Infra Sync

Infrastructure Sync Skill

Use this skill when changes are made to either the Terraform (terraform/aws-ecs/) or CDK (infra/) infrastructure and the other needs to be updated to maintain parity.

When to Use

• After modifying Terraform files in terraform/aws-ecs/
• After modifying CDK files in infra/lib/registry/
• When asked to check if Terraform and CDK are in sync
• Before deploying to verify both IaC tools produce equivalent infrastructure

Input Modes

1. Full Sync Check - Compare all resources across both IaC tools
2. Targeted Sync - Compare a specific area (e.g., "sync ECS services" or "sync networking")
3. Propagate Change - User made changes to one tool and wants the other updated

Workflow

Step 1: Identify the Source of Truth

Ask the user (or determine from context):

• Which IaC tool was just modified? (Terraform or CDK)
• Is this a full sync check or targeted to a specific area?

Step 2: Read Both Configurations

Read the relevant files from both Terraform and CDK based on the comparison area.

File Mapping (Terraform to CDK)

Step 3: Compare Resource by Resource

For each comparison area, check the following attributes:

ECS Services Comparison Checklist

For each service (registry, auth-server, MCP servers, A2A agents):

• Container image - Same ECR repository and tag
• CPU/Memory - Same task definition resources
• Port mappings - Same container ports
• Environment variables - Same env vars passed to container
  • Check every env var key and value source
  • Flag any env var present in one but not the other
• Secrets - Same Secrets Manager references
  • Check JSON key extraction syntax (:username::, :password::)
• EFS mounts - Same volume mounts (or both empty)
• Health check - Same endpoint, interval, timeout
• Service Connect - Same discovery name and port
• Auto-scaling - Same min/max/target values
• Circuit breaker - Document if only in one (CDK has it, Terraform may not)
• Replicas - Same desired count

Networking Comparison Checklist

• VPC - Same CIDR, AZ count, subnet layout
• ALB - Same scheme, listeners, target groups
• Security groups - Same ingress/egress rules
• Service Discovery - Same namespace name, service names
• VPC Endpoints - Same endpoint types

Storage Comparison Checklist

• EFS access points - Same paths, POSIX user/group, permissions
• EFS mount targets - Same subnet placement
• DocumentDB - Same engine, instance class, encryption, auth
• Aurora MySQL - Same engine, scaling, encryption

Secrets Comparison Checklist

• Secret names - Same set of secrets created
• KMS encryption - Same key configuration
• Conditional creation - Same conditions for optional secrets
• Rotation - Same rotation schedule and Lambda config

Step 4: Generate Parity Report

Present findings in this format:

## Infrastructure Parity Report

**Date:** {date}
**Source of Truth:** {Terraform|CDK}
**Scope:** {Full|Targeted area}

### Summary

| Area | Status | Discrepancies |
|------|--------|---------------|
| ECS Services | {In Sync / Diverged} | {count} |
| Networking | {In Sync / Diverged} | {count} |
| Storage | {In Sync / Diverged} | {count} |
| Secrets | {In Sync / Diverged} | {count} |
| IAM | {In Sync / Diverged} | {count} |
| Observability | {In Sync / Diverged} | {count} |

### Discrepancies

#### {Area}: {Description}

| Attribute | Terraform | CDK | Action Required |
|-----------|-----------|-----|-----------------|
| {attr} | {tf value} | {cdk value} | {Fix in TF / Fix in CDK / Intentional} |

### Intentional Differences

These differences are by design and should NOT be synced:

| Feature | CDK | Terraform | Rationale |
|---------|-----|-----------|-----------|
| Circuit Breaker | Enabled | Not configured | Faster failure detection (~4 min vs ~3 hours) |
| HOME=/tmp | Set on registry | Not set | Fixes Path.home() PermissionError in container |
| DocumentDB credentials | Always passed when cluster exists | Gated on storage_backend | Skills repository always uses DocumentDB |
| Keycloak URL fallback | Falls back to http://{alb-dns} | Always https:// | Deployment without Route53/certs |

### Recommendations

1. **Must Fix:** {Critical parity gaps}
2. **Should Fix:** {Important but non-breaking gaps}
3. **Consider:** {Nice-to-have improvements}

Step 5: Apply Fixes

If the user wants fixes applied:

1. Determine the target (Terraform or CDK)
2. Make the edits to bring the target in sync
3. For CDK changes: run cd infra && npx tsc --noEmit to verify TypeScript compiles
4. For Terraform changes: run cd terraform/aws-ecs && terraform validate if available
5. Present a summary of all changes made

Comparison Details by Area