Here is the whole repository as one sequence, which also doubles as a review of
every layer. (Full detail is in SETUP.md.)
| # | Step | Layer | Why it's in this position |
|---|---|---|---|
| 0 | Install pinned tools, enable git hooks | tooling | Consistent environment before anything. |
| 1 | Stand up the landing zone | platform/ |
Creates the AWS Organization and the member accounts everything else lives in. Two-phase apply. |
| 2 | Create the state backend per account | bootstrap/ |
Each account needs its remote-state S3 bucket + KMS key before its env can store state. One workspace per account. |
| 3 | Wire each backend | backend.s3.tfbackend files |
Copy the generated KMS key ARN into each root via make backend-config. |
| 4 | Create the CI/CD pipelines | cicd/ |
The one thing applied by hand (a pipeline can't create itself). Then authorize the GitHub connection once. |
| 5 | Provision dev | envs/dev/ |
Through its pipeline: push → plan → approve → apply. |
| 6 | Provision staging & prod | envs/staging, envs/prod |
Same, through their pipelines. |
After step 4, the normal loop becomes: edit code → git push → review the plan →
click Approve → the pipeline applies. You preview locally with
make plan DIR=..., but you never apply from your laptop except in emergencies.
The dependency chain in one breath: bootstrap makes the state bucket → platform makes the accounts → modules define reusable infra → envs compose modules per account (state in the bucket) → cicd delivers the envs automatically.