Phase 1 - Infrastructure (Terraform)

Prerequisites

Before running anything, ensure you have:

• AWS CLI configured (aws configure)
• Terraform >= 1.5.0 installed
• kubectl installed
• Helm >= 3.0 installed
• kubeseal installed
• WSL (if on Windows)

WSL TLS Fix

If you're on WSL, Terraform's TLS stack may fail to reach AWS endpoints. Fix it by pointing Go's TLS to Python's cert bundle:

export SSL_CERT_FILE=$(python3 -c "import certifi; print(certifi.where())")

Run this in every terminal session before applying Terraform.

Remote State Setup

Terraform state is stored in S3 with DynamoDB locking. This was created once manually:

S3 Bucket:      terraform-fintrack-state-203637463799
DynamoDB Table: fintrack-terraform-locks
Region:         us-east-1

Module Structure

modules/
  ├── vpc/        — VPC, subnets, internet gateway, route tables
  ├── eks/        — EKS cluster, node group, OIDC provider, access entries
  ├── rds/        — PostgreSQL 16, db.t3.micro, private subnets only
  ├── s3/         — Private bucket for receipt uploads
  ├── iam/        — IRSA roles, GitHub Actions OIDC role, ECR repositories
  └── dns/        — Route53 hosted zone, ACM certificate, A record alias

Why Two-Phase Apply?