> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oncoeverything.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Infrastructure

> The AWS and Vercel resources, where their Terraform lives, and how to apply a change.

Every AWS and Vercel resource is in Terraform, in `infra/`. Nobody makes a resource by clicking in a console. A clean `terraform apply` builds a working environment.

## Accounts

| Service | Account | Owner |
| - | - | - |
| AWS | 722399422425, us-east-1 | OncoEverything |
| Vercel | The OncoEverything team | OncoEverything |
| GitHub | `OncoEverything/oncoeverything` | OncoEverything |
| Stripe | OncoEverything's account | OncoEverything |
| Mintlify | The OncoEverything organization | OncoEverything |

`docs/operations/account-inventory.md` lists every account with its owner, renewal and cost.

## AWS resources

| Area | What | File |
| - | - | - |
| Network | A VPC with public and private subnets in two zones, one NAT gateway | `network.tf` |
| Database | RDS Postgres, backups, point-in-time recovery | `database.tf` |
| Files | Two private S3 buckets | `storage.tf` |
| Secrets | Secrets Manager | `secrets.tf` |
| API | ECR, ECS Fargate, a load balancer, CloudFront, IAM roles | `api.tf` |
| Downloads | CloudFront with signed URLs, a certificate, the delivery sweep | `delivery.tf` |
| DNS | The Route 53 zone and web records | `dns.tf` |
| Email | SES, DKIM, SPF, DMARC | `email.tf` |
| Alarms | SNS, CloudWatch alarms, the monthly budget | `monitoring.tf` |
| Deploys | The role GitHub Actions uses | `deploy.tf` |
| Vercel | The project, its environment variables, domains and firewall rules | `vercel.tf` |

Terraform state is in an S3 bucket that `infra/bootstrap.sh` created once. `infra/README.md` has the full first-run steps for a clean account.

## Get access

Sign in with AWS SSO. The `onco` profile assumes the admin role in the OncoEverything account.

```bash theme={null}
bun run aws:login
AWS_PROFILE=onco aws sts get-caller-identity
```

The Vercel provider needs a Vercel token. The Vercel CLI stores one after `vercel login`. `scripts/terraform.sh` reads that token and sets the `onco` profile, so the `infra:` scripts need no other setup.

## Apply a change

**1. Plan**

```bash theme={null}
bun run infra:plan
```

Read the plan. A task definition replacement is normal after a deploy. See the note below.

**2. Apply**

```bash theme={null}
bun run infra:apply
```

Type `yes` when Terraform asks. Where no one can answer the prompt, add `-auto-approve`.

**3. Commit**

Commit the `.tf` change to main. Do not commit `terraform.tfvars`. It holds settings, never secrets.

> [!NOTE]
>
> CI deploys the API outside Terraform. After each deploy, the plan includes a new task definition. That task definition reads the image the service already runs, so applying it does not change the running code.

## DNS

GoDaddy is the registrar for the domain. Its nameservers point to Route 53, so every record is in `dns.tf` and `email.tf`.

| Name | Points to |
| - | - |
| `oncoeverything.com`, `www` | Vercel. Both serve the site, and canonical links name [www](http://www). |
| `downloads` | The CloudFront download distribution |
| `docs` | Mintlify, for this handbook |
| `mail` | SES mail-from, with its MX and SPF |
| DKIM, DMARC and the apex SPF | SES |

## Cost

The cost is about $100 to $110 a month at current traffic. The NAT gateway is the largest line, at about $32. The budget is $120. It emails when the forecast passes 80%, and when actual spend passes 100%.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.