Epic: Deliver portable AWS development infrastructure with Terraform

Normative authority:

• 08 — AWS development and Terraform
• 01 — Platform architecture
• 07 — Security, privacy, accessibility, and operations
• 09 — Migration, rollout, and roadmap
• 10 — Verification strategy
• _docs/PROCESS.md

The former 08-aws-sandbox-terraform.md path is retained only as a compatibility link. Its canonical authority is now 08-aws-development-terraform.md; sandbox remains only where the accepted legacy physical-identifier boundary requires it until #94.

PM disposition — 2026-08-31

OPEN / GROOMED / P0 / INFRA / HUMAN / dependency-blocked / development-only. This is a coordination epic, not an implementation-sized issue. Keep it open until the direct children and the required cross-epic operational interfaces have independently passed their own lifecycle gates. Source validation, a Terraform plan, a deployment, a synthetic rehearsal, or a provider readback alone does not close the epic.

The current website main is face8e4808d65afbf0374d1ced7a88079950d663. Its push CI run 33295699282 is not a green release: ci-gate failed and the downstream Django, quality, Playwright, container, publish, and deploy jobs were cancelled. The scheduled failure at 33294786109 is for the older 9a491cd tree and is not current-head evidence.

The current DataTalksClub/aws-infra/main source is a83f6656d5ddd690d94079979b3f1a970551dac6. The previously accepted #78 source envelope predates that tip and cannot be reused as current acceptance. No current exact-main protected plan, apply, readback, deployment, or production evidence is recorded here.

Outcome

Deliver a portable Terraform-defined development workload for https://web.dtcdev.click in DataTalksClub/aws-infra, with the existing delegated hosted zone, TLS/edge/origin controls, web and worker runtime, private database, release assets, secrets containers, logs, alarms, backup settings, and rollback controls. Keep the definition portable to a separately configured production root without sharing development state, resources, credentials, or runtime assumptions.

The epic coordinates the infrastructure and deployment-control boundaries. It does not absorb the owning-domain implementation of email, content, courses, events, privacy, or observability contracts, and it does not grant authority to change a provider or production system.

Ownership and boundaries

#9 owns

• Workload-only Terraform/module/root source and policy for the development network, exact DNS ownership, TLS, CloudFront/WAF/ALB origin protection, ECR/ECS web/worker/migration runtime, RDS, release assets, secret containers and least-privilege task access, encrypted logs, minimum service alarms, and environment-specific production planning inputs.
• The infrastructure plan/apply workflow and its dedicated OIDC roles, exact state/lock boundary, serialization, redacted plan/readback evidence, and application/infrastructure role separation.
• The infrastructure-side contracts needed by application delivery, development noindex/canonical behavior, cache/WAF/invalidation operation, and the approved Relay client boundary. The website application and Relay service retain ownership of their runtime semantics.

Explicitly separate

• #21 is a #6 email epic, not a #9 child. It owns website EmailDelivery, Relay integration, Datamailer history/cutover, and sender semantics. #9 may provide reviewed infrastructure containers/permissions only after the exact Relay contract and its lifecycle gates are accepted; it never sends mail and never authorizes SES, Datamailer, or provider changes.
• #66 owns the cross-domain observability, target/query, backup-verification, restore, and failure-readiness coordination. Its #264–#269 contracts and live evidence must not be duplicated or inferred by this epic. #9 supplies only the AWS workload resources that an accepted contract authorizes.
• #71 owns the separate inactive courses.datatalks.club redirect workload and non-production rehearsal. Its production activation belongs only to #74 after #73; #9 does not switch production DNS/edge or retire the legacy course platform.
• #10 and #74 own migration/cutover, production sender/legacy-write retirement, production DNS/edge changes, and rollback observation. A production fixture or development rehearsal under #9 is not production authority.

Delivery gates

The gates are intentionally separated so source, proposed change, applied development state, and production activation cannot be conflated.

