ECS + Terraform

database_name     = "anysource_prod"
database_username = "postgres"        # Database master username
database_config = {
  engine_version      = "16.6"        # PostgreSQL version
  min_capacity       = 4              # Min Aurora capacity (ACUs)
  max_capacity       = 32             # Max Aurora capacity (ACUs)
  publicly_accessible = false         # Keep private (recommended)
  backup_retention   = 30             # Backup retention days
  subnet_type        = "private"      # Use private subnets
}

external_database = {
  host            = "postgres.internal.example.com"
  reader_host     = "postgres-reader.internal.example.com" # optional
  port            = 5432
  database        = "runlayer"
  username        = "runlayer"
  ssl_mode        = "require"
}
external_database_password = var.external_db_password

external_redis = {
  host        = "valkey.internal.example.com"
  port        = 6379
  tls_enabled = true
}
external_redis_password = var.external_redis_password

alb_access_type = "public"            # "public" or "private"
alb_allowed_cidrs = [                 # Security group IPv4 ranges
  "0.0.0.0/0"                        # Internet (change for security)
  # "203.0.113.0/24",                # Your office IPs
  # "198.51.100.0/24"                # Your VPN IPs
]
alb_allowed_ipv6_cidrs = ["::/0"]    # Security group IPv6 ranges (default: all)

# WAF IP Allowlisting (recommended for production)
waf_enable_ip_allowlisting = true     # Enable WAF-based IP filtering
waf_allowlist_ipv4_cidrs = [          # Allowed IPv4 CIDR blocks
  "203.0.113.0/24",                   # Office network
  "198.51.100.42/32",                 # Specific IP address
]
waf_allowlist_ipv6_cidrs = [          # Allowed IPv6 CIDR blocks
  "2001:db8::/48",                    # Office IPv6 range
]

# SSL Certificate options (choose one):

# Option 1: Look up existing wildcard certificate (DEFAULT)
# Module derives wildcard from domain: ai.prod.yourcompany.com → *.prod.yourcompany.com
hosted_zone_name = "prod.yourcompany.com"  # Used for DNS records and certificate lookup

# Option 2: Create new wildcard certificate with DNS validation
enable_acm_dns_validation = true           # Creates new cert instead of lookup
hosted_zone_name = "prod.yourcompany.com"  # Required for Route53 validation

# Option 3: Use specific certificate ARN (bypasses module)
ssl_certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/xxx"

# DNS record control (separate from certificate management)
create_dns_records = true  # Creates Route53 ALIAS record pointing domain to ALB (default: false)

# Enable dual ALB for split-horizon DNS
# Public ALB for internet traffic + Internal ALB for private network traffic
enable_dual_alb = true

# Optional: Use an existing private hosted zone
private_hosted_zone_id = "Z1234567890ABC"

# Optional: Associate with a specific VPC (defaults to service VPC)
private_hosted_zone_vpc_id = "vpc-1234567890abcdef0"

# Optional: Associate with additional VPCs (for VPC peering scenarios)
private_hosted_zone_additional_vpc_ids = [
  "vpc-0987654321fedcba0",  # Peered VPC 1
  "vpc-1111222233334444",   # Peered VPC 2
]

# Optional: Allow additional CIDRs to reach the internal ALB
# Useful for VPN, Transit Gateway, or other private networks
# that are not in the VPC or peered VPCs
alb_internal_allowed_cidrs = [
  "10.200.0.0/16",  # Corporate VPN
]
alb_internal_allowed_ipv6_cidrs = [
  "fd00::/64",      # Internal IPv6 range
]

# Accept and configure VPC peering connections
vpc_peering_connections = {
  "customer-vpc" = {
    peering_connection_id = "pcx-0abc123def456"  # VPC peering connection ID from the initiating side
    peer_vpc_cidr         = "172.16.0.0/16"      # CIDR block of the peer VPC
    peer_owner_id         = "123456789012"        # AWS account ID of the peer (REQUIRED)
    peer_region           = "us-east-1"           # AWS region of the peer (optional)
  }
}

