#8 Move SSM parameter definitions to bootstrap terraform

.github/workflows/verify-ssm-parameters.yml

@@ -57,8 +57,8 @@ jobs:
                     if ! PARAM_VALUE=$(aws ssm get-parameter --name "$param" --with-decryption --query 'Parameter.Value' --output text 2>/dev/null); then
                       echo "::error::Missing required SSM parameter: $param"
                       MISSING_PARAMS=1
-                    elif [ "$PARAM_VALUE" = "CHANGE_ME" ] || [ -z "$PARAM_VALUE" ]; then
-                      echo "::error::SSM parameter $param has not been configured (value is empty or placeholder)"
+                    elif [ -z "$PARAM_VALUE" ]; then
+                      echo "::error::SSM parameter $param exists but has an empty value"
                       MISSING_PARAMS=1
                     else
                       echo "✅ Parameter $param is properly configured"
@@ -71,9 +71,9 @@ jobs:
                     echo "::error::❌ One or more required SSM parameters are missing or misconfigured"
                     echo ""
                     echo "💡 To fix this:"
-                    echo "   1. Ensure Terraform has been applied to create the parameter structure"
-                    echo "   2. Manually set the actual values in AWS Systems Manager Parameter Store"
-                    echo "   3. Replace any 'CHANGE_ME' placeholder values with real configuration"
+                    echo "   1. Ensure bootstrap Terraform has been applied to create the parameters"
+                    echo "   2. Run 'terraform apply' in the infra/terraform/bootstrap directory"
+                    echo "   3. Provide the required values when prompted during bootstrap"
                     exit 1
                   fi
 

infra/terraform/bootstrap/main.tf

@@ -2,6 +2,30 @@ provider "aws" {
   region = var.aws_region
 }
 
+# SSM Parameters
+# These are populated interactively during bootstrap
+
+resource "aws_ssm_parameter" "alert_email" {
+  name        = "/jaildata/alert-email"
+  type        = "String"
+  value       = var.alert_email
+  description = "E-mail address for JailData alerts"
+}
+
+resource "aws_ssm_parameter" "jail_data_base_url" {
+  name        = "/jaildata/base-url"
+  type        = "String"
+  value       = var.jail_data_base_url
+  description = "Base URL for external jail data API endpoints"
+}
+
+resource "aws_ssm_parameter" "buncombe_api_id" {
+  name        = "/jaildata/facilities/buncombe/api-id"
+  type        = "String"
+  value       = var.buncombe_api_id
+  description = "API ID for Buncombe County jail data system"
+}
+
 # Create IAM user for GitHub Actions
 resource "aws_iam_user" "github_actions" {
   name = "github-actions-jaildata"
@@ -331,4 +355,32 @@ output "terraform_state_bucket" {
 output "terraform_state_lock_table" {
   description = "DynamoDB table for Terraform state locking"
   value       = aws_dynamodb_table.terraform_state_lock.name
+}
+
+# Reminder about SSM parameter configuration
+output "ssm_parameters_created" {
+  description = "SSM parameters created by bootstrap"
+  value = <<EOT
+
+✅ SSM Parameters Successfully Created ✅
+
+The following SSM parameters have been created with the values you provided:
+
+1. /jaildata/alert-email
+   - Purpose: Email address for JailData alerts
+
+2. /jaildata/base-url
+   - Purpose: Base URL for external jail data API endpoints
+
+3. /jaildata/facilities/buncombe/api-id
+   - Purpose: API ID for Buncombe County jail data system
+
+These parameters are now ready for use by:
+- CI/CD workflows (SSM parameter verification will pass)
+- Main Terraform deployments (dev/prod environments)
+- Serverless Lambda functions (runtime configuration)
+
+Note: The alert-topic-arn parameter is managed by the Serverless Framework deployment.
+
+EOT
 }

infra/terraform/bootstrap/variables.tf

@@ -2,4 +2,19 @@ variable "aws_region" {
   description = "The AWS region to deploy resources to"
   type        = string
   default     = "us-east-2"
+}
+
+variable "alert_email" {
+  description = "E-mail address for JailData alerts"
+  type        = string
+}
+
+variable "jail_data_base_url" {
+  description = "Base URL for external jail data API endpoints"
+  type        = string
+}
+
+variable "buncombe_api_id" {
+  description = "API ID for Buncombe County jail data system"
+  type        = string
 }

infra/terraform/dev/dev.tf

@@ -1,7 +1,6 @@
 module "main" {
-  source              = "../main"
-  environment         = var.environment
-  region              = var.region
-  domain              = var.domain
-  alert_email         = var.alert_email
+  source      = "../main"
+  environment = var.environment
+  region      = var.region
+  domain      = var.domain
 }

infra/terraform/dev/variables.tf

@@ -10,8 +10,3 @@ variable "region" {
     default = "us-east-2"
 }
 
-variable "alert_email" {
-    description = "Email address for alerts"
-    type        = string
-}
-

infra/terraform/main/parameters.tf

@@ -1,32 +1,10 @@
-resource "aws_ssm_parameter" "jail_data_base_url" {
-  name        = "/jaildata/base-url"
-  type        = "String"
-  value       = "CHANGE_ME"
-  description = "Base URL for external jail data API endpoints (set manually after deployment)"
-
-  lifecycle {
-    ignore_changes = [value]
-  }
-}
-
-resource "aws_ssm_parameter" "buncombe_api_id" {
-  name        = "/jaildata/facilities/buncombe/api-id"
-  type        = "String"
-  value       = "CHANGE_ME"
-  description = "API ID for Buncombe County jail data system (set manually after deployment)"
-
-  lifecycle {
-    ignore_changes = [value]
-  }
-}
-
 # API Gateway domain outputs
 output "ApiDomain" {
   description = "API Gateway custom domain name"
   value       = aws_api_gateway_domain_name.api_gateway_domain.domain_name
 }
 
 output "ApiZoneId" {
-  description = "Route53 zone ID for API domain"  
+  description = "Route53 zone ID for API domain"
   value       = aws_route53_zone.api_zone.zone_id
 }

infra/terraform/main/variables.tf

@@ -13,9 +13,3 @@ variable "region" {
   type        = string
 }
 
-variable "alert_email" {
-  description = "Email address for alerts"
-  type        = string
-  sensitive   = true
-}
-

infra/terraform/prod/prod.tf

@@ -3,5 +3,4 @@ module "main" {
   environment = var.environment
   region      = var.region
   domain      = var.domain
-  alert_email = var.alert_email
 }

infra/terraform/prod/variables.tf

@@ -10,8 +10,3 @@ variable "region" {
     default = "us-east-2"
 }
 
-variable "alert_email" {
-    description = "Email address for alerts"
-    type        = string
-}
-