1. Repository/source gate

The aws-infra source may be inspected and validated in an isolated worktree without provider access. It must use the exact delegated zone ID Z05963572WVWFHDQZH5NE, contain no secrets/state/real tfvars, prove workload-only ownership and policy denials, and expose a production fixture with a separate account/backend/state/environment/trust boundary. This gate permits no backend initialization, state read, provider readback, plan/apply, GitHub-control mutation, secret population, DNS change, deployment, or production action.

2. Protected development plan/apply gate

Repeated development Terraform operations require the current accepted #78 source/security envelope, its named protected plan/apply authority, and the exact state/lock boundary. #94 separately owns the legacy-to-development root/state/OIDC identity migration. Any plan/apply or control-plane mutation stops on source drift, lock/lineage/address mismatch, unapproved action, missing authority, expired credentials, or redaction failure.

3. Development runtime and rehearsal gate

The current exact release must independently prove TLS, edge/origin locking, no redirect loop, web/worker/migration ordering, private RDS, assets, noindex/canonical behavior, controlled email defaults, logs/alarms/backup controls, safe rollback, and the generated cache/WAF/invalidation matrix. The relevant direct or follow-on issue owns each gate: #36 for development SEO/privacy, #79 for automatic application delivery, #109 for cache/WAF/invalidation, #66/#268 for operational resources/evidence, and #71 for its separate redirect rehearsal. A source check or synthetic test is never live readback.

4. Production boundary

No #9 work authorizes production planning against real state, production apply, production DNS/edge, sender activation, legacy-write retirement, or destructive migration. Those actions require the separate #73/#74 gates, named owners, protected inputs, and the exact production lifecycle in the rollout specification.

Dependencies and current DAG

Resolved inputs:

• #1 is closed and supplies the runnable Django/uv foundation and process.
• #25 is closed and supplies the cost-aware two-AZ/no-NAT development topology decision.
• #26 is closed and supplies service/recovery target values only; it is not infrastructure evidence or live authority.
• #67, #68, #69, #70, and #79 are closed delivery/history slices. Their exact historical evidence remains bounded to the release and controls they accepted.

Open hard or cross-epic gates:

• #78 is the hard gate for repeated protected infrastructure plan/apply and current source revalidation. It is open/HUMAN and its historical accepted source is stale against current aws-infra/main.
• #94 is the successor identity migration for the development root/state/OIDC environment. It starts only after #78’s current source and protected gate are accepted; it is not a production migration and is not required for #71’s repository-only redirect source.
• #36 is a direct #9/#3 child that remains open/HUMAN for exact current deployed edge and protected-origin evidence.
• #71 is a direct #5/#9/#10 child, open/HUMAN, and remains blocked for source work by the accepted #60 map. Its live non-production rehearsal additionally requires the relevant #78/#94 control identities and explicit authority; production activation is #74.
• #109 is an open/HUMAN infrastructure follow-on, not a duplicate #9 child. Its current cache/WAF candidate failed the independent full Playwright gate and cannot be treated as accepted live infrastructure.
• #21 is an open #6 consumer of the #9 infrastructure boundary, not a direct #9 implementation child. Its Relay/provider and Datamailer gates remain separate.
• #66 is an open #8 operations epic; #268’s external Terraform source/live-authority packet remains blocked. No backup/restore/alarm evidence is inferred here.

The acyclic coordination order is:

closed #1 + closed #25/#26
        -> accepted historical #67/#68/#69/#70/#79 baselines
        -> current-source revalidation + protected authority #78
             |-> #94 development root/state/OIDC identity migration
             |-> current development runtime/edge gate #36
             |-> #109 cache/WAF/invalidation infrastructure follow-on
             |-> explicit #78/#94 rehearsal controls for #71
             |-> #21 Relay website integration (separate #6 lane)
             `-> #66/#268 operational resources and evidence (separate #8 lane)

accepted #60 map -> inactive #71 source -> authorized non-production rehearsal
                                 -> #73 aggregate rehearsal -> #74 production activation

The |-> lanes may be prepared independently when their issue-specific dependencies are satisfied, but infrastructure state/control-plane mutations remain serialized and separately authorized. The DAG does not imply that an issue label, source acceptance, repository access, or a prior deployment grants provider or production authority.

