菜单
Deploy a Terraform state backend (S3 + DynamoDB) via CloudFormation.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Deploy a backend tier stack: Lambda + API Gateway v2 + DynamoDB (feature-flagged).
Compose a deployment from stack skills and generate executable artifacts (Makefiles, security disposition). Use when the user says 'compose', 'generate deployment', or invokes /ipa-compose.
Initialize IPA project configuration
Deploy a CodePipeline CI/CD pipeline with CodeBuild for automated build/test/deploy.
Deploy a CodeCommit repository for source code management.
Deploy a Cognito User Pool stack with OAuth 2.0 Hosted UI and OIDC endpoints.
| name | ipa-stack-tfstate |
| description | Deploy a Terraform state backend (S3 + DynamoDB) via CloudFormation. |
Deploy the Terraform state backend infrastructure. This stack is always deployed via CloudFormation — even when APP_IAC=terraform — because the Terraform state backend must exist before Terraform can run.
| Property | Value |
|---|---|
| Stack name | {APP_NAMESPACE}-{APP_ENV}-tfstate |
| Template | infra/cfn/tfstate/tfstate.yml |
| Capabilities | none |
| Lifecycle | prepare (prerequisite stack) |
| Tier | tfstate |
| Parameter | Type | Default | Validation | Error Message |
|---|---|---|---|---|
| Namespace | String | — | /^[a-z][a-z0-9-]{0,11}$/ | "Invalid namespace — 1-12 chars, lowercase alphanumeric + hyphens, starts with letter" |
| Environment | String | — | dev | staging | prod | "Must be dev, staging, or prod" |
All parameters are Configuration type — sourced from .env.
No wirable parameters — all parameters are configuration type.
No Compose Config prompts — all values come from .env.
| Output | Description | Export Convention | Used By |
|---|---|---|---|
| StateBucketName | S3 bucket name for Terraform state files | {StackName}-StateBucketName | All Terraform modules (backend config) |
| LockTableName | DynamoDB table name for state locking | {StackName}-LockTableName | All Terraform modules (backend config) |
None.
Both the S3 bucket and DynamoDB table have DeletionPolicy: Retain. Manual cleanup required:
aws s3 rm s3://{bucket-name} --recursiveaws dynamodb delete-table --table-name {table-name}aws s3 rb s3://{bucket-name}make -f scripts/prepare.mk teardown-tfstateRequired IAM actions: s3:CreateBucket, PutBucketVersioning, PutBucketEncryption, PutBucketPublicAccessBlock, PutBucketPolicy — scoped to arn:aws:s3:::{ns}-{env}-tfstate-*. dynamodb:CreateTable, DescribeTable, UpdateTable, UpdateContinuousBackups — scoped to arn:aws:dynamodb:{Region}:{AccountId}:table/{ns}_{env}_tfstate_lock.
Security controls: S3 versioning enabled, AES256 encryption, public access blocked, TLS-only policy. DynamoDB SSE enabled, PITR enabled, PAY_PER_REQUEST billing.
Full advisory: See SECURITY.md