
type: string_array
- - description: AWS account ID that owns the peer VPC. Defaults to the current account. Required for cross-account peering.
+ - applied_by:
+ - stack
+ description: AWS account ID that owns the peer VPC. Defaults to the current account. Required for cross-account peering.
id: peer_owner_id
label: Peer AWS account ID number
required: false
type: string
- - description: AWS region of the peer VPC. Defaults to the current region. Required for cross-region peering.
+ - applied_by:
+ - stack
+ description: AWS region of the peer VPC. Defaults to the current region. Required for cross-region peering.
id: peer_region
label: Peer region
required: false
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Allow DNS resolution of private hostnames in the peer VPC from this VPC. Only valid for same-account, same-region peerings.
id: remote_vpc_dns_resolution_enabled
label: Remote VPC DNS resolution
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Add routes for peer_cidr_blocks to this VPC's public route table.
id: public_route_table_routes_enabled
label: Public route table routes
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Add routes for peer_cidr_blocks to this VPC's private route table(s).
id: private_route_table_routes_enabled
label: Private route table routes
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional list of route table IDs in the peer VPC to add return routes to (destination = this VPC's CIDR, target = the peering connection). Only supported for same-account, same-region peerings, since the AWS provider used by this module must have access to the peer's route tables. For cross-account or cross-region peerings, manage the return routes from the peer side instead.
id: peer_route_table_ids
label: Peer route table IDs
@@
- id: section_advanced
label: Terraform settings
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override the environment's default version for this module
id: opentofu_version
label: OpenTofu version override
required: false
type: string
values: $values:opentofu/versions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
id: ravion_state_backend_workspace
immutable: true
label: Ravion Terraform workspace name
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: {}
description: Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
id: advanced_terraform_variables
label: Advanced Terraform variables
required: false
type: object
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
@@
- **VPC Flow Logs** for network traffic monitoring and SOC 2 compliance
- **VPC Peering** to connect with existing VPCs across accounts or regions
- Terraform source: [ravionhq/modules/networking/vpc](https://github.com/ravionhq/modules/tree/rvn-aws-network@1.0.1/networking/vpc)
+ Terraform source: [ravionhq/modules/networking/vpc](https://github.com/ravionhq/modules/tree/rvn-aws-network@1.0.2/networking/vpc)
## Use cases
@@
base_path: networking/vpc
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-aws-network@1.0.1
+ ref: rvn-aws-network@1.0.2
repo: https://github.com/ravionhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-aws-static 1.1.1 -> 1.1.2--- remote
+++ compiled
- id: section_aws
label: AWS account & region
type: section
- - id: aws_account_id
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ id: aws_account_id
immutable: true
label: AWS account
required: true
type: string
values: $values:ravion/aws_accounts
- - default: us-east-1
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: us-east-1
description: Region for the S3 bucket. CloudFront and KVS always use us-east-1.
id: aws_region
immutable: true
@@
- id: section_hosting
label: Static hosting
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name for the bucket and other resources' prefix. Must be globally unique.
id: name
immutable: true
@@
pattern: ^[a-z0-9][a-z0-9.-]*[a-z0-9]$
required: true
type: string
- - default: spa
+ - applied_by:
+ - stack
+ default: spa
description: Use single page app for client-side routers, or Filesystem for static file trees where paths map to index files.
id: routing
label: Routing mode
@@
- description: Each path has its own file
label: Filesystem
value: filesystem
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: index.html
description: Object name resolved when a viewer requests the distribution root.
id: default_root_object
label: Default root object
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: main
description: Fallback version prefix and initial active KVS value.
id: default_version
@@
- id: section_build
label: Build config
type: section
- - default: railpack
+ - applied_by:
+ - build
+ - deploy
+ default: railpack
id: build_source
label: Build source
required: true
@@
- description: Skip the build step and promote a directory you upload to the hosting S3 bucket yourself.
label: Manual upload to S3
value: s3_directory
- - description: Repository containing the application source for Dockerfile or Railpack builds.
+ - applied_by:
+ - build
+ - deploy
+ description: Repository containing the application source for Dockerfile or Railpack builds.
id: source_repo
label: Git repository
required: true
@@
- railpack
- nixpacks
type: gitrepo
- - default: .
+ - applied_by:
+ - build
+ - deploy
+ default: .
description: Repository-relative source and build root.
id: source_base_path
label: Source base path
@@
- railpack
- nixpacks
type: string
- - default: dist
+ - applied_by:
+ - build
+ - deploy
+ default: dist
description: Directory produced by the build and uploaded to S3.
id: output_directory
label: Output directory
@@
show_when:
build_source: dockerfile
type: section
- - description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
id: dockerfile
label: Dockerfile path
placeholder: Dockerfile
show_when:
build_source: dockerfile
type: string
- - description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
id: dockerfile_context
label: Docker build context path
placeholder: .
@@
- railpack
- nixpacks
type: section
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Optional Railpack version to use for the build. Leave blank to use the Ravion default.
id: railpack_version
label: Railpack version
@@
- railpack
- nixpacks
type: string
- - description: Optional dependency installation command. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional dependency installation command. Leave blank to use Railpack detection.
id: railpack_install_cmd
label: Install command
placeholder: Railpack default
@@
- railpack
- nixpacks
type: string
- - description: Optional application build command. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional application build command. Leave blank to use Railpack detection.
id: railpack_build_cmd
label: Build command
placeholder: Railpack default
@@
- railpack
- nixpacks
type: string
- - description: Environment variables available during builds. Values can be plain strings or references loaded from Parameter Store or Secrets Manager.
+ - applied_by:
+ - build
+ - deploy
+ description: Environment variables available during builds. Values can be plain strings or references loaded from Parameter Store or Secrets Manager.
id: build_environment_variables
label: Build environment variables
placeholder: |-
@@
- railpack
- nixpacks
type: object
- - default: false
+ - applied_by:
+ - build
+ - deploy
+ default: false
description: Pass build environment variables into Dockerfile builds as build arguments.
id: dockerfile_inject_env_variables
label: Inject environment variables in Dockerfile
@@
- id: section_cloudfront
label: CloudFront settings
type: section
- - description: Required if using domain aliases. The certificate module must be in us-east-1.
+ - applied_by:
+ - stack
+ description: Required if using domain aliases. The certificate module must be in us-east-1.
id: distribution_acm_certificate
label: ACM certificate
mapped_inputs:
- - default: <<ref.stack.output.certificate_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.certificate_arn>>
id: distribution_acm_certificate_arn
label: CloudFront certificate ARN
type: string
required: false
type: $ref:rvn-acm-certificate
- add_button_label: Add domain alias
+ applied_by:
+ - stack
default: []
description: Custom domain names like app.example.com. Leave empty to use the default cloudfront.net domain.
id: distribution_aliases
label: Domain aliases
type: string_array
- - default: PriceClass_All
+ - applied_by:
+ - stack
+ default: PriceClass_All
description: You can reduce edge locations for some cost savings if it becomes an issue.
id: price_class
label: Price class
@@
value: PriceClass_200
- label: US, Canada, Europe
value: PriceClass_100
- - default: none
+ - applied_by:
+ - stack
+ default: none
id: geo_restriction_type
label: Geo restriction
type: string
@@
value: whitelist
- label: Blacklist
value: blacklist
- - default: []
+ - applied_by:
+ - stack
+ default: []
id: geo_restriction_locations
label: Geo restriction country codes
show_when:
@@
- whitelist
- blacklist
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional WAFv2 web ACL to associate with the distribution. Must be a global (CloudFront) web ACL.
id: web_acl_id
label: WAF web ACL ARN
placeholder: arn:aws:wafv2:us-east-1:123456789012:global/webacl/name/abc-123
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Add a CloudFront Origin Shield caching layer in front of the S3 bucket to improve cache hit ratio and reduce S3 load for high-traffic sites. The Origin Shield region is chosen automatically based on the bucket region.
id: origin_shield_enabled
@@
- id: section_cache_headers
label: Cache and headers
type: section
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Attach a CloudFront Function that sets Cache-Control headers for HTML and asset responses.
id: cache_control_enabled
label: Manage Cache-Control headers
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: null
description: Cache-Control header for HTML responses, routes without file extensions, dotted paths, and configured HTML path overrides. Steers browser caching only. Defaults to public, max-age=0, must-revalidate so browsers pick up new deploys on the next navigation.
id: html_cache_control
@@
show_when:
cache_control_enabled: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Cache-Control header for versioned static assets such as JavaScript, CSS, images, and fonts. Defaults to public, max-age=31536000, immutable
id: assets_cache_control
label: Asset Cache-Control
@@
cache_control_enabled: true
type: string
- add_button_label: Add path override
+ applied_by:
+ - stack
collapsible: true
description: Exact viewer paths that should receive the HTML Cache-Control header even when they have a file extension.
id: html_path_overrides
@@
show_when:
cache_control_enabled: true
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default:
- security_headers
description: AWS managed response header sets applied when no custom response headers policy is configured. Selections combine into a single AWS managed policy.
@@
- description: Allow CORS requests from any origin, including OPTIONS preflight.
label: CORS with preflight
value: cors_preflight
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional externally managed CloudFront response headers policy ID for security headers, CORS, or custom headers. Replaces the default security headers policy.
id: response_headers_policy_id
label: Response headers policy ID
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional module-managed CloudFront response headers policy for security headers, CORS, custom headers, and removed headers.
id: response_headers_policy
label: Managed response headers policy
required: false
type: object
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: CloudFront cache policy ID for the default behavior. By default the module manages a policy that caches at the edge for up to a year, which is safe because every deploy changes the cache key.
id: cache_policy_id
label: Cache policy ID
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: CloudFront origin request policy ID. Defaults to AWS managed CORS-S3Origin.
id: origin_request_policy_id
label: Origin request policy ID
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: []
description: Path patterns that should bypass CloudFront caching. Versioned deploys usually do not need this.
id: no_cache_paths
@@
- id:
... diff truncated ...rvn-cloudfront 1.2.2 -> 1.2.3--- remote
+++ compiled
- id: section_aws
label: AWS account & region
type: section
- - id: aws_account_id
+ - applied_by:
+ - stack
+ id: aws_account_id
immutable: true
label: AWS account
required: true
type: string
values: $values:ravion/aws_accounts
- - default: us-east-1
+ - applied_by:
+ - stack
+ default: us-east-1
description: CloudFront is global. Access logs go to CloudWatch Logs in us-east-1 by default; this region is used for the optional S3 logging bucket.
id: aws_region
immutable: true
@@
- id: section_distribution
label: Distribution
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name prefix for the distribution comment, origin access control, and logging bucket.
id: name
immutable: true
@@
required: true
type: string
- add_button_label: Add domain alias
+ applied_by:
+ - stack
default: []
description: Custom domain names like app.example.com. Leave empty to use the default cloudfront.net domain. Aliases must match the domain host rules on the origin load balancer when it routes by host.
id: distribution_aliases
label: Domain aliases
type: string_array
- - description: Certificate for the domain aliases. Required when aliases are set. CloudFront requires the certificate to be issued in us-east-1.
+ - applied_by:
+ - stack
+ description: Certificate for the domain aliases. Required when aliases are set. CloudFront requires the certificate to be issued in us-east-1.
id: certificate
label: ACM certificate
mapped_inputs:
- - default: <<ref.stack.output.certificate_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.certificate_arn>>
description: Certificate ARN from the selected ACM certificate module. Must be in us-east-1.
id: acm_certificate_arn
label: ACM certificate ARN
@@
id: section_origin
label: Origin
type: section
- - default: ecs_web_service
+ - applied_by:
+ - stack
+ default: ecs_web_service
description: Choose an existing ECS module, standalone ALB module, private S3 bucket, or custom origin domain name.
id: origin_source
label: Origin source
@@
- description: Enter any origin domain name, such as a load balancer, API endpoint, or S3 website endpoint.
label: Custom domain
value: custom
- - description: ECS web service whose load balancer becomes the origin. The service must be on rvn-ecs-web 0.8.0 or later so its stack exposes the load balancer DNS name.
+ - applied_by:
+ - stack
+ description: ECS web service whose load balancer becomes the origin. The service must be on rvn-ecs-web 0.8.0 or later so its stack exposes the load balancer DNS name.
id: ecs_web_service
label: ECS web service
mapped_inputs:
- - default: <<ref.stack.output.load_balancer_dns_name>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.load_balancer_dns_name>>
description: Load balancer DNS name from the selected ECS web service, used as the origin domain. If this is empty, update the service to rvn-ecs-web 0.8.0 or later and apply its stack, then re-select the service.
id: ecs_web_alb_dns_name
label: Service load balancer DNS name
required: true
type: string
- - default: <<ref.stack.output.load_balancer_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.load_balancer_arn>>
description: Load balancer ARN from the selected ECS web service, used to create the CloudFront VPC origin when private origin is enabled. If this is empty, update the service to rvn-ecs-web 0.8.0 or later and apply its stack, then re-select the service.
id: ecs_web_alb_arn
label: Service load balancer ARN
@@
show_when:
origin_source: ecs_web_service
type: $ref:rvn-ecs-web
- - description: Existing standalone ALB whose DNS name becomes the origin. The ALB must be internal when private origin is enabled.
+ - applied_by:
+ - stack
+ description: Existing standalone ALB whose DNS name becomes the origin. The ALB must be internal when private origin is enabled.
id: alb
label: Application Load Balancer
mapped_inputs:
- - default: <<ref.stack.output.alb_dns_name>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.alb_dns_name>>
description: DNS name from the selected standalone ALB module, used as the origin domain.
id: alb_dns_name
label: ALB DNS name
required: true
type: string
- - default: <<ref.stack.output.alb_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.alb_arn>>
description: ARN from the selected standalone ALB module, used to create the CloudFront VPC origin when private origin is enabled.
id: alb_arn
label: ALB ARN
@@
show_when:
origin_source: alb
type: $ref:rvn-aws-alb
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Connect to the ECS web service's load balancer or standalone ALB through a CloudFront VPC origin instead of over the public internet. Use when the load balancer is internal.
id: origin_vpc_enabled
label: Private origin (VPC origin)
@@
- ecs_web_service
- alb
type: boolean
- - description: Host name CloudFront uses as the origin domain and Host header. With HTTPS to the origin, it must be covered by the load balancer's TLS certificate and match the ECS service's or standalone ALB's host-based listener rule. No public DNS record is required.
