Skip to content

feat(infra): deploy web app to Vercel with CI workflow and SSM-backed env vars #456

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tataihono wants to merge 3 commits into from
Closed

feat(infra): deploy web app to Vercel with CI workflow and SSM-backed env vars #456

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ee6cea0
feat(infra): add Vercel env vars, web deploy IAM role, and SSM params
tataihono Mar 13, 2026
8228064
feat(infra): add web-deploy GitHub Actions workflow
tataihono Mar 13, 2026
514e197
fix(infra): add enable_web_deploy bootstrap guard for github stack
tataihono Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
232 changes: 232 additions & 0 deletions .github/workflows/web-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,232 @@
name: web-deploy

permissions:
contents: read

concurrency:
group: web-deploy-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
cancel-in-progress: true

on:
pull_request:
push:
branches:
- stage
- main
workflow_dispatch:

jobs:
affected:
if: github.event_name != 'workflow_dispatch'
permissions:
contents: read
runs-on: ubuntu-latest
outputs:
web: ${{ steps.affected.outputs.web }}
steps:
- name: Checkout
uses: actions/checkout@v6
with:
fetch-depth: 0

- name: Setup pnpm
uses: pnpm/action-setup@v4

- name: Setup Node
uses: actions/setup-node@v6
with:
node-version-file: .nvmrc
cache: pnpm

- name: Install dependencies
run: pnpm install --frozen-lockfile

- id: affected
name: Detect affected web package
run: |
if [ "${{ github.event_name }}" = "pull_request" ]; then
BASE="${{ github.event.pull_request.base.sha }}"
else
BASE="${{ github.event.before }}"
fi

if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ]; then
BASE=$(git rev-parse HEAD^ 2>/dev/null || true)
fi

if [ -z "$BASE" ]; then
echo "web=true" >> "$GITHUB_OUTPUT"
exit 0
fi

TURBO_STDERR=$(mktemp)
if ! TURBO_OUT=$(TURBO_SCM_BASE="$BASE" pnpm turbo run lint --affected --dry-run=json 2>"$TURBO_STDERR"); then
cat "$TURBO_STDERR" >&2
echo "$TURBO_OUT" >&2
rm -f "$TURBO_STDERR"
echo "Affected detection failed; forcing deploy to avoid false negative." >&2
echo "web=true" >> "$GITHUB_OUTPUT"
exit 0
fi

WEB_AFFECTED=$(echo "$TURBO_OUT" | jq -r 'try ([.tasks[]?.package] | any(. == "@forge/web")) catch "true"' 2>/dev/null || echo "true")
rm -f "$TURBO_STDERR"
echo "web=$WEB_AFFECTED" >> "$GITHUB_OUTPUT"

deploy:
permissions:
id-token: write
contents: write
pull-requests: write
needs: affected
if: >-
always() && (
(github.event_name == 'workflow_dispatch' && (github.ref_name == 'main' || github.ref_name == 'stage'))
|| (github.event_name != 'workflow_dispatch' && needs.affected.outputs.web == 'true')
)
environment: ${{ github.event_name == 'pull_request' && 'web-preview' || (github.ref_name == 'main' && 'web-prod' || 'web-stage') }}
runs-on: ubuntu-latest
env:
AWS_REGION: ${{ vars.AWS_REGION || 'us-east-2' }}
VERCEL_ORG_ID: ${{ vars.VERCEL_ORG_ID }}
VERCEL_PROJECT_ID: ${{ vars.VERCEL_WEB_PROJECT_ID }}
steps:
- name: Checkout
uses: actions/checkout@v6

- name: Setup pnpm
uses: pnpm/action-setup@v4

- name: Setup Node
uses: actions/setup-node@v6
with:
node-version-file: .nvmrc
cache: pnpm

- name: Install dependencies
run: pnpm install --frozen-lockfile

- name: Resolve environment
id: vars
run: |
if [ "${{ github.event_name }}" = "pull_request" ]; then
DEPLOY_ENV="preview"
VERCEL_ENV="preview"
PROD_FLAG=""
elif [ "${GITHUB_REF_NAME}" = "main" ]; then
DEPLOY_ENV="prod"
VERCEL_ENV="production"
PROD_FLAG="--prod"
elif [ "${GITHUB_REF_NAME}" = "stage" ]; then
DEPLOY_ENV="stage"
VERCEL_ENV="preview"
PROD_FLAG=""
else
echo "Unsupported branch: ${GITHUB_REF_NAME}" >&2
exit 1
fi

echo "role_arn=${{ secrets.WEB_DEPLOY_ROLE_ARN }}" >> "$GITHUB_OUTPUT"
echo "deploy_env=$DEPLOY_ENV" >> "$GITHUB_OUTPUT"
echo "vercel_env=$VERCEL_ENV" >> "$GITHUB_OUTPUT"
echo "prod_flag=$PROD_FLAG" >> "$GITHUB_OUTPUT"

