Data & Secrets
Give ShopLite a Postgres database without a password ever touching your code or state, protect stateful resources from accidental destruction, and add private uploads with least-privilege IAM.
Stateful resources change the stakes. A replaced load balancer is a blip; a replaced database is lost data. This stage adds RDS and an uploads bucket, and with them the techniques that separate a demo from production Terraform: AWS-managed secrets that never enter state, ECS secret injection, `prevent_destroy`, preconditions and `check` blocks that catch mistakes at plan time, and IAM policies scoped to exactly one bucket prefix.
+ ShopLite gains: RDS Postgres in the database subnets with an AWS-managed master secret, the API reading its credentials from Secrets Manager, lifecycle guardrails and health checks, and a private uploads bucket with presigned uploads
- 4.1
RDS Postgres in the Database Subnets
A private, encrypted Postgres 16 instance in the database subnets, reachable only from the app security group, with its master password generated and stored by AWS — not by you.
45 min (RDS takes ~8 minutes to create)~$0.02/hour for db.t4g.micro single-AZ + storage2 break-its - 4.2
Secrets from Secrets Manager into ECS — Never Through State
ShopLite `1.2.0` connects to Postgres over verified TLS using credentials ECS injects from Secrets Manager at task start, and you can prove the password appears nowhere in Terraform.
40 minSecrets Manager: ~$0.40/month per secret (the RDS-managed one)2 break-its - 4.3
Guardrails: prevent_destroy, Preconditions, and check Blocks
Terraform refuses any plan that would destroy the ShopLite database, refuses to deploy prod without Multi-AZ, and warns after every apply if the live API isn't healthy.
35 minFree3 break-its - 4.4
Private Uploads with a Least-Privilege Task Role
A private uploads bucket that clients write to directly with presigned URLs issued by ShopLite `1.3.0`, where the task role can touch exactly one prefix of one bucket and non-TLS requests are denied.
40 minCents2 break-its