+ - applied_by:
+ - stack
+ description: Host name CloudFront uses as the origin domain and Host header. With HTTPS to the origin, it must be covered by the load balancer's TLS certificate and match the ECS service's or standalone ALB's host-based listener rule. No public DNS record is required.
id: origin_vpc_domain_name
label: VPC origin domain name
placeholder: my-service.private.example.com
@@
show_when:
origin_vpc_enabled: true
type: string
- - description: ECS cluster whose public ALB becomes the origin. Listener rules on the ALB keep routing requests to the right services.
+ - applied_by:
+ - stack
+ description: ECS cluster whose public ALB becomes the origin. Listener rules on the ALB keep routing requests to the right services.
id: ecs_cluster
label: ECS cluster
mapped_inputs:
- - default: <<ref.stack.output.public_alb_dns_name>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.public_alb_dns_name>>
description: Public ALB DNS name from the selected ECS cluster, used as the origin domain. If this is empty, the selected cluster has no public ALB or has not applied its stack.
id: ecs_cluster_alb_dns_name
label: Cluster public ALB DNS name
@@
show_when:
origin_source: ecs_cluster
type: $ref:rvn-ecs-cluster
- - description: Domain name CloudFront connects to for the primary origin.
+ - applied_by:
+ - stack
+ description: Domain name CloudFront connects to for the primary origin.
id: origin_domain_name
label: Origin domain name
placeholder: my-alb-1234567890.us-east-1.elb.amazonaws.com
@@
show_when:
origin_source: custom
type: string
- - description: Private S3 bucket to serve through CloudFront Origin Access Control. After this CloudFront stack applies, add its distribution ARN to the S3 bucket's CloudFront OAC read policy template.
+ - applied_by:
+ - stack
+ description: Private S3 bucket to serve through CloudFront Origin Access Control. After this CloudFront stack applies, add its distribution ARN to the S3 bucket's CloudFront OAC read policy template.
id: s3_bucket
label: S3 bucket
mapped_inputs:
- - default: <<ref.stack.output.bucket_regional_domain_name>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.bucket_regional_domain_name>>
description: Regional S3 bucket domain name from the selected S3 bucket module.
id: s3_bucket_regional_domain_name
label: S3 bucket regional domain name
@@
show_when:
origin_source: s3_bucket
type: $ref:rvn-s3
- - default: https-only
+ - applied_by:
+ - stack
+ default: https-only
description: How CloudFront connects to the origin. HTTPS only requires the origin load balancer to serve a certificate valid for the forwarded host.
id: origin_protocol_policy
label: Origin protocol policy
@@
value: http-only
- label: Match viewer
value: match-viewer
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: []
description: Headers CloudFront adds to every request sent to the primary origin. Use them for origin authentication or routing.
id: origin_custom_headers
item_inputs:
- - id: name
+ - applied_by:
+ - stack
+ id: name
label: Header name
placeholder: X-Origin-Auth
required: true
type: string
- - id: value
+ - applied_by:
+ - stack
+ id: value
label: Header value
required: true
type: string
@@
- alb
- custom
type: object_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: []
description: Optional extra origins that custom cache behaviors can route paths to. Each origin needs a unique ID.
id: additional_origins
item_description: "{domain_name}"
item_inputs:
- - description: Unique identifier referenced by cache behaviors. The primary origin uses the ID primary.
+ - applied_by:
+ - stack
+ description: Unique identifier referenced by cache behaviors. The primary origin uses the ID primary.
id: origin_id
label: Origin ID
required: true
type: string
- - id: domain_name
+ - applied_by:
+ - stack
+ id: domain_name
label: Domain name
placeholder: assets.example.com
required: true
type: string
- - description: Optional path prefix CloudFront adds to requests sent to this origin.
+ - applied_by:
+ - stack
+ description: Optional path prefix CloudFront adds to requests sent to this origin.
id: origin_path
label: Origin path
placeholder: /base-path
required: false
type: string
- - default: https-only
+ - applied_by:
+ - stack
+ default: https-only
id: origin_protocol_policy
label: Origin protocol policy
required: true
@@
value: http-only
- label: Match viewer
value: match-viewer
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: []
description: Headers CloudFront adds to every request sent to this origin.
id: custom_headers
item_inputs:
- - id: name
+ - applied_by:
+ - stack
+ id: name
label: Header name
placeholder: X-Origin-Auth
required: true
type: string
- - id: value
+ - applied_by:
+ - stack
+ id: value
label: Header value
required: true
type: string
@@
id: section_edge_redirects
label: Edge redirects
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible:
... diff truncated ...rvn-ec2-service 1.4.0 -> 1.3.1--- remote
+++ compiled
timeout: 86400
type: aws:ec2
inputs:
- - description: Existing Ravion network that supplies the AWS account, region, VPC, and public and private subnets for the instances.
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ description: Existing Ravion network that supplies the AWS account, region, VPC, and public and private subnets for the instances.
id: network
immutable: true
label: VPC network
mapped_inputs:
- - id: section_aws
+ - applied_by: []
+ id: section_aws
label: AWS account & region
type: section
- - default: << ref.input.aws_account_id >>
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: << ref.input.aws_account_id >>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: << ref.input.aws_region >>
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: << ref.input.aws_region >>
description: AWS region for this module. If unset in Terraform, the provider region is used.
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - id: section_vpc
+ - applied_by: []
+ id: section_vpc
label: VPC
type: section
- - default: <<ref.stack.output.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.private_subnet_ids>>
description: Required by Terraform. Used for private workloads and private load balancers.
id: private_subnet_ids
@@
required: true
type: string_array
- add_button_label: Add public subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.public_subnet_ids>>
description: Used for public load balancers. Terraform defaults to [] when no public load balancer is enabled.
id: public_subnet_ids
@@
type: string_array
required: true
type: $ref:rvn-aws-network
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Recommended. Requires a NAT gateway or equivalent for internet access and a static IP.
id: private_subnet_placement_enabled
label: Run in private subnets
@@
- id: section_service
label: EC2 service
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name for the instance group and related resources.
id: name
immutable: true
@@
pattern: ^[a-z0-9]([a-z0-9-]{0,26}[a-z0-9])?$
required: true
type: string
- - id: instance_type
+ - applied_by:
+ - stack
+ id: instance_type
label: Instance type
no_options_message: Select a VPC Network, or enter an AWS account and region, to load available EC2 instance types.
required: true
type: string
values: $values:aws/ec2/instances?awsAccountId=<<module.input.aws_account_id>>®ion=<<module.input.aws_region>>
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Custom AMI for new instances. Leave blank for the latest architecture-matched Amazon Linux 2023 AMI.
id: ami_id
label: Custom AMI ID
placeholder: ami-...
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional EC2 key pair for SSH access.
id: key_name
label: SSH key pair name
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Shell script run as root after Ravion's bootstrap on every newly launched instance.
id: additional_user_data
label: Additional user data
required: false
type: text
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Off for a worker. On to serve HTTP traffic through a load balancer.
id: http_traffic_enabled
label: Serve HTTP traffic
type: boolean
- - default: container
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: container
description: Choose in-place container image deploys or host-level shell commands.
id: deploy_type
label: Deploy type
@@
show_when:
deploy_type: container
type: section
- - default: dockerfile
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: dockerfile
description: Build a container image from source with Dockerfile or Railpack, or deploy an existing image from a configured registry repository.
id: build_source
label: Build source
@@
- description: Deploy an image from a registry configured on this module. Provide only the tag or digest at deploy time.
label: Pull from image registry
value: image_registry
- - description: Repository containing the application source for Dockerfile or Railpack builds.
+ - applied_by:
+ - build
+ - deploy
+ description: Repository containing the application source for Dockerfile or Railpack builds.
id: source_repo
label: Git repository
required: true
@@
- railpack
deploy_type: container
type: gitrepo
- - default: .
+ - applied_by:
+ - build
+ - deploy
+ default: .
description: Repository-relative source and build root.
id: source_base_path
label: Source base path
@@
- railpack
deploy_type: container
type: string
- - description: Repository without a tag or digest, such as `nginx` or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`. Registries requiring Docker credentials are unsupported. Same-region private ECR also needs a repository policy that lets the service instance role pull images.
+ - applied_by:
+ - deploy
+ description: Repository without a tag or digest, such as `nginx` or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`. Registries requiring Docker credentials are unsupported. Same-region private ECR also needs a repository policy that lets the service instance role pull images.
id: image_repository
label: Image repository
placeholder: nginx
@@
build_source: image_registry
deploy_type: container
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional command string that overrides the image CMD. The image ENTRYPOINT is preserved.
id: container_start_command
label: Start command override
@@
show_when:
deploy_type: container
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: "Mount the host Docker socket into the container and add the host docker group's GID. This grants the container root-equivalent control of the instance: it can start privileged containers, read the host filesystem, and use the instance role. The container image must include a docker CLI for this to be useful."
id: docker_socket_mount_enabled
@@
build_source: dockerfile
deploy_type: container
type: section
- - description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
id: dockerfile
label: Dockerfile path
placeholder: Dockerfile
@@
build_source: dockerfile
deploy_type: container
type: string
- - description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
id: dockerfile_context
label: Docker build context path
placeholder: .
@@
build_source: railpack
deploy_type: container
type: section
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Optional Railpack version to use for the build. Leave blank to use the Ravion default.
id: railpack_version
label: Railpack version
@@
build_source: railpack
deploy_type: container
type: string
- - description: Optional dependency installation command. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional dependency installation command. Leave blank to use Railpack detection.
id: railpack_install_cmd
label: Install command
placeholder: Railpack default
@@
build_source: railpack
deploy_type: container
type: string
- - description: Optional application build command. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional application build command. Leave blank to use Railpack detection.
id: railpack_build_cmd
label: Build command
placeholder: Railpack default
@@
build_source: railpack
deploy_type: container
type: string
- - description: Optional start command embedded in the Railpack-built image. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional start command embedded in the Railpack-built image. Leave blank to use Railpack detection.
id: railpack_start_cmd
label: Start command
placeholder: Railpack default
@@
- id: section_deployment
label: Deployment
type: section
- - description: Optional repository to check out before manual deploy commands run. Leave blank to run the commands without a managed source checkout.
+ - applied_by:
+ - deploy
+ description: Optional repository to check out before manual deploy commands run. Leave blank to run the commands without a managed source checkout.
id: deploy_source_repo
label: Git repository
required: false
show_when:
deploy_type: manual
type: gitrepo
- - default: .
+ - applied_by:
+ - deploy
+ default: .
description: Repository-relative working directory for manual deploy and start commands when a Git repository is selected.
id: deploy_source_base_path
label: Source base path
@@
deploy_type: manual
type: string
- add_button_label: Add command
+ applied_by:
+ - deploy
description: Release preparation commands run as root, in order, on every instance during each manual deploy. Keep them idempotent; any command that exits non-zero fails that instance's deploy.
id: deploy_commands
label: Deploy commands
@@
show_when:
deploy_type: manual
type: string_array
- - description: Long-running foreground app command that supervisord runs as root after preparation and restarts if it
... diff truncated ...rvn-ecs-cluster 1.0.1 -> 1.0.2--- remote
+++ compiled
inputs:
- - id: network
+ - applied_by:
+ - stack
+ id: network
immutable: true
label: VPC network
mapped_inputs:
- - id: section_aws
+ - applied_by: []
+ id: section_aws
label: AWS account & region
type: section
- - default: << ref.input.aws_account_id >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_account_id >>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: << ref.input.aws_region >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_region >>
description: AWS region for this module. If unset in Terraform, the provider region is used.
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - id: section_vpc
+ - applied_by: []
+ id: section_vpc
label: VPC
type: section
- - default: <<ref.stack.output.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.private_subnet_ids>>
description: Required by Terraform. Used for private workloads and private load balancers.
id: private_subnet_ids
@@
required: true
type: string_array
- add_button_label: Add public subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.public_subnet_ids>>
description: Used for public load balancers. Terraform defaults to [] when no public load balancer is enabled.
id: public_subnet_ids
@@
- id: section_cluster
label: ECS cluster
type: section
- - default: <<project.given_id>>-<<environment.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>
description: Name prefix for all resources. Terraform requires 1-28 characters so generated ALB names fit AWS limits.
id: name
immutable: true
@@
pattern: ^[a-z0-9]([a-z0-9-]{0,26}[a-z0-9])?$
required: true
type: string
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Prevent accidental deletion of load balancers created by this module.
id: load_balancer_deletion_protection_enabled
label: Load balancer deletion protection
type: boolean
- - default: enhanced
+ - applied_by:
+ - stack
+ default: enhanced
description: Configures CloudWatch Container Insights for the ECS cluster. Enhanced observability adds detailed task and container metrics and may increase CloudWatch costs.
id: container_insights
label: Container insights
@@
- id: section_capacity
label: Capacity providers
type: section
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Allows ECS services in this cluster to use Fargate for serverless task capacity.
id: fargate_enabled
label: Fargate
type: boolean
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Allows ECS services in this cluster to use Fargate Spot for lower-cost, interruptible serverless task capacity.
id: fargate_spot_enabled
label: Fargate spot
type: boolean
- - description: Enables the EC2 capacity provider when set. Leave blank to use only Fargate/Fargate Spot.
+ - applied_by:
+ - stack
+ description: Enables the EC2 capacity provider when set. Leave blank to use only Fargate/Fargate Spot.
id: ec2_instance_type
label: EC2 instance type
no_options_message: Select a VPC Network, or enter an AWS account and region, to load available EC2 instance types.
@@
ec2_instance_type:
not: ""
type: section
- - description: Minimum EC2 instances in the Auto Scaling Group. To speed up deployments and autoscaling, set this high enough to keep spare capacity for all ECS services using this cluster. As a starting point, use about 2x the total desired task instances across those services.
+ - applied_by:
+ - stack
+ description: Minimum EC2 instances in the Auto Scaling Group. To speed up deployments and autoscaling, set this high enough to keep spare capacity for all ECS services using this cluster. As a starting point, use about 2x the total desired task instances across those services.
id: ec2_min_size
label: Min instances
min: 0
@@
ec2_instance_type:
not: ""
type: number
- - description: Maximum EC2 instances in the Auto Scaling Group. Must be high enough to accommodate 2x the total max task instances across all ECS services using this cluster, otherwise deployments can fail.
