# bootstrap

**Spinbox is experimental: APIs change and data may be lost.** What is built and what proves it is on [Status](https://spin-stack.github.io/website/reference/status.md); what Spinbox does not do is on [Limitations](https://spin-stack.github.io/website/overview/limitations.md).

> spin-terraform-aws, the once-per-account state bucket and key, and CI's roles.

<!-- Generated by tools/refgen from spin-terraform-aws:bootstrap/variables.tf. Edit the source, not this file. -->

Source: `github.com/spin-stack/spin-terraform-aws//bootstrap?ref=<tag>`. Generated from its `variables.tf` and `outputs.tf`.

## Variables

| Variable | Type | Default |
|---|---|---|
| [`cost_allocation_tags`](#cost_allocation_tags) | `bool` | `false` |
| [`github_repositories`](#github_repositories) | `map(string)` | `{}` |
| [`region`](#region) | `string` | `"us-west-2"` |
| [`image_publishers`](#image_publishers) | `map(string)` | `{}` |
| [`publish_regions`](#publish_regions) | `list(string)` | `[]` |

### cost_allocation_tags

Activate spin's tags as cost allocation tags in this account: true once an installation has run a day here, in one bootstrap per account.

- Type: `bool`
- Default: `false`

### github_repositories

Repositories that apply an installation from GitHub Actions, as owner/name => the prefix of their OIDC subject (sub_claim_prefix, above): each gets a plan role and an apply role.

- Type: `map(string)`
- Default: `{}`

### region

The region the installations are in.

- Type: `string`
- Default: `"us-west-2"`

### image_publishers

Repositories that publish Spin OS from GitHub Actions, as owner/name => the prefix of their OIDC subject (github.tf): each gets a publish role.

- Type: `map(string)`
- Default: `{}`

### publish_regions

The regions a publish role writes snapshots and registers images in; none is this bootstrap's region.

- Type: `list(string)`
- Default: `[]`

## Outputs

| Output | What it is |
|---|---|
| `github_roles` | For each repository, the roles its workflow assumes: AWS_PLAN_ROLE and AWS_APPLY_ROLE. |
| `bucket` | The bucket every installation's state is in. |
| `kms_alias` | The key every installation's state is encrypted with. |
| `init` | Run this in an installation's directory (examples/complete, or your own copy of it) instead of a bare tofu init. |
| `secure_boot_keys` | Each role's Secure Boot key, by the alias spin-stack/ami signs that role's image with. |
| `publish_roles` | For each repository that publishes Spin OS, the role its workflow assumes. |