I need to understand two things so I can write a new Terragrunt configuration:

1. Read the Terraform module at /Users/steve.briggs/projects/operations/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount — specifically variables.tf and main.tf (and outputs.tf if present). I need to know every input variable, its type, description, and whether it has a default.

2. Look at 2-3 existing Terragrunt configurations in /Users/steve.briggs/projects/customer-platform-infrastructure/platform-management/us-east-1/ — specifically look inside eks-platform-mgmt-use1-1 and one or two other modules (e.g. teleport-db-bot-service-account or teleport-controller) to understand the terragrunt.hcl pattern used (source, inputs, locals, includes, etc.).

Also check if there is a root terragrunt.hcl or common.hcl in /Users/steve.briggs/projects/customer-platform-infrastructure/platform-management/ or its parent directories.

Report back:
- All variables from the module (name, type, description, default)
- The terragrunt.hcl pattern (how source is referenced, what includes are used, what locals are pulled in, any common patterns for kubernetes/IAM service account modules specifically)
- Any region.hcl or account.hcl patterns for locals


I'll help you gather this information. Let me start by exploring the Terraform module and the Terragrunt configurations.


Bash

find /Users/steve.briggs/projects/operations/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount -type f -name "*.tf" | head -20


Now let me read the three files from the Terraform module:


1	# ---------------------------------------------------------------------------------------------------------------------
2	# MODULE PARAMETERS
3	# These variables are expected to be passed in by the operator when calling this terraform module.
4	# ---------------------------------------------------------------------------------------------------------------------
5
6	# ---------------------------------------------------------------------------------------------------------------------
7	# REQUIRED PARAMETERS
8	# These variables must be set.
9	# ---------------------------------------------------------------------------------------------------------------------
10
11	variable "role_name" {
12	  description = "Name of the role and the IAM policy"
13	  type        = string
14	}
15
16	variable "assume_role_entities" {
17	  description = "A list of objects defining what kubernetes service accounts can assume this role"
18	  type = list(object({
19	    namespace                = string
20	    service_account_name     = string
21	    identity_provider_issuer = string
22	    identity_provider_arn    = string
23	    test                     = optional(string, "StringEquals")
24	  }))
25	}
26
27	# ---------------------------------------------------------------------------------------------------------------------
28	# OPTIONAL PARAMETERS
29	# These variables are configurable, but have reasonable defaults set.
30	# ---------------------------------------------------------------------------------------------------------------------
31	variable "policy_statements" {
32	  description = "List of statements with actions and resources to create the IAM policy"
33	  type = list(object({
34	    sid           = optional(string, null)
35	    actions       = optional(list(string), null)
36	    not_actions   = optional(list(string), null)
37	    resources     = optional(list(string), null)
38	    not_resources = optional(list(string), null)
39	    principals = optional(list(object({
40	      identifiers = list(string)
41	      type        = string
42	    })), [])
43	    not_principals = optional(list(object({
44	      identifiers = list(string)
45	      type        = string
46	    })), [])
47	    effect = optional(string, "Allow")
48	    conditions = optional(list(object({
49	      test     = optional(string, "StringEquals")
50	      variable = string
51	      values   = list(string)
52	    })), [])
53	  }))
54	  default = []
55	}
56
57	variable "policy_path" {
58	  description = "Path to keep the IAM policy in AWS"
59	  type        = string
60	  default     = "/eks/"
61	}
62
63	variable "tags" {
64	  description = "Map of key-value pairs to tag created resources with."
65	  type        = map(any)
66	  default     = {}
67	}
68
69


1	# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2	# CREATE A IAM POLICIES FOR EKS SERVICEACCOUNT
3	# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4
5	# ---------------------------------------------------------------------------------------------------------------------
6	# SET TERRAFORM REQUIREMENTS FOR RUNNING THIS MODULE
7	# ---------------------------------------------------------------------------------------------------------------------
8
9	terraform {
10	  required_version = "~> 1.0"
11
12	  required_providers {
13	    aws = {
14	      source  = "hashicorp/aws"
15	      version = "~> 6.0"
16	    }
17	  }
18	}
19
20	# ---------------------------------------------------------------------------------------------------------------------
21	# CREATE A TERRAFORM RESOURCE
22	# ---------------------------------------------------------------------------------------------------------------------
23
24	data "aws_iam_policy_document" "policy_doc" {
25	  count = length(var.policy_statements) > 0 ? 1 : 0
26
27	  dynamic "statement" {
28	    for_each = var.policy_statements
29	    content {
30	      sid           = statement.value.sid
31	      effect        = statement.value.effect
32	      actions       = statement.value.actions
33	      not_actions   = statement.value.not_actions
34	      resources     = statement.value.resources
35	      not_resources = statement.value.not_resources
36	      dynamic "principals" {
37	        for_each = statement.value.principals
38	        content {
39	          identifiers = principals.value.identifiers
40	          type        = principals.value.type
41	        }
42	      }
43	      dynamic "not_principals" {
44	        for_each = statement.value.not_principals
45	        content {
46	          identifiers = not_principals.value.identifiers
47	          type        = not_principals.value.type
48	        }
49	      }
50	      dynamic "condition" {
51	        for_each = statement.value.conditions
52	        content {
53	          test     = condition.value.test
54	          variable = condition.value.variable
55	          values   = condition.value["values"]
56	        }
57	      }
58	    }
59	  }
60	}
61
62	resource "aws_iam_policy" "policy" {
63	  count = length(var.policy_statements) > 0 ? 1 : 0
64
65	  name   = var.role_name
66	  policy = data.aws_iam_policy_document.policy_doc[0].json
67	  path   = var.policy_path
68	  tags   = var.tags
69	}
70
71	data "aws_iam_policy_document" "assume_doc" {
72	  dynamic "statement" {
73	    for_each = toset(var.assume_role_entities)
74	    content {
75	      actions = ["sts:AssumeRoleWithWebIdentity"]
76	      condition {
77	        test     = statement.value["test"]
78	        variable = format("%s:sub", statement.value["identity_provider_issuer"])
79	        values = [
80	          format("system:serviceaccount:%s:%s", statement.value["namespace"], statement.value["service_account_name"])
81	        ]
82	      }
83	      condition {
84	        test     = statement.value["test"]
85	        variable = format("%s:aud", statement.value["identity_provider_issuer"])
86	        values = [
87	          "sts.amazonaws.com"
88	        ]
89	      }
90	      principals {
91	        type        = "Federated"
92	        identifiers = [statement.value["identity_provider_arn"]]
93	      }
94	    }
95	  }
96	}
97
98
99	resource "aws_iam_role" "role" {
100	  assume_role_policy = data.aws_iam_policy_document.assume_doc.json
101	  name               = var.role_name
102	  tags               = var.tags
103	}
104
105	resource "aws_iam_role_policy_attachment" "attachment" {
106	  count = length(var.policy_statements) > 0 ? 1 : 0
107
108	  policy_arn = aws_iam_policy.policy[0].arn
109	  role       = aws_iam_role.role.name
110	}
111


1	output "iam_role_arn" {
2	  description = "The ARN of the created role"
3	  value       = aws_iam_role.role.arn
4	}
5
6	output "iam_role_name" {
7	  description = "The ARN of the created role"
8	  value       = aws_iam_role.role.name
9	}
10
11	output "iam_policy_arn" {
12	  description = "The ARN of the created policy"
13	  value       = length(var.policy_statements) > 0 ? aws_iam_policy.policy[0].arn : null
14	}
15
16	output "iam_policy_name" {
17	  description = "The ARN of the created policy"
18	  value       = length(var.policy_statements) > 0 ? aws_iam_policy.policy[0].name : null
19	}
20
21


Now let me look at the Terragrunt configurations. First, let me find what modules exist in the us-east-1 directory:


find /Users/steve.briggs/projects/customer-platform-infrastructure/platform-management/us-east-1 -maxdepth 1 -type d | sort


Perfect. Let me read the terragrunt.hcl files from the three modules you mentioned:


1	# ---------------------------------------------------------------------------------------------------------------------
2	# TERRAGRUNT CONFIGURATION
3	# ---------------------------------------------------------------------------------------------------------------------
4
5	terraform {
6	  source = "tfr://crow.infrastructure.immuta.io/iac/compute-eks-mgmt-cluster/aws?version=${local.cluster_module}"
7	}
8
9	# Include all settings from the root terragrunt.hcl file
10	include {
11	  path = find_in_parent_folders()
12	}
13
14	# platform management account provider to access ic-ops.net domain
15	generate "domain_account_provider" {
16	  path      = "domain-account-provider.tf"
17	  if_exists = "overwrite_terragrunt"
18	  contents  = <<EOF
19	provider aws {
20	  alias   = "domain_account"
21	  profile = "${local.accounts["platform_management"]["profile"]}"
22	  region  = "${local.aws_region}"
23	}
24	EOF
25	}
26
27	# ---------------------------------------------------------------------------------------------------------------------
28	# Locals are named constants that are reusable within the configuration.
29	# ---------------------------------------------------------------------------------------------------------------------
30	locals {
31	  # Automatically load common variables shared across all accounts
32	  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
33
34	  # Automatically load account-level variables
35	  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
36
37	  # Automatically load region-level variables
38	  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
39
40	  # Automatically load blueprint for versioning
41	  blueprint_vars = read_terragrunt_config(find_in_parent_folders("_blueprints/eks-saas/2026-05-05.hcl"))
42
43	  # Get account environment
44	  env = local.account_vars.locals.env
45
46	  # Extract the region for easy access
47	  aws_region           = local.region_vars.locals.aws_region
48	  aws_region_shortname = local.region_vars.locals.aws_region_shortname
49
50	  # A local for more convenient access to the accounts map.
51	  accounts = local.common_vars.locals.accounts
52
53	  # Extract blueprint
54	  app_blueprint   = local.blueprint_vars.locals.app_versions
55	  ami_version     = local.blueprint_vars.locals.ami_version
56	  cluster_module  = local.blueprint_vars.locals.eks_mgmt_cluster_module
57	  cluster_version = local.blueprint_vars.locals.cluster_version
58
59	  # Extract cluster ID
60	  cluster_name = "eks-platform-mgmt-use1-1"
61	  cluster_id   = local.common_vars.locals.clustermesh_cluster_ids["prod"][local.cluster_name]
62
63	  current_dir = run_cmd("--terragrunt-quiet", "basename", get_terragrunt_dir())
64	  tags = merge(local.common_vars.locals.global_tags, {
65	    tfpath = "/${local.account_vars.locals.domain_name}/${local.aws_region}/${local.current_dir}"
66	  })
67	}
68
69	# ---------------------------------------------------------------------------------------------------------------------
70	# MODULE DEPENDENCIES
71	# ---------------------------------------------------------------------------------------------------------------------
72
73	dependency mgmt_vpc_cloudwan {
74	  config_path = "../vpc-cloudwan"
75	}
76
77	dependency ic_ops_net_cert {
78	  config_path = "../ic-ops-net-cert"
79	}
80
81	# ---------------------------------------------------------------------------------------------------------------------
82	# MODULE PARAMETERS
83	# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
84	# ---------------------------------------------------------------------------------------------------------------------
85	inputs = {
86	  cluster_name       = local.cluster_name
87	  cluster_id         = local.cluster_id
88	  cluster_version    = local.cluster_version
89	  env                = local.env
90	  region             = local.aws_region
91	  vpc_id             = dependency.mgmt_vpc_cloudwan.outputs.vpc["vpc_id"]
92	  private_subnet_ids = dependency.mgmt_vpc_cloudwan.outputs.vpc["private_subnet_ids"]
93
94	  private_access_cidrs = [
95	    dependency.mgmt_vpc_cloudwan.outputs.vpc.vpc_cidr_block,
96	    local.common_vars.locals.cidr_blocks.infrastructure.core
97	  ]
98	  public_access = true
99	  public_access_cidrs = concat(
100	    local.common_vars.locals.globalprotect_public_ips,
101	    [local.common_vars.locals.office_public_ips.columbus],
102	    [for k, v in dependency.mgmt_vpc_cloudwan.outputs.vpc.nat_gateway_map : format("%s/32", v.public_ip)],
103	  )
104
105	  ingress_controller_cert = dependency.ic_ops_net_cert.outputs.acm_cert_arn
106
107	  argocd_rbac_policy = file("rbac.csv")
108	  argocd_repo        = "application-deployment"
109
110	  cilium_enterprise = true
111
112	  coredns_version                      = local.app_blueprint.coredns.helm
113	  coredns_tag                          = local.app_blueprint.coredns.tag
114	  teleport_agent_version               = local.app_blueprint.teleport_agent.helm
115	  cilium_version                       = local.app_blueprint.cilium.helm
116	  cilium_dnsproxy_version              = local.app_blueprint.cilium_dnsproxy.helm
117	  hubble_enterprise_version            = local.app_blueprint.hubble_enterprise.helm
118	  hubbleui_version                     = local.app_blueprint.hubble_ui.helm
119	  cluster_autoscaler_version           = local.app_blueprint.cluster_autoscaler.helm
120	  cluster_autoscaler_version_tag       = local.app_blueprint.cluster_autoscaler.tag
121	  external_dns_version                 = local.app_blueprint.external_dns.helm
122	  external_dns_version_tag             = local.app_blueprint.external_dns.tag
123	  cert_manager_version                 = local.app_blueprint.cert_manager.helm
124	  metrics_server_version               = local.app_blueprint.metrics_server.helm
125	  metrics_server_version_tag           = local.app_blueprint.metrics_server.tag
126	  aws_load_balancer_controller_version = local.app_blueprint.aws_load_balancer_controller.helm
127	  fluxcd_chart_version                 = local.app_blueprint.fluxcd.helm
128	  kyverno_chart_version                = local.app_blueprint.kyverno.helm
129
130	  vault_sidecar_chart_version     = local.app_blueprint.vault_sidecar_injector.helm
131	  vault_sidecar_chart_version_tag = local.app_blueprint.vault_sidecar_injector.tag
132	  vault_endpoint                  = "https://vault.ic-ops.net:8200"
133	  external_secrets_enable         = true
134	  external_secrets_chart_version  = local.app_blueprint.external_secrets.helm
135
136	  # This is "nonprod" because we're just using LetsEncrypt
137	  cluster_issuers_acme_server = local.common_vars.locals.cluster_issuers_acme_servers["nonprod"]
138
139	  external_networking_enable                        = true
140	  external_networking_app_listener_hostname         = local.common_vars.locals.app_fqdns["mgmt"]
141	  external_networking_api_listener_hostname         = local.common_vars.locals.api_fqdns["mgmt"]
142	  external_networking_hosted_listener_hostname      = "*.ic-ops.net"
143	  external_networking_privatelink_listener_hostname = local.common_vars.locals.privatelink_fqdns["mgmt"]
144	  external_networking_wildcard_listener_hostname    = local.common_vars.locals.wildcard_fqdns["mgmt"]
145
146
147	  reloader_enable               = true
148	  reloader_version              = local.app_blueprint.reloader.helm
149	  reloader_version_tag          = local.app_blueprint.reloader.tag
150	  application_deployment_enable = true
151
152	  gatewayapi_enabled = true
153
154	  ebs_csi_addon_version = local.app_blueprint.aws_ebs_csi_driver.addon
155
156	  otel_collector_enabled = true
157	  otel_collector_chart_version = local.app_blueprint.otel_collector.helm
158	  otel_collector_version = local.app_blueprint.otel_collector.tag
159
160	  wireguard_enabled             = true
161	  enable_kube_proxy_replacement = true
162	  maglev_config = {
163	    enabled    = true
164	    table_size = 16381
165	    hash_seed  = "bYL2nWMVZdxtDIcC" // generated by `head -c12 /dev/urandom | base64 -w0`
166	  }
167
168	  sysdig_agent_version = local.app_blueprint.sysdig_agent_version.helm
169
170	  flow_export_filter_rules = <<-EOT
171	  {"source_pod":["argocd/"]}
172	  {"destination_pod":["argocd/"]}
173	  EOT
174
175	  ingress_controller_version       = local.app_blueprint.ingress_nginx.tag
176	  ingress_controller_chart_version = local.app_blueprint.ingress_nginx.helm
177	  argocd_version                   = "v3.3.6"
178	  argocd_chart_version             = "9.4.17"
179
180	  argocd_env_version              = "1.6.0"
181	  argocd_env_arch                 = "amd64"
182	  argocd_env_helm_secrets_version = "4.7.5"
183	  argocd_env_kubectl_version      = "1.35.3"
184	  argocd_env_vals_version         = "0.43.3"
185	  argocd_env_sops_version         = "3.12.2"
186	  application_controller_resources = { limits = { memory = "16G", cpu = null }, requests = { memory = "8G", cpu = "2" } }
187	  argocd_hostname = "argocd.ic-ops.net"
188
189	  cluster_argocd_repo_service_name = "*"
190
191	  external_dns_public_domain_names = [
192	    "ic-ops.com"
193	  ]
194
195	  cm_domain_names = [
196	    "ic-ops.net",
197	    "ic-ops.com"
198	  ]
199
200	  ingress_controller_min_replicas = 3
201	  ingress_controller_max_replicas = 3
202
203	  envoy_enabled              = false
204	  ingress_controller_enabled = false
205	  # cilium_lb_cert_arn         = dependency.ic_ops_net_cert.outputs.acm_cert_arn
206	  cluster_mesh_enabled = false
207
208	  extra_managed_node_policies = [
209	    "HarborS3Access"
210	  ]
211
212	  release_version = local.ami_version
213
214	  on_demand_instance_types = [
215	    "c6a.4xlarge"
216	  ]
217	  on_demand_arm_instance_types = ["m7g.4xlarge"]
218
219	  tags = local.tags
220	}
221