+ - applied_by:
+ - stack
+ description: Maximum EC2 instances in the Auto Scaling Group. Must be high enough to accommodate 2x the total max task instances across all ECS services using this cluster, otherwise deployments can fail.
id: ec2_max_size
label: Max instances
min: 1
@@
ec2_instance_type:
not: ""
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Root EBS volume size for EC2 capacity instances.
id: ec2_root_volume_size
label: Root volume size (GB)
@@
not: ""
type: number
- add_button_label: Add security group ID
+ applied_by:
+ - stack
collapsible: true
description: Additional security groups attached to EC2 capacity instances.
id: ec2_security_group_ids
@@
ec2_instance_type:
not: ""
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Use Spot instances in the EC2 Auto Scaling Group.
id: ec2_spot_enabled
@@
not: ""
type: boolean
- add_button_label: Add instance type
+ applied_by:
+ - stack
collapsible: true
description: Additional instance types for Spot capacity.
id: ec2_spot_instance_types
@@
not: ""
ec2_spot_enabled: true
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Custom AMI for EC2 capacity. Leave blank to use the latest ECS-optimized AMI.
id: ec2_ami_id
label: Custom AMI ID
@@
ec2_instance_type:
not: ""
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Key pair for SSH access to EC2 capacity instances.
id: ec2_key_name
label: SSH key pair name
@@
ec2_instance_type:
not: ""
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Root EBS volume type.
id: ec2_root_volume_type
label: Root volume type
@@
value: io1
- label: io2
value: io2
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Additional user data script appended after ECS config.
id: ec2_user_data
label: Additional user data
@@
ec2_instance_type:
not: ""
type: text
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Managed termination protection for EC2 capacity.
id: ec2_managed_termination_protection_enabled
@@
ec2_instance_type:
not: ""
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Lets ECS automatically scale the EC2 Auto Scaling Group to match task demand. Disable to manage the instance count yourself.
id: ec2_managed_scaling_enabled
@@
ec2_instance_type:
not: ""
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Defaults to 100% which means ECS autoscales EC2 instances to have zero extra capacity (cheapest). Reduce to something like 80-90% if you want to pay for spare capacity for faster autoscaling.
id: ec2_managed_scaling_target_capacity
label: Managed scaling target capacity (%)
@@
id: section_public_alb
label: Public application load balancer
type: section
- - default: true
+ - applied_by:
+ - stack
+ default: true
id: public_alb_enabled
label: Public load balancer
type: boolean
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Enable HTTPS listener on the public ALB.
id: public_alb_https_enabled
label: HTTPS
show_when:
public_alb_enabled: true
type: boolean
- - description: Primary ACM certificate module for public ALB HTTPS.
+ - applied_by:
+ - stack
+ description: Primary ACM certificate module for public ALB HTTPS.
id: public_alb_certificate
label: Certificate
mapped_inputs:
- add_button_label: Add certificate ARN
+ applied_by:
+ - stack
default:
- <<ref.stack.output.certificate_arn>>
description: ACM certificate ARNs resolved from the selected module. The first ARN is the default certificate.
@@
public_alb_https_enabled: true
type: $ref:rvn-acm-certificate
- add_button_label: Add certificate ARN
+ applied_by:
+ - stack
collapsible: true
default: []
description: Additional ACM certificate ARNs attached to the public ALB HTTPS listener for SNI.
@@
public_alb_enabled: true
public_alb_https_enabled: true
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: SSL policy for public ALB HTTPS.
id: public_alb_ssl_policy
label: SSL policy
@@
public_alb_enabled: true
public_alb_https_enabled: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Idle timeout for the public ALB.
id: public_alb_idle_timeout
label: Idle timeout (seconds)
@@
show_when:
public_alb_enabled: true
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: WAFv2 Web ACL ARN for the public ALB.
id: public_alb_web_acl_arn
label: WAF web ACL ARN
@@
show_when:
public_alb_enabled: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Enable public ALB access logging.
id: public_alb_access_logs_enabled
@@
show_when:
public_alb_enabled: true
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Existing S3 bucket ARN for public ALB access logs.
id: public_alb_access_logs_bucket_arn
label: Access logs bucket ARN
@@
id: section_private_alb
label: Private application load balancer
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
id: private_alb_enabled
label: Private load balancer
type: boolean
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Enable HTTPS listener on the private A
... diff truncated ...rvn-ecs-nlb 1.1.0 -> 1.1.1--- remote
+++ compiled
- id: section_cluster
label: ECS cluster
type: section
- - id: cluster
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ id: cluster
immutable: true
label: ECS cluster
mapped_inputs:
- - default: <<ref.input.aws_account_id>>
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: <<ref.input.aws_account_id>>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: <<ref.input.aws_region>>
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: <<ref.input.aws_region>>
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Terraform execution environment inherited from the selected ECS cluster.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - default: <<ref.stack.output.cluster_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.cluster_arn>>
id: cluster_arn
immutable: true
label: Cluster ARN
required: true
type: string
- - default: <<ref.input.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.input.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
+ - deploy
default: <<ref.input.private_subnet_ids>>
description: Private subnets available from the selected ECS cluster network.
id: private_subnet_ids
@@
required: true
type: string_array
- add_button_label: Add public subnet ID
+ applied_by:
+ - stack
+ - deploy
default: <<ref.input.public_subnet_ids>>
description: Public subnets available from the selected ECS cluster network.
id: public_subnet_ids
@@
label: Public subnet IDs
type: string_array
- add_button_label: Add subnet ID
+ applied_by: []
collapsible: true
default: <<ref.input.private_subnet_ids>>
description: Legacy service subnet override. Leave blank to derive subnets from the public/private service setting.
@@
label: Private subnet IDs
required: false
type: string_array
- - id: section_cluster_capacity
+ - applied_by: []
+ id: section_cluster_capacity
label: Cluster capacity providers
type: section
- - default: <<ref.stack.output.fargate_capacity_provider_name>>
+ - applied_by:
+ - stack
+ - deploy
+ default: <<ref.stack.output.fargate_capacity_provider_name>>
id: fargate_capacity_provider_name
immutable: true
label: Fargate capacity provider
type: string
- - default: <<ref.stack.output.fargate_spot_capacity_provider_name>>
+ - applied_by:
+ - stack
+ - deploy
+ default: <<ref.stack.output.fargate_spot_capacity_provider_name>>
id: fargate_spot_capacity_provider_name
immutable: true
label: Fargate spot capacity provider
type: string
- - default: ""
+ - applied_by:
+ - stack
+ - deploy
+ default: ""
description: EC2 capacity provider name from the selected cluster. Required only when using EC2 capacity.
id: ec2_capacity_provider_name
immutable: true
@@
show_when:
capacity_provider: ec2
type: string
- - id: section_cluster_nlb
+ - applied_by: []
+ id: section_cluster_nlb
label: Cluster network load balancers
type: section
- - default: <<ref.stack.output.public_nlb_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.public_nlb_arn>>
id: public_nlb_arn
immutable: true
label: Public NLB ARN
type: string
- - default: <<ref.stack.output.public_nlb_arn_suffix>>
+ - applied_by: []
+ default: <<ref.stack.output.public_nlb_arn_suffix>>
id: public_nlb_arn_suffix
immutable: true
label: Public NLB ARN suffix
type: string
- - default: <<ref.stack.output.public_nlb_security_group_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.public_nlb_security_group_id>>
id: public_nlb_security_group_id
immutable: true
label: Public NLB security group ID
type: string
- - default: <<ref.stack.output.private_nlb_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.private_nlb_arn>>
id: private_nlb_arn
immutable: true
label: Private NLB ARN
type: string
- - default: <<ref.stack.output.private_nlb_arn_suffix>>
+ - applied_by: []
+ default: <<ref.stack.output.private_nlb_arn_suffix>>
id: private_nlb_arn_suffix
immutable: true
label: Private NLB ARN suffix
type: string
- - default: <<ref.stack.output.private_nlb_security_group_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.private_nlb_security_group_id>>
id: private_nlb_security_group_id
immutable: true
label: Private NLB security group ID
@@
- id: section_service
label: Network service
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name for the ECS service and related resources.
id: name
immutable: true
@@
pattern: ^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$
required: true
type: string
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Expose this service through the public NLB. Turn off to use the private NLB.
id: public_nlb_service_enabled
label: Public network service
type: boolean
- - default: true
+ - applied_by:
+ - stack
+ - deploy
+ default: true
description: Recommended. Requires a NAT gateway or equivalent for internet access and keeps tasks off public subnets.
id: private_subnet_placement_enabled
label: Run in private subnets
@@
- id: section_build
label: Build config
type: section
- - default: dockerfile
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: dockerfile
id: build_source
label: Build source
required: true
@@
- description: Deploy an image from a registry configured on this module. Provide only the tag or digest at deploy time.
label: Pull from image registry
value: image_registry
- - description: Repository containing the application source for Dockerfile or Railpack builds.
+ - applied_by:
+ - build
+ - deploy
+ description: Repository containing the application source for Dockerfile or Railpack builds.
id: source_repo
label: Git repository
required: true
@@
- dockerfile
- railpack
type: gitrepo
- - default: .
+ - applied_by:
+ - build
+ - deploy
+ default: .
description: Repository-relative source and build root.
id: source_base_path
label: Source base path
@@
- dockerfile
- railpack
type: string
- - description: Image repository without a tag or digest, such as `nginx`, `ghcr.io/org/app`, or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`.
+ - applied_by:
+ - deploy
+ description: Image repository without a tag or digest, such as `nginx`, `ghcr.io/org/app`, or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`.
id: image_repository
label: Image repository
placeholder: nginx
@@
show_when:
build_source: image_registry
type: string
- - collapsible: true
+ - applied_by:
+ - deploy
+ collapsible: true
description: Secrets Manager secret ARN for private registries such as GHCR or Docker Hub. The secret must use the ECS repository credentials JSON format. Not needed for public images or normal same-account ECR.
id: image_registry_credentials_secret_arn
label: Registry credentials secret ARN
@@
build_source: image_registry
type: string
- add_button_label: Add cmd segment
+ applied_by:
+ - deploy
default: []
description: Optional command arguments that override the image default command. For shell behavior, use `/bin/sh`, `-lc`, and your command string as separate arguments.
id: image_start_command
@@
show_when:
build_source: dockerfile
type: section
- - description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
id: dockerfile
label: Dockerfile path
placeholder: Dockerfile
show_when:
build_source: dockerfile
type: string
- - description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
id: dockerfile_context
label: Docker build context path
placeholder: .
@@
show_when:
build_source: railpack
type: section
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Optional Railpack version to use for the build. Leave blank to use the Ravion default.
id: railpack_version
label: Railpack version
@@
show_when:
build_source: railpack
type: string
- - description: Optional dependency installation command. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional dependency installation command. Leave blank to use Railpack detection.
id: railpack_install_cmd
label: Install command
placeholder: Railpack default
show_when:
build_source: railpack
type: string
- - description: Optional application build command. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional application build command. Leave blank to use Railpack detection.
id: railpack_build_cmd
label: Build command
placeholder: Railpack default
show_when:
build_source: railpack
type: string
- - id: railpack_start_cmd
+ - applied_by:
+ - build
+ - deploy
+ id: railpack_start_cmd
label: Start command
placeholder: Railpack default
show_when:
@@
- id: section_listener
label: Network listeners
type: section
- - default:
+ - applied_by:
+ - stack
+ - deploy
+ default:
- container_port: 3000
listener_port: 80
listener_protocol: TCP
@@
immutable: true
item_description: "Container port: {container_port}"
item_inputs:
- - default: 80
+ - applied_by:
+ - stack
+ default: 80
description: Port the NLB listens on. Each listener port must be unique.
id: listener_port
la
... diff truncated ...rvn-ecs-web 1.1.0 -> 1.1.1--- remote
+++ compiled
- id: section_cluster
label: ECS cluster
type: section
- - id: cluster
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ id: cluster
immutable: true
label: ECS cluster
mapped_inputs:
- - default: <<ref.input.aws_account_id>>
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: <<ref.input.aws_account_id>>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: <<ref.input.aws_region>>
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: <<ref.input.aws_region>>
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Terraform execution environment inherited from the selected ECS cluster.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - default: <<ref.stack.output.cluster_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.cluster_arn>>
id: cluster_arn
immutable: true
label: Cluster ARN
required: true
type: string
- - default: <<ref.input.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.input.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
+ - deploy
default: <<ref.input.private_subnet_ids>>
description: Private subnets available from the selected ECS cluster network.
id: private_subnet_ids
@@
required: true
type: string_array
- add_button_label: Add public subnet ID
+ applied_by:
+ - stack
+ - deploy
default: <<ref.input.public_subnet_ids>>
description: Public subnets available from the selected ECS cluster network.
id: public_subnet_ids
@@
label: Public subnet IDs
type: string_array
- add_button_label: Add subnet ID
+ applied_by: []
collapsible: true
default: <<ref.input.private_subnet_ids>>
description: Legacy service subnet override. Leave blank to derive subnets from the public/private service setting.
