Legend
Deploy
Deployment configuration for this moduleModuleDeployment
Deployment configuration — discriminated by deployment typeDiscriminated union. Thetype field selects which schema applies.AwsStaticModuleDeployment
AWS static site deployment configurationenum
required
Deployment type discriminatorAllowed values:
aws:staticAwsStaticDeploymentInfrastructure
required
Infrastructure resources required by the deploymentSee: AwsStaticDeploymentInfrastructure
integer
Maximum total wall-clock budget (in seconds) for a single deploy, measured
from the moment the workflow starts (including time spent waiting for the
deployment-manager lock). Matches the semantics of pipeline step
timeout.
When omitted the deploy has no explicit wall-clock limit beyond the
workflow-level activity timeouts on each phase.
Default: unset (no wall-clock cap).(format:int32,min:60)InputProperty[]
required
Deployment-specific inputs shown in the deploy modal.
Same types as module inputs — reuses the InputProperty union.See: InputProperty
AwsStaticDeploymentDefinition
required
Per-deploy definition. Templateable — supports both module.input and
deploy.input references inside string fields.See: AwsStaticDeploymentDefinition(templateable)
Ec2ModuleDeployment
AWS EC2 deployment configuration. In-place only: instances are never replaced; the module-provided SSM document performs the whole per-instance deploy and its exit status is the per-instance verdict. Traffic-shift strategies are deliberately out of scope — rolling is the only supported deployment strategy.enum
required
Deployment type discriminatorAllowed values:
aws:ec2Pipeline.GitSource
See: Pipeline.GitSource(templateable)
Ec2DeploymentInfrastructure
required
Infrastructure resources required by the deployment.See: Ec2DeploymentInfrastructure
EcsDeployConcurrency
Concurrency policy — controls how simultaneous deploy requests are handled.
Omit to use defaults: queue_size=1, queue_overflow=oldest.See: EcsDeployConcurrency
Ec2DeploymentStrategyConfig
Rolling in-place deployment strategy. Its rollout controls map to SSM
SendCommand MaxConcurrency / MaxErrors.
Omit for the safe default: one instance at a time, stop on first failure.See: Ec2DeploymentStrategyConfig(templateable)
integer
Maximum total wall-clock budget (in seconds) for a single deploy,
measured from the moment the workflow starts (including time spent
waiting for the deployment-manager lock). Matches the semantics of
pipeline step
timeout.
Default: unset (no wall-clock cap).(format:int32,min:60)InputProperty[]
required
Deployment-specific inputs shown in the deploy modal.
Same types as module inputs — reuses the InputProperty union.See: InputProperty
Ec2DeploymentDefinition
required
Per-deploy definition. Templateable — supports both module.input and
deploy.input references inside string fields.See: Ec2DeploymentDefinition(templateable)
LambdaModuleDeployment
AWS Lambda deployment configuration. v1 supports UpdateFunctionCode- PublishVersion + UpdateAlias. Pre/post deploy hooks and weighted- routing alias shifts are deliberately out of scope for v1.
enum
required
Deployment type discriminatorAllowed values:
aws:lambdaLambdaDeploymentInfrastructure
required
Infrastructure resources required by the deployment.See: LambdaDeploymentInfrastructure
integer
Maximum total wall-clock budget (in seconds) for a single deploy,
measured from the moment the workflow starts (including time spent
waiting for the deployment-manager lock). Matches the semantics of
pipeline step
timeout.
Default: unset (no wall-clock cap).(format:int32,min:60)InputProperty[]
required
Deployment-specific inputs shown in the deploy modal.
Same types as module inputs — reuses the InputProperty union.See: InputProperty
LambdaDeploymentDefinition
required
Per-deploy definition. Templateable — supports both module.input
and deploy.input references inside string fields.See: LambdaDeploymentDefinition(templateable)
LambdaFunctionConfiguration
Per-deploy function-configuration overrides applied via
UpdateFunctionConfiguration before the new code is published.
