type: user

role: user

content:
Read and review `/Users/steve.briggs/projects/cpi-new/platform-management/us-east-1/tools-database/terragrunt.hcl`.

Also read the existing reference for comparison: `/Users/steve.briggs/projects/cpi-new/platform-management/us-east-1/retool-database/terragrunt.hcl`

**Spec compliance** — verify all of the following:
1. `terraform.source` = `"tfr://crow.infrastructure.immuta.io/iac/storage-database-tools-db/aws?version=1.0.0"`
2. `include` block with `find_in_parent_folders()`
3. `generate "backup_provider"` block generating `backup-provider.tf` with `aws.backup` alias pointing to `us-east-2`
4. `locals` loading `common_vars`, `account_vars`, `region_vars`; extracting `aws_region`, `env`, `accounts`, `gs_cidr_blocks`; `tags` with `tfpath = "/platform-management/${local.aws_region}/tools-database"`
5. `dependency vpc` with `config_path = "../vpc-cloudwan"`
6. `inputs` containing: `name = "tools-database"`, `pg_version = "17.4"`, `env = "prod"`, `private_subnet_ids` from vpc dependency, `vpc_id` from vpc dependency, security group name overrides (`tools-db`, `tools-db-access`, `tools-db-trusted-access`), `rds_instance_size = "db.t4g.small"`, `enhanced_monitoring_enabled = false`, `performance_insights_enabled = false`, `multi_az = false`, `allocated_storage = 20`, `storage_encrypted = true`, `backup_retention_period = 5`, `replica_retention_period = 5`, `final_snapshot = false`, `encrypt_replicas = true`, `vault_secret_path = "platform/tools-database"`, `trusted_cidr_blocks` using `gs_cidr_blocks["management"]["mgmt"]`, `tags = local.tags`

**Quality** — consistent style with the reference `retool-database/terragrunt.hcl`.

End with `REVIEW: ✅ APPROVED` or `REVIEW: ❌ ISSUES` with details.

userType: external

entrypoint: cli


content:
- obsidian-load: Load context from Obsidian notes in the `Claude/` directory into the current conversation.
- obsidian-save: Save current conversation context to an Obsidian note under the `Claude/` directory.
- mind:search: Search memories for specific content or patterns
- mind:stats: Show memory statistics and storage information
- mind:ask: Ask questions about memories and get context-aware answers
- mind:recent: Show recent memories and activity timeline
- mind:memory: Claude Mind - Search and manage Claude's persistent memory stored in a single portable .mv2 file
- mind:mind: Claude Mind - Search and manage Claude's persistent memory stored in a single portable .mv2 file
- superpowers:dispatching-parallel-agents: Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies
- superpowers:test-driven-development: Use when implementing any feature or bugfix, before writing implementation code
- superpowers:systematic-debugging: Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
- superpowers:executing-plans: Use when you have a written implementation plan to execute in a separate session with review checkpoints
- superpowers:using-superpowers: Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions
- superpowers:using-git-worktrees: Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback
- superpowers:requesting-code-review: Use when completing tasks, implementing major features, or before merging to verify work meets requirements
- superpowers:finishing-a-development-branch: Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
- superpowers:brainstorming: You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
- superpowers:writing-plans: Use when you have a spec or requirements for a multi-step task, before touching code
- superpowers:receiving-code-review: Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
- superpowers:verification-before-completion: Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always
- superpowers:writing-skills: Use when creating new skills, editing existing skills, or verifying skills work before deployment
- superpowers:subagent-driven-development: Use when executing implementation plans with independent tasks in the current session
- update-config: Use this skill to configure the Claude Code harness via settings.json. Automated behaviors ("from now on when X", "each time X", "whenever X", "before/after X") require hooks configured in settings.json - the harness executes these, not Claude, so memory/preferences cannot fulfill them. Also use for: permissions ("allow X", "add permission", "move permission to"), env vars ("set X=Y"), hook troubleshooting, or any changes to settings.json/settings.local.json files. Examples: "allow npm commands", "add bq permission to global settings", "move permission to user settings", "set DEBUG=true", "when claude stops show X". For simple settings like theme/model, suggest the /config command.
- keybindings-help: Use when the user wants to customize keyboard shortcuts, rebind keys, add chord bindings, or modify ~/.claude/keybindings.json. Examples: "rebind ctrl+s", "add a chord shortcut", "change the submit key", "customize keybindings".
- verify: Verify that a code change actually does what it's supposed to by running the app and observing behavior. Use when asked to verify a PR, confirm a fix works, test a change manually, check that a feature works, or validate local changes before pushing.
- simplify: Review changed code for reuse, quality, and efficiency, then fix any issues found.
- fewer-permission-prompts: Scan your transcripts for common read-only Bash and MCP tool calls, then add a prioritized allowlist to project .claude/settings.json to reduce permission prompts.
- loop: Run a prompt or slash command on a recurring interval (e.g. /loop 5m /foo). Omit the interval to let the model self-pace. - When the user wants to set up a recurring task, poll for status, or run something repeatedly on an interval (e.g. "check the deploy every 5 minutes", "keep running /babysit-prs"). Do NOT invoke for one-off tasks.
- schedule: Create, update, list, or run scheduled remote agents (routines) that execute on a cron schedule. - When the user wants to schedule a recurring remote agent, set up automated tasks, create a cron job for Claude Code, or manage their scheduled agents/routines. Also use when the user wants a one-time scheduled run ("run this once at 3pm", "remind me to check X tomorrow").
- claude-api: Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements).
TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project.
SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.
- run: Launch and drive this project's app to see a change working. Use when asked to run, start, or screenshot the app, or to confirm a change works in the real app (not just tests). First looks for a project skill that already covers launching the app; otherwise falls back to built-in patterns per project type (CLI, server, TUI, Electron, browser-driven, library).
- init: Initialize a new CLAUDE.md file with codebase documentation
- review: Review a pull request
- security-review: Complete a security review of the pending changes on the current branch