- name: Validate role ARN is configured
if: steps.vars.outputs.role_arn == ''
run: |
echo "Missing WEB_DEPLOY_ROLE_ARN secret for ${GITHUB_JOB} environment on ${GITHUB_REF_NAME}" >&2
exit 1

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v5
with:
role-to-assume: ${{ steps.vars.outputs.role_arn }}
aws-region: ${{ env.AWS_REGION }}

- name: Read Vercel API token from SSM
id: ssm
run: |
TOKEN=$(aws ssm get-parameter --name /forge/vercel/api_token --with-decryption --query 'Parameter.Value' --output text)
echo "::add-mask::$TOKEN"
echo "vercel_token=$TOKEN" >> "$GITHUB_OUTPUT"

- name: Pull Vercel environment
run: pnpm vercel pull --yes --environment=${{ steps.vars.outputs.vercel_env }} --token=${{ steps.ssm.outputs.vercel_token }}

- name: Build
run: pnpm vercel build ${{ steps.vars.outputs.prod_flag }} --token=${{ steps.ssm.outputs.vercel_token }}

- name: Deploy
id: deploy
run: |
URL=$(pnpm vercel deploy --prebuilt ${{ steps.vars.outputs.prod_flag }} --token=${{ steps.ssm.outputs.vercel_token }})
echo "url=$URL" >> "$GITHUB_OUTPUT"

- name: Post preview URL on PR
if: always() && github.event_name == 'pull_request' && steps.deploy.outputs.url
continue-on-error: true
uses: actions/github-script@v8
env:
DEPLOY_URL: ${{ steps.deploy.outputs.url }}
JOB_STATUS: ${{ job.status }}
with:
script: |
const marker = "<!-- web-deploy-preview -->"
const status = process.env.JOB_STATUS === "success" ? "deployed" : "failed"
const url = process.env.DEPLOY_URL
const body = [
marker,
`**Web preview ${status}**`,
"",
url ? `URL: ${url}` : "",
`Run: ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
].filter(Boolean).join("\n")

const { data: comments } = await github.rest.issues.listComments({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
})
const existing = comments.find(c => c.body?.includes(marker))
if (existing) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: existing.id,
body,
})
} else {
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
body,
})
}

- name: Post deployment status comment
if: always() && github.event_name != 'pull_request'
continue-on-error: true
uses: actions/github-script@v8
env:
DEPLOY_ENV: ${{ steps.vars.outputs.deploy_env }}
DEPLOY_URL: ${{ steps.deploy.outputs.url }}
JOB_STATUS: ${{ job.status }}
with:
script: |
const status = process.env.JOB_STATUS === "success" ? "SUCCESS" : "FAILED"
const body = [
`Web deploy ${status}`,
"",
`- Environment: \`${process.env.DEPLOY_ENV || "unknown"}\``,
`- Branch: \`${context.ref.replace("refs/heads/", "")}\``,
`- URL: ${process.env.DEPLOY_URL || "n/a"}`,
`- Run: ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
].join("\n")

await github.rest.repos.createCommitComment({
owner: context.repo.owner,
repo: context.repo.repo,
commit_sha: context.sha,
body,
})
5 changes: 5 additions & 0 deletions infra/aws/github/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,11 @@ output "github_actions_cms_deploy_role_arn" {
value = aws_iam_role.github_actions_cms_deploy.arn
}

output "github_actions_web_deploy_role_arn" {
description = "GitHub Actions role for web Vercel deploy."
value = aws_iam_role.github_actions_web_deploy.arn
}

output "github_actions_terraform_apply_role_arn" {
description = "GitHub Actions role for Terraform apply."
value = aws_iam_role.github_actions_terraform_apply.arn
Expand Down
6 changes: 6 additions & 0 deletions infra/aws/github/ssm.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,12 @@ resource "aws_ssm_parameter" "cms_deploy_role_arn" {
value = aws_iam_role.github_actions_cms_deploy.arn
}

resource "aws_ssm_parameter" "web_deploy_role_arn" {
name = "/forge/github/web_deploy_role_arn_${var.environment}"
type = "String"
value = aws_iam_role.github_actions_web_deploy.arn
}

resource "aws_ssm_parameter" "terraform_vercel_role_plan_arn" {
count = local.create_github_secure_parameters ? 1 : 0

