ECS + Terraform

database_name     = "anysource"
database_username = "postgres"
database_config = {
  engine_version      = "16"
  min_capacity        = 4   # ACUs, not an instance class
  max_capacity        = 32
  publicly_accessible = false
  backup_retention    = 30
}

external_database = {
  host            = "postgres.internal.example.com"
  reader_host     = "postgres-reader.internal.example.com" # optional
  port            = 5432
  database        = "runlayer"
  username        = "runlayer"
  ssl_mode        = "require"
}
external_database_password = var.external_db_password

external_redis = {
  host        = "valkey.internal.example.com"
  port        = 6379
  tls_enabled = true
}
external_redis_password = var.external_redis_password

alb_access_type = "public"            # "public" or "private"
alb_allowed_cidrs = [
  "0.0.0.0/0"                         # tighten for production
]
alb_allowed_ipv6_cidrs = ["::/0"]

# WAF IP allowlisting (recommended for production)
waf_enable_ip_allowlisting = true
waf_allowlist_ipv4_cidrs = [
  "203.0.113.0/24",
  "198.51.100.42/32",
]
waf_allowlist_ipv6_cidrs = [
  "2001:db8::/48",
]

# Optional: additional source ranges for agent webhook invocation only
waf_webhook_allowlist_ipv4_cidrs = ["198.51.100.0/24"]
waf_webhook_allowlist_ipv6_cidrs = ["2001:db8:5678::/48"]

# SSL options (choose one):

# Option 1: Look up existing wildcard certificate (DEFAULT)
hosted_zone_name = "prod.yourcompany.com"

# Option 2: Create new certificate with DNS validation
enable_acm_dns_validation = true
hosted_zone_name          = "prod.yourcompany.com"

# Option 3: Provide a certificate ARN
ssl_certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/xxx"

# DNS record control
create_dns_records = true  # Route53 ALIAS to ALB (default: false)

enable_dual_alb = true

# Optional: existing private hosted zone
private_hosted_zone_id = "Z1234567890ABC"
private_hosted_zone_vpc_id = "vpc-1234567890abcdef0"
private_hosted_zone_additional_vpc_ids = [
  "vpc-0987654321fedcba0",
]

alb_internal_allowed_cidrs = [
  "10.200.0.0/16",  # Corporate VPN
]
alb_internal_allowed_ipv6_cidrs = [
  "fd00::/64",
]

vpc_peering_connections = {
  "customer-vpc" = {
    peering_connection_id = "pcx-0abc123def456"
    peer_vpc_cidr         = "172.16.0.0/16"
    peer_owner_id         = "123456789012"   # REQUIRED
    peer_region           = "us-east-1"      # optional
  }
}

services_configurations = {
  "backend" = {
    name              = "backend"
    path_pattern      = ["/api/*", "/docs*", "/redoc*", "/.well-known*"]
    health_check_path = "/api/v1/utils/health-check/"
    container_port    = 8000
    host_port         = 8000
    port              = 8000
    priority          = 10
    min_capacity      = 3   # runtime floor (autoscaling target)
    max_capacity      = 10  # runtime ceiling
    cpu               = 2048
    memory            = 4096
    cpu_auto_scalling_target_value    = 70
    memory_auto_scalling_target_value = 80
  }

  "frontend" = {
    name              = "frontend"
    path_pattern      = ["/*"]
    health_check_path = "/"
    container_port    = 80
    host_port         = 80
    port              = 80
    priority          = 20
    min_capacity      = 2
    max_capacity      = 10
    cpu               = 512
    memory            = 1024
  }
}

vpc_cidr        = "10.0.0.0/16"
region_az       = ["us-east-1a", "us-east-1b", "us-east-1c"]
public_subnets  = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
private_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
enable_ipv6     = true   # set false for IPv4-only networks
single_nat_gateway = false
enable_vpc_endpoints = true

