ECS Optional Features

bedrock_auto_model_access = true
bedrock_region            = "" # empty → deployment region

# Self-managed installs: override before first successful auto-submit
# (form is submit-once and permanent). Defaults name "Runlayer".
bedrock_model_access_company_name    = "Example Corp"
bedrock_model_access_company_website = "https://example.com"
bedrock_model_access_industry        = "Technology"
bedrock_model_access_intended_users  = 100

# Custom agents only — not required for Runlayer Assistant
enable_bedrock_anthropic_models = false
# anthropic_api_key = var.anthropic_api_key  # via TF_VAR_*
# platform_llm_trial_default_budget_usd = "50"

distribution_api_key = var.distribution_api_key
distribution_api_url = "https://distribution.prod.runlayer.com"
openfeature_provider = "flagd"

additional_backend_env_vars = {
  FF_ENABLE = "gzip-hooks,zstd-hooks"
}

distribution_registry_bucket  = "mcp-catalog"
distribution_registry_source  = "runlayer-customer-deployments"
distribution_target_id        = "managed-aws:<your-account-id>"
distribution_configuration_id = "<uuid-from-runlayer>"

enable_runlayer_agents             = true
enable_runlayer_agentcore_runtime  = true
enable_runlayer_tool_guard         = true
enable_runlayer_topic_cpu          = false
enable_runlayer_rev                = false # separate GPU decision-model service
enable_runlayer_cimd               = true
enable_runlayer_deploy_healthcheck = false
# runlayer_deploy_use_shared_sg = false
# runlayer_deploy_use_shared_task_role = false

# ToolGuard sizing (when enable_runlayer_tool_guard = true)
# runlayer_tool_guard_desired_count = 2
# runlayer_tool_guard_max_count = 4
# runlayer_tool_guard_timeout = 30   # deprecated for enforcement scans (use the workspace scan latency budget); still sets the tool-list/analyze/models timeout
# runlayer_tool_guard_gpu_resource_value = "ALL"  # required for g6f.* fractional GPUs
# runlayer_tool_guard_scaling_profile = "conservative" # balanced | aggressive
# runlayer_tool_guard_predictive_scaling_mode = null # disabled | forecast_only | forecast_and_scale (default follows profile)

enable_audit_log_kinesis    = true
audit_log_write_target      = "kinesis"
enable_audit_log_s3_archive = true
# S3 archive alone keeps Aurora hot-window size bounded (default
# audit_log_archive_hot_window_days = 90). Kinesis is only for SIEM export of
# full audit metadata — enable when you have a consumer ready.
audit_log_kinesis_consumer_config = {
  enabled       = true
  desired_count = 1
}

enable_audit_payload_offload = true
enable_audit_log_spool       = true
enable_toolguard_feedback    = true
enable_tool_output_offload   = false

# Separate Sentry DSN for sandbox errors (does not reuse backend sentry_dsn)
# Pass via TF_VAR / secrets backend — never commit
runlayer_agent_sandbox_sentry_dsn = var.agent_sandbox_sentry_dsn

# Optional image overrides
# runlayer_agent_sandbox_image_uri = "123456789012.dkr.ecr.us-east-1.amazonaws.com/runlayer/agent-sandbox:1.28.162"
# With WAF IP allowlisting, use VPC + PrivateLink (not PUBLIC):
# enable_privatelink              = true
# runlayer_agentcore_network_mode = "VPC"
# runlayer_agentcore_consumer_vpc_id = "vpc-xxxxx"
# runlayer_agentcore_consumer_private_subnet_ids = ["subnet-xxxxx", "subnet-yyyyy"]
# runlayer_agentcore_max_lifetime_seconds = 3600
# runlayer_agentcore_idle_timeout_seconds = 900