Every field is optional — omitted fields are left untouched on
AWS (partial update semantic). Omitting the entire block skips
the UpdateFunctionConfiguration phase.Templateable — every string/scalar leaf supports module.input and
deploy.input references.See: LambdaFunctionConfiguration(templateable)AwsStaticDeploymentDefinition
Per-deploy definition for AWS static deployments. The deploy manager promotes the resolveds3_directory to the active KVS key and (optionally) issues a
background CloudFront cache invalidation across all distributions.string
required
S3 directory (version prefix) to promote to active.
Templateable — typically references a deploy input that holds the version
built by the upstream pipeline step.(minLen:1; templateable)
string[] | null
CloudFront cache invalidation paths to issue across every distribution
after the KVS write succeeds. Runs in the background — the deploy is
marked complete on KVS write, not on invalidation completion.
Empty list disables invalidation entirely (preferred for KVS-versioned
setups where each version flip is automatically a fresh cache key).(templateable)
integer | null
Number of latest successful deploys to keep in S3. Older S3 directories
are pruned in the background after a successful deploy. Omit or set to 0
to disable pruning entirely.(format:int32,min:0; templateable)
AwsStaticDeploymentInfrastructure
Infrastructure resources required for AWS static site deployment. Not provisioned by the deploy manager — must already exist (typically created by thehosting/static_site Terraform module). The KeyValueStore is shared
by all distributions of the module; the CloudFront viewer-request function
reads it on every request to resolve the active S3 directory.string
required
CloudFront KeyValueStore ARN that holds the active version pointer.
The deploy step writes
key="active", value=<s3_directory> to this store
via PutKey with optimistic ETag concurrency.(minLen:1; templateable)string[]
required
CloudFront distribution ARNs that share this origin/KVS.
Used for optional cache invalidation after the version flip.(minItems:1; templateable)
string
required
AWS region of the S3 hosting bucket.(minLen:1; templateable)
string
required
S3 bucket name that hosts the versioned build directories.
Build artifacts live at
s3://<s3_bucket>/<s3_directory>/....(minLen:1; templateable)Ec2DeploymentDefinition
Per-deploy EC2 definition — discriminated byruntime.Discriminated union. The runtime field selects which schema applies.Ec2DeploymentInfrastructure
Infrastructure resources required for an AWS EC2 deployment. Not provisioned by the deploy manager — must already exist (created by thecompute/ec2_service Terraform module). The deploy manager runs the
module-provided SSM command document against the Auto Scaling Group’s
in-service instances; all deploy mechanics (env rebuild, target-group
drain/re-register, container/artifact swap, local health gate) live inside
the document.string
required
Name of the Auto Scaling Group whose in-service instances the deploy
targets. For container deploys the module’s SSM deploy document is
derived from this name by convention (
<name>-deploy) — the
Terraform module names both from the same input, so the document is
not part of this contract.(minLen:1; templateable)string
required
AWS region of the Auto Scaling Group and SSM document.(minLen:1; templateable)
string
required
Ravion AWS account ID (
awsact_…, as selected from
$values:ravion/aws_accounts) that owns the Auto Scaling Group — not
the raw AWS account number. Unlike the ECS / Lambda / Static deploy
types, no EC2 infrastructure field is an ARN the account could be
parsed from, so it is declared explicitly.(minLen:1; templateable)string | null
CloudWatch log group receiving application stdout and stderr from the
EC2 instances. The deploy manager combines this with the deployment and
instance IDs to query one exact stream per instance.(templateable)
string | null
ARN of the service target group when the service is attached to a load
balancer. Informational for the deploy manager (the SSM document owns
drain/re-register); omitted for worker-mode services.(templateable)
Ec2DeploymentStrategyConfig
Rolling in-place deployment strategy for EC2 instances. The rollout controls map 1:1 to SSM SendCommand’s MaxConcurrency / MaxErrors semantics — values are absolute counts (“1”, “5”) or percentages (“25%”).enum
required
Deployment strategy. EC2 deployments currently support rolling in-place
updates only.Allowed values:
rolling(templateable)string | null
How many instances run the deploy document at once. SSM SendCommand
MaxConcurrency semantics.
