grada-run 0.0.2 → 0.32.0

package/templates/github/drift.yml

@@ -0,0 +1,112 @@
+name: IaC Drift Detection
+
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+
+env:
+  AWS_REGION: {{REGION}}
+
+permissions:
+  id-token: write
+  contents: read
+  issues: write
+
+jobs:
+  drift:
+    name: Detect Terraform drift
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: {{ROLE_ARN}}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          # The wrapper mangles -detailed-exitcode; raw codes (0/1/2) are the signal.
+          terraform_wrapper: false
+
+      - name: Terraform Init
+        working-directory: ./terraform
+        run: terraform init -input=false
+
+      # -detailed-exitcode: 0 = no changes, 1 = error, 2 = drift detected.
+      - name: Terraform Plan
+        id: plan
+        working-directory: ./terraform
+        run: |
+          set +e
+          terraform plan -detailed-exitcode -no-color -out=tfplan > plan-full.txt 2>&1
+          EXITCODE=$?
+          echo "exitcode=$EXITCODE" >> "$GITHUB_OUTPUT"
+          if [ "$EXITCODE" != "1" ]; then
+            terraform show -no-color tfplan > plan.txt
+          else
+            cp plan-full.txt plan.txt
+          fi
+          echo "### Drift plan (exit $EXITCODE)" >> "$GITHUB_STEP_SUMMARY"
+          head -50 plan.txt >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Report drift as GitHub Issue
+        if: steps.plan.outputs.exitcode == '2' || steps.plan.outputs.exitcode == '0'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const { owner, repo } = context.repo;
+            const exitcode = '${{ steps.plan.outputs.exitcode }}';
+            const label = 'iac-drift';
+            const runUrl = `https://github.com/${owner}/${repo}/actions/runs/${context.runId}`;
+            let diff = '';
+            try {
+              diff = fs.readFileSync('terraform/plan.txt', 'utf8');
+            } catch (error) {
+              diff = '(plan output unavailable)';
+            }
+            if (diff.length > 30000) {
+              diff = `${diff.slice(0, 30000)}\n... (truncated, see ${runUrl})`;
+            }
+            try {
+              await github.rest.issues.getLabel({ owner, repo, name: label });
+            } catch (error) {
+              if (error.status === 404) {
+                await github.rest.issues.createLabel({ owner, repo, name: label, color: 'd93f0b', description: 'Out-of-band AWS infrastructure changes detected by Terraform' });
+              } else {
+                throw error;
+              }
+            }
+            const { data: open } = await github.rest.issues.listForRepo({ owner, repo, state: 'open', labels: label });
+            const existing = open[0];
+            if (exitcode === '2') {
+              const body = `## ⚠️ Infrastructure Drift Detected in AWS\n\nLive AWS state differs from Terraform on \`${new Date().toISOString()}\` ([workflow run](${runUrl})).\n\n\`\`\`terraform\n${diff}\n\`\`\`\n\nReconcile with \`npx grada-run apply\`, or adopt the live resource with \`terraform import\`.`;
+              if (existing) {
+                await github.rest.issues.createComment({ owner, repo, issue_number: existing.number, body: `Drift still present on \`${new Date().toISOString()}\` ([run](${runUrl})).\n\n\`\`\`terraform\n${diff}\n\`\`\`` });
+                await github.rest.issues.update({ owner, repo, issue_number: existing.number, body });
+              } else {
+                await github.rest.issues.create({ owner, repo, title: '⚠️ Infrastructure Drift Detected in AWS', labels: [label], body });
+              }
+            } else if (existing) {
+              await github.rest.issues.createComment({ owner, repo, issue_number: existing.number, body: `✅ Drift resolved on \`${new Date().toISOString()}\` ([run](${runUrl})).` });
+              await github.rest.issues.update({ owner, repo, issue_number: existing.number, state: 'closed' });
+            }
+
+      - name: Notify Slack
+        if: steps.plan.outputs.exitcode == '2' && secrets.SLACK_WEBHOOK_URL != ''
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          SUMMARY=$(head -c 1500 terraform/plan.txt)
+          jq -n \
+            --arg repo "$GITHUB_REPOSITORY" \
+            --arg url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
+            --arg summary "$SUMMARY" \
+            '{text: (":warning: Infrastructure drift detected in " + $repo + "\n" + $url + "\n```" + $summary + "```")}' > /tmp/drift-slack.json
+          curl -sS -X POST -H 'Content-Type: application/json' -d @/tmp/drift-slack.json "$SLACK_WEBHOOK_URL"

