bootstrap

Source: github.com/spin-stack/spin-terraform-aws//bootstrap?ref=<tag>. Generated from its variables.tf and outputs.tf.

Variables

Variable	Type	Default
cost_allocation_tags	bool	false
github_repositories	map(string)	{}
region	string	"us-west-2"
image_publishers	map(string)	{}
publish_regions	list(string)	[]

cost_allocation_tags

Activate spin’s tags as cost allocation tags in this account: true once an installation has run a day here, in one bootstrap per account.

• Type: bool
• Default: false

github_repositories

Repositories that apply an installation from GitHub Actions, as owner/name => the prefix of their OIDC subject (sub_claim_prefix, above): each gets a plan role and an apply role.

• Type: map(string)
• Default: {}

region

The region the installations are in.

• Type: string
• Default: "us-west-2"

image_publishers

Repositories that publish Spin OS from GitHub Actions, as owner/name => the prefix of their OIDC subject (github.tf): each gets a publish role.

• Type: map(string)
• Default: {}

publish_regions

The regions a publish role writes snapshots and registers images in; none is this bootstrap’s region.

• Type: list(string)
• Default: []

Outputs

Output	What it is
github_roles	For each repository, the roles its workflow assumes: AWS_PLAN_ROLE and AWS_APPLY_ROLE.
bucket	The bucket every installation’s state is in.
kms_alias	The key every installation’s state is encrypted with.
init	Run this in an installation’s directory (examples/complete, or your own copy of it) instead of a bare tofu init.
secure_boot_keys	Each role’s Secure Boot key, by the alias spin-stack/ami signs that role’s image with.
publish_roles	For each repository that publishes Spin OS, the role its workflow assumes.