lab part 2: legacy system production-grade Terraform modules + GitLab

🎯 Goal When you push to GitLab: CI runs terraform plan for envs/legacy It uses remote S3 backend It assumes AWS role (OIDC) It does NOT auto-apply Apply is manual + protected 🏗 Current Structure (Correct) infra-live/ ├── envs/ │ ├── legacy/ │ │ ├── backend.tf │ │ ├── main.tf │ │ ├── providers.tf │ │ ├── variables.tf │ │ ├── terraform.tfvars │ │ └── .terraform.lock.hcl ├── scripts/ │ └── assume_role.sh ├── .gitlab-ci.yml └── .gitignore Backend already configured: backend "s3" {} State is already in S3. Good. 🟢 STEP 1 — Make Sure CI Has AWS Access Your pipeline already uses OIDC: scripts/assume_role.sh It should: Assume IAM role Export AWS credentials Print caller identity In CI logs you should see: aws sts get-caller-identity If that works → AWS access is ready. 🟢 STEP 2 — Add Legacy Plan Job in .gitlab-ci.yml Add this block: stages : - plan - apply legacy-plan : stage : plan image : hashicorp/terraform:1.7 before_script : - apk add --no-cache bash curl jq aws-cli - . scripts/assume_rol