Menu
Deploy a Terraform state backend (S3 + DynamoDB) via CloudFormation.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Deploy a backend tier stack: Lambda + API Gateway v2 + DynamoDB (feature-flagged).
Compose a deployment from stack skills and generate executable artifacts (Makefiles, security disposition). Use when the user says 'compose', 'generate deployment', or invokes /ipa-compose.
Initialize IPA project configuration
Deploy a CodePipeline CI/CD pipeline with CodeBuild for automated build/test/deploy.
Deploy a CodeCommit repository for source code management.
Deploy a Cognito User Pool stack with OAuth 2.0 Hosted UI and OIDC endpoints.
| name | ipa-stack-tfstate |
| description | Deploy a Terraform state backend (S3 + DynamoDB) via CloudFormation. |
Deploy the Terraform state backend infrastructure. This stack is always deployed via CloudFormation — even when APP_IAC=terraform — because the Terraform state backend must exist before Terraform can run.
| Property | Value |
|---|---|
| Stack name | {APP_NAMESPACE}-{APP_ENV}-tfstate |
| Template | infra/cfn/tfstate/tfstate.yml |
| Capabilities | none |
| Lifecycle | prepare (prerequisite stack) |
| Tier | tfstate |
| Parameter | Type | Default | Validation | Error Message |
|---|---|---|---|---|
| Namespace | String | — | /^[a-z][a-z0-9-]{0,11}$/ | "Invalid namespace — 1-12 chars, lowercase alphanumeric + hyphens, starts with letter" |
| Environment | String | — | dev | staging | prod | "Must be dev, staging, or prod" |
All parameters are Configuration type — sourced from .env.
No wirable parameters — all parameters are configuration type.
No Compose Config prompts — all values come from .env.
| Output | Description | Export Convention | Used By |
|---|---|---|---|
| StateBucketName | S3 bucket name for Terraform state files | {StackName}-StateBucketName | All Terraform modules (backend config) |
| LockTableName | DynamoDB table name for state locking | {StackName}-LockTableName | All Terraform modules (backend config) |
None.
Both the S3 bucket and DynamoDB table have DeletionPolicy: Retain. Manual cleanup required:
aws s3 rm s3://{bucket-name} --recursiveaws dynamodb delete-table --table-name {table-name}aws s3 rb s3://{bucket-name}make -f scripts/prepare.mk teardown-tfstateRequired IAM actions: s3:CreateBucket, PutBucketVersioning, PutBucketEncryption, PutBucketPublicAccessBlock, PutBucketPolicy — scoped to arn:aws:s3:::{ns}-{env}-tfstate-*. dynamodb:CreateTable, DescribeTable, UpdateTable, UpdateContinuousBackups — scoped to arn:aws:dynamodb:{Region}:{AccountId}:table/{ns}_{env}_tfstate_lock.
Security controls: S3 versioning enabled, AES256 encryption, public access blocked, TLS-only policy. DynamoDB SSE enabled, PITR enabled, PAY_PER_REQUEST billing.
Full advisory: See SECURITY.md