Terraform Infrastructure Configuration

Official IaC guidelines for provisioning Aevum Encyclopedia's multi-region backend, search clusters, and knowledge graph storage using HashiCorp Terraform.

Overview

The Aevum Encyclopedia infrastructure is fully declarative and managed through Terraform. All state is stored in a remote S3 backend with DynamoDB locking to support parallel development and safe CI/CD deployments.

Note: This module supports AWS, GCP, and Azure backends via the cloud_provider variable. Default configurations assume AWS. Switch providers by updating terraform.tfvars.

Prerequisites & Providers

Ensure the following Terraform version and provider constraints are met before initializing:

versions.tf

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.30"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.85"
    }
    google = {
      source  = "hashicorp/google"
      version = "~> 5.20"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.5"
    }
  }

  backend "s3" {
    bucket         = "aevum-infra-state"
    key            = "global/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "aevum-terraform-locks"
  }
}

Module Architecture

Our infrastructure follows a modular, environment-scoped structure:

modules/core/ - VPC, IAM roles, DNS, Route53
modules/compute/ - ECS Fargate, Lambda functions, ALBs
modules/data/ - Aurora PostgreSQL, Elasticache Redis, S3 buckets
modules/search/ - OpenSearch domain, vector indexes, indexing workers
environments/{dev,staging,prod}/ - Environment-specific variable overrides

Configuration Example

Below is the root module configuration for the production environment:

environments/prod/main.tf

# Core Networking & Security
module "core" {
  source = "../../modules/core"

  environment        = "production"
  domain             = "aevum-encyclopedia.com"
  vpc_cidr           = "10.0.0.0/16"
  availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
  enable_private_dns = true
}

# Data Layer
module "data" {
  source   = "../../modules/data"
  vpc_id   = module.core.vpc_id
  subnet_ids = module.core.private_subnet_ids
  
  db_engine            = "aurora-postgresql"
  db_engine_version    = "15.4"
  db_instance_class    = "db.r6g.xlarge"
  aurora_cluster_mode  = true
  enable_backup_vault  = true
  backup_retention     = 35
}

# Search & Vector Indexing
module "search" {
  source     = "../../modules/search"
  vpc_id     = module.core.vpc_id
  subnet_ids = module.core.private_subnet_ids
  
  domain_name      = "aevum-knowledge-graph"
  instance_type    = "r6g.xlarge.search"
  instance_count   = 3
  vector_enabled   = true
  vector_capacity  = 256
}

Environment Variables

Required variables for local development and CI/CD runners. Sensitive values should be injected via Vault or CI secrets manager.

Variable	Description	Type	Required
`AWS_ACCESS_KEY_ID`	AWS credentials for state/backend access	String	Required
`AWS_SECRET_ACCESS_KEY`	Secret key paired with access key	String	Required
`TF_VAR_cloud_provider`	Target cloud: aws, gcp, azure	String	Required
`TF_VAR_db_master_password`	Aurora master credentials	String	Required
`TF_VAR_enable_vpc_flow_logs`	Enable VPC traffic logging	Bool	Optional
`VAULT_ADDR`	Vault server endpoint for secret injection	String	Optional

Deployment Workflow

Follow this sequence for safe infrastructure changes:

Initialize: terraform init -backend-config=environments/prod/backend.hcl
Validate: terraform validate
Plan: terraform plan -out=tfplan -var-file=environments/prod/terraform.tfvars
Review: Analyze diff output for resource modifications, replacements, or drift.
Apply: terraform apply tfplan
Verify: Run terraform plan again to confirm no residual drift.

Warning: Never run terraform destroy against production without explicit approval from the Platform Engineering team. State corruption is irreversible without backup restoration.

State Management & Drift Detection

Drift detection runs automatically via GitHub Actions on a 6-hour schedule. If unexpected changes are detected, a pull request is automatically created with the proposed reconciliation plan. All state modifications must pass the terraform fmt and tflint checks in CI.