Nuon AWS Empty Sandbox

This is a baseline sandbox that provides a bare minimum AWS environment for use with Nuon.

It includes outputs required for Nuon to function.

Updated 2025-08-21 to let an AWS Lambda app config work correctly. See the example-app-configs repository for more information and other app configs.

Requirements

Name	Version
terraform	>= 1.7.5
aws	>= 5.86.1

Providers

Name	Version
aws	>= 5.86.1

Modules

Name	Source	Version
ecr	terraform-aws-modules/ecr/aws	>= 2.4.0

Resources

Name	Type
aws_iam_policy.ecr_access	resource
aws_iam_role_policy_attachment.ecr_access_deprovision	resource
aws_iam_role_policy_attachment.ecr_access_maintenance	resource
aws_iam_role_policy_attachment.ecr_access_provision	resource
aws_route53_record.caa	resource
aws_route53_zone.internal	resource
aws_route53_zone.public	resource
aws_availability_zones.available	data source
aws_caller_identity.current	data source
aws_iam_policy_document.ecr	data source
aws_security_group.default	data source
aws_security_groups.runner	data source
aws_subnet.private	data source
aws_subnet.public	data source
aws_subnet.runner	data source
aws_subnets.private	data source
aws_subnets.public	data source
aws_subnets.runner	data source
aws_vpc.vpc	data source

Inputs

Name	Description	Type	Default	Required
additional_tags	Extra tags to append to the default tags that will be added to install resources.	map(any)	{}	no
deprovision_iam_role_arn	The deprovision IAM Role ARN	string	n/a	yes
enable_nuon_dns	Whether or not the app should use a nuon-provided nuon.run domain. Controls the cert-manager-issuer and the route_53_zone.	string	"false"	no
internal_root_domain	The internal root domain.	string	n/a	yes
maintenance_iam_role_arn	The provision IAM Role ARN	string	n/a	yes
nuon_id	The nuon id for this install. Used for naming purposes.	string	n/a	yes
provision_iam_role_arn	The maintenance IAM Role ARN	string	n/a	yes
public_root_domain	The public root domain.	string	n/a	yes
region	The region to launch the cluster in.	string	n/a	yes
tags	List of custom tags to add to the install resources. Used for taxonomic purposes.	map(any)	n/a	yes
vpc_id	The ID of the AWS VPC to provision the sandbox in.	string	n/a	yes

Outputs

Name	Description
account	A map of AWS account attributes: id, region.
ecr	A map of ECR attributes: repository_url, repository_arn, repository_name, registry_id, registry_url.
nuon_dns	A map of Nuon DNS attributes: whether DNS has been enabled; AWS Route 53 details for the public_domain and internal_domain.
vpc	A map of vpc attributes: name, id, cidr, azs, private_subnet_cidr_blocks, private_subnet_ids, public_subnet_cidr_blocks, public_subnet_ids, default_security_group_id.