Add AWS application stack catalog: VPC, EKS Fargate, RDS Postgres, S3, Helm app

[coryodaniel]

Summary

A self-contained AWS application stack as Massdriver bundles. Real Terraform throughout — no random_pet simulations.

Bundles

• aws-vpc — real VPC via terraform-aws-modules/vpc/aws. Configurable region, CIDR, AZ count, NAT mode, optional VPC Flow Logs.
• aws-eks-fargate — bare-minimum EKS Fargate cluster. Cluster IAM role, EKS control plane, Fargate pod-execution role, Fargate profiles per namespace, plus a cluster-admin ServiceAccount with a long-lived bearer-token Secret used by the Massdriver helm provisioner. No OIDC provider, no addons, no log group — fork the bundle if you need them.
• aws-rds-postgres — real RDS Postgres with IAM auth, Multi-AZ option, 0–5 read replicas, Secrets Manager-backed master credentials, parameter group with rds.force_ssl=1 + pg_stat_statements, enhanced monitoring.
• aws-s3-bucket — real S3 bucket tuned for user-uploaded content: SSE-KMS or SSE-S3, versioning, CORS, lifecycle archive/expire, presign-friendly IAM policies, optional SNS event notifications, optional cross-region replication.
• aws-app — in-bundle Helm chart that deploys nginx (public.ecr.aws/nginx/nginx:1.27 — anonymous ECR Public pulls, no Docker Hub rate limits) on EKS Fargate. Connection metadata from the linked RDS Postgres database and S3 bucket is rendered into the pod as environment variables. DB password is not in pod env — DB_SECRET_ARN points at Secrets Manager and a real workload would fetch credentials at runtime via IRSA.

Resource types

aws-vpc, aws-eks-cluster, aws-rds-postgres, aws-s3-bucket, aws-application. All flat (no data/specs wrappers). The Massdriver helm provisioner reads a v1-shaped kubernetes_cluster.data.authentication.cluster.server / …user.token contract; aws-app's helm step config reshapes the flat aws-eks-cluster artifact into that contract inline so the rest of the catalog's resource types stay clean.

Schema features

• $md.immutable on identity-shaping fields: CIDR, AZ count, cluster name, namespace, bucket prefix, master username, encryption mode, ownership.
• $md.sensitive on the RDS master password override and the cluster bearer token.
• $md.enum is wired through the helm chart template (templates/aws-helm-chart/) for surfacing data-resource policy choices on scaffolded app bundles.

Compliance

• Per-bundle .checkov.yml skip lists with rationale comments. Skips cover only false positives (cross-module flow logs, NAT EIPs, 443-only egress) and the project-level no-CMK policy. Configurable knobs (Multi-AZ, deletion protection, public endpoint, CRR, etc.) are deliberately not skipped — production presets set them, lower envs surface a warning.
• Each bundle's checkov config has halt_on_failure: '.params.md_metadata.default_tags["md-target"] | test("^(prod|prd|production)$")'. Failures block deploy in production envs and surface as warnings in lower envs.

Operator runbooks

Each bundle ships a mustache-templated operator.md with copy-pasteable AWS CLI / kubectl / psql commands that interpolate the live cluster name, region, bucket name, ARNs, etc. Each bundle also ships a GitHub-style README.md describing what it provisions, its connections, outputs, and configuration highlights.

Helm chart template

templates/aws-helm-chart/ scaffolds new helm-deployed app bundles wired to aws-eks-cluster (and optionally aws-rds-postgres / aws-s3-bucket). Same in-bundle-chart pattern as aws-app — operators publish their app's chart inside the bundle, the helm provisioner picks it up.

Test plan

• mass resource-type publish for each of the five resource types (admin rights required)
• make publish-bundles (or per-bundle mass bundle publish --development)
• Build a project canvas; link components per GUIDE.md
• Set the AWS IAM role as the env default
• Pin instances to release-channel=development for auto-redeploy on dev publishes
• Deploy in order: vpc → cluster → db / uploads (parallel) → app
• Verify env wiring on the running pod: kubectl exec -n app <pod> -- env | grep -E '^(DB|S3|EKS)_'

Notes

• Per-region VPC quota of at least 1 free slot is required. The bundle's region enum supports the common 10 AWS regions. The example deploy in this PR uses us-west-1.
• The helm provisioner authenticates via static bearer token, not exec — short-lived aws eks get-token tokens don't fit the provisioner's contract. The aws-eks-fargate bundle creates a kubernetes.io/service-account-token Secret bound to a cluster-admin ServiceAccount for that purpose.
• The aws-app bundle's connection field for the cluster is named eks (not kubernetes_cluster); the cluster's artifact field is named kubernetes_cluster. So the canvas link is <cluster-component>.kubernetes_cluster → <app-component>.eks.
• The aws-eks-fargate bundle does NOT provision an OIDC provider or set up IRSA. If your workload needs IRSA, run aws eks describe-cluster ... --query 'cluster.identity.oidc.issuer' and create the IAM identity provider out-of-band, then annotate ServiceAccounts with eks.amazonaws.com/role-arn.

🤖 Generated with Claude Code