1a. Remote state bootstrap

cd documind-infra/bootstrap
terraform init
terraform apply -var="state_bucket_name=documind-terraform-state-<account-id>"

1b. Backend + providers (root module)

backend.tf:

terraform {
backend "s3" {
bucket       = "documind-terraform-state-<account-id>"
key          = "dev/terraform.tfstate"
region       = "us-east-1"
encrypt      = true
use_lockfile = true
}
}

providers.tf - aws, kubernetes, helm providers. The kubernetes/helm providers use exec-based auth (aws eks get-token), not a static token - static tokens expire mid-apply on long-running Helm installs.

1c. VPC, EKS, RDS, S3, IRSA

export TF_VAR_db_password="..."
export TF_VAR_database_url="placeholder"
export TF_VAR_jwt_secret="placeholder"
export TF_VAR_gemini_api_key="placeholder"   # real value needed by Phase 10
terraform apply -target=module.vpc -target=module.eks -target=module.rds \
  -target=module.s3 -target=module.irsa

• VPC: 2 public + 2 private subnets, NAT Gateway, correctly tagged for EKS (kubernetes.io/role/elb / internal-elb)
• EKS: separate IAM roles for control plane vs. node group
• RDS: security group restricted to EKS node SG only, never public
• S3: private, presigned-URL access only
• IRSA: one scoped IAM role per AWS-calling component

aws eks update-kubeconfig --profile documind --region us-east-1 --name documind-dev
kubectl get nodes