1	# ---------------------------------------------------------------------------------------------------------------------
2	# TERRAGRUNT CONFIGURATION
3	# ---------------------------------------------------------------------------------------------------------------------
4
5	terraform {
6	  source = "git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git?ref=v5.0.0"
7	}
8
9	# Include all settings from the root terragrunt.hcl file
10	include {
11	  path = find_in_parent_folders()
12	}
13
14	# ---------------------------------------------------------------------------------------------------------------------
15	# Locals are named constants that are reusable within the configuration.
16	# ---------------------------------------------------------------------------------------------------------------------
17	locals {
18	  # Automatically load common variables shared across all accounts
19	  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
20
21	  # Automatically load account-level variables
22	  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
23
24	  # Automatically load region-level variables
25	  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
26
27	  # Extract the region and environment for easy access
28	  aws_region           = local.region_vars.locals.aws_region
29	  aws_region_shortname = local.region_vars.locals.aws_region_shortname
30	  default_region       = local.common_vars.locals.default_region
31	  env                  = local.account_vars.locals.env
32
33	  # A local for more convenient access to the accounts map.
34	  accounts     = local.common_vars.locals.accounts
35	  account_name = local.account_vars.locals.account_name
36	  account_domain_name = local.account_vars.locals.domain_name
37
38	  cidr_blocks                = local.common_vars.locals.cidr_blocks
39	  cloud_account_domain_names = local.common_vars.locals.cloud_account_domain_names
40	  cloud_portal_domain_names  = local.common_vars.locals.cloud_portal_domain_names
41
42	  current_dir = run_cmd("--terragrunt-quiet", "basename", get_terragrunt_dir())
43	  tags = merge(local.common_vars.locals.global_tags, {
44	    tfpath = "/${local.account_vars.locals.domain_name}/${local.aws_region}/${local.current_dir}"
45	  })
46	}
47
48	# ---------------------------------------------------------------------------------------------------------------------
49	# MODULE DEPENDENCIES
50	# ---------------------------------------------------------------------------------------------------------------------
51
52	dependency cluster {
53	  config_path = "../eks-platform-mgmt-use1-1"
54	}
55
56	# ---------------------------------------------------------------------------------------------------------------------
57	# MODULE PARAMETERS
58	# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
59	# ---------------------------------------------------------------------------------------------------------------------
60	inputs = {
61	  role_name = "teleport-db-bot"
62
63	  assume_role_entities = [
64	    {
65	      namespace = "tbot-database-proxy"
66	      service_account_name = "teleport-db-bot"
67	      identity_provider_issuer = dependency.cluster.outputs.cluster_oidc_issuer_url
68	      identity_provider_arn = dependency.cluster.outputs.cluster_oidc_provider_arn
69	    }
70	  ]
71	}
72


1	# ---------------------------------------------------------------------------------------------------------------------
2	# TERRAGRUNT CONFIGURATION
3	# ---------------------------------------------------------------------------------------------------------------------
4
5	terraform {
6	  source = "git@gitlab.infrastructure.immuta.io:infrastructure/terraform/iac-library/aws/application-infrastructure/teleport-controller.git?ref=v3.2.1"
7	}
8
9	# Include all settings from the root terragrunt.hcl file
10	include {
11	  path = find_in_parent_folders()
12	}
13
14	# platform management account provider to access ic-ops.net domain
15	generate "domain_account_provider" {
16	  path      = "domain-account-provider.tf"
17	  if_exists = "overwrite_terragrunt"
18	  contents  = <<EOF
19	provider aws {
20	  alias   = "domain_account"
21	  profile = "${local.accounts["platform_management"]["profile"]}"
22	  region  = "${local.aws_region}"
23	}
24	EOF
25	}
26
27	# ---------------------------------------------------------------------------------------------------------------------
28	# Locals are named constants that are reusable within the configuration.
29	# ---------------------------------------------------------------------------------------------------------------------
30	locals {
31	  # Automatically load common variables shared across all accounts
32	  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
33
34	  # Automatically load account-level variables
35	  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
36
37	  # Automatically load region-level variables
38	  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
39
40	  # Extract the environment
41	  env = local.account_vars.locals.env
42
43	  # Extract the region for easy access
44	  aws_region           = local.region_vars.locals.aws_region
45	  aws_region_shortname = local.region_vars.locals.aws_region_shortname
46
47	  # A local for more convenient access to the accounts map.
48	  accounts     = local.common_vars.locals.accounts
49	  account_name = local.account_vars.locals.account_name
50	  account_id   = local.accounts["platform_management"]["id"]
51
52	  tags = merge(local.common_vars.locals.global_tags, {
53	    tfpath = "platform-management/us-east-1/teleport-controller"
54	  })
55	}
56
57	# ---------------------------------------------------------------------------------------------------------------------
58	# MODULE DEPENDENCIES
59	# ---------------------------------------------------------------------------------------------------------------------
60
61	dependency eks_cluster {
62	  config_path = "../eks-platform-mgmt-use1-1"
63	}
64
65	dependency retool_database {
66	  config_path = "../retool-database"
67	}
68
69	dependency mgmt_database {
70	  config_path = "../mgmt-database"
71	}
72
73	# ---------------------------------------------------------------------------------------------------------------------
74	# MODULE PARAMETERS
75	# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
76	# ---------------------------------------------------------------------------------------------------------------------
77
78	inputs = {
79	  account_id = local.account_id
80
81	  cluster_name                     = dependency.eks_cluster.outputs.cluster_name
82	  cluster_identity_provider_arn    = dependency.eks_cluster.outputs.cluster_oidc_provider_arn
83	  cluster_identity_provider_issuer = dependency.eks_cluster.outputs.cluster_oidc_issuer_url
84
85	  backend_table_name = "platform-na-teleport-backend"
86	  events_table_name = "platform-na-teleport-events"
87	  sessions_bucket = "platform-na-teleport-sessions"
88
89	  teleport_rds_users = [
90	    "arn:aws:rds-db:${local.aws_region}:${local.account_id}:dbuser:${dependency.retool_database.outputs.resource_id}/immuta_admin",
91	    "arn:aws:rds-db:${local.aws_region}:${local.account_id}:dbuser:${dependency.retool_database.outputs.resource_id}/immuta_view",
92	    "arn:aws:rds-db:${local.aws_region}:${local.account_id}:dbuser:${dependency.mgmt_database.outputs.resource_id}/immuta_admin",
93	    "arn:aws:rds-db:${local.aws_region}:${local.account_id}:dbuser:${dependency.mgmt_database.outputs.resource_id}/immuta_view"
94	  ]
95
96	  teleport_agent_account_name = "teleport-agent"
97
98	  tags = local.tags
99	}
100


Now let me check for root-level terragrunt.hcl and the common.hcl, account.hcl, and region.hcl files:


find /Users/steve.briggs/projects/customer-platform-infrastructure/platform-management -maxdepth 3 -name "terragrunt.hcl" -o -name "common.hcl" -o -name "account.hcl" -o -name "region.hcl" | grep -E "(terragrunt\.hcl|common\.hcl|account\.hcl|region\.hcl)" | head -20


