BACKEND_SETUP_README.md

Terraform Backend Setup - Quick Start

This directory contains multiple options for setting up the required AWS backend resources (S3 bucket and DynamoDB table) for Terraform state management.

Choose Your Setup Method

Method 1: PowerShell Script (Windows with AWS CLI)

Requirements: AWS CLI installed and configured

cd agentguard-infrastructure
.\setup-backend.ps1

Pros: Fully automated, fastest method Cons: Requires AWS CLI installation

---

Method 2: Bash Script (Linux/Mac with AWS CLI)

Requirements: AWS CLI installed and configured

cd agentguard-infrastructure
chmod +x setup-backend.sh
./setup-backend.sh

Pros: Fully automated, fastest method Cons: Requires AWS CLI installation

---

Method 3: AWS Console (Manual Setup)

Requirements: AWS Console access only (no CLI needed)

Follow the detailed step-by-step instructions in: 📄 MANUAL_SETUP_INSTRUCTIONS.md

Pros: No CLI installation required, visual interface Cons: Manual steps, takes longer

---

What Gets Created

Both methods create the following AWS resources:

1. S3 Bucket

• Name: agentguard-terraform-state-<random-suffix>
• Purpose: Store Terraform state file
• Features:
  • ✓ Versioning enabled (state history)
  • ✓ Server-side encryption (AES-256)
  • ✓ Public access blocked
  • ✓ Secure by default

2. DynamoDB Table

• Name: agentguard-terraform-state-lock
• Purpose: State locking (prevent concurrent modifications)
• Features:
  • ✓ Partition key: LockID (String)
  • ✓ On-demand billing mode
  • ✓ Encryption at rest
  • ✓ Cost-optimized

Cost Estimate

• S3 Bucket: < $0.10/month (state file is typically < 1 MB)
• DynamoDB Table: < $0.50/month (infrequent operations)
• Total: < $1.00/month

After Setup

Once you've created the backend resources using any method above:

1. Update backend.tf with your bucket name and region:

   terraform {
     backend "s3" {
       bucket         = "agentguard-terraform-state-<your-suffix>"
       key            = "agentguard/terraform.tfstate"
       region         = "us-east-1"
       dynamodb_table = "agentguard-terraform-state-lock"
       encrypt        = true
     }
   }

2. Initialize Terraform:

   terraform init

   Testing Note: For comprehensive testing procedures and troubleshooting, see TERRAFORM_INIT_TESTING.md

3. Proceed with infrastructure deployment:

   terraform plan
   terraform apply

Troubleshooting

AWS CLI Not Found

• Windows: Download from https://awscli.amazonaws.com/AWSCLIV2.msi
• Linux/Mac: Follow instructions at https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
• Alternative: Use Method 3 (AWS Console)

AWS Credentials Not Configured

aws configure

Enter your AWS Access Key ID, Secret Access Key, and default region.

Bucket Name Already Exists

S3 bucket names must be globally unique. The scripts use random suffixes, but if you encounter this error, try running the script again or manually specify a unique name.

Need Help?

• 📖 Detailed manual instructions: MANUAL_SETUP_INSTRUCTIONS.md
• 📖 Full setup guide: SETUP.md
• 📖 Design documentation: ../.kiro/specs/agentguard-infrastructure/design.md

Security Notes

• ✓ All resources are created with security best practices
• ✓ Encryption enabled by default
• ✓ Public access blocked
• ✓ Versioning enabled for state recovery
• ✓ State locking prevents concurrent modifications

Next Steps

After backend setup is complete, proceed to:

1. Configure Terraform variables (terraform.tfvars)
2. Deploy VPC infrastructure
3. Deploy EKS cluster
4. Deploy worker nodes

See SETUP.md for the complete deployment guide.