feat(iac): wire optional Archera comparison settings with single-secret access

[cristim]

Third slice of #785 (IaC and deployment docs). Independent of the pin bump and the backend PRs; uses only the settled names ARCHERA_ORG_ID, ARCHERA_PLAN_ID, ARCHERA_API_KEY_SECRET.

• Optional variables, default empty, in all six compute modules (AWS lambda/fargate, GCP cloud-run/gke, Azure container-apps/aks) and the three environments. Env vars are set only when non-empty, so an unconfigured deployment carries none.
• AWS: the secret ARN is added to the existing compact() GetSecretValue list with the ${arn}* pattern (lambda role; fargate task role). GCP: per-secret google_secret_manager_secret_iam_member on the one secret (cloud-run and gke). Azure: no new grant; the platform vault already gives the runtime identity vault-wide Key Vault Secrets User, a secret-scoped assignment is needed only for a secret in another vault (documented). Narrowing the vault-wide grant stays an owner item.
• The operator creates the secret out-of-band; no key in Terraform state. docs/DEPLOYMENT.md section added.

Verification (local, macOS): terraform fmt clean; init -backend=false + validate OK for the six modules and three environments (temp copy); go test ./terraform/modules/compute/{aws,gcp,azure} OK. No apply, no live calls.

Refs #785 #786

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 19 billable files and costs up to $4.75.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 2 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 87 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: c8cb44ba-6a16-402a-9a72-f286f4c60c5f

---

📥 Commits

Reviewing files that changed from the base of the PR and between 525e6ad and 4c9d45d.

---

📒 Files selected for processing (19)

• docs/DEPLOYMENT.md
• terraform/environments/aws/compute.tf
• terraform/environments/aws/variables.tf
• terraform/environments/azure/compute.tf
• terraform/environments/azure/variables.tf
• terraform/environments/gcp/compute.tf
• terraform/environments/gcp/variables.tf
• terraform/modules/compute/aws/fargate/main.tf
• terraform/modules/compute/aws/fargate/variables.tf
• terraform/modules/compute/aws/lambda/main.tf
• terraform/modules/compute/aws/lambda/variables.tf
• terraform/modules/compute/azure/aks/main.tf
• terraform/modules/compute/azure/aks/variables.tf
• terraform/modules/compute/azure/container-apps/main.tf
• terraform/modules/compute/azure/container-apps/variables.tf
• terraform/modules/compute/gcp/cloud-run/main.tf
• terraform/modules/compute/gcp/cloud-run/variables.tf
• terraform/modules/compute/gcp/gke/main.tf
• terraform/modules/compute/gcp/gke/variables.tf

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Gate review at 96b900b: CHANGES REQUESTED (not merging).

IAM is clean: AWS adds the ARN and ${arn}* to the existing compact() list, GetSecretValue only, on the lambda role and the fargate task role (aws_iam_role.task), and only when the ARN is non-empty. GCP adds one count-gated secretAccessor binding per runtime SA on that one secret. Azure adds no grant; the vault-wide Key Vault Secrets User is real (environments/azure/compute.tf:214-219, aks/main.tf:160-163) and the docs say so. Env vars are set only when non-empty, and every default is "".
Local checks from git archive: terraform fmt -check -recursive 0. init -backend=false + validate 0 for all 6 modules and 3 environments. go test ./terraform/modules/compute/... 0. misspell -locale US finds nothing on the added lines (the pre-existing defence/reorganised hits are not in this diff). CI 26/26 pass, CLEAN.

Findings:

1. (medium) GCP perpetual replace. terraform/modules/compute/gcp/cloud-run/variables.tf:270 and gke/variables.tf:383 describe archera_api_key_secret_id as the "full resource name", and the bindings at cloud-run/main.tf:540 and gke/main.tf:836 set project. This repo already notes (cloud-run/main.tf:300-304, gke/main.tf:256-259) that a projects/<NUMBER>/secrets/<id> name combined with project replaces the binding on every apply, and the destroy removes the live grant. An out-of-band secret's name from gcloud secrets describe comes in exactly that NUMBER form. Fix: document the variable as the short secret ID (as workload_additional does; the runtime resolver accepts both forms, internal/secrets/gcp_resolver.go:40-45), or drop project and require the full name. Make the environments/gcp/variables.tf description match.
2. (low) Six module variables.tf files say "see docs/archera-comparison.md": aws/lambda:311, aws/fargate:331, gcp/cloud-run:254, gcp/gke:367, azure/container-apps:262, azure/aks:212. That file does not exist. Point them at the docs/DEPLOYMENT.md section.
3. (low) docs/DEPLOYMENT.md:322 says "the existing Archera disclosures stay in place" but does not include them. feat(insurance): consume pkg/insurance for an explicit Archera comparison (backend, API, config, UI) #785 asks for the disclosure text in the deployment docs. Quote the two mandatory strings verbatim from cloud-commitments-go pkg/common/archera.go:38-39 (ArcheraNonGatingDisclosure) and :43-44 (ArcheraSponsorshipDisclosure).

[cristim]

Gate re-run at 4c9d45d: CLEAN, merging.

All three findings are fixed:

1. GCP: archera_api_key_secret_id is now the short secret ID. A validation { condition = !strcontains(var, "/") } sits in both gcp/cloud-run and gcp/gke variables.tf, and the descriptions match in the modules and in environments/gcp. Proven in an isolated root with the exact variable block: terraform plan -var archera_api_key_secret_id=projects/123/secrets/archera exits 1 with the error "must be the short secret ID". "archera-key" and "" both plan 0. The runtime resolver accepts short IDs (internal/secrets/gcp_resolver.go:40-45).
2. Every docs/archera-comparison.md reference now points to the Archera section of docs/DEPLOYMENT.md.
3. docs/DEPLOYMENT.md quotes ArcheraNonGatingDisclosure and ArcheraSponsorshipDisclosure verbatim; checked byte for byte against cloud-commitments-go pkg/common/archera.go:38-39 and :43-44.
   IAM is unchanged from the previous gate (scoping was clean there).
   Local from git archive: terraform fmt -check -recursive 0. init -backend=false + validate 0 for all 6 compute modules and 3 environments. go test ./terraform/modules/compute/... 0. misspell -locale US on the added lines 0.
   CI 26/26 pass at this SHA. Since then feat(insurance): add default-off Archera settings, lazy client and status endpoint #795 merged into main; it touches no terraform or docs files, so the PR diff is unchanged (19 files, +352/-3).