4d74fdf593
Add complete ECS Fargate infrastructure for Clawdbot Discord bot deployment on AWS. ## Infrastructure (Terraform) - **VPC**: 100.64.0.0/16 with DNS support - **Public Subnets**: 2 subnets in different AZs - **ECR Repository**: clawdbot/bot with lifecycle policy - **IAM Roles**: Task Role (DynamoDB+S3) + Execution Role - **ECS Resources**: Fargate (256 CPU, 2048 MB memory) - **Security Group**: Outbound only - **CloudWatch**: Log group with 7-day retention ## Security Improvements - Discord Bot Token → AWS Secrets Manager - IAM policy with least privilege principle - No plaintext secrets in code ## Code Quality - Fix all 22 lint errors - Add *.d.ts to oxlint ignore patterns - Fix Dockerfile .buildstamp for Linux compatibility Closes #2049 Co-Authored-By: Claude <noreply@anthropic.com>
61 lines
1.3 KiB
HCL
61 lines
1.3 KiB
HCL
/**
|
|
* S3 Bucket for Artifact Storage
|
|
*/
|
|
|
|
resource "aws_s3_bucket" "artifacts" {
|
|
bucket = var.artifacts_bucket_name
|
|
|
|
tags = {
|
|
Name = "${var.project_name}-artifacts"
|
|
}
|
|
}
|
|
|
|
# S3 bucket versioning (disabled for cost optimization)
|
|
resource "aws_s3_bucket_versioning" "artifacts" {
|
|
bucket = aws_s3_bucket.artifacts.bucket
|
|
versioning_configuration {
|
|
status = "Suspended"
|
|
}
|
|
}
|
|
|
|
# S3 bucket server-side encryption (SSE-S3)
|
|
resource "aws_s3_bucket_server_side_encryption_configuration" "artifacts" {
|
|
bucket = aws_s3_bucket.artifacts.id
|
|
|
|
rule {
|
|
apply_server_side_encryption_by_default {
|
|
sse_algorithm = "AES256"
|
|
}
|
|
}
|
|
}
|
|
|
|
# S3 bucket public access block (private bucket)
|
|
resource "aws_s3_bucket_public_access_block" "artifacts" {
|
|
bucket = aws_s3_bucket.artifacts.id
|
|
|
|
block_public_acls = true
|
|
block_public_policy = true
|
|
ignore_public_acls = true
|
|
restrict_public_buckets = true
|
|
}
|
|
|
|
# S3 bucket lifecycle configuration (auto-expire old artifacts)
|
|
resource "aws_s3_bucket_lifecycle_configuration" "artifacts" {
|
|
bucket = aws_s3_bucket.artifacts.id
|
|
|
|
rule {
|
|
id = "expire-old-artifacts"
|
|
status = "Enabled"
|
|
|
|
filter {}
|
|
|
|
expiration {
|
|
days = var.artifacts_bucket_ttl_days
|
|
}
|
|
|
|
noncurrent_version_expiration {
|
|
noncurrent_days = 1
|
|
}
|
|
}
|
|
}
|