Auto-generated

This page is generated by terraform-docs at build time from the infra/ repo. Do not edit manually.

Vault API

ECS service for the Vault analytics API. Provides query endpoints for analytics data stored in ClickHouse. Deployed behind the internal ALB with SSM-backed secrets for ClickHouse credentials and API authentication.

Requirements

Name	Version
terraform	>= 1.6.0
aws	~> 5.0

Providers

Name	Version
aws	~> 5.0

Modules

No modules.

Resources

Name	Type
aws_cloudwatch_log_group.vault_api	resource
aws_ecs_service.vault_api	resource
aws_ecs_task_definition.vault_api	resource
aws_iam_access_key.exports_clickhouse_s3	resource
aws_iam_policy.read_ssm	resource
aws_iam_role.execution_role	resource
aws_iam_role.gh_deploy	resource
aws_iam_role.task_role	resource
aws_iam_role_policy.gh_deploy	resource
aws_iam_role_policy.task_role_exports_s3	resource
aws_iam_role_policy_attachment.execution_read_ssm	resource
aws_iam_role_policy_attachment.execution_role_policy	resource
aws_iam_user.exports_clickhouse_s3	resource
aws_iam_user_policy.exports_clickhouse_s3	resource
aws_lb_listener_rule.vault_api	resource
aws_lb_target_group.vault_api	resource
aws_route53_record.vault_api	resource
aws_security_group_rule.vault_api_from_alb	resource
aws_ssm_parameter.clickhouse_password	resource
aws_ssm_parameter.clickhouse_url	resource
aws_ssm_parameter.clickhouse_username	resource
aws_ssm_parameter.exports_clickhouse_s3_access_key_id	resource
aws_ssm_parameter.exports_clickhouse_s3_secret_access_key	resource
aws_ssm_parameter.exports_database_url	resource
aws_ssm_parameter.exports_s3_bucket	resource
aws_ssm_parameter.exports_s3_prefix	resource
aws_ssm_parameter.exports_s3_region	resource
aws_ssm_parameter.vault_api_key	resource
aws_caller_identity.current	data source
aws_ecr_repository.vault_api	data source
aws_iam_openid_connect_provider.github	data source
aws_iam_policy_document.ecs_assume_role	data source
aws_route53_zone.selected	data source

Inputs

Name	Description	Type	Default	Required
alb_dns_name	DNS name of the internal ALB (for Route53 alias target)	string	n/a	yes
alb_https_listener_arn	ARN of the internal ALB HTTPS listener	string	n/a	yes
alb_security_group_id	Security group ID of the internal ALB	string	n/a	yes
alb_zone_id	Canonical hosted zone ID of the internal ALB (for Route53 alias)	string	n/a	yes
base_tags	Base tags to apply to all resources	map(string)	{}	no
clickhouse_max_execution_time	ClickHouse query timeout in seconds. Bumped above the default 10 because the per-day INSERT INTO s3() can take longer for big customers.	number	60	no
cluster_name	ECS cluster name to deploy the service into	string	n/a	yes
deployment_maximum_percent	ECS rolling deploy maximum percent. 200 = double during rollout (default), 100 = stop-before-start when paired with min=0.	number	200	no
deployment_minimum_healthy_percent	ECS rolling deploy minimum healthy percent. Set to 0 on capacity-constrained clusters to allow stop-before-start; 100 elsewhere.	number	100	no
desired_count	Desired number of ECS tasks	number	1	no
ecs_security_group_id	Security group ID of ECS tasks (ingress rule for ALB will be added to it)	string	n/a	yes
environment	Environment name	string	n/a	yes
exports_s3_bucket_arn	ARN of the S3 bucket where consent log export zips land.	string	n/a	yes
exports_s3_bucket_name	Name of the S3 bucket where consent log export zips land.	string	n/a	yes
exports_s3_prefix	S3 key prefix under which consent log exports live (zips at /.zip, temp CSVs at /_tmp//.csv).	string	"vault-exports"	no
github_oidc_ref	Git ref pattern for OIDC trust policy (e.g. refs/heads/main for branch, refs/tags/* for releases)	string	"ref:refs/heads/main"	no
github_repo	GitHub repository (org/repo) allowed to deploy via OIDC	string	"cookiehub-com/vault-api"	no
group	Resource group	string	n/a	yes
name_prefix	Prefix for resource names	string	n/a	yes
region	AWS region	string	n/a	yes
task_cpu	CPU units for the ECS task	number	1024	no
task_memory	Memory in MB for the ECS task	number	1024	no
vpc_id	VPC ID (used for the ALB target group)	string	n/a	yes
zone_id	Route53 private hosted zone ID	string	n/a	yes

Outputs

Name	Description
gh_deploy_role_arn	ARN of the GitHub OIDC deploy role for vault-api
target_group_arn	ARN of the ALB target group for the vault-api service
target_group_arn_suffix	Target group ARN suffix, used as the TargetGroup CloudWatch dimension.