Expand Down
52 changes: 44 additions & 8 deletions infra/aws/github/terraform.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -340,6 +340,26 @@ data "aws_kms_key" "cms_ssm_prod" {
key_id = data.aws_kms_alias.cms_ssm_prod[0].target_key_arn
}

data "aws_kms_alias" "web_ssm_stage" {
count = local.create_shared_github_resources ? 1 : 0
name = "alias/forge-web-stage-ssm"
}

data "aws_kms_key" "web_ssm_stage" {
count = local.create_shared_github_resources ? 1 : 0
key_id = data.aws_kms_alias.web_ssm_stage[0].target_key_arn
}

data "aws_kms_alias" "web_ssm_prod" {
count = local.create_shared_github_resources ? 1 : 0
name = "alias/forge-web-prod-ssm"
}

data "aws_kms_key" "web_ssm_prod" {
count = local.create_shared_github_resources ? 1 : 0
key_id = data.aws_kms_alias.web_ssm_prod[0].target_key_arn
}

locals {
terraform_stack_roles = local.create_shared_github_resources ? {
vercel_plan = {
Expand All @@ -361,13 +381,19 @@ locals {
]
ssm_parameter_arns = [
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/api_token",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/cms/stage/STRAPI_INTERNAL_API_TOKEN",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/cms/prod/STRAPI_INTERNAL_API_TOKEN",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/STRAPI_API_TOKEN",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/STRAPI_API_TOKEN",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/STRAPI_PREVIEW_SECRET",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/STRAPI_PREVIEW_SECRET",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/NEXT_PUBLIC_GRAPHQL_URL",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/NEXT_PUBLIC_GRAPHQL_URL",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/NEXT_PUBLIC_CMS_HOSTNAME",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/NEXT_PUBLIC_CMS_HOSTNAME",
]
Comment on lines 382 to 392
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Missing SSM read scope for Vercel org/project IDs in Vercel stack roles

Line [383]-[392] and Line [425]-[434] don’t include /forge/vercel/org_id and /forge/vercel/web_project_id, but the Vercel stack reads them (seen in current plan failures). This leaves vercel_plan/vercel_apply unable to read required parameters.

🔧 Proposed fix 
       ssm_parameter_arns = [
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/api_token",
+        "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/org_id",
+        "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/web_project_id",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/STRAPI_API_TOKEN",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/STRAPI_API_TOKEN",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/STRAPI_PREVIEW_SECRET",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/STRAPI_PREVIEW_SECRET",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/NEXT_PUBLIC_GRAPHQL_URL",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/NEXT_PUBLIC_GRAPHQL_URL",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/NEXT_PUBLIC_CMS_HOSTNAME",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/NEXT_PUBLIC_CMS_HOSTNAME",
       ]
...
       ssm_parameter_arns = [
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/api_token",
+        "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/org_id",
+        "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/web_project_id",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/STRAPI_API_TOKEN",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/STRAPI_API_TOKEN",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/STRAPI_PREVIEW_SECRET",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/STRAPI_PREVIEW_SECRET",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/NEXT_PUBLIC_GRAPHQL_URL",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/NEXT_PUBLIC_GRAPHQL_URL",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/NEXT_PUBLIC_CMS_HOSTNAME",
         "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/NEXT_PUBLIC_CMS_HOSTNAME",
       ]

Also applies to: 424-434

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@infra/aws/github/terraform.tf` around lines 382 - 392, The ssm_parameter_arns
list in the resource defining IAM permissions (the ssm_parameter_arns array
shown in the diff) is missing the SSM parameter ARNs for the Vercel organization
and project IDs; add the two ARNs
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/org_id"
and
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/web_project_id"
to the ssm_parameter_arns lists (both places referenced in the diff) so the
Vercel plan/apply roles can read those parameters.

Copy link
Copy Markdown
Contributor Author

@tataihono tataihono Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The infra/vercel stack does not read org_id or web_project_id from SSM — only infra/github does, and the github_plan/github_apply roles already include those ARNs (lines 460–461 and 498–499). This is a false positive; no change needed.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tataihono, you're absolutely right — I apologize for the false positive. Looking at the file, github_plan and github_apply already include /forge/vercel/org_id and /forge/vercel/web_project_id in their ssm_parameter_arns. The vercel_plan/vercel_apply roles only need access to the Vercel API token and the web SSM env vars that infra/vercel actually reads; org_id and web_project_id are consumed solely by infra/github. No change needed.