@@
label: Private subnet IDs
required: false
type: string_array
- - id: section_cluster_capacity
+ - applied_by: []
+ id: section_cluster_capacity
label: Cluster capacity providers
type: section
- - default: <<ref.stack.output.fargate_capacity_provider_name>>
+ - applied_by:
+ - stack
+ - deploy
+ default: <<ref.stack.output.fargate_capacity_provider_name>>
id: fargate_capacity_provider_name
immutable: true
label: Fargate capacity provider
type: string
- - default: <<ref.stack.output.fargate_spot_capacity_provider_name>>
+ - applied_by:
+ - stack
+ - deploy
+ default: <<ref.stack.output.fargate_spot_capacity_provider_name>>
id: fargate_spot_capacity_provider_name
immutable: true
label: Fargate spot capacity provider
type: string
- - default: ""
+ - applied_by:
+ - stack
+ - deploy
+ default: ""
description: EC2 capacity provider name from the selected cluster. Required only when using EC2 capacity.
id: ec2_capacity_provider_name
immutable: true
@@
show_when:
capacity_provider: ec2
type: string
- - id: section_cluster_alb
+ - applied_by: []
+ id: section_cluster_alb
label: Cluster load balancers
type: section
- - default: <<ref.stack.output.public_alb_http_listener_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.public_alb_http_listener_arn>>
id: public_alb_http_listener_arn
immutable: true
label: Public ALB HTTP listener ARN
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: <<ref.stack.output.public_alb_https_listener_arn>>
description: HTTPS listener ARN from the selected public ALB. Ravion uses it when present, otherwise falls back to HTTP.
id: public_alb_https_listener_arn
@@
label: Public ALB HTTPS listener ARN
required: false
type: string
- - default: <<ref.stack.output.public_alb_security_group_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.public_alb_security_group_id>>
id: public_alb_security_group_id
immutable: true
label: Public ALB security group ID
type: string
- - default: <<ref.stack.output.private_alb_http_listener_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.private_alb_http_listener_arn>>
id: private_alb_http_listener_arn
immutable: true
label: Private ALB HTTP listener ARN
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: <<ref.stack.output.private_alb_https_listener_arn>>
description: HTTPS listener ARN from the selected private ALB. Ravion uses it when present, otherwise falls back to HTTP.
id: private_alb_https_listener_arn
@@
label: Private ALB HTTPS listener ARN
required: false
type: string
- - default: <<ref.stack.output.private_alb_security_group_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.private_alb_security_group_id>>
id: private_alb_security_group_id
immutable: true
label: Private ALB security group ID
type: string
- - default: <<ref.stack.output.public_alb_arn_suffix>>
+ - applied_by: []
+ default: <<ref.stack.output.public_alb_arn_suffix>>
id: public_alb_arn_suffix
immutable: true
label: Public ALB ARN suffix
type: string
- - default: <<ref.stack.output.private_alb_arn_suffix>>
+ - applied_by: []
+ default: <<ref.stack.output.private_alb_arn_suffix>>
id: private_alb_arn_suffix
immutable: true
label: Private ALB ARN suffix
@@
- id: section_service
label: Web service
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name for the ECS service and related resources.
id: name
immutable: true
@@
pattern: ^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$
required: true
type: string
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Expose this service through the public ALB. Turn off to use the private ALB.
id: public_web_service_enabled
label: Public web service
type: boolean
- - default: true
+ - applied_by:
+ - stack
+ - deploy
+ default: true
description: Recommended. Requires a NAT gateway or equivalent for internet access and a static IP.
id: private_subnet_placement_enabled
label: Run in private subnets
@@
- id: section_build
label: Build config
type: section
- - default: dockerfile
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: dockerfile
id: build_source
label: Build source
required: true
@@
- description: Deploy an image from a registry configured on this module. Provide only the tag or digest at deploy time.
label: Pull from image registry
value: image_registry
- - description: Repository containing the application source for Dockerfile or Railpack builds.
+ - applied_by:
+ - build
+ - deploy
+ description: Repository containing the application source for Dockerfile or Railpack builds.
id: source_repo
label: Git repository
required: true
@@
- dockerfile
- railpack
type: gitrepo
- - default: .
+ - applied_by:
+ - build
+ - deploy
+ default: .
description: Repository-relative source and build root.
id: source_base_path
label: Source base path
@@
- dockerfile
- railpack
type: string
- - description: Image repository without a tag or digest, such as `nginx`, `ghcr.io/org/app`, or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`.
+ - applied_by:
+ - deploy
+ description: Image repository without a tag or digest, such as `nginx`, `ghcr.io/org/app`, or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`.
id: image_repository
label: Image repository
placeholder: nginx
@@
show_when:
build_source: image_registry
type: string
- - collapsible: true
+ - applied_by:
+ - deploy
+ collapsible: true
description: Secrets Manager secret ARN for private registries such as GHCR or Docker Hub. The secret must use the ECS repository credentials JSON format. Not needed for public images or normal same-account ECR.
id: image_registry_credentials_secret_arn
label: Registry credentials secret ARN
@@
build_source: image_registry
type: string
- add_button_label: Add cmd segment
+ applied_by:
+ - deploy
default: []
description: Optional command arguments that override the image default command. For shell behavior, use `/bin/sh`, `-lc`, and your command string as separate arguments.
id: image_start_command
@@
show_when:
build_source: dockerfile
type: section
- - description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
id: dockerfile
label: Dockerfile path
placeholder: Dockerfile
show_when:
build_source: dockerfile
type: string
- - description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
id: dockerfile_context
label: Docker build context path
placeholder: .
@@
show_when:
build_source: railpack
type: section
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Optional Railpack version to use for the build. Leave blank to use the Ravion default.
id: railpack_version
label: Railpack version
@@
show_when:
build_source: railpack
type: string
- - description: Optional dependency installation command. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional dependency installation command. Leave blank to use Railpack detection.
id: railpack_install_cmd
label: Install command
placeholder: Railpack default
show_when:
build_source: railpack
type: string
- - description: Optional application build command. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional
... diff truncated ...rvn-ecs-worker 1.1.0 -> 1.1.1--- remote
+++ compiled
- id: section_cluster
label: ECS cluster
type: section
- - id: cluster
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ id: cluster
immutable: true
label: ECS cluster
mapped_inputs:
- - default: <<ref.input.aws_account_id>>
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: <<ref.input.aws_account_id>>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: <<ref.input.aws_region>>
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: <<ref.input.aws_region>>
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Terraform execution environment inherited from the selected ECS cluster.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - default: <<ref.stack.output.cluster_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.cluster_arn>>
id: cluster_arn
immutable: true
label: Cluster ARN
required: true
type: string
- - default: <<ref.input.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.input.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
+ - deploy
default: <<ref.input.private_subnet_ids>>
description: Private subnets available from the selected ECS cluster network.
id: private_subnet_ids
@@
required: true
type: string_array
- add_button_label: Add public subnet ID
+ applied_by:
+ - stack
+ - deploy
default: <<ref.input.public_subnet_ids>>
description: Public subnets available from the selected ECS cluster network.
id: public_subnet_ids
@@
label: Public subnet IDs
type: string_array
- add_button_label: Add subnet ID
+ applied_by: []
collapsible: true
default: <<ref.input.private_subnet_ids>>
description: Legacy service subnet override. Leave blank to derive subnets from the public/private service setting.
@@
label: Private subnet IDs
required: false
type: string_array
- - id: section_cluster_capacity
+ - applied_by: []
+ id: section_cluster_capacity
label: Cluster capacity providers
type: section
- - default: <<ref.stack.output.fargate_capacity_provider_name>>
+ - applied_by:
+ - stack
+ - deploy
+ default: <<ref.stack.output.fargate_capacity_provider_name>>
id: fargate_capacity_provider_name
immutable: true
label: Fargate capacity provider
type: string
- - default: <<ref.stack.output.fargate_spot_capacity_provider_name>>
+ - applied_by:
+ - stack
+ - deploy
+ default: <<ref.stack.output.fargate_spot_capacity_provider_name>>
id: fargate_spot_capacity_provider_name
immutable: true
label: Fargate spot capacity provider
type: string
- - default: ""
+ - applied_by:
+ - stack
+ - deploy
+ default: ""
description: EC2 capacity provider name from the selected cluster. Required only when using EC2 capacity.
id: ec2_capacity_provider_name
immutable: true
@@
- id: section_service
label: Worker service
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name for the ECS worker service and related resources.
id: name
immutable: true
@@
pattern: ^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$
required: true
type: string
- - default: true
+ - applied_by:
+ - stack
+ - deploy
+ default: true
description: Recommended. Requires a NAT gateway or equivalent for internet access and keeps worker tasks off public subnets.
id: private_subnet_placement_enabled
label: Run in private subnets
@@
- id: section_build
label: Build config
type: section
- - default: dockerfile
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: dockerfile
id: build_source
label: Build source
required: true
@@
- description: Deploy an image from a registry configured on this module. Provide only the tag or digest at deploy time.
label: Pull from image registry
value: image_registry
- - description: Repository containing the application source for Dockerfile or Railpack builds.
+ - applied_by:
+ - build
+ - deploy
+ description: Repository containing the application source for Dockerfile or Railpack builds.
id: source_repo
label: Git repository
required: true
@@
- dockerfile
- railpack
type: gitrepo
- - default: .
+ - applied_by:
+ - build
+ - deploy
+ default: .
description: Repository-relative source and build root.
id: source_base_path
label: Source base path
@@
- dockerfile
- railpack
type: string
- - description: Image repository without a tag or digest, such as `nginx`, `ghcr.io/org/app`, or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`.
+ - applied_by:
+ - deploy
+ description: Image repository without a tag or digest, such as `nginx`, `ghcr.io/org/app`, or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`.
id: image_repository
label: Image repository
placeholder: nginx
@@
show_when:
build_source: image_registry
type: string
- - collapsible: true
+ - applied_by:
+ - deploy
+ collapsible: true
description: Secrets Manager secret ARN for private registries such as GHCR or Docker Hub. The secret must use the ECS repository credentials JSON format. Not needed for public images or normal same-account ECR.
id: image_registry_credentials_secret_arn
label: Registry credentials secret ARN
@@
build_source: image_registry
type: string
- add_button_label: Add cmd segment
+ applied_by:
+ - deploy
default: []
description: Optional command arguments that override the image default command. For shell behavior, use `/bin/sh`, `-lc`, and your command string as separate arguments.
id: image_start_command
@@
show_when:
build_source: dockerfile
type: section
- - description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
id: dockerfile
label: Dockerfile path
placeholder: Dockerfile
show_when:
build_source: dockerfile
type: string
- - description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
id: dockerfile_context
label: Docker build context path
placeholder: .
@@
show_when:
build_source: railpack
type: section
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Optional Railpack version to use for the build. Leave blank to use the Ravion default.
id: railpack_version
label: Railpack version
@@
show_when:
build_source: railpack
type: string
- - description: Optional dependency installation command. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional dependency installation command. Leave blank to use Railpack detection.
id: railpack_install_cmd
label: Install command
placeholder: Railpack default
show_when:
build_source: railpack
type: string
- - description: Optional application build command. Leave blank to use Railpack detection.
+ - applied_by:
+ - build
+ - deploy
+ description: Optional application build command. Leave blank to use Railpack detection.
id: railpack_build_cmd
label: Build command
placeholder: Railpack default
show_when:
build_source: railpack
type: string
- - id: railpack_start_cmd
+ - applied_by:
+ - build
+ - deploy
+ id: railpack_start_cmd
label: Start command
placeholder: Railpack default
show_when:
@@
- id: section_task
label: Container resources
type: section
- - default: fargate
+ - applied_by:
+ - stack
+ - deploy
+ default: fargate
description: Choose the primary capacity provider. Most services should use only one provider.
id: capacity_provider
label: Capacity provider
@@
value: fargate_spot
- label: EC2
value: ec2
- - collapsible: true
+ - applied_by:
+ - stack
+ - deploy
+ collapsible: true
default: false
description: Add Fargate to the capacity provider strategy in addition to the primary provider.
id: additional_fargate_capacity_enabled
@@
capacity_provider:
not: fargate
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ - deploy
+ collapsible: true
default: false
description: Add lower-cost interruptible Fargate spot capacity in addition to the primary provider.
id: additional_fargate_spot_capacity_enabled
@@
capacity_provider:
not: fargate_spot
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ - deploy
+ collapsible: true
default: false
description: Add EC2 capacity from the selected cluster in addition to the primary provider.
id: additional_ec2_capacity_enabled
@@
capacity_provider:
not: ec2
type: boolean
- - default:
+ - applied_by:
+ - stack
+ - deploy
+ default:
memory_gb: 4
vcpu: 2
description: CPU and memory for Fargate tasks. Prices are estimated from AWS Fargate pricing for the selected region, architecture, and capacity provider.
@@
- fargate_spot
type: compound
values: $values:aws/fargate/sizes?region=<<module.input.aws_region>>&cpuArchitecture=<<module.input.cpu_architecture>>&operatingSystem=linux&capacityProvider=<<module.input.capacity_provider>>
- - collapsible: true
+ - applied_by:
+ - stack
+ - deploy
+ collapsible: true
description: Optional ephemeral storage size for each Fargate app task, from 21 to 200 GiB. Leave blank to use the AWS default of 20 GiB.
id: task_ephemeral_storage_size_gib
label: App ephemeral storage (GiB)
@@
- fargate
- fargate_spot
type: number
- - default: "1.5"
+ - applied_by:
+ - stack
+ - deploy
+ default: "1.5"
description: vCPU reserved for each app task on EC2 capacity. Leave at least 0.25 vCPU unreserved on each EC2 instance for the ECS agent and system processes.
id: task_cpu
label: App vCPU
@@
show_when:
capacity_provider: ec2
type: string
- - default: "3.5"
+ - appl
... diff truncated ...rvn-efs 1.0.1 -> 1.0.2--- remote
+++ compiled
inputs:
- - id: network
+ - applied_by:
+ - stack
+ id: network
immutable: true
label: VPC network
mapped_inputs:
- - id: section_aws
+ - applied_by: []
+ id: section_aws
label: AWS account & region
type: section
- - default: << ref.input.aws_account_id >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_account_id >>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: << ref.input.aws_region >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_region >>
description: AWS region for this file system.
