autumn-cli 0.10.0

# outputs.tf — generated by `autumn release init --target aws-app-runner`

# Every `aws` CLI call in the deploy walkthrough targets this region
# explicitly (via AWS_REGION, sourced from this output) rather than relying
# on the operator's ambient CLI config, which may point somewhere else
# entirely. AWS_REGION, not AWS_DEFAULT_REGION: the AWS CLI documents
# AWS_REGION as taking precedence over AWS_DEFAULT_REGION when both are
# set, so exporting only the latter wouldn't override an operator's
# already-exported AWS_REGION.
output "region" {
  description = "AWS region `terraform apply` provisioned into — export as AWS_REGION (not AWS_DEFAULT_REGION, which AWS_REGION takes precedence over) before running any `aws` CLI command in the deploy walkthrough, so the CLI always targets the same region Terraform used."
  value       = var.region
}

# App Runner assigns this hostname at service-creation time — there's no
# environment-level domain known in advance the way Azure Container Apps
# has, so AUTUMN_SECURITY__TRUSTED_HOSTS__HOSTS can only be set (via the
# same `aws apprunner update-service` call that swaps in the real image —
# see docs/guide/deployment.md) once this output exists.
output "app_url" {
  description = "Public HTTPS URL of the deployed {{project_name}} App Runner service."
  value       = "https://${aws_apprunner_service.this.service_url}"
}

output "service_arn" {
  description = "ARN of the App Runner service — used by the deploy walkthrough's `aws apprunner update-service`/`start-deployment` calls."
  value       = aws_apprunner_service.this.arn
}

output "service_name" {
  description = "Sanitized name Terraform gave the App Runner service (see local.app_name_safe in main.tf)."
  value       = aws_apprunner_service.this.service_name
}

output "ecr_repository_url" {
  description = "URL of the ECR repository (used by `docker push`/`docker login` in the deploy walkthrough)."
  value       = aws_ecr_repository.this.repository_url
}

output "apprunner_access_role_arn" {
  description = "ARN of the IAM role that grants App Runner pull access to the private ECR repository — pass this as the `access-role-arn` once the deploy walkthrough switches source_configuration over to your own image."
  value       = aws_iam_role.apprunner_access.arn
}

output "apprunner_instance_role_arn" {
  description = "Secret-reading runtime role for the real application image. The bootstrap image deliberately receives no instance role; the deploy walkthrough attaches this role during cutover."
  value       = aws_iam_role.apprunner_instance.arn
}

# `aws apprunner update-service --source-configuration` REPLACES the image
# configuration wholesale, not merges it — the deploy walkthrough's cutover
# call must therefore re-supply RuntimeEnvironmentSecrets explicitly (using
# these ARNs) alongside the real image, or the cutover silently drops
# AUTUMN_DATABASE__PRIMARY_URL/AUTUMN_SECURITY__SIGNING_SECRET and the real
# app can't boot.
output "database_url_secret_arn" {
  description = "Secrets Manager ARN for the derived database URL — required by the deploy walkthrough's cutover `update-service` call (RuntimeEnvironmentSecrets)."
  value       = aws_secretsmanager_secret.database_url.arn
}

output "signing_secret_secret_arn" {
  description = "Secrets Manager ARN for the signing secret — required by the deploy walkthrough's cutover `update-service` call (RuntimeEnvironmentSecrets)."
  value       = aws_secretsmanager_secret.signing_secret.arn
}

# The four outputs below back the deploy walkthrough's `aws ecs run-task`
# call for the one-shot migration task (see aws_ecs_task_definition.migrate
# in main.tf) — App Runner has no release-phase hook of its own, and RDS is
# private with no public entry point, so migrations need this dedicated
# path into the VPC.

output "migrate_cluster_name" {
  description = "ECS cluster name required by the deploy walkthrough's `aws ecs run-task` call for the one-shot migration task."
  value       = aws_ecs_cluster.migrate.name
}

output "migrate_task_family" {
  description = "Task definition family for the one-shot migration task — the deploy walkthrough registers a fresh revision with the real image before every cutover, since App Runner never runs migrations on its own."
  value       = aws_ecs_task_definition.migrate.family
}

output "private_subnet_ids" {
  description = "Private subnet IDs required by the deploy walkthrough's `aws ecs run-task --network-configuration` for the one-shot migration task."
  value       = aws_subnet.private[*].id
}

# Deliberately the SAME security group the App Runner VPC connector itself
# uses, not a new one: RDS's ingress rule (aws_security_group.database)
# already trusts this security group as its source, so running the
# migration task with it attached reaches RDS without a second security
# group or RDS rule to keep in sync.
output "vpc_connector_security_group_id" {
  description = "Security group ID shared by the App Runner VPC connector and RDS's own ingress rule — required by the deploy walkthrough's `aws ecs run-task --network-configuration` for the one-shot migration task."
  value       = aws_security_group.vpc_connector.id
}