Default: “1” — one instance at a time, so a load-balanced service keeps
serving from the untouched instances during the rollout.(templateable)
string | null
How many per-instance failures are tolerated before SSM stops sending
the document to further instances. SSM SendCommand MaxErrors semantics.
Default: “0” — the first failed instance halts the rollout.(templateable)
LambdaDeploymentDefinition
Per-deploy Lambda definition — discriminated bypackage_type.Discriminated union. The package_type field selects which schema applies.LambdaDeploymentInfrastructure
Infrastructure resources required for AWS Lambda deployment. Not provisioned by the deploy manager — must already exist (typically created by thecompute/lambda Terraform module). The alias is
expected to already exist on the function; the deploy step only
flips it onto a freshly-published version.string
required
Full ARN of the Lambda function the deploy targets.(minLen:1; templateable)
string
required
AWS region of the function. Mirrors
aws_static_module_deployment’s
s3_region — needed because Lambda’s regional endpoint is the only
thing the workflow can reach the function through.(minLen:1; templateable)string | null
Alias the deploy flips after publishing the new function version.
Default:
live. The alias must already exist on the function — the
deploy step calls UpdateAlias, never CreateAlias.(templateable)string | null
S3 bucket the build step uploaded the zip artifact into. Optional —
captured into the deploy snapshot for audit even when the deploy
itself targets an Image-packaged function.(templateable)
LambdaFunctionConfiguration
AWS Lambda function configuration — every field optional, applied as a partial update viaUpdateFunctionConfiguration. Fields the user
omits are left untouched on AWS; an empty block (or omitting the
function_configuration key entirely) skips the
UpdateFunctionConfiguration phase altogether.All scalar/string fields are templateable for << module.input.* >>
and << deploy.input.* >> expressions.https://docs.aws.amazon.com/lambda/latest/api/API_UpdateFunctionConfiguration.htmlstring | null
IAM execution role ARN.(templateable)
string | null
Handler entrypoint (Zip only — ignored for Image).(templateable)
string | null
Lambda runtime (Zip only — ignored for Image).(templateable)
integer | null
Memory size in MiB. 128–10240.(format:int32,min:128,max:10240; templateable)
integer | null
Wall-clock timeout in seconds. 1–900.(format:int32,min:1,max:900; templateable)
string | null
Function description shown in the AWS console.(templateable)
enum[x86_64,arm64][] | null
CPU architectures — exactly one of
x86_64 or arm64.(templateable)LambdaEnvironment
LambdaVpcConfig
VPC configuration. Setting empty arrays disconnects the function
from the VPC.See: LambdaVpcConfig(templateable)
string[] | null
Lambda layer ARNs (versioned, e.g.
arn:aws:lambda:us-east-1:123456789012:layer:foo:3).(templateable)LambdaEphemeralStorage
LambdaTracingConfig
string | null
Customer-managed KMS key ARN for environment variable encryption.(templateable)
LambdaDeadLetterConfig
LambdaFileSystemConfig[] | null
LambdaSnapStart
SnapStart configuration. Java-only on AWS today, but the field is
forwarded as-is to Lambda.See: LambdaSnapStart(templateable)
LambdaLoggingConfig
LambdaImageConfig
Ec2ContainerDeploymentDefinition
Container-runtime EC2 deploy definition. The image must already exist (pushed by the upstream build step’secr destination, or supplied by
the user for prebuilt/disabled builds).enum
required
Definition type discriminator.Allowed values:
container(templateable)string
required
Full image URI to deploy. Prefer a digest-qualified URI for
reproducibility. Templateable — typically combines the repository URL
with a deploy input or references a deploy input containing the full URI.(minLen:1; templateable)
Ec2ManualDeploymentDefinition
Manual-runtime EC2 deploy definition. The deploy manager sends these shell commands to every in-service instance through the module-provided deploy document, which refreshes and loads the app env file (plain values and secrets) before running them — no build artifact is involved.enum
required
Definition type discriminator.Allowed values:
manual(templateable)string[]
required
Shell commands run in order on each instance, as root. A non-zero
exit fails the deploy on that instance.