# Extra private routes via Transit Gateway (module-created VPC only)
private_additional_transit_gateway_routes = [
  { cidr_block = "10.100.0.0/16", transit_gateway_id = "tgw-xxxxxxxx" },
]

alb_additional_inbound_security_group_ids = ["sg-xxxxxxxx"]

existing_vpc_id             = "vpc-xxxxx"
existing_private_subnet_ids = ["subnet-xxxxx", "subnet-yyyyy", "subnet-zzzzz"]
existing_public_subnet_ids  = ["subnet-aaaaa", "subnet-bbbbb", "subnet-ccccc"]
# Must match the existing VPC CIDR (default is 10.0.0.0/16). Used for SG/WAF-related
# CIDR rules even when the module does not create the VPC.
vpc_cidr = "10.8.0.0/16"

enable_monitoring = true

# Default true: mission-critical CloudWatch alarms → SNS topic
# ${project}-${environment}-critical-alerts
critical_alerts_enabled = true

# Fan alarms to an existing same-region SNS topic (e.g. your Slack/Chatbot relay).
# The module does not create Slack Chatbot config; wire Slack on that topic yourself.
critical_alerts_extra_sns_topic_arns = [
  "arn:aws:sns:us-east-1:123456789012:my-ops-alerts",
]
# ToolGuard's actionable alarms fan out to these topics too (see the module README).
critical_alerts_create_sqs_subscription = true

enable_db_health_alarms    = true
enable_agent_run_alarms    = true
enable_worker_queue_alarms = true
enable_dashboard           = true

# ECS Container Insights: null uses environment default
# (production → "enabled", staging/development → "disabled")
container_insights = "enabled"

rds_alarm_config = {
  DiskQueueDepth = { period = 300, threshold = 5, unit = "Count" }
  WriteIOPS      = { period = 300, threshold = 1000, unit = "Count" }
  ReadIOPS       = { period = 300, threshold = 1000, unit = "Count" }
  Storage        = { period = 300, threshold = 107374182400, unit = "Bytes" }
}

alb_5xx_alarm_period    = 300
alb_5xx_alarm_threshold = 1

redis_curr_connections_threshold      = 2000
redis_evictions_threshold             = 1
redis_burst_evictions_threshold       = 5000
redis_sustained_evictions_threshold   = 500
rds_database_connections_threshold    = 2700
rds_writer_cpu_utilization_threshold  = 85
rds_reader_cpu_utilization_threshold  = 90
rds_writer_acu_utilization_threshold  = 90
db_idle_in_txn_max_duration_threshold = 300
db_idle_in_txn_count_threshold        = 5

agent_run_stall_threshold_minutes        = 60
agent_run_stalled_count_threshold        = 0
agent_run_failure_rate_threshold_percent = 5
agent_run_failure_rate_min_volume        = 20

redis_node_type                  = "cache.r7g.large"
redis_num_cache_clusters         = 2
redis_automatic_failover_enabled = true
redis_multi_az_enabled           = true
redis_snapshot_retention_limit   = 7

# Dedicated noeviction Redis (REDIS_CRITICAL_URL)
# Group name: <project>-<environment>-redis-critical
enable_critical_redis             = true
critical_redis_node_type          = "cache.t4g.small"
critical_redis_num_cache_clusters = 2
critical_redis_multi_az_enabled   = true

enable_privatelink = true
privatelink_allowed_principals = [
  "arn:aws:iam::123456789012:root",
]
privatelink_acceptance_required = true
# privatelink_subnet_ids = ["subnet-aaaa", "subnet-bbbb"]  # optional; defaults to private subnets
# privatelink_additional_supported_regions = ["us-west-2"]

# Private connection types: "aws_privatelink" and/or "tunnel"
private_connection_types = ["aws_privatelink"]

# Tunnel options (when "tunnel" is enabled)
# tunnel_image_tag = "1.2.3"  # optional override; normally use the module default
# tunnel_router_listener_priority = 15
# tunnel_trace_sample_ratio = 0.1
# tunnel_aws_endpoint_security_group_id = "sg-xxxxxxxx"  # required with existing VPC

enable_dual_alb            = true
enable_resolver_endpoint   = true  # Route53 Resolver inbound for private DNS
# cross_account_hosted_zone_id = "ZXXXXXXXX"  # configure aws.route53 assume_role when set
# manage_service_vpc_private_hosted_zone_association = true

enable_llm_gateway            = true
llm_gateway_listener_priority = 12
# llm_gateway_image_uri = "123456789012.dkr.ecr.us-east-1.amazonaws.com/runlayer/llm-gateway:1.28.162"
# Pass via TF_VAR_llm_gateway_runlayer_api_key — never commit
# llm_gateway_runlayer_api_key = var.llm_gateway_runlayer_api_key

