# terraform/aws/account

Parent directory for the two Terraform root modules that configure AWS accounts in the TiDB Cloud deployment model. There is no Terraform code here — all resources live in the subdirectories.

## Module layout

| Directory | Role |
|-----------|------|
| `seed/`   | Control-plane (internal TiDB Cloud) AWS account — read-only data sources only; publishes outputs consumed by `shoot/` |
| `shoot/`  | Data-plane AWS account (Gardener "shoot") — consumes `seed/` outputs; provisions VPC endpoint permissions, CloudFormation stack, and ACM PCA share |

## Apply order

`seed/` must be applied before `shoot/`. `shoot/` reads `seed/`'s state directly from S3.

## Related Documentation

- [seed/AGENTS.md](seed/AGENTS.md) — commands, variables, provider wiring, and outputs for the seed module
- [shoot/AGENTS.md](shoot/AGENTS.md) — commands, variables, provider wiring, and provisioned resources for the shoot module