# Optional: For dual ALB setup, associate private hosted zone with peered VPC
enable_dual_alb = true
private_hosted_zone_additional_vpc_ids = ["vpc-customer123"]

services_configurations = {
  "backend" = {
    desired_count     = 3             # Number of instances
    min_capacity      = 2             # Min for auto-scaling
    max_capacity      = 10            # Max for auto-scaling
    cpu              = 2048           # CPU units (1024 = 1 vCPU)
    memory           = 4096           # Memory in MB

    # Auto-scaling thresholds
    cpu_auto_scalling_target_value    = 70    # Scale at 70% CPU
    memory_auto_scalling_target_value = 80    # Scale at 80% memory
  }

  "frontend" = {
    desired_count = 2
    cpu          = 512
    memory       = 1024
  }
}

cidr = "10.0.0.0/16" # VPC CIDR block
region_az = ["us-east-1a", "us-east-1b", "us-east-1c"]
public_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
private_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
database_subnets = ["10.0.7.0/24", "10.0.8.0/24", "10.0.9.0/24"]

# Enable CloudWatch monitoring and alerting
enable_monitoring = true              # Create CloudWatch alarms
slack_channel_id = "C1234567890"      # Your #alerts channel ID (enables Slack alerts)
slack_team_id = "T1234567890"         # Your Slack workspace ID

# ECS Container Insights: omit or set null to use the environment default
# (production → "enabled", staging/development → "disabled"). Override with
# "enhanced", "enabled", or "disabled" when needed.
container_insights = "enabled"

rds_alarm_config = {
  FreeableMemory = {
    period    = 300
    threshold = 268435456 # 256MB
    unit      = "Bytes"
  }
  DiskQueueDepth = {
    period    = 300
    threshold = 5
    unit      = "Count"
  }
  WriteIOPS = {
    period    = 300
    threshold = 1000
    unit      = "Count"
  }
  ReadIOPS = {
    period    = 300
    threshold = 1000
    unit      = "Count"
  }
  Storage = {
    period    = 300
    threshold = 107374182400 # 100GB
    unit      = "Bytes"
  }
}

# ALB 5XX error monitoring
alb_5xx_alarm_period    = 300  # 5 minute period
alb_5xx_alarm_threshold = 1    # Alert on any 5XX error

# Environment Variables

env_vars = {
ENVIRONMENT = "production"
COMPANY = "YourCompany"
}

# Optional: Lambda memory for Agent Sandbox Runner (default: 4096 MB)
# Some AWS accounts cap at 3008 MB; valid range: 128–10240
runlayer_agent_sandbox_memory_size = 4096

# Optional: restrict Agent Sandbox Lambda egress at the security group.
# Defaults to all IPv4/IPv6 egress. Set [] to deny all egress.
agent_sandbox_security_group_egress_rules = [
  {
    description      = "Allow HTTPS to approved network"
    from_port        = 443
    to_port          = 443
    protocol         = "tcp"
    cidr_blocks      = ["10.0.0.0/16"] # pragma: allowlist secret
    ipv6_cidr_blocks = []
    prefix_list_ids  = []
    security_groups  = []
  }
]

# Check if wildcard certificate exists
aws acm list-certificates --query "CertificateSummaryList[?contains(DomainName, '*')]"

# The module derives: your-domain.example.com → *.example.com
# Ensure a certificate exists for the wildcard domain

# Check certificate status
aws acm describe-certificate --certificate-arn your-cert-arn

# Verify DNS records exist
dig _acme-challenge.your-domain.com CNAME

# Check target group health
aws elbv2 describe-target-health --target-group-arn your-tg-arn

# Check ECS service status
aws ecs describe-services --cluster anysource-production

# Check CloudWatch alarms exist
aws cloudwatch describe-alarms --state-value ALARM

# Check alarm actions and thresholds
aws cloudwatch describe-alarms --alarm-names "your-alarm-name"