otel_exporter_otlp_metrics_endpoint = "https://otel.example.com:4317"
otel_exporter_otlp_metrics_protocol = "grpc"
otel_service_name                   = "runlayer-backend"

otel_collector_config = {
  enabled         = true
  export_endpoint = "otel-collector.example.com:4317"  # your collector; not localhost
  export_insecure = false
}

flow_metrics_collection_enabled       = true
flow_trace_adaptive_sampling_enabled  = true

backend_min_capacity               = 3  # runtime floor; autoscaling owns the live count
backend_ephemeral_storage_size_gib = 40
backend_stop_timeout_seconds       = 120
health_check_grace_period_seconds  = 60
target_group_deregistration_delay  = 30
wait_for_ecs_steady_state          = true
ecs_service_wait_timeout           = "30m"
enable_ecs_exec                    = false
enable_read_only_root_filesystem   = true
deletion_protection                = true

workers = 4
worker_config = {
  min_capacity = 2  # runtime floor; autoscaling owns the live count
  cpu          = 1024
  memory       = 2048
}

additional_backend_env_vars = {
  LOG_LEVEL = "INFO"
}

# Restore Aurora from snapshot at create time only
# snapshot_identifier = "rds:acme-staging-YYYY-MM-DD"

# migration_lock_timeout_ms = 0
# migration_statement_timeout_ms = 0
# migration_retry_count = 0
# backend_migration_wait_timeout_seconds = 1800
# backend_migration_aws_role = { arn = "arn:aws:iam::123456789012:role/migration-runner" }

# Prefer TF_VAR_* / a secrets backend — do not commit values
# secret_key  = var.secret_key   # must pair with master_salt, or omit both
# master_salt = var.master_salt
# sentry_dsn  = var.sentry_dsn
# mcp_catalog_api_key = var.mcp_catalog_api_key
# distribution_api_key = var.distribution_api_key

mcp_catalog_api_url = ""  # empty → backend default

frontend_sentry_dsn               = ""
frontend_sentry_traces_sample_rate = "0.1"
sentry_audit_events_enabled       = true
sentry_relay_enabled              = true
# sentry_relay_upstream = "https://sentry.example.com/"
# sentry_relay_config   = { ... }

oauth_broker_url = ""  # empty → module default when broker is used
# oauth_client_registration_rate_limit_per_hour = 1000

# ms_teams_app_client_secret = var.ms_teams_app_client_secret  # via TF_VAR_*

additional_backend_env_vars = {
  MS_TEAMS_APP_CLIENT_ID         = "00000000-0000-0000-0000-000000000000"
  MS_TEAMS_RUNLAYER_TENANT_ID    = "00000000-0000-0000-0000-000000000000"
  MS_TEAMS_AZURE_SUBSCRIPTION_ID = "00000000-0000-0000-0000-000000000000"
  MS_TEAMS_AZURE_RESOURCE_GROUP  = "runlayer-ms-teams-bots"
}

bedrock_auto_model_access = true
bedrock_region            = ""  # empty → deployment region

# Self-managed installs: override before first successful auto-submit
# (form is submit-once and permanent). Defaults name "Runlayer".
bedrock_model_access_company_name    = "Example Corp"
bedrock_model_access_company_website = "https://example.com"
bedrock_model_access_industry        = "Technology"
bedrock_model_access_intended_users  = 100

# Custom agents only — not required for Runlayer Assistant
enable_bedrock_anthropic_models = false
# anthropic_api_key = var.anthropic_api_key  # via TF_VAR_*
# platform_llm_trial_default_budget_usd = "50"

enable_runlayer_agents            = true
enable_runlayer_agentcore_runtime = true
enable_runlayer_tool_guard        = true
enable_runlayer_topic_cpu         = false
enable_runlayer_cimd              = true
enable_runlayer_deploy_healthcheck = false
# runlayer_deploy_use_shared_sg = false
# runlayer_deploy_use_shared_task_role = false