Templateable — typically references a module input.(minItems:1; templateable)
string | null
Long-running foreground command started after the release commands
succeed. The deploy manager forwards it to the module-provided deploy
document so it is captured with the release instead of the stack.(templateable)
LambdaImageDefinition
Image-packaged Lambda deploy definition. The image must already exist in ECR (typically pushed by the upstream build step’secr destination).enum
required
Definition type discriminator.Allowed values:
image(templateable)string
required
Full ECR image URI. Prefer
<repo>@sha256:<digest> form for
reproducibility — Lambda resolves a mutable tag at deploy time and
silently pins it, but the deploy snapshot records the resolved
digest only when one was provided.(minLen:1; templateable)LambdaZipDefinition
Zip-packaged Lambda deploy definition. The code object must already exist in S3 (typically uploaded by the upstream build step’ss3-zip destination).enum
required
Definition type discriminator.Allowed values:
zip(templateable)string
required
S3 key the build step uploaded into.
Templateable — typically references a deploy input that holds the
key written by the upstream build step.(minLen:1; templateable)
LambdaDeadLetterConfig
Dead-letter destination for async invocations.string | null
SQS queue ARN or SNS topic ARN.(templateable)
LambdaEnvironment
Lambda function environment block. Mirrors AWS Lambda’sEnvironment shape — a single variables map of string → string.map<string,string> | null
Environment variables applied to the function. Replaces the
existing variable set on AWS — the API doesn’t merge.(templateable)
LambdaEphemeralStorage
Function-level ephemeral storage (/tmp) size in MiB.integer
required
Size in MiB. 512–10240.(format:int32,min:512,max:10240; templateable)
LambdaFileSystemConfig
EFS file system attached to the function.string
required
EFS access point ARN.(templateable)
string
required
Mount path inside the container — must start with
/mnt/.(templateable)LambdaImageConfig
Container image configuration overrides — image-packaged functions only.string[] | null
Override the image’s CMD.(templateable)
string[] | null
Override the image’s ENTRYPOINT.(templateable)
string | null
Override the image’s WORKDIR.(templateable)
LambdaLoggingConfig
Function logging configuration (CloudWatch destination + log levels).enum | null
Format the logs are emitted in.Allowed values:
JSON | Text(templateable)enum | null
Application log level — only valid when
log_format is JSON.Allowed values: TRACE | DEBUG | INFO | WARN | ERROR | FATAL(templateable)enum | null
System log level — only valid when
log_format is JSON.Allowed values: DEBUG | INFO | WARN(templateable)string | null
Destination CloudWatch log group.(templateable)
LambdaSnapStart
SnapStart configuration.enum
required
When to take the snapshot.
None disables SnapStart;
PublishedVersions snapshots each PublishVersion call.Allowed values: None | PublishedVersions(templateable)LambdaTracingConfig
AWS X-Ray tracing configuration.enum
required
Active samples + traces requests; PassThrough only propagates an
upstream sampling decision.Allowed values:
Active | PassThrough(templateable)LambdaVpcConfig
VPC configuration for a Lambda function.string[] | null
Subnet IDs the function’s ENIs are placed into.(templateable)
string[] | null
Security group IDs attached to the function’s ENIs.(templateable)
boolean | null
Whether the function gets dual-stack IPv6 networking.(templateable)