Let me look for the root terragrunt.hcl and common.hcl:


.rw-r--r-- steve.briggs staff 243 B Thu May  7 12:14:14 2026 /Users/steve.briggs/projects/customer-platform-infrastructure/platform-management/account.hcl


Let me check if there's a common.hcl at a parent level:


find /Users/steve.briggs/projects/customer-platform-infrastructure -maxdepth 3 -name "common.hcl" -o -name "terragrunt.hcl" | grep -v "\.terraform" | sort


Perfect! Now let me read the root terragrunt.hcl, common.hcl, account.hcl, and region.hcl files:


1	# ----------------------------------------------------------------------------------------------------------------
2	# This is the root configuration for customer-platform-infrastructure. Its purpose is to:
3	#
4	#   - generate a provider block to configure the Terraform provider for AWS
5	#   - generate a remote state block for storing state in S3
6	#   - define a minimal set of global inputs that may be needed by any file
7	#
8	# Each module within customer-platform-infrastructure includes this file.
9	# ----------------------------------------------------------------------------------------------------------------
10
11	# ----------------------------------------------------------------------------------------------------------------
12	# LOAD COMMON VARIABLES
13	# ----------------------------------------------------------------------------------------------------------------
14	locals {
15	  # Automatically load common variables shared across all accounts
16	  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
17
18	  # Automatically load account-level variables
19	  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
20
21	  # Automatically load region-level variables
22	  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl", find_in_parent_folders("default-region.hcl")))
23	}
24
25	# ----------------------------------------------------------------------------------------------------------------
26	# GENERATED PROVIDER BLOCK
27	# ----------------------------------------------------------------------------------------------------------------
28	generate "provider" {
29	  path      = "provider.tf"
30	  if_exists = "overwrite_terragrunt"
31	  contents  = <<EOF
32	provider aws {
33	  profile = "immuta-${local.account_vars.locals.account_name}"
34	  region  = "${local.region_vars.locals.aws_region}"
35	  ignore_tags {
36	    key_prefixes = [
37	      "kubernetes.io/cluster/"
38	    ]
39	  }
40	}
41
42	provider vault {
43	  address = "${local.account_vars.locals.vault_addr}"
44	}
45
46	provider kubernetes {
47	  alias          = "argocd-cluster"
48	  config_path    = "~/.kube/config"
49	  config_context = "transporter.ic-ops.com-eks-platform-mgmt-use1-1"
50	}
51
52	provider google {
53	  project = "saas-certificates"
54	}
55	EOF
56	}
57	# ----------------------------------------------------------------------------------------------------------------
58	# GENERATED REMOTE STATE BLOCK
59	# ----------------------------------------------------------------------------------------------------------------
60	# Generate the Terraform remote state block for storing state in S3
61	remote_state {
62	  backend = "s3"
63	  config = {
64	    encrypt        = true
65	    bucket         = local.account_vars.locals.state_bucket
66	    key            = "${path_relative_to_include()}/terraform.tfstate"
67	    region         = local.common_vars.locals.default_region
68	    profile        = "immuta-${local.account_vars.locals.account_name}"
69	    dynamodb_table = "${local.account_vars.locals.state_bucket}"
70
71	    disable_bucket_update = true
72	    bucket_sse_algorithm  = "AES256"
73	  }
74	  generate = {
75	    path      = "backend.tf"
76	    if_exists = "overwrite_terragrunt"
77	  }
78	}
79	# ----------------------------------------------------------------------------------------------------------------
80	# DEFAULT INPUTS
81	# ----------------------------------------------------------------------------------------------------------------
82	inputs = {}
83


1	# Common variables for this region
2	locals {
3	  aws_region           = "us-east-1"
4	  aws_region_shortname = "use1"
5	  global_segment       = "mgmt"
6	}
7


1	# Set account-wide variables
2	locals {
3	  account_name = "platform-management"
4	  domain_name  = "management"
5	  env          = "management"
6	  vault_addr   = "https://vault.ic-ops.net:8200"
7	  state_bucket = "immuta-tf-state-platform-management"
8	}
9