# ToolGuard sizing (when enable_runlayer_tool_guard = true)
# runlayer_tool_guard_desired_count = 2
# runlayer_tool_guard_max_count = 4
# runlayer_tool_guard_timeout = 30   # deprecated for enforcement scans (use the workspace scan latency budget); still sets the tool-list/analyze/models timeout
# runlayer_tool_guard_gpu_resource_value = "ALL"  # required for g6f.* fractional GPUs
# runlayer_tool_guard_scaling_profile = "conservative" # balanced | aggressive
# runlayer_tool_guard_predictive_scaling_mode = null # disabled | forecast_only | forecast_and_scale (default follows profile)

enable_audit_log_kinesis    = true
audit_log_write_target      = "kinesis"
enable_audit_log_s3_archive = true
# S3 archive alone keeps Aurora hot-window size bounded (default
# audit_log_archive_hot_window_days = 90). Kinesis is only for SIEM export of
# full audit metadata — enable when you have a consumer ready.
audit_log_kinesis_consumer_config = {
  enabled       = true
  desired_count = 1
}

enable_audit_payload_offload = true
enable_audit_log_spool       = true
enable_toolguard_feedback    = true
enable_tool_output_offload   = false

enable_hook_events_pipeline = true
# hook_events_alert_email = "ops@example.com"

enable_audit_log_siem_export = true
# Write to your bucket (or omit external_* to use the Runlayer-managed bucket)
# audit_log_siem_export_external_s3_bucket = "acme-audit-siem"
# audit_log_siem_export_external_s3_region = "us-east-1"
# audit_log_siem_export_assume_role_arn    = "arn:aws:iam::123456789012:role/siem-writer"
# audit_log_siem_export_external_id        = "REPLACE_ME"
# audit_log_siem_export_s3_prefix          = "runlayer/audit"
# audit_log_siem_export_read_role_arns     = ["arn:aws:iam::123456789012:role/siem-reader"]

# session_siem_export_kinesis_consumer_config = { enabled = true, desired_count = 1 }
# session_siem_export_external_s3_bucket = "acme-session-siem"
# sessions_read_from_postgres = false
# session_materializer_config = { enabled = true, desired_count = 1 }

# data_export_bucket_arn = "arn:aws:s3:::acme-hook-events-export"

enable_binary_package_distribution = true
# runlayer_download_token = var.runlayer_download_token  # via TF_VAR_*
# runlayer_downloads_base_url = "https://downloads.example.com"

customer_id     = "acme"
deployment_name = "staging"
infra_version   = "v28.1.1"

# Separate Sentry DSN for sandbox errors (does not reuse backend sentry_dsn)
# Pass via TF_VAR / secrets backend — never commit
runlayer_agent_sandbox_sentry_dsn = var.agent_sandbox_sentry_dsn

# Optional image overrides
# runlayer_agent_sandbox_image_uri = "123456789012.dkr.ecr.us-east-1.amazonaws.com/runlayer/agent-sandbox:1.28.162"
# With WAF IP allowlisting, use VPC + PrivateLink (not PUBLIC):
# enable_privatelink              = true
# runlayer_agentcore_network_mode = "VPC"
# runlayer_agentcore_consumer_vpc_id = "vpc-xxxxx"
# runlayer_agentcore_consumer_private_subnet_ids = ["subnet-xxxxx", "subnet-yyyyy"]
# runlayer_agentcore_max_lifetime_seconds = 3600
# runlayer_agentcore_idle_timeout_seconds = 900

# Per-agent network access policies (requires VPC mode). Roll out in order:
# 1. VPC mode with direct egress left on (the defaults above).
# 2. sandbox_egress_mode = "proxy"                  # proxy runs, nothing routes through it yet
# 3. Turn the sandbox-egress-proxy feature flag on for every organization, for example
#    additional_backend_env_vars = { FF_ENABLE = "<flags already forced>,sandbox-egress-proxy" }
#    and wait for the backend rollout to finish before step 4.
# 4. sandbox_egress_mode = "proxy_only"             # proxy becomes the only path for every run; skipping
#    step 3 costs organizations without the flag a few minutes of sandbox internet while the backend rolls out
# sandbox_egress_proxy_egress_ports = [443, 8443]    # 443 is always open; add ports that host:port policies may use
# sandbox_egress_proxy_image_uri    = "…/runlayer/sandbox-egress-proxy:1.28.500"

aws acm list-certificates --query "CertificateSummaryList[?contains(DomainName, '*')]"

aws acm describe-certificate --certificate-arn your-cert-arn
dig _acme-challenge.your-domain.com CNAME

aws elbv2 describe-target-health --target-group-arn your-tg-arn
aws ecs describe-services --cluster "$(terraform output -raw ecs_cluster_name)"