Direct child ledger

• #67 — development network, DNS, TLS, edge foundation (closed).
• #68 — HTTPS origin and minimum ECS/RDS runtime (closed).
• #69 — immutable application delivery/OIDC scaffold (closed).
• #70 — historical one-time bootstrap, superseded by automatic delivery (closed; historical evidence only).
• #79 — automatic accepted-main delivery (closed; its human verification is bounded to that mechanism/release).
• #36 — current development noindex/canonical and protected edge/origin evidence (open/HUMAN).
• #78 — least-privilege infrastructure OIDC plan/apply control (open/HUMAN).
• #71 — separate inactive course-host redirect workload/rehearsal (open/HUMAN).

Resolved decisions #25 and #26 are inputs, not direct children. #21, #94, #109, and #66/#268 are explicitly cross-epic or follow-on gates and are not silently reparented by this ledger.

Epic completion criteria

• Current aws-infra source and its workload-only Terraform plan pass the exact policy, ownership, state/lock, redaction, OIDC, cost, and production-portability review.
• The protected #78 plan/apply path is accepted against current source, and any #94 identity migration has its own exact preflight, transition, terminal, rollback, and on-call evidence.
• Development TLS, DNS, edge/origin lock, web/worker/migration release, private encrypted RDS, assets, secrets containers, logs, alarms, backup settings, and rollback behavior pass their owning source, tester, PM, protected-live, and HUMAN gates.
• Development noindex/canonical and private/no-store behavior pass the current #36 edge/origin gate; generated cache/WAF/invalidation behavior passes the #109 contract and its applicable live evidence.
• The approved Relay client boundary is provisioned only through the infrastructure contract, while #21/#48–#50 independently prove website intent, Relay versioning/idempotency/callback/reconciliation, sender safeguards, Datamailer migration, and no direct SES/new Datamailer sends.
• The separate #71 source/rehearsal contract is accepted without activating production DNS/edge; #73/#74 retain ownership of aggregate rehearsal, production activation, observation, rollback, and legacy retention.
• #66/#268’s operational target/catalog/backup/alarm/dashboard/readback contracts are accepted where they consume #9 resources; source validation is not counted as backup, restore, alarm-firing, or recovery evidence.
• Every criterion is independently tested and PM-accepted with exact source/head/plan/evidence identity, and all applicable browser/screenshots, redaction, failure, rollback, and on-call gates are green. No unresolved HUMAN gate is hidden by closing the epic.

Explicit non-goals

• No production account/backend/state, DNS/edge switch, provider subscription or mutation, sender/callback/Relay operation, protected-data access, database export/restore, live backup drill, secret-value read/write, or destructive migration.
• No direct Amazon SES or Datamailer send path, website email renderer/template store, content/course/event/privacy implementation, or application-domain business mutation.
• No hosted-zone name lookup/creation, shared-state ownership, default-VPC reuse, public RDS/task ingress, wildcard IAM, state/plan/credential/secret artifact, production-state promotion, or console-only emergency change.
• No catch-all redirect, route/canonical redesign, indexing change, legacy course-host activation, production cutover, or retirement of the old runtime. Those remain in their owning issues and protected rollout gates.

Lifecycle

Each implementation slice follows _docs/PROCESS.md: groomed issue → uncommitted isolated engineer → independent tester and required screenshots → PM acceptance → focused commit/merge/push → on-call observation. #9 itself receives coordination/evidence comments only; it does not authorize a child to skip its lifecycle. A failed or stale source, plan, deployment, provider readback, or HUMAN check keeps the relevant checkbox and the epic open.

Start with _docs/specs/08-aws-development-terraform.md, the related platform, operations, rollout, and verification specs, and _docs/PROCESS.md; then inspect the pinned aws-infra/main source commit. This is a coordination epic rather than an implementation-sized task, so completion requires its direct children and cross-epic operational interfaces to pass their own lifecycle gates, not merely a plan or deployment.