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - id: section_vpc
+ - applied_by: []
+ id: section_vpc
label: VPC
type: section
- - default: <<ref.stack.output.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.private_subnet_ids>>
description: Subnets where EFS mount targets are created, one per subnet. Use private subnets in distinct availability zones.
id: subnet_ids
@@
- id: section_file_system
label: File system
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name prefix for all EFS resources.
id: name
immutable: true
@@
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9_-]{0,62}[a-zA-Z0-9])?$
required: true
type: string
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Encrypt file system data at rest. Cannot be changed after creation.
id: encrypted
immutable: true
label: Encryption at rest
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: KMS key for encryption at rest. Leave blank to use the AWS managed key for EFS.
id: kms_key_id
label: KMS key ARN
@@
show_when:
encrypted: true
type: string
- - default: generalPurpose
+ - applied_by:
+ - stack
+ default: generalPurpose
description: General purpose fits most workloads. Max I/O trades higher latency for higher aggregate throughput and cannot be changed after creation.
id: performance_mode
immutable: true
@@
- description: Higher aggregate throughput and operations per second at the cost of latency. Not supported with elastic throughput.
label: Max I/O
value: maxIO
- - default: bursting
+ - applied_by:
+ - stack
+ default: bursting
description: How the file system scales throughput.
id: throughput_mode
label: Throughput mode
@@
- description: Fixed throughput independent of the amount of data stored.
label: Provisioned
value: provisioned
- - default: 128
+ - applied_by:
+ - stack
+ default: 128
description: Throughput to provision for the file system.
id: provisioned_throughput_in_mibps
label: Provisioned throughput (MiB/s)
@@
- id: section_lifecycle
label: Lifecycle & backups
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Move files not accessed for this period to the lower-cost Infrequent Access storage class. Leave blank to keep files in Standard storage.
id: transition_to_ia
label: Transition to Infrequent Access
@@
value: AFTER_270_DAYS
- label: After 365 days
value: AFTER_365_DAYS
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Move files not accessed for this period to the Archive storage class. Requires a Transition to Infrequent Access period.
id: transition_to_archive
label: Transition to Archive
@@
value: AFTER_270_DAYS
- label: After 365 days
value: AFTER_365_DAYS
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Move files back to Standard storage on first access, avoiding repeated Infrequent Access retrieval charges for files that become hot again.
id: transition_to_primary_storage_class
label: Transition back to Standard
@@
values:
- label: After 1 access
value: AFTER_1_ACCESS
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Back up the file system automatically through AWS Backup.
id: backup_enabled
label: Automatic backups
@@
- id: section_access_point
label: Access point
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Create an EFS access point that scopes clients to a directory with fixed POSIX ownership. Recommended when containers should not access the whole file system as root.
id: access_point_enabled
label: Access point
type: boolean
- - default: /data
+ - applied_by:
+ - stack
+ default: /data
description: Directory exposed through the access point. EFS creates it with the ownership below on first use when the path is not /.
id: access_point_root_directory_path
label: Root directory path
@@
show_when:
access_point_enabled: true
type: string
- - default: 1000
+ - applied_by:
+ - stack
+ default: 1000
description: User ID applied to all requests through the access point and owner of the created directory.
id: access_point_posix_uid
label: POSIX user ID
@@
show_when:
access_point_enabled: true
type: number
- - default: 1000
+ - applied_by:
+ - stack
+ default: 1000
description: Group ID applied to all requests through the access point and owner of the created directory.
id: access_point_posix_gid
label: POSIX group ID
@@
show_when:
access_point_enabled: true
type: number
- - default: "755"
+ - applied_by:
+ - stack
+ default: "755"
description: Octal permissions for the created root directory.
id: access_point_permissions
label: Directory permissions
@@
label: Security
type: section
- add_button_label: Add security group ID
+ applied_by:
+ - stack
collapsible: true
description: Extra security groups allowed to reach the mount targets over NFS, beyond the managed client security group.
id: allowed_security_group_ids
@@
placeholder: sg-...
type: string_array
- add_button_label: Add CIDR block
+ applied_by:
+ - stack
collapsible: true
description: IPv4 CIDR blocks allowed to reach the mount targets over NFS.
id: allowed_cidr_blocks
@@
placeholder: 10.0.0.0/16
type: string_array
- add_button_label: Add IPv6 CIDR block
+ applied_by:
+ - stack
collapsible: true
description: IPv6 CIDR blocks allowed to reach the mount targets over NFS.
id: allowed_ipv6_cidr_blocks
@@
- id: section_misc
label: Misc
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId`
id: tags
label: Tags
@@
- id: section_advanced
label: Terraform settings
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override the environment's default version for this module
id: opentofu_version
label: OpenTofu version override
required: false
type: string
values: $values:opentofu/versions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
id: ravion_state_backend_workspace
immutable: true
label: Ravion Terraform workspace name
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: {}
description: Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
id: advanced_terraform_variables
@@
ECS services can reference this module directly: the service mounts the file system into the app container and attaches the client security group automatically.
- Terraform source: [ravionhq/modules/storage/efs](https://github.com/ravionhq/modules/tree/rvn-efs@1.0.1/storage/efs)
+ Terraform source: [ravionhq/modules/storage/efs](https://github.com/ravionhq/modules/tree/rvn-efs@1.0.2/storage/efs)
## Use cases
@@
base_path: storage/efs
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-efs@1.0.1
+ ref: rvn-efs@1.0.2
repo: https://github.com/ravionhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-elasticache 1.0.1 -> 1.0.2--- remote
+++ compiled
inputs:
- - id: network
+ - applied_by:
+ - stack
+ id: network
immutable: true
label: VPC network
mapped_inputs:
- - id: section_aws
+ - applied_by: []
+ id: section_aws
label: AWS account & region
type: section
- - default: << ref.input.aws_account_id >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_account_id >>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: << ref.input.aws_region >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_region >>
description: AWS region for this cache.
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - id: section_vpc
+ - applied_by: []
+ id: section_vpc
label: VPC
type: section
- - default: <<ref.stack.output.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.private_subnet_ids>>
description: Subnets for the ElastiCache subnet group or serverless cache. Use private subnets for normal cache deployments.
id: subnet_ids
@@
- id: section_cache
label: Cache
type: section
- - default: <<project.given_id>>-<<environment.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>
description: Name prefix for all ElastiCache resources.
id: name
immutable: true
@@
- id: section_version
label: Version
type: section
- - default: valkey
+ - applied_by:
+ - stack
+ default: valkey
description: Choose Valkey for Redis-compatible workloads with lower AWS pricing, Redis for Redis OSS compatibility requirements, or Memcached for simple non-persistent object caching without Redis data structures. AWS prices Valkey 20% lower than Redis OSS for node-based ElastiCache and 33% lower for Serverless, with a 90% lower Serverless minimum data storage size.
id: engine
immutable: true
@@
- description: Best for simple volatile object caching where you do not need Redis commands, persistence, replicas, or cluster-mode sharding.
label: Memcached
value: memcached
- - description: Major engine version. Current latest major versions include Valkey 9, Redis OSS 7, and Memcached 1.6.
+ - applied_by:
+ - stack
+ description: Major engine version. Current latest major versions include Valkey 9, Redis OSS 7, and Memcached 1.6.
id: engine_major_version
immutable: true
label: Engine major version
placeholder: "9"
required: true
type: string
- - description: Minor or patch version appended to the major version.
+ - applied_by:
+ - stack
+ description: Minor or patch version appended to the major version.
id: engine_minor_version
label: Engine minor version
placeholder: "0"
required: true
type: string
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Enable automatic minor engine version upgrades during the maintenance window.
id: minor_version_auto_upgrade_enabled
label: Auto minor version upgrades
@@
- id: section_size
label: Size & topology
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Create an ElastiCache Serverless cache instead of provisioned nodes. Supported for Redis and Valkey.
id: serverless_enabled
immutable: true
@@
- redis
- valkey
type: boolean
- - default: cache.t4g.micro
+ - applied_by:
+ - stack
+ default: cache.t4g.micro
description: ElastiCache node size for provisioned clusters.
id: node_type
label: Node type
@@
show_when:
serverless_enabled: false
type: string
- - default: 1
+ - applied_by:
+ - stack
+ default: 1
description: Number of Memcached cache nodes.
id: num_cache_nodes
label: Cache nodes
@@
engine: memcached
serverless_enabled: false
type: number
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Enable cluster mode when one primary shard is not enough for your data size or throughput. Leave disabled for simpler Redis or Valkey deployments with one primary and optional replicas.
id: cluster_mode_enabled
label: Cluster mode
@@
- valkey
serverless_enabled: false
type: boolean
- - default: 1
+ - applied_by:
+ - stack
+ default: 1
description: Number of Redis or Valkey shards. Use 1 when cluster mode is disabled.
id: num_node_groups
label: Node groups
@@
- valkey
serverless_enabled: false
type: number
- - default: 0
+ - applied_by:
+ - stack
+ default: 0
description: Number of replica nodes in each Redis or Valkey node group.
id: replicas_per_node_group
label: Replicas per node group
@@
- valkey
serverless_enabled: false
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Port where the cache accepts connections. Leave blank for engine defaults.
id: port
label: Port
max: 65535
min: 1
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: ipv4
description: Network type for the replication group.
id: network_type
@@
value: ipv6
- label: Dual stack
value: dual_stack
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: ipv4
description: IP address discovery method.
id: ip_discovery
@@
- id: section_security
label: Security
type: section
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Create a security group with ingress rules for this cache.
id: security_group_creation_enabled
label: Security group creation
type: boolean
- - description: Existing security group ID to use when security group creation is disabled.
+ - applied_by:
+ - stack
+ description: Existing security group ID to use when security group creation is disabled.
id: security_group_id
label: Security group ID
patterns:
@@
security_group_creation_enabled: false
type: string
- add_button_label: Add security group ID
+ applied_by:
+ - stack
description: Security groups allowed to connect to this cache.
id: allowed_security_group_ids
label: Allowed security groups
@@
placeholder: sg-...
type: string_array
- add_button_label: Add CIDR block
+ applied_by:
+ - stack
collapsible: true
description: IPv4 CIDR blocks allowed to connect to this cache.
id: allowed_cidr_blocks
@@
placeholder: 10.0.0.0/16
type: string_array
- add_button_label: Add IPv6 CIDR block
+ applied_by:
+ - stack
collapsible: true
description: IPv6 CIDR blocks allowed to connect to this cache.
id: allowed_ipv6_cidr_blocks
label: Allowed IPv6 CIDR blocks
placeholder: 2001:db8::/64
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Enable TLS encryption for Redis and Valkey traffic.
id: transit_encryption_enabled
@@
- redis
- valkey
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Enable encryption at rest for Redis and Valkey.
id: at_rest_encryption_enabled
@@
- redis
- valkey
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: KMS key ARN for at-rest encryption. Leave blank to use the AWS managed key.
id: kms_key_arn
label: KMS key ARN
@@
- redis
- valkey
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Generate an AUTH token for Redis or Valkey when no token is provided. Requires transit encryption.
id: auth_token_enabled
@@
- valkey
transit_encryption_enabled: true
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional explicit AUTH token. Leave blank to generate one when AUTH token generation is enabled.
id: auth_token
label: AUTH token
@@
- valkey
transit_encryption_enabled: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 32
description: Length of the generated AUTH token.
id: auth_token_length
@@
- valkey
serverless_enabled: false
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Enable automatic failover. Requires at least one replica.
id: automatic_failover_enabled
label: Automatic failover
@@
- valkey
serverless_enabled: false
type: boolean
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Enable Multi-AZ support for the replication group.
id: multi_az_enabled
label: Multi-AZ
@@
- valkey
serverless_enabled: false
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Enable data tiering for r6gd or r7gd node types.
id: data_tiering_enabled
@@
- redis
- valkey
type: section
- - default: 0
+ - applied_by:
+ - stack
+ default: 0
description: Number of days to retain automatic snapshots. Set to 0 to disable backups.
id: snapshot_retention_limit
label: Snapshot retention days
@@
- valkey
serverless_enabled: false
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Daily UTC window for automatic snapshots.
id: snapshot_window
label: Snapshot window
@@
- valkey
serverless_enabled: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Final snapshot name to create when deleting the replication group. Leave blank to skip final snapshot creation.
id: final_snapshot_identifier
label: Final snapshot identifier
@@
- valkey
serverless_enabled: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Snapshot ARNs to restore into the serverless cache.
id: serverless_snapshot_arns_to_restore
label: Serverless snapshot ARNs to restore
@@
- valkey
serverless_enabled: true
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Daily UTC time for serverless automated snapshots.
id: serverless_daily_snapshot_time
label: Serverless daily snapshot time
@@
show_when:
... diff truncated ...rvn-lambda 1.1.0 -> 1.1.1--- remote
+++ compiled
- id: section_aws
label: AWS account & region
type: section
- - id: aws_account_id
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ id: aws_account_id
immutable: true
label: AWS account
required: true
type: string
values: $values:ravion/aws_accounts
- - id: aws_region
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ id: aws_region
immutable: true
label: Region
required: true
@@
- id: section_function
label: Lambda function
type: section
- - default: regional
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: regional
id: lambda_type
immutable: true
label: Lambda type
@@
value: regional
- label: CloudFront Lambda@Edge
value: edge
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Name for the Lambda function and related resources.
id: name
immutable: true
@@
pattern: ^[A-Za-z0-9_-]{1,64}$
required: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Description shown for the Lambda function in AWS.
id: description
label: Function description
required: false
type: string
- - default: Zip
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: Zip
id: package_type
immutable: true
label: Package type
@@
show_when:
lambda_type: regional
value: Image
- - default: x86_64
+ - applied_by:
+ - stack
+ default: x86_64
description: CPU architecture used by the function.
id: architecture
label: Architecture
@@
value: x86_64
- label: arm64
value: arm64
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Publish a new immutable Lambda version on function updates. Required for Lambda@Edge and aliases that target published versions.
id: version_publishing_enabled
label: Version publishing
@@
show_when:
package_type: Zip
type: section
- - default: $values:first
+ - applied_by:
+ - stack
+ default: $values:first
description: Lambda runtime for Zip packages.
id: runtime
label: Runtime
@@
value: dotnet8
- label: Go provided AL2023
value: provided.al2023
- - description: Function entrypoint for the zip package, such as index.handler.
+ - applied_by:
+ - stack
+ description: Function entrypoint for the zip package, such as index.handler.
id: handler
label: Handler
placeholder: index.handler
@@
show_when:
package_type: Zip
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: S3 bucket containing the deployment package. Leave empty to create a managed code bucket.
id: s3_bucket
label: Package S3 bucket
show_when:
package_type: Zip
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: S3 key of the deployment package. Required when Package S3 bucket is set.
id: s3_key
label: Package S3 key
show_when:
package_type: Zip
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Name for the s3 bucket used for Lambda zip artifacts. Must be globally unique. Defaults to <function-name>-code-<account-id>.
id: code_bucket_name
immutable: true
@@
show_when:
package_type: Zip
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Delete the code bucket even when it contains package objects during stack destroy.
id: code_bucket_force_destroy_enabled
@@
show_when:
package_type: Zip
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: bootstrap-package.zip
description: S3 key for the initial bootstrap deployment package in the managed code bucket.
id: placeholder_object_key
@@
- id: section_build
label: Build config
type: section
- - default: dockerfile
+ - applied_by:
+ - stack
+ - build
+ - deploy
+ default: dockerfile
id: build_source
label: Build source
required: true
@@
show_when:
package_type: Image
value: image_registry
- - description: Repository containing the application source for Dockerfile or Railpack builds.
+ - applied_by:
+ - build
+ - deploy
+ description: Repository containing the application source for Dockerfile or Railpack builds.
id: source_repo
label: Git repository
required: true
@@
- nixpacks
- dockerfile
type: gitrepo
- - default: .
+ - applied_by:
+ - build
+ - deploy
+ default: .
description: Repository-relative source and build root.
id: source_base_path
label: Source base path
@@
- nixpacks
- dockerfile
type: string
- - default: /app
+ - applied_by:
+ - build
+ - deploy
+ default: /app
description: Directory inside the built image that contains the Lambda package files.
id: output_directory
label: Package output directory
@@
- dockerfile
package_type: Zip
type: string
- - description: ECR repository URI without a tag or digest, such as 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-function. The repository must be in the same region as the function. A repository in a different AWS account works when its repository policy grants pull access to the function's account and the Lambda service principal.