1	locals {
2	  # ----------------------------------------------------------------------------------------------------------------
3	  # ACCOUNT IDS AND CONVENIENCE LOCALS
4	  # ----------------------------------------------------------------------------------------------------------------
5
6	  # Tags that are applied globally
7	  global_tags = {
8	    CostCenter = "Platform",
9	    ManagedBy  = "customer-platform-infrastructure"
10	  }
11
12	  # Define a default region to use when operating on resources that are not contained within a specific region.
13	  default_region           = "us-east-1"
14	  default_region_shortname = "use1"
15
16	  # Transit Gateway IDs (from infrastructure account)
17	  transit_gateway_ids = {
18	    us_east_1      = "tgw-02080c88b578ea1c0"
19	    us_east_2      = "tgw-0c90d4cadcef37d94"
20	    us_west_2      = "tgw-0bd1086699efb46b6"
21	    eu_central_1   = "tgw-078b1cae77602b742"
22	    ap_southeast_2 = "tgw-0b33fbe93127b4bdf"
23	    eu_west_1      = "tgw-02cde9156b8015386"
24	    eu_west_2      = "tgw-08160e1ef985b6f32"
25	    ap_northeast_3 = "tgw-0c186d19dbc0448fd"
26	    ap_southeast_1 = "tgw-06e34ecb06196ae53"
27	    ap_northeast_1 = "tgw-0a01bf0ac5cf67c7c"
28	    ca_central_1   = "tgw-0caf974a669f90fe5"
29	    eu_north_1     = "tgw-0a5628c57da8fc922"
30	    ap_south_1     = "tgw-015d9ef1e0219887e"
31	    ap_northeast_2 = "tgw-07bb491aaa8af09d4"
32	  }
33
34	  # Argo CD Config Roles
35	  argo_cd_config_roles = [
36	    "arn:aws:iam::365430248327:role/eks-platform-mgmt-use1-1-argocd"
37	  ]
38
39	  clustermesh_cluster_ids = {
40	    prod = { # Fits in second octet of CloudWAN CIDR
41	      "eks-platform-mgmt-use1-1" = 1
42	      "eks-cps-prod-use1-2" = 4
43	      "eks-saas-prod-use1-2" = 8
44	      "eks-saas-prod-usw2-2" = 9
45	      "eks-saas-prod-euc1-2" = 16
46	      "eks-saas-prod-euw1-2" = 17
47	      "eks-saas-prod-euw2-2" = 18
48	      "eks-saas-prod-apse2-2" = 24
49	      "eks-saas-prod-apne1-2" = 25
50	    }
51	    staging = { # Matches in third octet of CIDR
52	      "eks-cps-nonprod-use1-1" = 1
53	      "eks-saas-nonprod-use1-1" = 32
54	      "eks-test-nonprod-use1-1" = 33
55	      "eks-saas-nonprod-use2-1" = 34
56	      "eks-saas-nonprod-euc1-1" = 64
57	    }
58	  }
59
60	  # Instance types for SaaS Hosting Clusters
61	  # Note, dev and staging are null so they will fall back on the cluster defaults.
62	  saas_on_demand_instance_types = {
63	    dev     = null
64	    staging = "r7i.4xlarge"
65	    prod    = "r5a.4xlarge"
66	  }
67
68	  saas_on_demand_arm_instance_types = {
69	    dev     = null
70	    staging = "m7g.4xlarge"
71	    prod    = "m7g.4xlarge"
72	  }
73	  saas_spot_instance_types = {
74	    dev = null,
75	    staging = [
76	      "m5.2xlarge",
77	      "m5a.2xlarge",
78	      "m5d.2xlarge",
79	      "m5ad.2xlarge",
80	      "c5.2xlarge",
81	      "c5ad.2xlarge",
82	      "c6i.2xlarge",
83	      "c6a.2xlarge",
84	      "c7i.2xlarge",
85	      "r5.2xlarge"
86	    ],
87	    prod = [
88	      "m5.2xlarge",
89	      "m5a.2xlarge",
90	      "m5d.2xlarge",
91	      "m5ad.2xlarge",
92	      "c5.2xlarge",
93	      "c5ad.2xlarge",
94	      "c6i.2xlarge",
95	      "c6a.2xlarge",
96	      "c7i.2xlarge",
97	      "r5.2xlarge"
98	    ],
99	    management = [
100	      "m7i.2xlarge",
101	      "m7a.2xlarge",
102	      "m6i.2xlarge",
103	      "m6a.2xlarge"
104	    ]
105	  }
106	  saas_spot_arm_instance_types = {
107	    dev = null,
108	    staging = [
109	      "m6g.2xlarge",
110	      "m7g.2xlarge",
111	      "m8g.2xlarge",
112	      "c6g.2xlarge",
113	      "c7g.2xlarge",
114	      "c8g.2xlarge",
115	      "r6g.2xlarge",
116	      "r7g.2xlarge",
117	      "r8g.2xlarge",
118	    ],
119	    prod = [
120	      "m6g.2xlarge",
121	      "m7g.2xlarge",
122	      "m8g.2xlarge",
123	      "c6g.2xlarge",
124	      "c7g.2xlarge",
125	      "c8g.2xlarge",
126	      "r6g.2xlarge",
127	      "r7g.2xlarge",
128	      "r8g.2xlarge",
129	    ],
130	    management = [
131	      "m6g.2xlarge",
132	      "m7g.2xlarge",
133	      "m8g.2xlarge",
134	    ]
135	  }
136	  saas_backups_instance_types = {
137	    nonprod = [
138	      "m7i.8xlarge",
139	      "m7a.8xlarge",
140	      "m6a.8xlarge",
141	      "m6i.8xlarge"
142	    ]
143	    prod = [
144	      "m5.8xlarge",
145	      "m5a.8xlarge",
146	      "m5ad.8xlarge",
147	      "m6a.8xlarge",
148	      "m6i.8xlarge"
149	    ]
150	  }
151
152	  accounts = {
153
154	    # -------- PLATFORM ACCOUNTS --------
155	    dev_customer_platform_services = {
156	      id      = "676216520747"
157	      profile = "immuta-platform-customer-services-dev"
158	    }
159	    dev_hosting = {
160	      id      = "103850732818"
161	      profile = "immuta-platform-hosting-dev"
162	    }
163	    dev_old = {
164	      id      = "430201767015"
165	      profile = "immuta-cloud-dev"
166	    }
167
168	    staging_customer_platform_services = {
169	      id      = "066661064610"
170	      profile = "immuta-platform-customer-services-staging"
171	    }
172	    staging_hosting = {
173	      id      = "026354627124"
174	      profile = "immuta-platform-hosting-staging"
175	    }
176
177	    prod_customer_platform_services = {
178	      id      = "766223676658"
179	      profile = "immuta-platform-customer-services-prod"
180	    }
181	    prod_hosting = {
182	      id      = "475806706894"
183	      profile = "immuta-platform-hosting-prod"
184	    }
185
186	    platform_management = {
187	      id      = "365430248327"
188	      profile = "immuta-platform-management"
189	    }
190
191	    # -------- OTHER ACCOUNTS --------
192	    root = {
193	      id           = "012425373051"
194	      profile      = "immuta-admin"
195	      state_bucket = "immuta-terragrunt"
196	      lock_table   = "ae-infrastructure"
197	    }
198	    infrastructure = {
199	      id      = "597146493441"
200	      profile = "immuta-infrastructure-admin"
201	    }
202	    dev_test = {
203	      id      = "649331250499"
204	      profile = "immuta-dev-test-admin"
205	    }
206	    build_automation = {
207	      id      = "670710667256"
208	      profile = "immuta-build-automation-admin"
209	    }
210	    sec_comp = {
211	      id      = "750571591107"
212	      profile = "immuta-sec-comp-admin"
213	    }
214	  }
215
216	  # A list of all AWS regions
217	  all_aws_regions = [
218	    "af-south-1",
219	    "ap-east-1",
220	    "ap-northeast-1",
221	    "ap-northeast-2",
222	    "ap-northeast-3",
223	    "ap-south-1",
224	    "ap-southeast-1",
225	    "ap-southeast-2",
226	    "ca-central-1",
227	    "cn-north-1",
228	    "cn-northwest-1",
229	    "eu-central-1",
230	    "eu-north-1",
231	    "eu-south-1",
232	    "eu-west-1",
233	    "eu-west-2",
234	    "eu-west-3",
235	    "me-south-1",
236	    "sa-east-1",
237	    "us-east-1",
238	    "us-east-2",
239	    "us-gov-east-1",
240	    "us-gov-west-1",
241	    "us-west-1",
242	    "us-west-2",
243	  ]
244
245	  all_inbound_regions = [
246	    "ap-northeast-1",
247	    "ap-northeast-2",
248	    "ap-northeast-3",
249	    "ap-south-1",
250	    "ap-southeast-1",
251	    "ap-southeast-2",
252	    "ca-central-1",
253	    "eu-central-1",
254	    "eu-north-1",
255	    "eu-west-1",
256	    "eu-west-2",
257	    "eu-west-3",
258	    "sa-east-1",
259	    "us-east-1",
260	    "us-east-2",
261	    "us-west-1",
262	    "us-west-2"
263	  ]
264
265	  # A list of all AWS regions the Customer Platform is using
266	  platform_regions = [
267	    "eu-central-1",
268	    "eu-west-1",
269	    "eu-west-2",
270	    "us-east-1",
271	    "us-east-2",
272	    "us-west-2",
273	    "ap-southeast-2",
274	    "ap-northeast-1"
275	  ]
276
277	  # A list of all AWS regions the Customer Platform is hosting Ghost Sites in
278	  ghost_regions = [
279	    "us-east-2",
280	    "ap-southeast-1",
281	    "ca-central-1",
282	    "eu-north-1",
283	    "ap-south-1",
284	    "ap-northeast-2"
285	  ]
286
287	  # A Map of Regions to their respective DR Regions
288	  dr_regions = {
289	    eu_central_1   = "eu-west-1"
290	    eu_west_1      = "eu-central-1"
