# Enterprise IaC Scaffold

A structured Infrastructure as Code scaffold for enterprise AWS deployments, built on Terraform, Bitbucket Pipelines, and OPA policy governance.

## Tools

| Tool           | Version | License    | Used In   | Purpose                                                           |
| -------------- | ------- | ---------- | --------- | ----------------------------------------------------------------- |
| Terraform      | 1.5.4+  | BSL 1.1    | Local, CI | Provisions and manages AWS infrastructure via declarative HCL     |
| OPA            | 0.68.2  | Apache-2.0 | Local, CI | Validates Terraform plans against Rego policies before apply      |
| tflint         | 0.62.1  | MPL-2.0    | Local, CI | Static analysis of Terraform code to catch errors before planning |
| terraform-docs | 0.24.0  | MIT        | Local, CI | Generates module documentation from Terraform source              |
| Python         | 3.12+   | PSF        | CI        | Powers all pipeline scripts                                       |
| PowerShell     | 5.1+    | MIT        | Local     | Developer tooling and local workspace scripts                     |

## Repository Layout

| Repository         | Purpose                                                                                                               |
| ------------------ | --------------------------------------------------------------------------------------------------------------------- |
| `iac-policies`     | OPA Rego policy rules enforced across all infrastructure repositories. Versioned and released via git tags.           |
| `iac-modules`      | Reusable composite Terraform modules consumed by environments and platform stacks.                                    |
| `iac-environments` | Workload infrastructure organized by environment. Each environment contains independently deployable Terraform units. |
| `iac-core`         | Foundational AWS infrastructure — account management, networking, security, and archival.                             |

## Pipeline Flows

### iac-policies

PR opens → OPA policy tests → peer review → merge → publish bundle to Artifactory

### iac-modules

PR opens → `terraform fmt --check` → tflint (advisory) → terraform-docs staleness check → peer review → merge → publish module to Artifactory

### iac-environments

**PR pipeline**
PR opens → `terraform init` + `fmt --check` + `validate` → tflint (hard fail) → OPA policy evaluation (hard fail) → `terraform plan` saved to S3 → post plan summary to PR

**Apply pipeline**
Retrieve plan from S3 → `terraform apply` → post apply result to PR

### iac-core

Same flow as `iac-environments`. Higher blast radius — stricter reviewer requirements.

## Gates

| Repository         | Merge Gate                              |
| ------------------ | --------------------------------------- |
| `iac-policies`     | PR approval by platform leads           |
| `iac-modules`      | PR approval by platform leads           |
| `iac-environments` | PR approval + passing pipeline required |
| `iac-core`         | PR approval + passing pipeline required |