+ - applied_by:
+ - stack
+ - deploy
+ description: ECR repository URI without a tag or digest, such as 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-function. The repository must be in the same region as the function. A repository in a different AWS account works when its repository policy grants pull access to the function's account and the Lambda service principal.
id: image_repository
label: Image repository
placeholder: 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-function
@@
build_source: image_registry
package_type: Image
type: string
- - description: Tag or digest used only to create the function before its first deployment. It must already exist in the image repository above. Deployments promote the tag or digest you pass at deploy time; changing this value afterward has no effect. Do not include the repository URI.
+ - applied_by:
+ - stack
+ description: Tag or digest used only to create the function before its first deployment. It must already exist in the image repository above. Deployments promote the tag or digest you pass at deploy time; changing this value afterward has no effect. Do not include the repository URI.
id: initial_image_ref
label: Initial image tag or digest
placeholder: sha256:... or latest
@@
package_type: Image
type: string
- add_button_label: Add cmd segment
+ applied_by:
+ - stack
default: []
description: Optional command arguments that override the image default command (CMD). Leave empty to use the image default.
id: image_start_command
@@
package_type: Image
type: string_array
- add_button_label: Add entry point segment
+ applied_by:
+ - stack
collapsible: true
default: []
description: Optional entry point arguments that override the image default ENTRYPOINT.
@@
lambda_type: regional
package_type: Image
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional working directory override inside the image.
id: image_working_directory
label: Working directory
@@
show_when:
build_source: dockerfile
type: section
- - description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
id: dockerfile
label: Dockerfile path
placeholder: Dockerfile
show_when:
build_source: dockerfile
type: string
- - description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
+ - applied_by:
+ - build
+ - deploy
+ description: Directory to use as the Docker build context, relative to the repository root or configured source base path.
id: dockerfile_context
label: Docker build context path
placeholder: .
@@
show_when:
build_source: nixpacks
type: section
- - id: nixpacks_install_cmd
+ - applied_by:
+ - build
+ - deploy
+ id: nixpacks_install_cmd
label: Install command
placeholder: Intelligent default based on your language & framework
show_when:
build_source: nixpacks
type: string
- - id: nixpacks_build_cmd
+ - applied_by:
+ - build
+ - deploy
+ id: nixpacks_build_cmd
label: Build command
placeholder: Intelligent default based on your language & framework
show_when:
build_source: nixpacks
type: string
- - id: nixpacks_start_cmd
+ - applied_by:
+ - build
+ - deploy
+ id: nixpacks_start_cmd
label: Start command
placeholder: Intelligent default based on your language & framework
show_when:
build_source: nixpacks
package_type: Image
type: string
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Path to a custom Nixpacks config file, relative to the repository root or configured source base path.
id: nixpacks_config_file_path
label: Nixpacks config file path
show_when:
build_source: nixpacks
type: string
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Application path for Nixpacks to build, relative to the repository root or configured source base path.
id: nixpacks_build_path
label: Nixpacks build path
show_when:
build_source: nixpacks
type: string
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Optional Nixpacks version to use for the build. Leave blank to use the default version.
id: nixpacks_version
label: Nixpacks version
show_when:
build_source: nixpacks
type: string
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Additional Nix packages to install during the Nixpacks build.
id: nixpacks_nix_pkgs
label: Nix packages
show_when:
build_source: nixpacks
type: string_array
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Additional APT packages to install during the Nixpacks build.
id: nixpacks_apt_pkgs
label: APT packages
show_when:
build_source: nixpacks
type: string_array
- - collapsible: true
+ - applied_by:
+ - build
+ - deploy
+ collapsible: true
description: Additional Nix libraries to make available during the Nixpacks build.
id: nixpacks_nix_libs
label: Nix libraries
@@
show_when:
lambda_type: regional
type: section
- - default: 128
+ - applied_by:
+ - stack
+ default: 128
description: Memory allocated to the function. Lambda CPU scales with memory.
id:
... diff truncated ...rvn-rds 1.2.0 -> 1.2.1--- remote
+++ compiled
inputs:
- - id: network
+ - applied_by:
+ - stack
+ id: network
immutable: true
label: VPC network
mapped_inputs:
- - id: section_aws
+ - applied_by: []
+ id: section_aws
label: AWS account & region
type: section
- - default: << ref.input.aws_account_id >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_account_id >>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: << ref.input.aws_region >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_region >>
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Override the VPC, subnet, and security group for Pipeline Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - id: section_vpc
+ - applied_by: []
+ id: section_vpc
label: VPC
type: section
- - default: <<ref.stack.output.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.private_subnet_ids>>
description: Subnets for the RDS DB subnet group. Use private subnets for normal database deployments.
id: subnet_ids
@@
- id: section_database
label: Database
type: section
- - default: <<project.given_id>>-<<environment.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>
description: Name prefix for all RDS resources.
id: name
immutable: true
@@
pattern: ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$
required: true
type: string
- - default: none
+ - applied_by:
+ - stack
+ default: none
id: restore_mode
immutable: true
label: Create or restore
@@
value: snapshot
- label: Point-in-time restore
value: point_in_time
- - id: db_name
+ - applied_by:
+ - stack
+ id: db_name
immutable: true
label: Database name
patterns:
@@
- oracle-se2-cdb
restore_mode: none
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: dbadmin
id: username
immutable: true
@@
show_when:
restore_mode: none
type: string
- - description: Snapshot identifier or ARN to restore into this new database. The snapshot must be compatible with the selected engine and instance settings.
+ - applied_by:
+ - stack
+ description: Snapshot identifier or ARN to restore into this new database. The snapshot must be compatible with the selected engine and instance settings.
id: snapshot_identifier
immutable: true
label: Snapshot to restore
@@
show_when:
restore_mode: snapshot
type: string
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Restore to the latest time AWS can recover from the selected source database backup.
id: point_in_time_use_latest_restorable_time
immutable: true
@@
show_when:
restore_mode: point_in_time
type: boolean
- - description: Restore to this UTC timestamp instead of the latest restorable time.
+ - applied_by:
+ - stack
+ description: Restore to this UTC timestamp instead of the latest restorable time.
id: point_in_time_restore_time
immutable: true
label: Restore time
@@
point_in_time_use_latest_restorable_time: false
restore_mode: point_in_time
type: string
- - description: Source DB instance identifier to restore from.
+ - applied_by:
+ - stack
+ description: Source DB instance identifier to restore from.
id: point_in_time_source_db_instance_identifier
immutable: true
label: Source DB instance identifier
@@
show_when:
restore_mode: point_in_time
type: string
- - description: ARN of the source automated backups to restore from. Use this for cross-region or retained automated backup restores.
+ - applied_by:
+ - stack
+ description: ARN of the source automated backups to restore from. Use this for cross-region or retained automated backup restores.
id: point_in_time_source_db_instance_automated_backups_arn
immutable: true
label: Source automated backups ARN
@@
show_when:
restore_mode: point_in_time
type: string
- - description: Source DB resource ID to restore from when using automated backups.
+ - applied_by:
+ - stack
+ description: Source DB resource ID to restore from when using automated backups.
id: point_in_time_source_dbi_resource_id
immutable: true
label: Source DB resource ID
@@
- id: section_version
label: Version
type: section
- - default: postgres
+ - applied_by:
+ - stack
+ default: postgres
id: engine
immutable: true
label: Engine
@@
value: sqlserver-ex
- label: SQL Server Web
value: sqlserver-web
- - description: "Examples: 15 for PostgreSQL or SQL Server, 8.0 for MySQL, 19 for Oracle."
+ - applied_by:
+ - stack
+ description: "Examples: 15 for PostgreSQL or SQL Server, 8.0 for MySQL, 19 for Oracle."
id: engine_major_version
immutable: true
label: Engine major version
placeholder: "15"
required: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: "Optional minor engine version appended to the major version. Example: major 15 and minor 4 becomes 15.4."
id: engine_minor_version
label: Engine minor version
placeholder: "4"
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Enable automatic minor engine version upgrades during the configured maintenance window.
id: minor_version_auto_upgrade_enabled
@@
- id: section_size
label: Size & Storage
type: section
- - default: db.t4g.micro
+ - applied_by:
+ - stack
+ default: db.t4g.micro
description: RDS instance size, such as db.t4g.micro or db.r6g.large.
id: instance_class
label: Instance class
placeholder: db.t4g.micro
required: true
type: string
- - default: 20
+ - applied_by:
+ - stack
+ default: 20
description: AWS supports increasing allocated storage after creation, but not reducing it in place.
id: allocated_storage
label: Allocated storage (GiB)
@@
min: 20
required: true
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 0
description: Upper limit for RDS storage autoscaling. Use 0 to disable. AWS can grow storage up to this limit, but storage cannot be reduced in place.
id: max_allocated_storage
@@
max: 65536
min: 0
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: gp3
id: storage_type
label: Storage type
@@
value: io2
- label: standard
value: standard
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
id: iops
label: Provisioned IOPS
max: 256000
@@
- io1
- io2
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
id: storage_throughput
label: Storage throughput (MiB/s)
max: 1000
@@
show_when:
storage_type: gp3
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
id: kms_key_id
immutable: true
label: Storage KMS key ARN
placeholder: arn:aws:kms:...
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
id: ca_cert_identifier
label: CA certificate identifier
required: false
@@
- id: section_access
label: Network access
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Keep disabled for production databases unless public access is intentional.
id: public_access_enabled
label: Publicly accessible
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Leave blank to use the engine default port.
id: port
label: Port
@@
min: 1
required: false
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
id: security_group_creation_enabled
immutable: true
label: Security group creation
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
id: security_group_id
label: Existing security group ID
placeholder: sg-...
@@
security_group_creation_enabled: false
type: string
- add_button_label: Add security group ID
+ applied_by:
+ - stack
collapsible: true
id: allowed_security_group_ids
label: Allowed security groups
@@
security_group_creation_enabled: true
type: string_array
- add_button_label: Add CIDR block
+ applied_by:
+ - stack
collapsible: true
id: allowed_cidr_blocks
label: Allowed CIDR blocks
@@
- sqlserver-ex
- sqlserver-web
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Create an RDS Proxy in front of the database for connection pooling and improved failover handling. Applications keep connecting to the database endpoint until you update their connection string to the proxy endpoint output.
id: proxy_creation_enabled
label: RDS Proxy
@@
- sqlserver-web
type: boolean
- add_button_label: Add secret ARN
+ applied_by:
+ - stack
collapsible: true
description: Secrets Manager secrets containing database credentials for the proxy. Leave blank to use the managed master user secret.
id: proxy_auth_secret_arns
@@
proxy_creation_enabled: true
type: string_array
- add_button_label: Add KMS key ARN
+ applied_by:
+ - stack
collapsible: true
description: KMS keys used to encrypt the auth secrets when using customer-managed keys. The master user secret KMS key is included automatically.
id: proxy_secret_kms_key_arns
@@
show_when:
proxy_creation_enabled: true
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Require IAM authentication for client connections to the proxy.
id: proxy_iam_auth_enabled
@@
show_when:
proxy_creation_enabled: true
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Require TLS for client connections to the proxy.
id: proxy_tls_requirement_enabled
@@
show_when:
proxy_creation_enabled: true
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Log detailed connection information, including SQL statements, to CloudWatch Logs.
id: proxy_debug_logging_enabled
@@
show_when:
proxy_creat
... diff truncated ...rvn-rds-proxy 0.1.0 -> 0.1.1--- remote
+++ compiled
inputs:
- - id: network
+ - applied_by:
+ - stack
+ id: network
immutable: true
label: VPC network
mapped_inputs:
- - id: section_aws
+ - applied_by: []
+ id: section_aws
label: AWS account & region
type: section
- - default: << ref.input.aws_account_id >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_account_id >>
id: aws_account_id
immutable: true
label: AWS account
type: string
values: $values:ravion/aws_accounts
- - default: << ref.input.aws_region >>
+ - applied_by:
+ - stack
+ default: << ref.input.aws_region >>
id: aws_region
immutable: true
label: Region
type: string
values: $values:aws/regions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: << ref.input.execution_environment_id >>
description: Override the VPC, subnet, and security group for Pipeline Terraform runners. Must use the same AWS account as selected above.
id: execution_environment_id
label: Terraform execution environment
type: string
values: $values:ravion/execution_environments
- - id: section_vpc
+ - applied_by: []
+ id: section_vpc
label: VPC
type: section
- - default: <<ref.stack.output.vpc_id>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.vpc_id>>
id: vpc_id
immutable: true
label: VPC ID
required: true
type: string
- add_button_label: Add private subnet ID
+ applied_by:
+ - stack
default: <<ref.stack.output.private_subnet_ids>>
description: Subnets for the RDS Proxy. Use private subnets for normal deployments.
id: subnet_ids
@@
- id: section_proxy
label: Proxy
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-proxy
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-proxy
description: Name prefix for all proxy resources.
id: name
immutable: true
@@
pattern: ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$
required: true
type: string
- - default: POSTGRESQL
+ - applied_by:
+ - stack
+ default: POSTGRESQL
description: Must match the engine of the target database.
id: engine_family
immutable: true
@@
- id: section_target
label: Target database
type: section
- - default: db_instance
+ - applied_by: []
+ default: db_instance
description: Register an RDS instance or an Aurora cluster as the proxy target.
id: target_type
label: Target type
@@
value: db_instance
- label: Aurora cluster
value: db_cluster
- - description: RDS database module to register as the proxy target. Add this proxy's security group to that module's allowed security groups so the database accepts proxy connections.
+ - applied_by:
+ - stack
+ description: RDS database module to register as the proxy target. Add this proxy's security group to that module's allowed security groups so the database accepts proxy connections.
id: rds_database
label: RDS database
mapped_inputs:
- - default: <<ref.stack.output.db_instance_identifier>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.db_instance_identifier>>
description: Instance identifier from the selected RDS module, or the identifier of an existing RDS instance.
id: rds_db_instance_identifier
label: DB instance identifier
placeholder: my-db
required: true
type: string
- - default: <<ref.stack.output.master_user_secret_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.master_user_secret_arn>>
description: Managed master user secret from the selected RDS module. Blank when that database does not manage its password in Secrets Manager; add auth secret ARNs instead.
id: rds_master_user_secret_arn
label: Master user secret ARN
placeholder: arn:aws:secretsmanager:...
required: false
type: string
- - default: <<ref.stack.output.port>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.port>>
description: Database port from the selected RDS module. Leave blank to use the engine family default port.
id: rds_port
label: Database port
@@
show_when:
target_type: db_instance
type: $ref:rvn-rds
- - description: Aurora cluster module to register as the proxy target. Add this proxy's security group to that module's allowed security groups so the cluster accepts proxy connections.
