> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fastfoundation.nimble.la/llms.txt
> Use this file to discover all available pages before exploring further.

# Create AWS Resources

> Configure AWS infrastructure resources for your application including ECR repositories, IAM roles, and secrets

## Step-by-Step Process

### 1. Navigate to the Correct Directory

Move into the appropriate environment directory:

For **development**:

```bash theme={null}
cd Workloads/Development/<workload-development>/development/<region>/cluster-permissions/applications/config
```

For **production**:

```bash theme={null}
cd Workloads/Production/<workload-production>/production/<region>/cluster-permissions/applications/config
```

### 2. Initialize Terraform

```bash theme={null}
terragrunt init
```

This command will:

* Initialize Terraform
* Create the SSM parameter for this unit if it does not already exist (when secrets are enabled)

### 3. Configure Your Application

Edit the `inputs.hcl` file and add your service definition under the microservice section.

<CodeGroup>
  ```hcl Example Configuration theme={null}
  {
    name = "your-app-name"
    tier = "application"
    ecr  = {}
    
    deployer = {
      additional_policy_statements = {}
      allowed_ssm_parameter_arns   = []
      
      oidc = {
        audiences = [
          "sts.amazonaws.com"
        ]
        subjects_with_wildcards = []
        subjects = [
          "repo:your-org/your-app:ref:refs/heads/development",
          "repo:your-org/your-app:environment:development"
        ]
      }
    }
    
    static_secret = {
      create             = true
      additional_secrets = []
    }
    
    clusters = {
      "dev-1-31-your-cluster" = {
        create_secret                            = false
        additional_secrets                       = []
        application_additional_policy_statements = {}
      }
    }
  }
  ```
</CodeGroup>

#### Configuration Fields Explained

| Field                    | Description                                | Example Value                                         |
| ------------------------ | ------------------------------------------ | ----------------------------------------------------- |
| `name`                   | Unique application name                    | `"your-app-name"`                                     |
| `tier`                   | Application tier (usually `"application"`) | `"application"`                                       |
| `namespace`              | Environment namespace                      | `"development"` or `"production"`                     |
| `ecr`                    | ECR (Elastic Container Registry) settings  | `{}` (empty for default)                              |
| `deployer.oidc.subjects` | GitHub repository + branch patterns        | `"repo:your-org/your-app:ref:refs/heads/branch-name"` |
| `static_secret.create`   | Create environment variables secret?       | `true`                                                |
| `clusters`               | Per-cluster configuration                  | Defines secrets and IAM policies                      |

<Warning>
  * Use a **unique name** for each application to avoid conflicts
  * Update the `subjects` array with your actual GitHub repo and branch names
  * Replace `your-org/your-app` with your GitHub organization and repository
  * Update the cluster name to match your target cluster
</Warning>

When you save the configuration, Fast Foundation automatically creates the following AWS resources:

<CardGroup cols={2}>
  <Card title="Pipeline Role" icon="key">
    IAM role for your CI/CD pipeline to deploy the application
  </Card>

  <Card title="Application Role" icon="shield">
    IAM role for your app to access AWS services
  </Card>

  <Card title="Application Secret" icon="lock">
    AWS Secrets Manager secret for environment variables
  </Card>

  <Card title="ECR Repository" icon="box">
    Container registry for storing Docker images
  </Card>
</CardGroup>

### 4. Plan and Apply Changes

Run the following commands to review and apply changes:

```bash theme={null}
# Review what will be created
terragrunt plan

# Apply changes
terragrunt apply
```

### 5. Save the Output Values

After Terraform applies successfully, capture the output values:

```bash theme={null}
terragrunt output
```

## Example Output

A typical output looks like this:

```json theme={null}
"app_name" = {
  "cluster_resources_per_cluster" = {
    "cluster_name" = {
      "service_account_role_arn" = "arn:aws:iam::123456789101:role/cluster_name_environment_app_prefix"
    }
  }
  "ecr_repository" = "1110987654321.dkr.ecr.us-east-1.amazonaws.com/development/application/app_name"
  "pipeline_role" = "arn:aws:iam::1110987654321:role/deployer_environment_app_name"
  "static_secret" = "arn:aws:secretsmanager:us-east-1:123456789101:secret:environment/app_name/env-cDkfzs"
}
```

## Understanding the Output Values

| Value                      | Description                             | Purpose                            |
| -------------------------- | --------------------------------------- | ---------------------------------- |
| `service_account_role_arn` | Role used by Kubernetes service account | Application permissions in cluster |
| `ecr_repository`           | Container registry URL                  | Stores Docker images for the app   |
| `pipeline_role`            | CI/CD deployment role                   | Used by GitHub Actions             |
| `static_secret`            | ARN of environment secret               | Holds app configuration variables  |

## Configure Application Secrets

At this stage you can add your environment variables:

1. Open AWS Secrets Manager in the AWS Console
2. Find the secret created for your app
3. Add key-value pairs for environment variables

## Next Steps

With AWS resources created and outputs saved, move on to [Create Manifest Files](/application-creation/3-create-manifest-files) to configure your Kubernetes deployment.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Permission Denied Error">
    Ensure you're using AWS credentials with the right permissions for the workload account.
  </Accordion>

  <Accordion title="Terraform State Lock Error">
    ### State lock issues

    Terragrunt and Terraform use **DynamoDB locks** to prevent multiple people from applying changes at the same time on the same unit. If you see a state lock error, it usually means someone else is already running a deployment.

    **What to do:**

    * ⏳ Wait for the other deployment to finish.
    * ✅ Verify you’re not overwriting someone else’s changes.
    * ✅ Refresh your parameter. Save your current changes locally (they may be overwritten).
    * 🚀 Apply your changes once you’re sure everything is okay.
  </Accordion>

  <Accordion title="Configuration Not Found">
    Double-check you are in the correct directory and have successfully run `terragrunt init`.
  </Accordion>
</AccordionGroup>