Create AWS Resources

Step-by-Step Process

1. Navigate to the Correct Directory

Move into the appropriate environment directory: For development:

cd Workloads/Development/<workload-development>/development/<region>/cluster-permissions/applications/config

For production:

cd Workloads/Production/<workload-production>/production/<region>/cluster-permissions/applications/config

2. Initialize Terraform

terragrunt init

This command will:

Initialize Terraform
Create the SSM parameter for this unit if it does not already exist (when secrets are enabled)

3. Configure Your Application

Edit the inputs.hcl file and add your service definition under the microservice section.

{
  name = "your-app-name"
  tier = "application"
  ecr  = {}
  
  deployer = {
    additional_policy_statements = {}
    allowed_ssm_parameter_arns   = []
    
    oidc = {
      audiences = [
        "sts.amazonaws.com"
      ]
      subjects_with_wildcards = []
      subjects = [
        "repo:your-org/your-app:ref:refs/heads/development",
        "repo:your-org/your-app:environment:development"
      ]
    }
  }
  
  static_secret = {
    create             = true
    additional_secrets = []
  }
  
  clusters = {
    "dev-1-31-your-cluster" = {
      create_secret                            = false
      additional_secrets                       = []
      application_additional_policy_statements = {}
    }
  }
}

Configuration Fields Explained

Field	Description	Example Value
`name`	Unique application name	`"your-app-name"`
`tier`	Application tier (usually `"application"`)	`"application"`
`namespace`	Environment namespace	`"development"` or `"production"`
`ecr`	ECR (Elastic Container Registry) settings	`{}` (empty for default)
`deployer.oidc.subjects`	GitHub repository + branch patterns	`"repo:your-org/your-app:ref:refs/heads/branch-name"`
`static_secret.create`	Create environment variables secret?	`true`
`clusters`	Per-cluster configuration	Defines secrets and IAM policies

Use a unique name for each application to avoid conflicts
Update the subjects array with your actual GitHub repo and branch names
Replace your-org/your-app with your GitHub organization and repository
Update the cluster name to match your target cluster

When you save the configuration, Fast Foundation automatically creates the following AWS resources:

Pipeline Role

IAM role for your CI/CD pipeline to deploy the application

Application Role

IAM role for your app to access AWS services

Application Secret

AWS Secrets Manager secret for environment variables

ECR Repository

Container registry for storing Docker images

4. Plan and Apply Changes

Run the following commands to review and apply changes:

# Review what will be created
terragrunt plan

# Apply changes
terragrunt apply

5. Save the Output Values

After Terraform applies successfully, capture the output values:

terragrunt output

Example Output

A typical output looks like this:

"app_name" = {
  "cluster_resources_per_cluster" = {
    "cluster_name" = {
      "service_account_role_arn" = "arn:aws:iam::123456789101:role/cluster_name_environment_app_prefix"
    }
  }
  "ecr_repository" = "1110987654321.dkr.ecr.us-east-1.amazonaws.com/development/application/app_name"
  "pipeline_role" = "arn:aws:iam::1110987654321:role/deployer_environment_app_name"
  "static_secret" = "arn:aws:secretsmanager:us-east-1:123456789101:secret:environment/app_name/env-cDkfzs"
}

Understanding the Output Values

Value	Description	Purpose
`service_account_role_arn`	Role used by Kubernetes service account	Application permissions in cluster
`ecr_repository`	Container registry URL	Stores Docker images for the app
`pipeline_role`	CI/CD deployment role	Used by GitHub Actions
`static_secret`	ARN of environment secret	Holds app configuration variables

Configure Application Secrets

At this stage you can add your environment variables:

Open AWS Secrets Manager in the AWS Console
Find the secret created for your app
Add key-value pairs for environment variables

Next Steps

With AWS resources created and outputs saved, move on to Create Manifest Files to configure your Kubernetes deployment.

Troubleshooting

Permission Denied Error

Ensure you’re using AWS credentials with the right permissions for the workload account.

Terraform State Lock Error

State lock issues

Terragrunt and Terraform use DynamoDB locks to prevent multiple people from applying changes at the same time on the same unit. If you see a state lock error, it usually means someone else is already running a deployment.What to do:

⏳ Wait for the other deployment to finish.
✅ Verify you’re not overwriting someone else’s changes.
✅ Refresh your parameter. Save your current changes locally (they may be overwritten).
🚀 Apply your changes once you’re sure everything is okay.

Configuration Not Found

Double-check you are in the correct directory and have successfully run terragrunt init.

Introduction & Key Concepts

AWS SSO Setup

IaC Management

User Management

Application Creation

ArgoCD UI

Workshops

Step-by-Step Process

1. Navigate to the Correct Directory

2. Initialize Terraform

3. Configure Your Application

Configuration Fields Explained

Pipeline Role

Application Role

Application Secret

ECR Repository

4. Plan and Apply Changes

5. Save the Output Values

Example Output

Understanding the Output Values

Configure Application Secrets

Next Steps

Troubleshooting

State lock issues

​Step-by-Step Process

​1. Navigate to the Correct Directory

​2. Initialize Terraform

​3. Configure Your Application

​Configuration Fields Explained

Pipeline Role

Application Role

Application Secret

ECR Repository

​4. Plan and Apply Changes

​5. Save the Output Values

​Example Output

​Understanding the Output Values

​Configure Application Secrets

​Next Steps

​Troubleshooting

​State lock issues

Step-by-Step Process

1. Navigate to the Correct Directory

2. Initialize Terraform

3. Configure Your Application

Configuration Fields Explained

4. Plan and Apply Changes

5. Save the Output Values

Example Output

Understanding the Output Values

Configure Application Secrets

Next Steps

Troubleshooting

State lock issues