+ - applied_by:
+ - stack
+ description: Aurora cluster module to register as the proxy target. Add this proxy's security group to that module's allowed security groups so the cluster accepts proxy connections.
id: aurora_database
label: Aurora cluster
mapped_inputs:
- - default: <<ref.stack.output.cluster_identifier>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.cluster_identifier>>
description: Cluster identifier from the selected Aurora module, or the identifier of an existing Aurora cluster.
id: aurora_cluster_identifier
label: DB cluster identifier
placeholder: my-aurora
required: true
type: string
- - default: <<ref.stack.output.cluster_master_user_secret_arn>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.cluster_master_user_secret_arn>>
description: Managed master user secret from the selected Aurora module. Blank when that cluster does not manage its password in Secrets Manager; add auth secret ARNs instead.
id: aurora_master_user_secret_arn
label: Master user secret ARN
placeholder: arn:aws:secretsmanager:...
required: false
type: string
- - default: <<ref.stack.output.cluster_port>>
+ - applied_by:
+ - stack
+ default: <<ref.stack.output.cluster_port>>
description: Cluster port from the selected Aurora module. Leave blank to use the engine family default port.
id: aurora_port
label: Database port
@@
label: Authentication
type: section
- add_button_label: Add secret ARN
+ applied_by:
+ - stack
description: Secrets Manager secrets containing database credentials the proxy uses to connect to the target database. Leave blank to use the managed master user secret of the selected database module.
id: auth_secret_arns
label: Auth secret ARNs
@@
required: false
type: string_array
- add_button_label: Add KMS key ARN
+ applied_by:
+ - stack
collapsible: true
description: KMS keys used to encrypt the auth secrets when using customer-managed keys.
id: secret_kms_key_arns
@@
placeholder: arn:aws:kms:...
required: false
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Require IAM authentication for client connections to the proxy.
id: iam_auth_enabled
label: IAM authentication
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Require TLS for client connections to the proxy.
id: tls_requirement_enabled
label: Require TLS
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Create the IAM role the proxy uses to read credentials from Secrets Manager. Disable this only when you want to provide an existing role.
id: iam_role_creation_enabled
immutable: true
label: IAM role creation
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
id: iam_role_arn
label: Existing IAM role ARN
placeholder: arn:aws:iam::...
@@
- id: section_access
label: Network access
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: "Leave blank to use the port of the selected database module, or the engine family default port: 5432 for PostgreSQL, 3306 for MySQL, or 1433 for SQL Server."
id: port
label: Port
@@
min: 1
required: false
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
id: security_group_creation_enabled
immutable: true
label: Security group creation
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
id: security_group_id
label: Existing security group ID
placeholder: sg-...
@@
security_group_creation_enabled: false
type: string
- add_button_label: Add security group ID
+ applied_by:
+ - stack
collapsible: true
id: allowed_security_group_ids
label: Allowed security groups
@@
security_group_creation_enabled: true
type: string_array
- add_button_label: Add CIDR block
+ applied_by:
+ - stack
collapsible: true
id: allowed_cidr_blocks
label: Allowed CIDR blocks
@@
- id: section_pool
label: Connection pool
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 1800
id: idle_client_timeout
label: Idle client timeout (seconds)
max: 28800
min: 1
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 120
id: connection_borrow_timeout
label: Connection borrow timeout (seconds)
min: 0
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 100
description: Maximum size of the connection pool as a percentage of the database max_connections setting.
id: max_connections_percent
@@
max: 100
min: 1
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 50
description: Maximum idle connections kept open, as a percentage of the database max_connections setting.
id: max_idle_connections_percent
@@
min: 0
type: number
- add_button_label: Add filter
+ applied_by:
+ - stack
collapsible: true
id: session_pinning_filters
label: Session pinning filters
@@
values:
- label: EXCLUDE_VARIABLE_SETS
value: EXCLUDE_VARIABLE_SETS
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: SQL statements the proxy runs when opening each new database connection.
id: init_query
label: Initialization query
placeholder: SET time_zone = 'UTC'
required: false
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Log detailed connection information, including SQL statements, to CloudWatch Logs.
id: debug_logging_enabled
@@
- id: section_misc
label: Misc
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId`
id: tags
label: Tags
@@
- id: section_advanced
label: Terraform settings
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override the environment's default version for this module
id: opentofu_version
label: OpenTofu version override
required: false
type: string
... diff truncated ...rvn-route53 1.0.3 -> 1.0.4--- remote
+++ compiled
- id: section_aws
label: AWS account & region
type: section
- - id: aws_account_id
+ - applied_by:
+ - stack
+ id: aws_account_id
immutable: true
label: AWS account
required: true
type: string
values: $values:ravion/aws_accounts
- - id: aws_region
+ - applied_by:
+ - stack
+ id: aws_region
immutable: true
label: Region
required: true
@@
- id: section_hosted_zone
label: Hosted zone and name server
type: section
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Create a new Route 53 hosted zone, which is Route 53's DNS zone and name-server setup for a domain. Disable this to manage records in an existing hosted zone.
id: zone_creation_enabled
immutable: true
label: Create hosted zone
type: boolean
- - description: Existing Route 53 hosted zone ID to manage records in. A hosted zone is Route 53's DNS zone and name-server setup for a domain. Required when Create hosted zone is disabled.
+ - applied_by:
+ - stack
+ description: Existing Route 53 hosted zone ID to manage records in. A hosted zone is Route 53's DNS zone and name-server setup for a domain. Required when Create hosted zone is disabled.
id: zone_id
immutable: true
label: Hosted zone ID
@@
show_when:
zone_creation_enabled: false
type: string
- - description: Fully qualified domain name for the hosted zone.
+ - applied_by:
+ - stack
+ description: Fully qualified domain name for the hosted zone.
id: name
immutable: true
label: Domain name
@@
show_when:
zone_creation_enabled: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: Managed in Ravion
description: Comment stored on the hosted zone.
id: comment
@@
show_when:
zone_creation_enabled: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Destroy all records in the hosted zone when the created zone is destroyed.
id: record_force_destroy_enabled
@@
show_when:
zone_creation_enabled: true
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Reusable delegation set ID for a public hosted zone. Use this when you want multiple hosted zones to use the same authoritative name servers, for example to keep registrar or parent-zone delegation consistent across related domains.
id: delegation_set_id
label: Delegation set ID
@@
private_zone_enabled: false
zone_creation_enabled: true
type: string
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Create a private hosted zone associated with VPCs instead of a public hosted zone.
id: private_zone_enabled
immutable: true
@@
show_when:
zone_creation_enabled: true
type: boolean
- - description: VPCs to associate with the private hosted zone.
+ - applied_by:
+ - stack
+ description: VPCs to associate with the private hosted zone.
id: vpc_associations
item_inputs:
- - description: VPC ID to associate with the private hosted zone.
+ - applied_by:
+ - stack
+ description: VPC ID to associate with the private hosted zone.
id: vpc_id
label: VPC ID
patterns:
@@
placeholder: vpc-1234567890abcdef0
required: true
type: string
- - description: AWS region for the VPC association. Defaults to the stack region when empty.
+ - applied_by:
+ - stack
+ description: AWS region for the VPC association. Defaults to the stack region when empty.
id: vpc_region
label: VPC region
required: false
@@
- id: section_records
label: DNS records
type: section
- - description: DNS records to create in the hosted zone.
+ - applied_by:
+ - stack
+ description: DNS records to create in the hosted zone.
id: records
item_inputs:
- - description: DNS record type.
+ - applied_by:
+ - stack
+ description: DNS record type.
id: type
label: Record type
required: true
@@
value: TXT
- label: DS
value: DS
- - description: Fully qualified record name.
+ - applied_by:
+ - stack
+ description: Fully qualified record name.
id: name
label: Record name
placeholder: www.example.com
required: true
type: string
- - default: standard
+ - applied_by:
+ - stack
+ default: standard
description: Choose standard record values with a TTL, or an AWS alias target such as a load balancer or CloudFront distribution.
id: target_type
label: Target type
@@
label: Alias target
value: alias
- add_button_label: Add record value
+ applied_by:
+ - stack
description: Values for a standard DNS record. Leave empty for alias records.
id: records
label: Record values
@@
- CNAME
- SOA
type: string_array
- - description: Value for a standard DNS record type that accepts exactly one value.
+ - applied_by:
+ - stack
+ description: Value for a standard DNS record type that accepts exactly one value.
id: record_value
label: Record value
required: true
@@
- CNAME
- SOA
type: string
- - description: DNS name of the AWS target resource. For an ALB or NLB, use the load balancer DNS name. For CloudFront, use the distribution domain name such as d111111abcdef8.cloudfront.net.
+ - applied_by:
+ - stack
+ description: DNS name of the AWS target resource. For an ALB or NLB, use the load balancer DNS name. For CloudFront, use the distribution domain name such as d111111abcdef8.cloudfront.net.
id: alias_name
label: Alias target DNS name
placeholder: dualstack.example-alb.us-east-1.elb.amazonaws.com
@@
- A
- AAAA
type: string
- - description: Hosted zone ID of the AWS target resource, not this domain's hosted zone ID. For an ALB/NLB, use the load balancer canonical hosted zone ID from AWS. For CloudFront, use Z2FDTNDATAQYW2. Regional services such as API Gateway or S3 website endpoints have service and region-specific hosted zone IDs.
+ - applied_by:
+ - stack
+ description: Hosted zone ID of the AWS target resource, not this domain's hosted zone ID. For an ALB/NLB, use the load balancer canonical hosted zone ID from AWS. For CloudFront, use Z2FDTNDATAQYW2. Regional services such as API Gateway or S3 website endpoints have service and region-specific hosted zone IDs.
id: alias_zone_id
label: Alias target hosted zone ID
placeholder: Z35SXDOTRQ7X7K
@@
- A
- AAAA
type: string
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Let Route 53 consider the target resource health when answering DNS queries. This is commonly useful for load balancers. Leave disabled for targets that do not support Route 53 target health evaluation, such as CloudFront.
id: alias_evaluate_target_health
label: Evaluate target health
@@
- A
- AAAA
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Route 53 health check ID for this record.
id: health_check_id
label: Health check ID
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Allow this record to overwrite an existing Route 53 record.
id: allow_overwrite
label: Allow overwrite
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: 300
description: TTL in seconds for standard records. Lower values update faster but can increase DNS query volume; 300 seconds is a common default.
id: ttl
@@
target_type:
not: alias
type: number
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: simple
description: Optional Route 53 routing policy for this record.
id: routing_policy
@@
- description: Return multiple healthy records in DNS responses. Use this for simple DNS-level load distribution across several endpoints.
label: Multivalue answer
value: multivalue
- - description: Unique identifier for a record that uses a routing policy. Required when multiple records share the same name and type.
+ - applied_by:
+ - stack
+ description: Unique identifier for a record that uses a routing policy. Required when multiple records share the same name and type.
id: set_identifier
label: Set identifier
required: true
@@
routing_policy:
not: simple
type: string
- - description: Weight for weighted routing.
+ - applied_by:
+ - stack
+ description: Weight for weighted routing.
id: weighted_routing_policy_weight
label: Weight
min: 0
@@
show_when:
routing_policy: weighted
type: number
- - description: Failover role for failover routing.
+ - applied_by:
+ - stack
+ description: Failover role for failover routing.
id: failover_routing_policy_type
label: Failover type
required: true
@@
value: PRIMARY
- label: Secondary
value: SECONDARY
- - description: AWS region for latency routing.
+ - applied_by:
+ - stack
+ description: AWS region for latency routing.
id: latency_routing_policy_region
label: Latency region
required: true
@@
routing_policy: latency
type: string
values: $values:aws/regions
- - description: Continent code for geolocation routing.
+ - applied_by:
+ - stack
+ description: Continent code for geolocation routing.
id: geolocation_routing_policy_continent
label: Continent code
placeholder: NA
show_when:
routing_policy: geolocation
type: string
- - description: Country code for geolocation routing.
+ - applied_by:
+ - stack
+ description: Country code for geolocation routing.
id: geolocation_routing_policy_country
label: Country code
placeholder: US
show_when:
routing_policy: geolocation
type: string
- - description: Subdivision code for geolocation routing.
+ - applied_by:
+ - stack
+ description: Subdivision code for geolocation routing.
id: geolocation_routing_policy_subdivision
label: Subdivision code
placeholder: CA
@@
show_when:
private_zone_enabled: false
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Enable Route 53 query logging for the public hosted zone.
id: query_logging_enabled
label: Query logging
show_when:
private_zone_enabled: false
type: boolean
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Create the CloudWatch Logs log group and resource policy in us-east-1 for Route 53 query logs.
id: query_log_gr
... diff truncated ...rvn-s3 1.0.1 -> 1.0.2--- remote
+++ compiled
- id: section_aws
label: AWS account & region
type: section
- - id: aws_account_id
+ - applied_by:
+ - stack
+ id: aws_account_id
immutable: true
label: AWS account
required: true
type: string
values: $values:ravion/aws_accounts
- - id: aws_region
+ - applied_by:
+ - stack
+ id: aws_region
immutable: true
label: Region
required: true
@@
- id: section_bucket
label: Bucket
type: section
- - default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
+ - applied_by:
+ - stack
+ default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
description: Globally unique S3 bucket name.
id: name
immutable: true
@@
pattern: ^(?!xn--)(?!.*-s3alias$).*$
required: true
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: false
description: Delete the bucket even when it contains objects. Use with caution.
id: force_destroy_enabled
@@
- id: section_public_access
label: Public access block
type: section
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Block public ACLs for this bucket.
id: block_public_acls
label: Block public ACLs
type: boolean
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Block public bucket policies for this bucket.
id: block_public_policy
label: Block public policies
type: boolean
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Ignore public ACLs on this bucket and its objects.
id: ignore_public_acls
label: Ignore public ACLs
type: boolean
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Restrict public bucket policies to AWS service principals and authorized users in this account.
id: restrict_public_buckets
label: Restrict public buckets
@@
- id: section_encryption
label: Encryption
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Optional AWS KMS key ID or ARN for SSE-KMS. Leave empty to use SSE-S3 AES256 encryption.
id: kms_key_id
label: KMS key ID
placeholder: arn:aws:kms:us-east-1:123456789012:key/abc-123
type: string
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: true
description: Enable S3 Bucket Keys for SSE-KMS to reduce KMS request costs. Applies only when KMS key ID is set.
id: bucket_key_enabled
@@
- id: section_versioning
label: Versioning
type: section
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Keep multiple versions of objects in the bucket.
id: versioning_enabled
label: Versioning
@@
- id: section_lifecycle
label: Lifecycle rules
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: []
description: Configure common lifecycle rules with form fields. Use advanced lifecycle rules below for multiple transitions, tag filters, or less common combinations.
id: lifecycle_rule_forms
item_inputs:
- - description: Unique identifier for this lifecycle rule. Use letters, numbers, periods, underscores, or hyphens.
