Skip to main content

01 · AWS account setup

Before running the Terraform snippets, prepare the account and remote-state backend.

1. Verify AWS credentials​

aws sts get-caller-identity
# Expect: Account, Arn, UserId — no error

If this fails, configure via aws configure or export AWS_PROFILE.

2. Choose region + VPC strategy​

  • Region: pick per your data residency / latency needs. Openbox does not prescribe.
  • VPC: either reuse an existing VPC (recommended for enterprise) OR let Terraform create a new one.

If reusing, note the VPC ID + subnet IDs (need ≥ 2 private subnets across ≥ 2 AZs).

3. Enable required AWS services​

Most are enabled by default. Verify:

# EKS (should return an empty list, not an error)
aws eks list-clusters

# KMS (should return keys or empty, not permission-denied)
aws kms list-keys --limit 1

# S3 (should return buckets or empty, not error)
aws s3 ls

If any command returns AccessDenied, your IAM principal needs broader permissions.

4. Set up Terraform remote state (S3 + DynamoDB lock)​

Create an S3 bucket + DynamoDB table for state locking. One-time setup, do this before running the OpenBox snippets.

# Choose a globally-unique bucket name
export TF_STATE_BUCKET="openbox-tfstate-${AWS_ACCOUNT_ID}"
export TF_LOCK_TABLE="openbox-tflock"
export AWS_REGION="us-east-1"   # your choice

# S3 bucket (versioned + encrypted)
aws s3api create-bucket \
  --bucket "$TF_STATE_BUCKET" \
  --region "$AWS_REGION" \
  --create-bucket-configuration LocationConstraint="$AWS_REGION" 2>/dev/null \
  || aws s3api create-bucket --bucket "$TF_STATE_BUCKET" --region "$AWS_REGION"

aws s3api put-bucket-versioning \
  --bucket "$TF_STATE_BUCKET" \
  --versioning-configuration Status=Enabled

aws s3api put-bucket-encryption \
  --bucket "$TF_STATE_BUCKET" \
  --server-side-encryption-configuration \
  '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'

# DynamoDB lock table
aws dynamodb create-table \
  --table-name "$TF_LOCK_TABLE" \
  --attribute-definitions AttributeName=LockID,AttributeType=S \
  --key-schema AttributeName=LockID,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST \
  --region "$AWS_REGION"

# Wait for table active
aws dynamodb wait table-exists --table-name "$TF_LOCK_TABLE"

5. Prepare backend.tf​

Create a file backend.tf in the same dir where you'll run the OpenBox snippets:

terraform {
  backend "s3" {
    bucket         = "openbox-tfstate-<your-account-id>"
    key            = "openbox/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "openbox-tflock"
    encrypt        = true
  }
}

Next​

02 · Terraform deploy →