Separate AWS Accounts and Provider Aliases

1. 1

   Create a deploy role in each account (once)

   In each workload account, a role named shoplite-deployer that trusts your identity account (and, in Stage 7, the CI OIDC provider) with permissions to manage ShopLite. Creating it is part of account setup (Control Tower, a bootstrap config per account, or a platform team). This course assumes it exists. Verify you can assume it.

   terminalcopy cmd

   $ aws sts assume-role --role-arn arn:aws:iam::444455556666:role/shoplite-deployer \

   --role-session-name check --query 'AssumedRoleUser.Arn' --output text

   ── expected output ──

   arn:aws:sts::444455556666:assumed-role/shoplite-deployer/check

2. 2

   Account variables

   Two new required inputs per environment. There are no defaults, so you can't forget them.

   variable "aws_account_id" {
     description = "The only AWS account this environment may operate on."
     type        = string
     validation {
       condition     = can(regex("^[0-9]{12}$", var.aws_account_id))
       error_message = "aws_account_id must be a 12-digit account ID."
     }
   }
   
   variable "deploy_role_arn" {
     description = "Role Terraform assumes in the target account."
     type        = string
   }

3. 3

   Provider: assume the role, allow only this account, add a us-east-1 alias

   Both provider configurations assume the same role and carry the same guard. The alias differs only in region. default_tags are repeated, since each provider configuration is independent.

   locals {
     default_tags = {
       Project     = var.project
       Environment = var.environment
       ManagedBy   = "terraform"
       Repo        = "github.com/you/shoplite"
     }
   }
   
   provider "aws" {
     region              = var.aws_region
     allowed_account_ids = [var.aws_account_id]
   
     assume_role {
       role_arn     = var.deploy_role_arn
       session_name = "terraform-${var.environment}"
     }
   
     default_tags {
       tags = local.default_tags
     }
   }
   
   provider "aws" {
     alias               = "us_east_1"
     region              = "us-east-1"
     allowed_account_ids = [var.aws_account_id]
   
     assume_role {
       role_arn     = var.deploy_role_arn
       session_name = "terraform-${var.environment}-use1"
     }
   
     default_tags {
       tags = local.default_tags
     }
   }

4. 4

   Per-environment account settings

   Add to each tfvars. Prod's state now lives in a bucket in the prod account (bootstrapped the same way as in Mission 1.2), so prod state is as isolated as prod itself.

   # envs/dev.tfvars
   aws_account_id  = "111122223333"
   deploy_role_arn = "arn:aws:iam::111122223333:role/shoplite-deployer"
   
   # envs/prod.tfvars
   aws_account_id  = "444455556666"
   deploy_role_arn = "arn:aws:iam::444455556666:role/shoplite-deployer"
   
   # envs/prod.s3.tfbackend — prod state in the prod account's own bucket
   bucket       = "shoplite-prod-tfstate-9a2b"
   key          = "shoplite/prod/terraform.tfstate"
   region       = "ap-south-1"
   encrypt      = true
   use_lockfile = true
   assume_role = {
     role_arn = "arn:aws:iam::444455556666:role/shoplite-deployer"
   }

5. 5

   Use the alias: a billing alarm in us-east-1

   AWS publishes EstimatedCharges only in us-east-1, so both the SNS topic and the alarm must be created there. Each resource names its provider explicitly. Enable 'Receive Billing Alerts' in the account's billing preferences once.

   variable "monthly_budget_usd" {
     type    = number
     default = 50
   }
   
   variable "billing_alert_email" {
     type = string
   }
   
   resource "aws_sns_topic" "billing" {
     provider = aws.us_east_1
     name     = "${local.name_prefix}-billing"
   }
   
   resource "aws_sns_topic_subscription" "billing_email" {
     provider  = aws.us_east_1
     topic_arn = aws_sns_topic.billing.arn
     protocol  = "email"
     endpoint  = var.billing_alert_email
   }
   
   resource "aws_cloudwatch_metric_alarm" "estimated_charges" {
     provider            = aws.us_east_1
     alarm_name          = "${local.name_prefix}-estimated-charges"
     namespace           = "AWS/Billing"
     metric_name         = "EstimatedCharges"
     dimensions          = { Currency = "USD" }
     statistic           = "Maximum"
     period              = 21600
     evaluation_periods  = 1
     comparison_operator = "GreaterThanThreshold"
     threshold           = var.monthly_budget_usd
     alarm_actions       = [aws_sns_topic.billing.arn]
   }

   terminalcopy cmd

   $ ./tf dev apply -var billing_alert_email=you@example.com

   ── expected output ──

   # aws_cloudwatch_metric_alarm.estimated_charges will be created

   + resource "aws_cloudwatch_metric_alarm" "estimated_charges" {

   + alarm_name = "shoplite-dev-estimated-charges"

   + region = "us-east-1"

   ...

   Plan: 3 to add, 0 to change, 0 to destroy.

   ...

   Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

6. 6

   Passing an alias to a module (for reference)

   When a MODULE needs the us-east-1 provider (say, a CloudFront + certificate module), pass it explicitly. Inside the module, its resources just use aws as usual. The module doesn't know or care which region it got. If a module needs BOTH regions, it declares configuration_aliases = [aws.us_east_1] in its required_providers, and the caller maps both.

   Example only — ShopLite doesn't have a cdn module.

   module "cdn" {
     source = "../modules/cdn"
   
     providers = {
       aws = aws.us_east_1
     }
   
     domain_name = "static.example.com"
   }

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.