PRD: Terraform AWS Infrastructure (M2)

[cursor]

Problem Statement

SmartWealthAI needs reproducible AWS infrastructure (S3 data lake, GitHub OIDC IAM, Secrets Manager) but has no IaC in the repo. M2 Terraform unblocks ingest-smoke without provisioning empty ECS before the pipeline Docker image exists (M3).

Solution

Terraform v1 scoped to CI/CD milestone M2: bootstrap remote state, dev/prod S3 buckets, GitHub OIDC roles, Secrets Manager placeholder for SIMFIN_API_KEY. ECR/ECS/MLflow deferred to M3–M6.

Spec

spec/prds/terraform/terraform-prd.md

Canonical docs

• Feature spec: spec/features/014-cicd-infrastructure/spec.md
• PRD: spec/prds/terraform/terraform-prd.md
• ADR: spec/adr/0003-terraform-for-aws-iac.md
• Parent CI/CD PRD: spec/prds/ci-cd/ci-cd-prd.md

Implementation Decisions (summary)

• v1 scope: M2 only — S3 dev+prod, OIDC IAM, Secrets Manager skeleton
• Tool: Terraform (infra/terraform/)
• State: S3 + DynamoDB (bootstrap module, one-time manual apply)
• Accounts: Single AWS account; dev/prod isolated by bucket + IAM role
• OIDC: Repo JLaborda/SmartWealthAI; dev = develop + Environment dev; prod = main + Environment production
• Apply: workflow_dispatch only; prod requires GitHub Environment approval
• Out of v1: ECR, ECS, EC2, EventBridge, application LAKE_URI/boto3 (#112)

User Stories

See full list in spec/prds/terraform/terraform-prd.md.

Testing Decisions

• CI: terraform fmt -check, validate, plan on PRs touching infra/terraform/
• Post-apply: ingest-smoke workflow proves OIDC → dev S3 write
• No automatic apply on merge

Out of Scope

Multi-account AWS, OpenTofu, Terraform Cloud, auto-apply on merge, ECS/ECR/EC2 in v1.

Child issues

• Terraform bootstrap: remote state bucket and DynamoDB lock #106 — Terraform bootstrap: remote state bucket + DynamoDB lock
• Terraform storage module: S3 dev and prod data lake buckets #107 — Terraform storage module: S3 dev and prod data lake buckets
• Terraform IAM: GitHub OIDC provider and dev/prod roles #108 — Terraform IAM: GitHub OIDC provider and dev/prod roles
• Terraform Secrets Manager: SimFin API key placeholder #109 — Terraform Secrets Manager: SimFin API key placeholder
• Terraform CI workflow: fmt, validate, and plan on PR #110 — Terraform CI workflow: fmt, validate, and plan on PR
• Ingest-smoke workflow: OIDC auth and dev S3 write #111 — Ingest-smoke workflow: OIDC auth and dev S3 write
• Lake root URI: configuration and S3 lake I/O #112 — Lake root URI: configuration and S3 lake I/O