Issues

• terraform: bump the AWS provider past 5.100.0 so GuardDuty's newer plans and sub-settings can be declared

  lentago/solidago#261 · Filter by author cpitzi opened on Nov 2, 2026

• docs: ADOPTION.md line references into environments/dev/main.tf have drifted again

  documentation
  lentago/solidago#255 · Filter by author cpitzi opened on Nov 2, 2026

• Terraform CI roles can read every stack's state in the shared tfstate bucket (Bucket Key blocks per-object KMS scoping)

  lentago/solidago#240 · Filter by author cpitzi opened on Nov 2, 2026

• uvularia-demo SSM slots use the aws/ssm key, which any ReadOnlyAccess principal can decrypt

  enhancement
  lentago/solidago#239 · Filter by author cpitzi opened on Nov 1, 2026

• iam: one shared deploy role and task role span every site, so a trusted site repo can roll any service

  enhancement
  lentago/solidago#237 · Filter by author cpitzi opened on Nov 1, 2026
  1

• Adoption receipt: one supervised cold run in a fresh AWS account

  enhancement
  lentago/solidago#233 · Filter by author cpitzi opened on Nov 1, 2026
  1

• ECR tag immutability: deploys reference the image by digest, :latest retires, then IMMUTABLE flips (tf-lint AVD-AWS-0031)

  enhancement
  lentago/solidago#224 · Filter by author cpitzi opened on Oct 30, 2026

• docs: list the betula and drosera cross-repo roles in ADOPTION.md, and scope BOOTSTRAP's locking note to solidago's own backend

  documentation
  lentago/solidago#223 · Filter by author cpitzi opened on Oct 30, 2026

• monitoring: pass the alert recipient as a sensitive variable, out of committed config and public plan output

  enhancement
  lentago/solidago#222 · Filter by author cpitzi opened on Oct 30, 2026

• On or after 2026-11-06: retire the pre-rename drosera Terraform role and state key (drosera#169 Phase 3)

  lentago/solidago#221 · Filter by author cpitzi opened on Oct 30, 2026

• iam: give the cross-repo Terraform pipeline roles a read-only plan path

  enhancement
  lentago/solidago#220 · Filter by author cpitzi opened on Oct 30, 2026

• Fail the apply when an out-of-band secret still holds its placeholder

  lentago/solidago#213 · Filter by author cpitzi opened on Oct 7, 2026

• CI plans are never clean: standing task-definition replacements and a recreating SNS email subscription

  lentago/solidago#184 · Filter by author cpitzi opened on Aug 19, 2026
  1

• DMARC posture on our own domains first (precondition for the Email Trust kit)

  enhancement
  lentago/solidago#167 · Filter by author cpitzi opened on Aug 16, 2026
  1

• Rotating a Lambda's Axiom token requires an unrelated apply to take effect

  lentago/solidago#149 · Filter by author cpitzi opened on Jul 25, 2026
  1

• Ask Lambda logs land in CloudWatch with no path to Axiom

  lentago/solidago#144 · Filter by author cpitzi opened on Jul 24, 2026
  2