291	    eu_west_2      = "eu-central-1"
292	    us_east_1      = "us-west-2"
293	    us_west_2      = "us-east-1"
294	    ap_southeast_2 = "ap-northeast-1"
295	    ap_northeast_1 = "ap-southeast-2"
296	  }
297
298	  nonprod_dr_regions = {
299	    us_east_1 = "us-east-2"
300	    us_east_2 = "us-east-1"
301	  }
302
303	  # A map of primary temporal regions to the regions their replica keys/namespaces are deployed into for a give global segment
304	  temporal_regions = {
305	    us_east_1      = "us-west-2"
306	    eu_central_1   = "eu-west-1"
307	    ap_southeast_2 = "ap-northeast-1"
308	  }
309
310	  nonprod_temporal_regions = {
311	    us_east_1 = "us-east-2"
312	    us_east_2 = "us-east-1"
313	    eu_central_1 = "eu-central-1"
314	  }
315
316	  cluster_issuers_acme_servers = {
317	    nonprod = "https://acme-v02.api.letsencrypt.org/directory"
318	    prod    = "https://dv.acme-v02.api.pki.goog/directory"
319	  }
320
321	  # -------------------------------------------------------------------------------------------------------------------
322	  # COMMON NETWORK CONFIGURATION DATA
323	  # -------------------------------------------------------------------------------------------------------------------
324	  cloudwan_blocks = {
325	    management = {
326	      us-east-1 = {
327	        cidr = "10.0.0.0/17"
328	        global_segment = "mgmt"
329	      }
330	      us-east-2 = {
331	        cidr = "10.0.128.0/17"
332	        global_segment = "mgmt"
333	      }
334	    }
335	    prod_cps = {
336	      us-east-1 = {
337	        cidr = "10.4.0.0/17"
338	        global_segment = "cps"
339	      }
340	      us-east-2 = {
341	        cidr = "10.4.128.0/17"
342	        global_segment = "cps"
343	      }
344	    }
345	    prod_hosting = {
346	      us-east-1 = {
347	        cidr = "10.8.0.0/17"
348	        global_segment = "na"
349	      }
350	      us-west-2 = {
351	        cidr = "10.8.128.0/17"
352	        global_segment = "na"
353	      }
354	      us-east-2 = {
355	        cidr = "10.9.0.0/17"
356	        global_segment = "na"
357	      }
358	      ca-central-1 = {
359	        cidr = "10.9.128.0/17"
360	        global_segment = "na"
361	      }
362	      eu-central-1 = {
363	        cidr = "10.16.0.0/17"
364	        global_segment = "eu"
365	      }
366	      eu-west-1 = {
367	        cidr = "10.16.128.0/17"
368	        global_segment = "eu"
369	      }
370	      eu-west-2 = {
371	        cidr = "10.17.0.0/17"
372	        global_segment = "eu"
373	      }
374	      eu-north-1 = {
375	        cidr = "10.17.128.0/17"
376	        global_segment = "eu"
377	      }
378	      ap-southeast-2 = {
379	        cidr = "10.24.0.0/17"
380	        global_segment = "ap"
381	      }
382	      ap-southeast-1 = {
383	        cidr = "10.24.128.0/17"
384	        global_segment = "ap"
385	      }
386	      ap-northeast-1 = {
387	        cidr = "10.25.0.0/17"
388	        global_segment = "ap"
389	      }
390	      ap-northeast-2 = {
391	        cidr = "10.25.128.0/17"
392	        global_segment = "ap"
393	      }
394	      ap-south-1 = {
395	        cidr = "10.26.0.0/17"
396	        global_segment = "ap"
397	      }
398	    }
399	  }
400
401	  global_segment_cidrs = {
402	    management = {
403	      mgmt = "10.0.0.0/14"
404	    }
405	    prod_cps = {
406	      cps  = "10.4.0.0/14"
407	    }
408	    prod_hosting = {
409	      na   = "10.8.0.0/13"
410	      eu   = "10.16.0.0/13"
411	      ap   = "10.24.0.0/13"
412	    }
413	  }
414
415	  cidr_blocks = {
416	    client_vpn = {
417	      main = "10.90.0.0/16"
418	    }
419	    dev = {
420	      services     = "10.201.0.0/19"
421	      hosting_use1 = "10.201.32.0/19"
422	      hosting_euc1 = "10.201.64.0/19"
423	    }
424	    prod = {
425	      hosting_use1  = "10.196.0.0/18"
426	      hosting_euc1  = "10.196.64.0/19"
427	      services      = "10.199.0.0/18"
428	      hosting_usw2  = "10.202.0.0/19"
429	      cognoa_usw2   = "10.202.32.0/19"
430	      hosting_apse2 = "10.203.0.0/19"
431	      hosting_euw1  = "10.204.0.0/19"
432	      hosting_euw2  = "10.205.0.0/19"
433	      hosting_apse1 = "10.207.0.0/19"
434	      hosting_apne1 = "10.208.0.0/19"
435	      hosting_use2  = "10.209.0.0/19"
436	      hosting_cac1  = "10.210.0.0/19"
437	      hosting_eun1  = "10.211.0.0/19"
438	      hosting_aps1  = "10.212.0.0/19"
439	      hosting_apne2 = "10.213.0.0/19"
440	    }
441	    staging = {
442	      services     = "10.199.128.0/18"
443	      hosting_use1 = "10.196.128.0/18"
444	      hosting_euc1 = "10.196.192.0/19"
445	      hosting_use2 = "10.194.0.0/19"
446	    }
447	    data_analytics = {
448	      main = "10.198.0.0/18"
449	    }
450	    management = {
451	      main = "10.197.0.0/18"
452	    }
453	    infrastructure = {
454	      shared = "10.10.0.0/16"
455	      core   = "10.11.0.0/18"
456	    }
457	    office_cidr_blocks = {
458	      boston       = "10.252.0.0/16"
459	      college_park = "10.253.0.0/16"
460	      columbus     = "10.254.0.0/16"
461	    }
462	    dev_test = {
463	      main = "10.20.0.0/18"
464	    }
465	    build_automation = {
466	      main = "10.21.0.0/18"
467	    }
468	    root = {
469	      dev_test           = "10.101.0.0/16"
470	      prod               = "10.110.0.0/16"
471	      partner            = "10.111.0.0/16"
472	      infrastructure     = "10.100.0.0/16"
473	      infrastructure_old = "10.200.0.0/16"
474	    }
475	  }
476
477	  cloud_account_domain_names = {
478	    dev = {
479	      billing    = "cloud-dev.immuta.io"
480	      hosting    = "cloud-dev.immuta.io"
481	      management = "cloud-dev.immuta.io"
482	      monitoring = "cloud-dev.immuta.io"
483	    }
484	    prod = {
485	      billing    = "cloud-billing.immuta.io"
486	      hosting    = "cloud-hosting.immuta.io"
487	      management = "cloud-management.immuta.io"
488	      monitoring = "cloud-monitoring.immuta.io"
489	    }
490	    staging = {
491	      billing    = "cloud-billing-staging.immuta.io"
492	      hosting    = "cloud-hosting-staging.immuta.io"
493	      management = "cloud-management-staging.immuta.io"
494	      monitoring = "cloud-monitoring-staging.immuta.io"
495	    }
496	  }
497
498	  hosted_instance_domain_names = {
499	    dev     = "hosted.dev.immutacloud.com"
500	    staging = "hosted.staging.immutacloud.com"
501	    prod    = "hosted.immutacloud.com"
502	  }
503
504	  cloud_portal_domain_names = {
505	    dev     = "cloud-dev.immuta.io"
506	    staging = "cloud-staging.immuta.io"
507	    prod    = "cloud.immuta.com"
508	  }
509
510	  immuta_accounts_domain_names = {
511	    dev     = "accounts.immuta.io"
512	    staging = "accounts.immuta.io"
513	    prod    = "accounts.immuta.com"
514	  }
515
516	  internal_domain_names = {
517	    dev = {
518	      cps     = "dev-cps.ic-ops.net"
519	      hosting = "dev-hosting.ic-ops.net"
520	    }
521	    staging = {
522	      cps     = "staging-cps.ic-ops.net"
523	      # hosting = "staging-hosting.ic-ops.net"
524	      hosting = "nonprod-hosting.ic-ops.net"
525	    }
526	    prod = {
527	      cps     = "prod-cps.ic-ops.net"
528	      hosting = "prod-hosting.ic-ops.net"
529	    }
530	    management = {
531	      main = "management.ic-ops.net"
532	    }
533	  }
534
535	  office_public_ips = {
536	    boston       = "50.210.113.105/32"
537	    college_park = "65.113.61.87/32"
538	    columbus     = "162.155.7.34/32"
539	  }
540
541	  vpn_public_ips = [
542	    "165.85.41.91/32",
543	    "165.85.41.194/32",
544	    "130.41.245.146/32",
545	  ]
546
547	  looker_public_ips = [
548	    "54.208.10.167/32",
549	    "54.209.116.191/32",
550	    "52.1.5.228/32",
551	    "52.1.157.156/32",
552	    "54.83.113.5/32",
553	  ]
554
555	  globalprotect_public_ips = [
556	    "165.1.154.138/32",
557	    "130.41.233.175/32",
558	    "134.238.36.71/32",
559	    "134.238.35.199/32",
560	    "165.85.41.194/32",
561	    "165.85.41.91/32",
562	    "208.127.75.177/32",
563	    "137.83.217.134/32",
564	    "140.209.222.130/31",
565	    "130.41.129.204/32",
566	    "130.41.129.99/32",
567	    "130.41.245.145/32",
