ADR-001: Module Naming Convention
kebab-case for module dirs, snake_case for HCL identifiers
kebab-case for module dirs, snake_case for HCL identifiers
Monorepo source with thin-wrapper multi-repo Registry publishing pattern
AWS provider >= 6.28 < 7.0, Terraform >= 1.11.0 across all modules
Native .tftest.hcl for Tiers 1-3, Terratest Go for pre-release integration
Three-tier prefix system: mvp-, poc-, production- with kebab-case descriptors
Use S3 use_lockfile=true for state locking, no DynamoDB required
Fork aws-ia/terraform-aws-sso, strip AWSCC, rebrand to oceansoft
Empty-group membership pattern for emergency admin access without Terraform apply
DevOps-TechDocs is the single source of truth for terraform-aws documentation — no cross-repo CI sync needed
Adopt release-please for automated semver, CHANGELOG, and git tag creation; adopt module-prefixed tag format for per-module TFC publishing from a monorepo
All modules are cloned from upstream terraform-aws-modules/* and extended with oceansoft value-adds rather than thin-wrapper or custom implementations
The web module wires alb + cloudfront + waf + dns into an opinionated secure-by-default composition layer rather than a derived upstream clone
Each module in the monorepo carries an independent semantic version, driven by conventional commits scoped to that module's path, automated by release-please per-package config