# Per-agent network access policies (requires VPC mode). Roll out in order:
# 1. VPC mode with direct egress left on (the defaults above).
# 2. sandbox_egress_mode = "proxy"                  # proxy runs, nothing routes through it yet
# 3. Turn the sandbox-egress-proxy feature flag on for every organization, for example
#    additional_backend_env_vars = { FF_ENABLE = "<flags already forced>,sandbox-egress-proxy" }
#    and wait for the backend rollout to finish before step 4.
# 4. sandbox_egress_mode = "proxy_only"             # proxy becomes the only path for every run; skipping
#    step 3 costs organizations without the flag a few minutes of sandbox internet while the backend rolls out
# sandbox_egress_proxy_egress_ports = [443, 8443]    # 443 is always open; add ports that host:port policies may use
# sandbox_egress_proxy_image_uri    = "…/runlayer/sandbox-egress-proxy:1.28.500"

enable_llm_gateway            = true
llm_gateway_listener_priority = 12
# llm_gateway_image_uri = "123456789012.dkr.ecr.us-east-1.amazonaws.com/runlayer/llm-gateway:1.28.162"
# Pass via TF_VAR_llm_gateway_runlayer_api_key — never commit
# llm_gateway_runlayer_api_key = var.llm_gateway_runlayer_api_key

# ms_teams_app_client_secret = var.ms_teams_app_client_secret  # via TF_VAR_*

additional_backend_env_vars = {
  MS_TEAMS_APP_CLIENT_ID         = "00000000-0000-0000-0000-000000000000"
  MS_TEAMS_RUNLAYER_TENANT_ID    = "00000000-0000-0000-0000-000000000000"
  MS_TEAMS_AZURE_SUBSCRIPTION_ID = "00000000-0000-0000-0000-000000000000"
  MS_TEAMS_AZURE_RESOURCE_GROUP  = "runlayer-ms-teams-bots"
}

enable_hook_events_pipeline = true
# hook_events_alert_email = "ops@example.com"

enable_audit_log_siem_export = true
# Write to your bucket (or omit external_* to use the Runlayer-managed bucket)
# audit_log_siem_export_external_s3_bucket = "acme-audit-siem"
# audit_log_siem_export_external_s3_region = "us-east-1"
# audit_log_siem_export_assume_role_arn    = "arn:aws:iam::123456789012:role/siem-writer"
# audit_log_siem_export_external_id        = "REPLACE_ME"
# audit_log_siem_export_s3_prefix          = "runlayer/audit"
# audit_log_siem_export_read_role_arns     = ["arn:aws:iam::123456789012:role/siem-reader"]

# session_siem_export_kinesis_consumer_config = { enabled = true, desired_count = 1 }
# session_siem_export_external_s3_bucket = "acme-session-siem"
# sessions_read_from_postgres = false
# session_materializer_config = { enabled = true, desired_count = 1 }

# data_export_bucket_arn = "arn:aws:s3:::acme-hook-events-export"

enable_binary_package_distribution = true
# runlayer_download_token = var.runlayer_download_token  # via TF_VAR_*
# runlayer_downloads_base_url = "https://downloads.example.com"

otel_exporter_otlp_metrics_endpoint = "https://otel.example.com:4317"
otel_exporter_otlp_metrics_protocol = "grpc"
otel_service_name                   = "runlayer-backend"

otel_collector_config = {
  enabled         = true
  export_endpoint = "otel-collector.example.com:4317" # your collector; not localhost
  export_insecure = false
}

flow_metrics_collection_enabled      = true
flow_trace_adaptive_sampling_enabled = true

# Prefer TF_VAR_* / a secrets backend — do not commit values
# secret_key  = var.secret_key   # must pair with master_salt, or omit both
# master_salt = var.master_salt
# sentry_dsn  = var.sentry_dsn
mcp_catalog_api_key = var.mcp_catalog_api_key # required for catalog / onboarding
# distribution_api_key = var.distribution_api_key

mcp_catalog_api_url = "" # empty → backend default

frontend_sentry_dsn                = ""
frontend_sentry_traces_sample_rate = "0.1"
sentry_audit_events_enabled        = true
sentry_relay_enabled               = true
# sentry_relay_upstream = "https://sentry.example.com/"
# sentry_relay_config   = { ... }

oauth_broker_url = "" # empty → module default when broker is used
# oauth_client_registration_rate_limit_per_hour = 1000

customer_id     = "acme"
deployment_name = "staging"
infra_version   = "v33.1.0"