✏️ Learnings added 
Learnt from: tataihono
Repo: JesusFilm/forge PR: 456
File: infra/aws/github/terraform.tf:382-392
Timestamp: 2026-03-13T11:34:16.837Z
Learning: In the JesusFilm/forge repository, the `infra/vercel` Terraform stack does NOT read `/forge/vercel/org_id` or `/forge/vercel/web_project_id` from AWS SSM. Only the `infra/github` stack reads those parameters (to populate GitHub Actions repository variables). The `vercel_plan` and `vercel_apply` IAM roles in `infra/aws/github/terraform.tf` therefore do not need ARNs for those parameters; the `github_plan` and `github_apply` roles already include them. Do not flag the absence of org_id/web_project_id ARNs from the vercel_plan/vercel_apply ssm_parameter_arns lists.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

🧠 Learnings used 
Learnt from: tataihono
Repo: JesusFilm/forge PR: 302
File: infra/vercel/data.tf:7-15
Timestamp: 2026-03-09T03:06:44.765Z
Learning: In the JesusFilm/forge repository, `infra/vercel` is a single Terraform stack that intentionally manages both preview and production Vercel environment variables together. Both `data "aws_ssm_parameter" "strapi_api_token_stage"` and `data "aws_ssm_parameter" "strapi_api_token_prod"` are unconditional because the plan path must read both tokens to diff the complete desired state. Do not flag the prod token lookup as needing a production-only gate in this stack.

Learnt from: tataihono
Repo: JesusFilm/forge PR: 302
File: infra/aws/modules/cms/main.tf:154-161
Timestamp: 2026-03-09T03:06:52.258Z
Learning: In Terraform configurations under infra/aws (and similar Terraform files in the repo), using value_wo and value_wo_version on aws_ssm_parameter resources is valid for write-only secrets (Terraform 1.11+). These fields prevent secrets from being stored in the Terraform state and enable versioned secret rotation when used with ephemeral random_password resources. Do not flag these fields as invalid; they are intentional and part of secure secret management.

Learnt from: CR
Repo: JesusFilm/forge PR: 0
File: infra/AGENTS.md:0-0
Timestamp: 2026-02-15T22:26:08.219Z
Learning: Applies to infra/**/*.{tf,tfvars} : Terraform-only changes in infrastructure code

Learnt from: CR
Repo: JesusFilm/forge PR: 0
File: infra/AGENTS.md:0-0
Timestamp: 2026-02-15T22:26:08.219Z
Learning: Applies to infra/**/*.{tf,tfvars} : Keep Terraform modules explicit and environment inputs parameterized

Learnt from: CR
Repo: JesusFilm/forge PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-11T02:00:52.599Z
Learning: Applies to infra/**/*.tf : Infrastructure changes must be implemented in Terraform at `infra/aws` and `infra/vercel`, not in application code.

Learnt from: CR
Repo: JesusFilm/forge PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-11T02:00:52.599Z
Learning: Applies to infra/**/*.tf : Infra changes are Terraform-only.

Learnt from: CR
Repo: JesusFilm/forge PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-13T03:58:30.823Z
Learning: Applies to infra/** : Use Terraform-only for infrastructure changes; never make manual console changes

ssm_kms_key_arns = [
var.vercel_ssm_kms_key_arn,
data.aws_kms_key.cms_ssm_stage[0].arn,
data.aws_kms_key.cms_ssm_prod[0].arn,
data.aws_kms_key.web_ssm_stage[0].arn,
data.aws_kms_key.web_ssm_prod[0].arn,
]
}
vercel_apply = {
Expand Down Expand Up @@ -397,13 +423,19 @@ locals {
]
ssm_parameter_arns = [
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/api_token",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/cms/stage/STRAPI_INTERNAL_API_TOKEN",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/cms/prod/STRAPI_INTERNAL_API_TOKEN",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/STRAPI_API_TOKEN",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/STRAPI_API_TOKEN",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/STRAPI_PREVIEW_SECRET",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/STRAPI_PREVIEW_SECRET",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/NEXT_PUBLIC_GRAPHQL_URL",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/NEXT_PUBLIC_GRAPHQL_URL",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/stage/NEXT_PUBLIC_CMS_HOSTNAME",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/web/prod/NEXT_PUBLIC_CMS_HOSTNAME",
]
ssm_kms_key_arns = [
var.vercel_ssm_kms_key_arn,
data.aws_kms_key.cms_ssm_stage[0].arn,
data.aws_kms_key.cms_ssm_prod[0].arn,
data.aws_kms_key.web_ssm_stage[0].arn,
data.aws_kms_key.web_ssm_prod[0].arn,
]
}
github_plan = {
Expand All @@ -425,6 +457,8 @@ locals {
]
ssm_parameter_arns = [
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/github/*",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/org_id",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/web_project_id",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/cms/stage/STRAPI_INTERNAL_API_TOKEN",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/cms/prod/STRAPI_INTERNAL_API_TOKEN",
]
Expand Down Expand Up @@ -461,6 +495,8 @@ locals {
]
ssm_parameter_arns = [
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/github/*",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/org_id",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/vercel/web_project_id",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/cms/stage/STRAPI_INTERNAL_API_TOKEN",
"arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/forge/aws/cms/prod/STRAPI_INTERNAL_API_TOKEN",
]
Expand Down
Loading
Loading