Skip to main content
Every AWS and Vercel resource is in Terraform, in infra/. Nobody makes a resource by clicking in a console. A clean terraform apply builds a working environment.

Accounts

docs/operations/account-inventory.md lists every account with its owner, renewal and cost.

AWS resources

Terraform state is in an S3 bucket that infra/bootstrap.sh created once. infra/README.md has the full first-run steps for a clean account.

Get access

Sign in with AWS SSO. The onco profile assumes the admin role in the OncoEverything account.
The Vercel provider needs a Vercel token. The Vercel CLI stores one after vercel login. scripts/terraform.sh reads that token and sets the onco profile, so the infra: scripts need no other setup.

Apply a change

1

Plan

Read the plan. A task definition replacement is normal after a deploy. See the note below.
2

Apply

Type yes when Terraform asks. Where no one can answer the prompt, add -auto-approve.
3

Commit

Commit the .tf change to main. Do not commit terraform.tfvars. It holds settings, never secrets.
CI deploys the API outside Terraform. After each deploy, the plan includes a new task definition. That task definition reads the image the service already runs, so applying it does not change the running code.

DNS

GoDaddy is the registrar for the domain. Its nameservers point to Route 53, so every record is in dns.tf and email.tf.

Cost

The cost is about $100 to $110 a month at current traffic. The NAT gateway is the largest line, at about $32. The budget is $120. It emails when the forecast passes 80%, and when actual spend passes 100%.