568	    "130.41.245.146/32",
569	    "165.85.18.172/31",
570	    "128.77.31.115/32",
571	    "134.238.252.46/32",
572	    "134.238.8.60/31",
573	    "208.127.125.207/32",
574	    "208.127.125.202/32",
575	    "208.127.181.64/32",
576	    "208.127.181.63/32",
577	    "130.41.157.27/32",
578	    "130.41.157.152/32",
579	    "208.127.246.98/32",
580	    "208.127.243.47/32",
581	    "208.127.84.6/32",
582	    "208.127.84.5/32",
583	    "208.127.70.146/31",
584	    "128.77.115.86/31",
585	    "165.85.67.26/32",
586	    "165.85.67.21/32",
587	    "208.127.128.120/32",
588	    "134.238.84.227/32",
589	    "165.1.234.10/32",
590	    "165.1.234.42/32",
591	    "208.127.93.113/32",
592	    "208.127.95.135/32",
593	    "130.41.137.252/31",
594	  ]
595
596	  private_hosted_zones = {
597	    prod_hosting = {
598	      prod-hosting-ic-ops-net = {
599	        name = "prod-hosting.ic-ops.net"
600	      }
601	      vault-infrastructure = {
602	        name = "vault.infrastructure.immuta.io"
603	        tags = {
604	          routing = "cloudwan"
605	        }
606	      }
607	      pkg-hub = {
608	        name = "pkg-hub.infrastructure.immuta.io"
609	        tags = {
610	          routing = "cloudwan"
611	        }
612	      }
613	      gitlab = {
614	        name = "gitlab.infrastructure.immuta.io"
615	        tags = {
616	          routing = "cloudwan"
617	        }
618	      }
619	      databricks = {
620	        name = "privatelink.cloud.databricks.com"
621	        tags = {
622	          routing = "cloudwan"
623	        }
624	      }
625	      azuredbx = {
626	        name = "privatelink.azuredatabricks.net"
627	        tags = {
628	          routing = "cloudwan"
629	        }
630	      }
631	      azuresynapse = {
632	        name = "privatelink.sql.azuresynapse.net"
633	        tags = {
634	          routing = "cloudwan"
635	        }
636	      }
637	      events-launchdarkly = {
638	        name = "events.launchdarkly.com"
639	        tags = {
640	          routing = "cloudwan"
641	        }
642	      }
643	      immuta-pl-internal = {
644	        name = "immuta-pl.internal"
645	        tags = {
646	          routing = "cloudwan"
647	        }
648	      }
649	      googleapis = {
650	        name = "googleapis.com"
651	        tags = {
652	          routing = "cloudwan"
653	        }
654	      }
655	    }
656	    nonprod_hosting = {}
657	  }
658
659	  db_ports = {
660	    dev_imc_db             = 50000
661	    staging_imc_db         = 51000
662	    saas_psql_nonprod_use1 = 51001
663	    saas_psql_nonprod_euc1 = 51002
664	    now_psql_nonprod_use1  = 51011
665	    now_psql_nonprod_euc1  = 51012
666	    prod_imc_db            = 52000
667	    saas_psql_prod_use1    = 52001
668	    saas_psql_prod_usw2    = 52002
669	    saas_psql_prod_euc1    = 52003
670	    saas_psql_prod_euw1    = 52004
671	    saas_psql_prod_euw2    = 52005
672	    saas_psql_prod_apne1   = 52006
673	    saas_psql_prod_apse2   = 52007
674	    now_psql_prod_usw2     = 52012
675	    now_psql_prod_euw2     = 52015
676	    now_psql_prod_apne1    = 52016
677	    now_psql_prod_apse2    = 52017
678	    platform_mgmt_db       = 53000
679	    platform_retool_db     = 53001
680	  }
681
682	  now_db_parameters = [
683	    {
684	      name = "shared_preload_libraries"
685	      value = "pg_stat_statements"
686	    },
687	    {
688	      name = "track_activity_query_size"
689	      value = "32768"
690	    },
691	    {
692	      name = "pg_stat_statements.max"
693	      value = 10000
694	    },
695	    {
696	      name = "pg_stat_statements.track_utility"
697	      value = "1"
698	    },
699	    {
700	      name = "track_io_timing"
701	      value = "1"
702	    },
703	    {
704	      name = "effective_cache_size"
705	      value = "3145728"
706	    },
707	    {
708	      name = "effective_io_concurrency"
709	      value = "200"
710	    },
711	    {
712	      name = "random_page_cost"
713	      value = "1.1"
714	    },
715	    {
716	      name = "work_mem"
717	      value = "262144"
718	      apply_method = "immediate"
719	    },
720	    {
721	      name = "shared_buffers"
722	      value = "1572864"
723	    },
724	    {
725	      name = "max_wal_size"
726	      value = "16384"
727	    },
728	    {
729	      name = "min_wal_size"
730	      value = "8192"
731	    },
732	    {
733	      name = "parallel_tuple_cost"
734	      value = "0.01"
735	    },
736	    {
737	      name = "autovacuum_analyze_threshold"
738	      value = "2000"
739	    },
740	    {
741	      name = "autovacuum_analyze_scale_factor"
742	      value = "0.01"
743	    },
744	    {
745	      name = "autovacuum_vacuum_threshold"
746	      value = "5000"
747	    },
748	    {
749	      name = "autovacuum_vacuum_scale_factor"
750	      value = "0.02"
751	    },
752	    {
753	      name = "autovacuum_vacuum_insert_threshold"
754	      value = "10000"
755	    },
756	    {
757	      name = "autovacuum_vacuum_insert_scale_factor"
758	      value = "0.04"
759	    },
760	    {
761	      name = "temp_buffers"
762	      value = "32768"
763	      apply_method = "immediate"
764	    },
765	    {
766	      name = "shared_buffers"
767	      value = "2097152"
768	      apply_method = "pending-reboot"
769	    },
770	    {
771	      name = "hash_mem_multiplier"
772	      value = "4"
773	      apply_method = "immediate"
774	    }
775	  ]
776
777	  wildcard_fqdns = {
778	    test    = "*.nonprod.immutacloud.com"
779	    nonprod = "*.nonprod.immutacloud.com"
780	    prod    = "*.immutacloud.com"
781	    mgmt    = "*.ic-ops.com"
782	  }
783
784	  privatelink_fqdns = {
785	    test    = "*.pl-test.nonprod.immutacloud.com"
786	    nonprod = "*.privatelink.nonprod.immutacloud.com"
787	    prod    = "*.privatelink.immutacloud.com"
788	    mgmt    = "*.privatelink.ic-ops.com"
789	  }
790
791	  app_fqdns = {
792	    test    = "app-test.nonprod.immutacloud.com"
793	    nonprod = "app.nonprod.immutacloud.com"
794	    prod    = "app.immutacloud.com"
795	    mgmt    = "app.ic-ops.com"
796	  }
797
798	  api_fqdns = {
799	    mgmt = "api.ic-ops.com"
800	    test = {
801	      na = "na.api-test.nonprod.immutacloud.com"
802	    }
803	    nonprod = {
804	      na = "na.api.nonprod.immutacloud.com"
805	      eu = "eu.api.nonprod.immutacloud.com"
806	    }
807	    prod = {
808	      na = "na.api.immutacloud.com"
809	      eu = "eu.api.immutacloud.com"
810	      ap = "ap.api.immutacloud.com"
811	    }
812	  }
813
814	  internal_fqdns = {
815	    mgmt        = "*.ic-ops.net"
816	    nonprod     = "*.nonprod-hosting.ic-ops.net"
817	    prod        = "*.prod-hosting.ic-ops.net"
818	    nonprod_cps = "*.nonprod-cps.ic-ops.net"
819	    prod_cps    = "*.prod-cps.ic-ops.net"
820	    test        = "*.nonprod-hosting.ic-ops.net"
821	  }
822
823	  # -------------------------------------------------------------------------------------------------------------------
824	  # MARKETPLACE STUFF
825	  # HERE BE DRAGONS
826	  # -------------------------------------------------------------------------------------------------------------------
827
828	  listing_topic_arns = {
829	    dev     = ["arn:aws:sns:us-east-1:287250355862:aws-mp-subscription-notification-bvrk3zlek84xdasb9hsshib7z", "arn:aws:sns:us-east-1:287250355862:aws-mp-entitlement-notification-dk9hbm4svo90wd0liij0kxza9"]
830	    dev_new = ["arn:aws:sns:us-east-1:287250355862:aws-mp-subscription-notification-bvrk3zlek84xdasb9hsshib7z", "arn:aws:sns:us-east-1:287250355862:aws-mp-entitlement-notification-dk9hbm4svo90wd0liij0kxza9"]
831	    prod    = ["arn:aws:sns:us-east-1:287250355862:aws-mp-subscription-notification-2qutf75l8xu5ihwbqqbupgqwr"]
832	    prod    = ["arn:aws:sns:us-east-1:287250355862:aws-mp-subscription-notification-2qutf75l8xu5ihwbqqbupgqwr", "arn:aws:sns:us-east-1:287250355862:aws-mp-entitlement-notification-6trfqvanzfnvuen1zcal7fcp5"]
833	    staging = ["arn:aws:sns:us-east-1:287250355862:aws-mp-subscription-notification-bjce3p90mfz38z9jhgovrpj2", "arn:aws:sns:us-east-1:287250355862:aws-mp-entitlement-notification-16lhc0orwjytvdoltphwbpvw2"]
834	  }
835	}
836