+ - applied_by:
+ - stack
+ description: Unique identifier for this lifecycle rule. Use letters, numbers, periods, underscores, or hyphens.
id: id
label: Rule ID
patterns:
@@
pattern: ^[A-Za-z0-9._-]{1,255}$
required: true
type: string
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Whether this lifecycle rule is enabled.
id: enabled
label: Enabled
type: boolean
- - description: Object key prefix matched by this rule. Leave empty to apply to the whole bucket.
+ - applied_by:
+ - stack
+ description: Object key prefix matched by this rule. Leave empty to apply to the whole bucket.
id: prefix
label: Prefix
required: false
type: string
- - description: Days after object creation when current versions expire.
+ - applied_by:
+ - stack
+ description: Days after object creation when current versions expire.
id: expiration_days
label: Expiration days
min: 1
required: false
type: number
- - description: Date when current versions expire, in YYYY-MM-DD format. Use either expiration days or expiration date, not both.
+ - applied_by:
+ - stack
+ description: Date when current versions expire, in YYYY-MM-DD format. Use either expiration days or expiration date, not both.
id: expiration_date
label: Expiration date
patterns:
@@
pattern: ^\d{4}-\d{2}-\d{2}$
required: false
type: string
- - default: false
+ - applied_by:
+ - stack
+ default: false
description: Expire delete markers when they are the only remaining version.
id: expiration_expired_object_delete_marker_enabled
label: Expire delete markers
type: boolean
- - description: Days after an object becomes noncurrent when noncurrent versions expire.
+ - applied_by:
+ - stack
+ description: Days after an object becomes noncurrent when noncurrent versions expire.
id: noncurrent_version_expiration_days
label: Noncurrent expiration days
min: 1
required: false
type: number
- - description: Number of newer noncurrent versions to retain before noncurrent expiration applies.
+ - applied_by:
+ - stack
+ description: Number of newer noncurrent versions to retain before noncurrent expiration applies.
id: noncurrent_version_newer_noncurrent_versions
label: Newer noncurrent versions to retain
min: 1
required: false
type: number
- - description: Storage class for a current version transition.
+ - applied_by:
+ - stack
+ description: Storage class for a current version transition.
id: transition_storage_class
label: Transition storage class
required: false
@@
value: DEEP_ARCHIVE
- label: Glacier Instant Retrieval
value: GLACIER_IR
- - description: Days after object creation when the current version transitions.
+ - applied_by:
+ - stack
+ description: Days after object creation when the current version transitions.
id: transition_days
label: Transition days
required: false
type: number
- - description: Date when current versions transition, in YYYY-MM-DD format. Use either transition days or transition date, not both.
+ - applied_by:
+ - stack
+ description: Date when current versions transition, in YYYY-MM-DD format. Use either transition days or transition date, not both.
id: transition_date
label: Transition date
patterns:
@@
pattern: ^\d{4}-\d{2}-\d{2}$
required: false
type: string
- - description: Storage class for a noncurrent version transition.
+ - applied_by:
+ - stack
+ description: Storage class for a noncurrent version transition.
id: noncurrent_transition_storage_class
label: Noncurrent transition storage class
required: false
@@
value: DEEP_ARCHIVE
- label: Glacier Instant Retrieval
value: GLACIER_IR
- - description: Days after an object becomes noncurrent when it transitions.
+ - applied_by:
+ - stack
+ description: Days after an object becomes noncurrent when it transitions.
id: noncurrent_transition_days
label: Noncurrent transition days
required: false
type: number
- - description: Number of newer noncurrent versions to retain before noncurrent transition applies.
+ - applied_by:
+ - stack
+ description: Number of newer noncurrent versions to retain before noncurrent transition applies.
id: noncurrent_transition_newer_noncurrent_versions
label: Newer noncurrent versions before transition
required: false
type: number
- - description: Days after initiation when incomplete multipart uploads are aborted.
+ - applied_by:
+ - stack
+ description: Days after initiation when incomplete multipart uploads are aborted.
id: abort_incomplete_multipart_upload_days
label: Abort incomplete multipart uploads days
min: 1
@@
label: Lifecycle rules
required: false
type: object_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: []
description: Advanced lifecycle rules in the Terraform lifecycle rule shape. Use this for tag filters, multiple transitions, or other combinations not covered by the form above.
id: lifecycle_rules_raw
@@
label: Bucket policy
type: section
- add_button_label: Add policy template
+ applied_by:
+ - stack
default: []
description: Prebuilt bucket policy statements to add.
id: policy_templates
@@
label: CloudFront OAC read
value: cloudfront_oac_read
- add_button_label: Add distribution ARN
+ applied_by:
+ - stack
collapsible: true
default: []
description: CloudFront distribution ARNs allowed to read objects when the CloudFront OAC read policy template is selected.
@@
pattern: ^arn:aws:cloudfront::[0-9]{12}:distribution/[A-Z0-9]+$
required: false
type: string_array
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Custom bucket policy JSON document. If policy templates are also selected, statements are merged.
id: custom_policy
label: Custom policy JSON
@@
- id: section_cors
label: CORS
type: section
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: []
description: Configure Cross-Origin Resource Sharing rules for browser access to bucket objects.
id: cors_rules
item_inputs:
- - description: Optional unique identifier for this CORS rule.
+ - applied_by:
+ - stack
+ description: Optional unique identifier for this CORS rule.
id: id
label: Rule ID
required: false
type: string
- add_button_label: Add allowed origin
+ applied_by:
+ - stack
description: Origins allowed to make cross-origin requests to this bucket.
id: allowed_origins
label: Allowed origins
@@
required: true
type: string_array
- add_button_label: Add allowed method
+ applied_by:
+ - stack
description: HTTP methods allowed for cross-origin requests.
id: allowed_methods
label: Allowed methods
@@
- label: DELETE
value: DELETE
- add_button_label: Add allowed header
+ applied_by:
+ - stack
collapsible: true
default: []
description: Request headers allowed in cross-origin requests. Use * to allow any header.
@@
required: false
type: string_array
- add_button_label: Add exposed header
+ applied_by:
+ - stack
collapsible: true
default: []
description: Response headers browsers may expose to client code.
@@
label: Exposed headers
required: false
type: string_array
- - collapsible: true
+
... diff truncated ...rvn-stack 1.2.4 -> 1.2.5--- remote
+++ compiled
- id: section_aws
label: Where to run Terraform plan & apply
type: section
- - description: Where to execute the Terraform plan & apply steps
+ - applied_by:
+ - stack
+ description: Where to execute the Terraform plan & apply steps
id: aws_account_id
label: AWS Account
required: true
@@
default_networking: true
type: string
values: $values:ravion/aws_accounts
- - default: true
+ - applied_by:
+ - stack
+ default: true
id: default_networking
label: Use default VPC, subnet and security group
type: boolean
- - description: Where to execute the Terraform plan & apply steps
+ - applied_by:
+ - stack
+ description: Where to execute the Terraform plan & apply steps
id: aws_region
label: Region
required: true
@@
default_networking: true
type: string
values: $values:aws/regions
- - description: Specify the VPC, subnet, and security group for Pipeline Terraform runners. Defaults to the Environment's default Execution Environment
+ - applied_by:
+ - stack
+ description: Specify the VPC, subnet, and security group for Pipeline Terraform runners. Defaults to the Environment's default Execution Environment
id: execution_environment_id
label: Execution environment
required: false
@@
- id: section_source
label: Source code
type: section
- - id: repo
+ - applied_by:
+ - stack
+ id: repo
label: Git repository
placeholder: https://github.com/org/repo.git
required: true
type: gitrepo
- - default: main
+ - applied_by:
+ - stack
+ default: main
id: primary_branch
label: Primary branch
required: true
type: string
- - description: Folder containing your Terraform files (relative to repo root)
+ - applied_by:
+ - stack
+ description: Folder containing your Terraform files (relative to repo root)
id: base_path
label: Base path
placeholder: terraform
type: string
- add_button_label: Add path
+ applied_by:
+ - stack
default:
- <<module.input.base_path>>/**
description: File paths glob patterns (e.g., `src/**`) that trigger a pipeline run when changed. Defaults to `**`
@@
label: Stack inputs
type: section
- add_button_label: Add variable file
+ applied_by:
+ - stack
description: Relative paths from base path to `.tfvars` or `.tfvars.json` files (equivalent to -var-file flags)
id: terraform_variable_files
label: Terraform variable files
placeholder: prod.tfvars
type: string_array
- - description: Variables passed to Terraform/OpenTofu (equivalent to -var flags)
+ - applied_by:
+ - stack
+ description: Variables passed to Terraform/OpenTofu (equivalent to -var flags)
id: tf_variables
label: Terraform variables
placeholder: key/value format
type: object
- - id: env_variables
+ - applied_by:
+ - stack
+ id: env_variables
label: Environment variables
placeholder: key/value format with support for from_parameter_store and from_secrets_manager
type: object
- id: section_iac
label: IaC tool
type: section
- - default: opentofu
+ - applied_by:
+ - stack
+ default: opentofu
description: Terraform is no longer free open source. OpenTofu is the popular community fork with full Terraform compatibility.
id: tool
label: Tool
@@
value: opentofu
- label: Terraform (FOSS, limited < v1.6.0)
value: terraform
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: $values:first
id: terraform_version
label: Terraform version
@@
tool: terraform
type: string
values: $values:terraform/versions
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
default: $values:first
id: opentofu_version
label: OpenTofu version
@@
tool: opentofu
type: string
values: $values:opentofu/versions
- - default: true
+ - applied_by:
+ - stack
+ default: true
description: Use Ravion-managed state. Your Terraform configuration must include an empty `terraform { cloud {} }` block; Ravion supplies the workspace configuration. Disable to use your own backend, including S3 or Terraform Cloud.
id: use_ravion_state_backend
immutable: true
label: Use Ravion for your Terraform state
type: boolean
- - collapsible: true
+ - applied_by:
+ - stack
+ collapsible: true
description: Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
id: ravion_state_backend_workspace
immutable: true |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| return; | ||
| } | ||
| if (typeof value === "string") { | ||
| const referencePattern = /\bmodule\.input\.([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*)/g; |
There was a problem hiding this comment.
When the ECS NLB definition uses module.input.listeners[0].…, this pattern captures only listeners; the parent then passes both stack and deploy phases to every child, causing stack-only TLS fields such as tls_certificate to be stamped with applies_on: ["stack", "deploy"] and incorrectly recommend or initiate a deploy when changed.
Knowledge Base Used: Terraform Stack module and shared partials
Prompt To Fix With AI
This is a comment left during a code review.
Path: tools/ravion-modules/src/compiler.ts
Line: 135
Comment:
**Indexed references over-attribute phases**
When the ECS NLB definition uses `module.input.listeners[0].…`, this pattern captures only `listeners`; the parent then passes both stack and deploy phases to every child, causing stack-only TLS fields such as `tls_certificate` to be stamped with `applies_on: ["stack", "deploy"]` and incorrectly recommend or initiate a deploy when changed.
**Knowledge Base Used:** [Terraform Stack module and shared partials](https://app.greptile.com/flightcontrol/-/custom-context/knowledge-base/ravionhq/modules/-/docs/stack-and-partials.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
devin-ai-integration
Bot
force-pushed
the
devin/1786224974-derive-applies-on
branch
from
August 8, 2026 22:11
9cfbcdb to
eea4fad
Compare
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
Co-Authored-By: brandon <brandon@flightcontrol.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Derives per-input
applies_on(stack/build/deploy) in the modules compiler, so every compiled definition says what a change to each input actually requires. Flightcontrol #6879 adds the schema field; #6881/#6883 consume this metadata in the API, CLI and UI.Derivation runs after
$include/$merge/$template/$withresolution and scansmodule.stack,module.build,module.deployfor references to each input, unioning the phases it finds.[]means "referenced by none of those sections", which is deliberately different from absent metadata (a definition published before this existed) — consumers treat the first as "nothing to do" and the second as "unknown".The attribution rules are where the subtlety lives, and getting them wrong silently mis-advises users:
module.input.listeners[0].tls_certificategiveslisteners.tls_certificate→["stack"]rather than dragging every listener child up to the parent's["stack","deploy"];#.fieldelement expressions bind to the collection of the enclosingmap(module.input.<collection>, ...)(innermost when nested), while plain references in the same string keep their own attribution;mapped_inputs— arbitraryitem_inputschildren collide on names likename/enabled, so an ambiguous ID gets no attribution and a warning instead of a wrong one.Authored
applies_onis preserved and overrides derivation; a superset is allowed silently and an override that omits a derived phase warns.Two authored overrides, because static derivation can only see references. Where a value reaches the running app through a deploy-time step behind a stack-only reference, derivation under-reports — which is the one failure mode this feature must not have:
rvn-ec2-serviceruntimeenvironment_variables/secrets→[stack, deploy]: the env file is re-rendered at boot and on every deploy, so a running instance doesn't see new values from a stack update alone.rvn-aws-staticbuild_environment_variables→[build, deploy]: the build uploads to a versioned S3 prefix, and a separate deploy flips the CloudFront KeyValueStoreactivekey (seeiam_deploy.tf/cloudfront_kvs.tf), so a rebuild alone doesn't go live.ECS web/NLB (
["deploy"]for runtime env/secrets), Lambda (["stack"], runtime config is stack-managed) and the remaining definitions were checked and derive correctly.Also documents the field for authors in
.agents/skills/module-definition-config/SKILL.md(alongsideInput Immutability), including when to author an override and how to read a specific input's derived phases, with a pointer fromAGENTS.md.Definition releases are patch-bumped where compiled output changed, and the README version table is regenerated. Note the publish dry-run cannot pass until #6879 is deployed — until then
api.ravion.comrejects the new field with422 "applies_on": "field is not allowed".Link to Devin session: https://app.devin.ai/sessions/a32da8ecb942427eb0e38330c7ff8294
Requested by: @flybayer