Deployment
Infrastructure Stacks

Infrastructure Stacks

Each stack lives under infrastructure/resources/aws/lkwiz/<stack>/ and follows the same copebit conventions.

Backend & state

  • S3 backend per account: bucket = tofu-states-${account_id}, with the key derived from the stack directory name — tofu_states/<stack>/<stack>_state.json. Native S3 locking (use_lockfile = true) is used.
  • assume_role into the tofu-admin IAM role in the target account for both the backend and the providers.
  • A us-east-1 provider alias (aws.us_east_1) is declared wherever CloudFront ACM certificates are needed (frontend, docs).

Shared config

  • customer_specs.yaml (infrastructure/resources/aws/customer_specs.yaml) provides shared parameters — customer_name: copebit, main_region: eu-central-1 — consumed by every stack's locals.tf.
  • <stage>.tfvars (dev.tfvars, prod.tfvars) set account_id, project_name, project_stage, and per-stack values such as domains and route53_enabled.

Default tags

Every provider applies default_tags: AccountName, CustomerName, ManagedBy = tofu, ProjectName, ProjectStage, and StackName.

Cross-stack references

Stacks read each other's outputs via terraform_remote_state:

  • Most stacks read account_prep for KMS/SNS ARNs.
  • The docs stack reads the frontend stack's route53_zone_id output so it can write its DNS records (CloudFront alias + ACM validation) into the frontend-owned Route53 zone, rather than creating a second zone.

DNS

DNS is Terraform-managed in dev only (route53_enabled = true): the frontend stack creates the lkwiz-dev.copebit.ch zone, and the frontend and docs stacks add their A/AAAA and ACM-validation records. In prod, DNS is managed externally in copebit.ch (route53_enabled = false).

Validation

Format and validate stacks without touching AWS:

cd infrastructure/resources/aws/lkwiz/<stack>
tofu fmt -check
tofu init -backend=false
tofu validate
OverviewCI/CD