type: attachment


type: message

role: assistant

type: text

text: I'll read both files and verify the spec compliance.

service_tier: standard

attributionAgent: general-purpose

type: assistant


Read

type: direct

speed: standard


content:
1	# ---------------------------------------------------------------------------------------------------------------------
2	# TERRAGRUNT CONFIGURATION
3	# ---------------------------------------------------------------------------------------------------------------------
4
5	terraform {
6	  source = "tfr://crow.infrastructure.immuta.io/iac/storage-database-tools-db/aws?version=1.0.0"
7	}
8
9	# Include all settings from the root terragrunt.hcl file
10	include {
11	  path = find_in_parent_folders()
12	}
13
14	generate "backup_provider" {
15	  path      = "backup-provider.tf"
16	  if_exists = "overwrite_terragrunt"
17	  contents  = <<EOF
18	provider aws {
19	  alias   = "backup"
20	  profile = "${local.accounts["platform_management"]["profile"]}"
21	  region  = "us-east-2"
22	}
23	EOF
24	}
25
26	# ---------------------------------------------------------------------------------------------------------------------
27	# Locals are named constants that are reusable within the configuration.
28	# ---------------------------------------------------------------------------------------------------------------------
29	locals {
30	  # Automatically load common variables shared across all accounts
31	  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
32
33	  # Automatically load account-level variables
34	  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
35
36	  # Automatically load region-level variables
37	  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
38
39	  # Extract the region and environment for easy access
40	  aws_region = local.region_vars.locals.aws_region
41	  env        = local.account_vars.locals.env
42
43	  # A local for more convenient access to the accounts map.
44	  accounts = local.common_vars.locals.accounts
45
46	  gs_cidr_blocks = local.common_vars.locals.global_segment_cidrs
47
48	  tags = merge(local.common_vars.locals.global_tags, {
49	    tfpath = "/platform-management/${local.aws_region}/tools-database"
50	  })
51	}
52
53	# ---------------------------------------------------------------------------------------------------------------------
54	# MODULE DEPENDENCIES
55	# ---------------------------------------------------------------------------------------------------------------------
56
57	dependency vpc {
58	  config_path = "../vpc-cloudwan"
59	}
60
61	# ---------------------------------------------------------------------------------------------------------------------
62	# MODULE PARAMETERS
63	# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
64	# ---------------------------------------------------------------------------------------------------------------------
65	inputs = {
66	  name       = "tools-database"
67	  pg_version = "17.4"
68	  env        = "prod"
69
70	  private_subnet_ids = [for subnet in dependency.vpc.outputs.vpc.private_subnet_map : subnet.id]
71	  vpc_id             = dependency.vpc.outputs.vpc.vpc_id
72
73	  subnet_group_name_override       = "tools-db"
74	  dba_security_group_name_override = "tools-db-access"
75	  security_group_name_override     = "tools-db-trusted-access"
76
77	  rds_instance_size            = "db.t4g.small"
78	  enhanced_monitoring_enabled  = false
79	  performance_insights_enabled = false
80	  multi_az                     = false
81
82	  allocated_storage = 20
83	  storage_encrypted = true
84
85	  backup_retention_period  = 5
86	  replica_retention_period = 5
87	  final_snapshot           = false
88	  encrypt_replicas         = true
89
90	  vault_secret_path = "platform/tools-database"
91
92	  trusted_cidr_blocks = [
93	    local.gs_cidr_blocks["management"]["mgmt"]
94	  ]
95
96	  tags = local.tags
97	}
98


