Update

Author: nikhilwoodruff

.github/workflows/deploy.yml

@@ -11,6 +11,7 @@ permissions:
 
 jobs:
   deploy:
+    name: Deploy
     runs-on: ubuntu-latest
 
     steps:

DEPLOYMENT.md

@@ -20,7 +20,7 @@ This creates `policyengine-api-v2-terraform-state` with versioning enabled.
 
 **Note**: Only needs to be done once.
 
-## Step 2: Set up GitHub OIDC
+## Step 2: Set up GitHub OIDC and IAM role
 
 1. Get your AWS account ID:
 
@@ -36,27 +36,22 @@ aws iam create-open-id-connect-provider \
   --client-id-list sts.amazonaws.com
 ```
 
-3. Create IAM role for GitHub Actions:
-   - AWS Console → IAM → Roles → Create role
-   - Trusted entity type: Web identity
-   - Identity provider: `token.actions.githubusercontent.com`
-   - Audience: `sts.amazonaws.com`
-   - GitHub organization: `PolicyEngine`
-   - GitHub repository: `policyengine-api-v2-alpha`
-   - GitHub branch: `main`
-   - Click Next
+3. Create/update the IAM role via Terraform:
 
-4. Attach these policies:
-   - `AmazonECS_FullAccess`
-   - `AmazonEC2ContainerRegistryPowerUser`
-   - `IAMFullAccess`
-   - `AmazonVPCFullAccess`
-   - `CloudWatchLogsFullAccess`
-   - `TerraformStateAccess` (custom policy created earlier)
+```bash
+cd terraform
+terraform init
+terraform import aws_iam_role.github_actions GitHubActionsDeployRole 2>/dev/null || echo "Role doesn't exist yet, will be created"
+terraform apply -target=aws_iam_role.github_actions -target=aws_iam_role_policy.github_actions_deploy
+```
 
-5. Name the role: `GitHubActionsDeployRole`
+This creates the `GitHubActionsDeployRole` with all required permissions for ECS, ECR, ElastiCache, Load Balancers, VPC, CloudWatch, IAM, and S3.
 
-6. Copy the role ARN: `arn:aws:iam::YOUR_ACCOUNT_ID:role/GitHubActionsDeployRole`
+4. Copy the role ARN from Terraform output:
+
+```bash
+terraform output github_actions_role_arn
+```
 
 ## Step 3: Configure GitHub secrets and variables
 
@@ -165,6 +160,18 @@ Any push to `main` automatically:
 
 ## Troubleshooting
 
+### Account doesn't support creating load balancers
+
+If you see "This AWS account currently does not support creating load balancers":
+
+1. Open AWS Support Center
+2. Create case: Service limit increase
+3. Select: Elastic Load Balancing
+4. Request: Enable Application Load Balancer creation
+5. Explain: Need ALB for ECS deployment
+
+This typically takes 24-48 hours for new AWS accounts. Alternatively, check your account has valid payment method and is in good standing.
+
 ### GitHub Actions can't assume role
 
 Trust policy must match your repo exactly:

terraform/iam.tf

@@ -0,0 +1,150 @@
+# GitHub Actions OIDC provider
+data "aws_iam_openid_connect_provider" "github" {
+  url = "https://token.actions.githubusercontent.com"
+}
+
+# IAM role for GitHub Actions
+resource "aws_iam_role" "github_actions" {
+  name = "GitHubActionsDeployRole"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Principal = {
+          Federated = data.aws_iam_openid_connect_provider.github.arn
+        }
+        Action = "sts:AssumeRoleWithWebIdentity"
+        Condition = {
+          StringEquals = {
+            "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
+          }
+          StringLike = {
+            "token.actions.githubusercontent.com:sub" = "repo:PolicyEngine/policyengine-api-v2-alpha:*"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = {
+    Name = "GitHubActionsDeployRole"
+  }
+}
+
+# Custom policy for GitHub Actions with all required permissions
+resource "aws_iam_role_policy" "github_actions_deploy" {
+  name = "GitHubActionsDeployPolicy"
+  role = aws_iam_role.github_actions.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          # ECR permissions
+          "ecr:*"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          # ECS permissions
+          "ecs:*"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          # ElastiCache permissions
+          "elasticache:*"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          # Load Balancer permissions
+          "elasticloadbalancing:*"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          # VPC and networking permissions
+          "ec2:*"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          # CloudWatch Logs permissions
+          "logs:*"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          # IAM permissions (for creating roles)
+          "iam:GetRole",
+          "iam:GetRolePolicy",
+          "iam:CreateRole",
+          "iam:DeleteRole",
+          "iam:AttachRolePolicy",
+          "iam:DetachRolePolicy",
+          "iam:PutRolePolicy",
+          "iam:DeleteRolePolicy",
+          "iam:TagRole",
+          "iam:PassRole",
+          "iam:ListAttachedRolePolicies",
+          "iam:ListRolePolicies",
+          "iam:GetPolicyVersion",
+          "iam:GetPolicy",
+          "iam:ListPolicyVersions"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          # S3 permissions for Terraform state
+          "s3:GetObject",
+          "s3:PutObject",
+          "s3:DeleteObject",
+          "s3:ListBucket",
+          "s3:GetBucketVersioning",
+          "s3:PutBucketVersioning"
+        ]
+        Resource = [
+          "arn:aws:s3:::policyengine-api-v2-terraform-state",
+          "arn:aws:s3:::policyengine-api-v2-terraform-state/*"
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          # DynamoDB for Terraform state locking
+          "dynamodb:GetItem",
+          "dynamodb:PutItem",
+          "dynamodb:DeleteItem",
+          "dynamodb:DescribeTable",
+          "dynamodb:CreateTable"
+        ]
+        Resource = "arn:aws:dynamodb:*:*:table/terraform-state-lock"
+      }
+    ]
+  })
+}
+
+# Output the role ARN for reference
+output "github_actions_role_arn" {
+  description = "ARN of the GitHub Actions IAM role"
+  value       = aws_iam_role.github_actions.arn
+}