Terraform Modules (Catalog)

Last Updated: 2026-01-19

Reusable Terraform modules used by roots under infra/platform/infra/**.

Where they live

  • infra/platform/modules/**

Modules

  • acm-certificate: ACM certificate in us-east-1 with DNS validation records.
  • cloudfront-distribution: CloudFront distribution with OAC origin, logging, and minimal security headers.
  • dns-record (legacy — not used by the prod root): Route53 records (A/AAAA/CNAME/TXT) with alias support for CloudFront.
  • route53-zone (legacy — not used by the prod root): Public hosted zone; outputs zone_id, name_servers.
  • s3-static-site: Private S3 bucket for static content; access via CloudFront OAC only.
  • vpc: VPC, subnets, gateways, optional endpoints (wired in live/prod/network).
  • wafv2: WAFv2 WebACL with sensible defaults and optional managed rule sets.

DNS is managed via Cloudflare, not Route53. Production DNS for the rocketclub.online zone is created with cloudflare_dns_record resources in infra/platform/infra/modules/core/cloudfront-apps and acm-alb-origin. There are no active aws_route53_* resources; the dns-record and route53-zone modules above are unused by the current prod environment. (The separate ronaldhatcher.com zone, used by the web and admin Vercel apps, is also on Cloudflare but managed outside this repo.)

NextNetworking & Entry PointsDNS, CDN, ALB, and ECS routing for the pipelines hostname.