# terraform/aws/account/seed

Standalone Terraform root module for the **TiDB Cloud internal seed (control plane) AWS account**. Applied directly — not a child of a parent module. Reads an existing Route53 hosted zone and base account state, then publishes outputs consumed by the sibling `../shoot/` module.

## Commands

```sh
# State key is NOT hardcoded — must be passed at init time
terraform init -backend-config="key=aws/account/seed/<env>.json"
terraform plan  -var-file=test.tfvars
terraform apply -var-file=test.tfvars
```

`test.tfvars` targets `env=dev`, `account=385595570414` and is safe for local planning.

## Backend

- Bucket: `autonomous-deployment-terraform-state`, region `us-west-2`, native S3 locking (`use_lockfile = true`).
- State key **not hardcoded** — always supply `-backend-config="key=aws/account/seed/<env>.json"` at `terraform init`.

## Lock file vs. provider version mismatch

`.terraform.lock.hcl` was generated against `~> 5.0` but `main.tf` now requires `~> 6.0`. Run `terraform init -upgrade` to regenerate the lock file before planning.

## Required variables

| Variable  | Type   | Example           | Purpose                            |
|-----------|--------|-------------------|------------------------------------|
| `env`     | string | `"dev"`           | Environment; drives hosted zone name and remote state key |
| `account` | string | `"385595570414"`  | AWS account ID of the seed account; used as the AWS CLI profile name |

## Provider wiring

| Provider        | Profile        | Region      | Purpose                                  |
|-----------------|----------------|-------------|------------------------------------------|
| _(default)_     | `var.account`  | `us-west-2` | Reads Route53 hosted zone in seed account |
| `aws.tf_state`  | `default`      | `us-west-2` | Reads state object from the S3 state bucket |

`default` AWS CLI profile must have read access to `autonomous-deployment-terraform-state`. The profile named after the account ID must authenticate to the seed account.

## Remote state dependency

Reads `aws/base/<env>.json` from the state bucket. Exposes `base_account` from its outputs.

## What this module provisions

No resources are created. Everything is read-only:
- `data.aws_route53_zone` — looks up the pre-existing `{env}.aws.tidbcloud.com` hosted zone in the seed account.
- `data.aws_s3_object.base_state` — fetches the base environment state JSON.

## Outputs consumed downstream

| Output              | Value                                     | Consumer              |
|---------------------|-------------------------------------------|-----------------------|
| `env`               | `var.env`                                 | `../shoot/`           |
| `base_account`      | From base state: `outputs.account.value`  | `../shoot/`           |
| `seed_account`      | `var.account`                             | `../shoot/`           |
| `hosted_zone_name`  | `{env}.aws.tidbcloud.com`                 | `../shoot/`           |
| `hosted_zone_id`    | Route53 zone ID                           | `../shoot/`           |

The shoot module reads this state at `aws/account/seed/{env}.json`.

## Related Documentation

- [../shoot/main.tf](../shoot/main.tf) — consumer of this module's state outputs
- [../../byoc/AGENTS.md](../../byoc/AGENTS.md) — parallel structure reference (BYOC modules share the same backend bucket and naming patterns)