content:
1	# ---------------------------------------------------------------------------------------------------------------------
2	# TERRAGRUNT CONFIGURATION
3	# ---------------------------------------------------------------------------------------------------------------------
4
5	terraform {
6	  source = "tfr://crow.infrastructure.immuta.io/iac/storage-database-retool/aws?version=1.3.0"
7	}
8
9	# Include all settings from the root terragrunt.hcl file
10	include {
11	  path = find_in_parent_folders()
12	}
13
14	generate "backup_provider" {
15	  path      = "backup-provider.tf"
16	  if_exists = "overwrite_terragrunt"
17	  contents  = <<EOF
18	provider aws {
19	  alias   = "backup"
20	  profile = "${local.accounts["platform_management"]["profile"]}"
21	  region  = "us-east-2"
22	}
23	EOF
24	}
25
26	# ---------------------------------------------------------------------------------------------------------------------
27	# Locals are named constants that are reusable within the configuration.
28	# ---------------------------------------------------------------------------------------------------------------------
29	locals {
30	  # Automatically load common variables shared across all accounts
31	  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
32
33	  # Automatically load account-level variables
34	  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
35
36	  # Automatically load region-level variables
37	  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
38
39	  # Extract the region and environment for easy access
40	  aws_region = local.region_vars.locals.aws_region
41	  env        = local.account_vars.locals.env
42
43	  # A local for more convenient access to the accounts map.
44	  accounts = local.common_vars.locals.accounts
45
46	  # Temp hard coding of networking info
47	  private_subnet_ids = [
48	    "subnet-06cb9a003fdd25469",
49	    "subnet-0c0d3ae5cb03f32c4",
50	    "subnet-09ec022a9217e26d2"
51	  ]
52	  vpc_id             = "vpc-05a7c8e424ce2fadf"
53
54	  cidr_blocks           = local.common_vars.locals.cidr_blocks
55	  internal_domain_names = local.common_vars.locals.internal_domain_names
56
57
58	  tags = merge(local.common_vars.locals.global_tags, {
59	    tfpath = "/platform-management/${local.aws_region}/retool-database"
60	  })
61	}
62
63	# ---------------------------------------------------------------------------------------------------------------------
64	# MODULE DEPENDENCIES
65	# ---------------------------------------------------------------------------------------------------------------------
66
67	 dependency vpc {
68	   config_path = "../vpc-cloudwan"
69	 }
70
71	# ---------------------------------------------------------------------------------------------------------------------
72	# MODULE PARAMETERS
73	# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
74	# ---------------------------------------------------------------------------------------------------------------------
75	inputs = {
76	  name                     = "retool-app"
77	  pg_version               = "17.4"
78	  domain_name              = local.internal_domain_names[local.env]["main"]
79	  env                      = "prod"
80	  private_subnet_ids       = [for subnet in dependency.vpc.outputs.vpc.private_subnet_map : subnet.id]
81	  vpc_id                   = dependency.vpc.outputs.vpc.vpc_id
82
83	  subnet_group_name_override       = "retool-db"
84	  dba_security_group_name_override = "retool-db-trusted-access"
85	  security_group_name_override     = "retool-db-access"
86
87	  trusted_cidr_blocks = [
88	    local.common_vars.locals.global_segment_cidrs["management"]["mgmt"]
89	  ]
90
91	  tags = local.tags
92	}
93


text:
Now let me verify each specification item:

**Spec Compliance Review:**

1. ✅ **terraform.source** — Line 6: `tfr://crow.infrastructure.immuta.io/iac/storage-database-tools-db/aws?version=1.0.0` — CORRECT

2. ✅ **include block** — Lines 10-12: Include with `find_in_parent_folders()` — CORRECT

3. ✅ **generate "backup_provider" block** — Lines 14-24: Generates `backup-provider.tf` with `aws.backup` alias pointing to `us-east-2` — CORRECT

4. ✅ **locals section** — Lines 29-51:
   - `common_vars` loaded ✅
   - `account_vars` loaded ✅
   - `region_vars` loaded ✅
   - `aws_region` extracted ✅
   - `env` extracted ✅
   - `accounts` extracted ✅
   - `gs_cidr_blocks` extracted ✅
   - `tags` with correct `tfpath` ✅

5. ✅ **dependency vpc** — Lines 57-59: `config_path = "../vpc-cloudwan"` — CORRECT

6. ✅ **inputs block** — Lines 65-97:
   - `name = "tools-database"` ✅
   - `pg_version = "17.4"` ✅
   - `env = "prod"` ✅
   - `private_subnet_ids` from vpc dependency ✅
   - `vpc_id` from vpc dependency ✅
   - Security group name overrides: `tools-db`, `tools-db-access`, `tools-db-trusted-access` ✅
   - `rds_instance_size = "db.t4g.small"` ✅
   - `enhanced_monitoring_enabled = false` ✅
   - `performance_insights_enabled = false` ✅
   - `multi_az = false` ✅
   - `allocated_storage = 20` ✅
   - `storage_encrypted = true` ✅
   - `backup_retention_period = 5` ✅
   - `replica_retention_period = 5` ✅
   - `final_snapshot = false` ✅
   - `encrypt_replicas = true` ✅
   - `vault_secret_path = "platform/tools-database"` ✅
   - `trusted_cidr_blocks` using `gs_cidr_blocks["management"]["mgmt"]` ✅
   - `tags = local.tags` ✅

**Quality & Style:**
- Header comments match retool-database style ✅
- Consistent indentation and formatting ✅
- All required sections present ✅
- Clean, readable structure ✅

REVIEW: ✅ APPROVED

The `tools-database/terragrunt.hcl` file fully complies with all specifications. It follows the established pattern from `retool-database/terragrunt.hcl` with appropriate differences (tools-db vs retool-db naming, different PostgreSQL module source, and correct input parameter mappings). No issues detected.