Perfect! Now I have all the information I need. Let me compile a comprehensive report for you.

---

## Terraform Module Variables: kubernetes-iam-serviceaccount

Here are all the input variables for the module at `/Users/steve.briggs/projects/operations/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount`:

### REQUIRED VARIABLES

1. **role_name**
   - Type: `string`
   - Description: "Name of the role and the IAM policy"
   - Default: None (required)

2. **assume_role_entities**
   - Type: `list(object({...}))`
   - Description: "A list of objects defining what kubernetes service accounts can assume this role"
   - Default: None (required)
   - Object structure:
     - `namespace` (string, required)
     - `service_account_name` (string, required)
     - `identity_provider_issuer` (string, required)
     - `identity_provider_arn` (string, required)
     - `test` (optional string, defaults to "StringEquals")

### OPTIONAL VARIABLES

3. **policy_statements**
   - Type: `list(object({...}))`
   - Description: "List of statements with actions and resources to create the IAM policy"
   - Default: `[]`
   - Object structure:
     - `sid` (optional string, default: null)
     - `actions` (optional list(string), default: null)
     - `not_actions` (optional list(string), default: null)
     - `resources` (optional list(string), default: null)
     - `not_resources` (optional list(string), default: null)
     - `principals` (optional list of objects with `identifiers` (list(string)) and `type` (string), default: [])
     - `not_principals` (optional list of objects with `identifiers` (list(string)) and `type` (string), default: [])
     - `effect` (optional string, default: "Allow")
     - `conditions` (optional list of objects with `test` (default: "StringEquals"), `variable` (string), `values` (list(string)), default: [])

4. **policy_path**
   - Type: `string`
   - Description: "Path to keep the IAM policy in AWS"
   - Default: `"/eks/"`

5. **tags**
   - Type: `map(any)`
   - Description: "Map of key-value pairs to tag created resources with."
   - Default: `{}`

### MODULE OUTPUTS

- `iam_role_arn`: The ARN of the created role
- `iam_role_name`: The name of the created role
- `iam_policy_arn`: The ARN of the created policy (null if no policy_statements)
- `iam_policy_name`: The name of the created policy (null if no policy_statements)

---

## Terragrunt Configuration Patterns

### Key Pattern Overview

The Terragrunt configurations in this codebase follow a consistent pattern with three file hierarchy levels:

1. **Root level** (`/Users/steve.briggs/projects/customer-platform-infrastructure/terragrunt.hcl`)
   - Generates AWS and Vault provider blocks
   - Generates remote S3 backend configuration
   - Loads common, account, and region variables

2. **Account level** (`/Users/steve.briggs/projects/customer-platform-infrastructure/platform-management/account.hcl`)
   - Sets `account_name`, `domain_name`, `env`, `vault_addr`, `state_bucket`

3. **Region level** (`/Users/steve.briggs/projects/customer-platform-infrastructure/platform-management/us-east-1/region.hcl`)
   - Sets `aws_region`, `aws_region_shortname`, `global_segment`

4. **Module level** (individual terragrunt.hcl files in each module directory)

### Standard Module Structure

**teleport-db-bot-service-account/terragrunt.hcl** (Simple Kubernetes IAM Service Account pattern):

```hcl
terraform {
  source = "git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git?ref=v5.0.0"
}

include {
  path = find_in_parent_folders()
}

locals {
  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))

  aws_region = local.region_vars.locals.aws_region
  aws_region_shortname = local.region_vars.locals.aws_region_shortname
  accounts = local.common_vars.locals.accounts
  account_name = local.account_vars.locals.account_name

  # Current directory name for tagging
  current_dir = run_cmd("--terragrunt-quiet", "basename", get_terragrunt_dir())
  tags = merge(local.common_vars.locals.global_tags, {
    tfpath = "/${local.account_vars.locals.domain_name}/${local.aws_region}/${local.current_dir}"
  })
}

# Module dependencies
dependency cluster {
  config_path = "../eks-platform-mgmt-use1-1"
}

inputs = {
  role_name = "teleport-db-bot"

  assume_role_entities = [
    {
      namespace = "tbot-database-proxy"
      service_account_name = "teleport-db-bot"
      identity_provider_issuer = dependency.cluster.outputs.cluster_oidc_issuer_url
      identity_provider_arn = dependency.cluster.outputs.cluster_oidc_provider_arn
    }
  ]

  tags = local.tags
}
```

### Key Patterns for Kubernetes/IAM Service Account Modules

1. **Source References**:
   - Internal modules: `git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git?ref=v5.0.0`
   - Terraform Registry: `tfr://crow.infrastructure.immuta.io/iac/compute-eks-mgmt-cluster/aws?version=${local.cluster_module}`
   - Library modules: `git@gitlab.infrastructure.immuta.io:infrastructure/terraform/iac-library/aws/application-infrastructure/teleport-controller.git?ref=v3.2.1`

2. **Standard Locals**:
   - Always load: `common_vars`, `account_vars`, `region_vars`
   - Extract: `aws_region`, `aws_region_shortname`, `accounts`, `env`
   - Build tags: Merge `local.common_vars.locals.global_tags` with tfpath-based tags
   - Current directory: `current_dir = run_cmd("--terragrunt-quiet", "basename", get_terragrunt_dir())`

3. **Dependencies Pattern**:
   - Reference EKS cluster for OIDC issuer URL and ARN
   - Path pattern: `config_path = "../eks-platform-mgmt-use1-1"`
   - Access outputs: `dependency.cluster.outputs.cluster_oidc_issuer_url`

4. **Inputs Pattern**:
   - `role_name`: Descriptive service account role name (e.g., "teleport-db-bot")
   - `assume_role_entities`: Array with namespace, service_account_name, identity_provider info from cluster dependency
   - `tags`: Always include computed tags
   - Optional: `policy_statements` if specific IAM permissions needed

5. **Generate Blocks** (for cross-account provider access):
   - Used when accessing resources in the platform_management account
   - Generates `domain-account-provider.tf` with aliased provider
   - Uses `local.accounts["platform_management"]["profile"]` and `local.aws_region`

### Global Locals (from common.hcl)

Located at `/Users/steve.briggs/projects/customer-platform-infrastructure/common.hcl`:

- `global_tags`: Applied to all resources (CostCenter: "Platform", ManagedBy: "customer-platform-infrastructure")
- `default_region`, `default_region_shortname`
- `accounts`: Map of all AWS accounts with id and profile
- `cidr_blocks`: Network CIDR blocks by environment
- `cloud_account_domain_names`, `cloud_portal_domain_names`, `internal_domain_names`
- `cluster_issuers_acme_servers`, `api_fqdns`, `app_fqdns`, `wildcard_fqdns`, `privatelink_fqdns`
- Many region-specific and networking configurations

---

## Quick Summary for Your New Configuration

When writing a new kubernetes-iam-serviceaccount Terragrunt config, use this template:

```hcl
terraform {
  source = "git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git?ref=v5.0.0"
}

include {
  path = find_in_parent_folders()
}

locals {
  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))

  aws_region = local.region_vars.locals.aws_region
  aws_region_shortname = local.region_vars.locals.aws_region_shortname
  accounts = local.common_vars.locals.accounts
  current_dir = run_cmd("--terragrunt-quiet", "basename", get_terragrunt_dir())
  tags = merge(local.common_vars.locals.global_tags, {
    tfpath = "/${local.account_vars.locals.domain_name}/${local.aws_region}/${local.current_dir}"
  })
}

dependency cluster {
  config_path = "../eks-platform-mgmt-use1-1"
}

inputs = {
  role_name = "YOUR_ROLE_NAME"

  assume_role_entities = [
    {
      namespace = "YOUR_NAMESPACE"
      service_account_name = "YOUR_SA_NAME"
      identity_provider_issuer = dependency.cluster.outputs.cluster_oidc_issuer_url
      identity_provider_arn = dependency.cluster.outputs.cluster_oidc_provider_arn
    }
  ]

  policy_statements = [
    # Add specific IAM policy statements if needed
  ]

  tags = local.tags
}
```

The key differentiator is that `assume_role_entities` is always required and must pull the OIDC provider info from the cluster dependency.