carlos / platform Public

Download this file

1	variable "deployment_bucket_name" {
2	description = "Name of the deployment bucket (apps, releases, channels, instance records, host config)."
3	type = string
4	}
5
6	variable "data_bucket_name" {
7	description = "Name of the regional data bucket (parked databases, WAL streams, leases, blobs)."
8	type = string
9	}
10
11	variable "operator_role_arns" {
12	description = "IAM role ARNs of human operators. Only these may write a box bind (control/boxes/*.bind.json). Empty means nobody can: the safe default until operators are named."
13	type = list(string)
14	default = []
15	}
16
17	variable "box_fence_writer_role_arns" {
18	description = "Exact enrolled box role ARNs allowed to create termination fences. Empty refuses every writer."
19	type = list(string)
20	default = []
21
22	validation {
23	condition = alltrue([
24	for arn in var.box_fence_writer_role_arns :
25	can(regex("^arn:[a-z0-9-]+:iam::[0-9]{12}:role/[^*?]+$", arn))
26	])
27	error_message = "Fence writers must be exact IAM role ARNs without wildcards."
28	}
29	}
30