package/templates/github/preview-lambda.yml

@@ -0,0 +1,86 @@
+name: Ephemeral PR Preview
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+env:
+  AWS_REGION: {{REGION}}
+  ECR_REPOSITORY: {{PROJECT_NAME}}-repo
+  WORKSPACE: pr-${{ github.event.pull_request.number }}
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write # Required to post the comment
+
+jobs:
+  deploy-preview:
+    name: Provision Preview Environment
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build and Push Docker image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        run: |
+          # We tag the image specifically for this PR workspace
+          docker build --platform linux/amd64 -t $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.WORKSPACE }} .
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.WORKSPACE }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Init & Apply
+        id: tf-apply
+        working-directory: ./terraform
+        run: |
+          terraform init
+          # Create or select the workspace specific to this PR
+          terraform workspace select -or-create ${{ env.WORKSPACE }}
+          terraform apply -auto-approve
+
+      - name: Deploy PR image to the preview function
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        run: |
+          # Terraform provisions the function pointing at :latest (which it
+          # then ignores), so the PR-tagged image is deployed explicitly —
+          # mirroring the workspace-tagged task definition on ECS targets.
+          aws lambda update-function-code \
+            --function-name {{PROJECT_NAME}}-${{ env.WORKSPACE }}-fn \
+            --image-uri $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.WORKSPACE }} \
+            --region ${{ env.AWS_REGION }}
+          aws lambda wait function-updated \
+            --function-name {{PROJECT_NAME}}-${{ env.WORKSPACE }}-fn \
+            --region ${{ env.AWS_REGION }}
+
+      - name: Read preview URL
+        working-directory: ./terraform
+        run: |
+          API_URL=$(terraform output -raw api_gateway_url)
+          echo "PREVIEW_URL=$API_URL" >> $GITHUB_ENV
+
+      - name: Comment PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `🚀 **Preview Environment Deployed!**\n\nYour ephemeral AWS Lambda environment is live at:\n[${process.env.PREVIEW_URL}](${process.env.PREVIEW_URL})\n\n_This environment will be automatically destroyed when the PR is merged or closed._\n\n---\n<div align="right"><sup>☁️ Generated by <a href="https://github.com/grada-run/grada">Grada</a></sup></div>`
+            })

package/templates/github/preview.yml

@@ -0,0 +1,69 @@
+name: Ephemeral PR Preview
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+env:
+  AWS_REGION: {{REGION}}
+  ECR_REPOSITORY: {{PROJECT_NAME}}-repo
+  WORKSPACE: pr-${{ github.event.pull_request.number }}
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write # Required to post the comment
+
+jobs:
+  deploy-preview:
+    name: Provision Preview Environment
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build and Push Docker image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        run: |
+          # We tag the image specifically for this PR workspace
+          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.WORKSPACE }} .
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.WORKSPACE }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Init & Apply
+        id: tf-apply
+        working-directory: ./terraform
+        run: |
+          terraform init
+          # Create or select the workspace specific to this PR
+          terraform workspace select -or-create ${{ env.WORKSPACE }}
+          terraform apply -auto-approve
+          
+          # Extract the ALB URL to post to GitHub
+          ALB_URL=$(terraform output -raw alb_direct_url)
+          echo "PREVIEW_URL=$ALB_URL" >> $GITHUB_ENV
+
+      - name: Comment PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `🚀 **Preview Environment Deployed!**\n\nYour ephemeral AWS Fargate environment is live at:\n[${process.env.PREVIEW_URL}](${process.env.PREVIEW_URL})\n\n_This environment will be automatically destroyed when the PR is merged or closed._\n\n---\n<div align="right"><sup>☁️ Generated by <a href="https://github.com/grada-run/grada">Grada</a></sup></div>`
+            })

package/templates/github/teardown.yml

@@ -0,0 +1,43 @@
+name: Destroy PR Preview
+
+on:
+  pull_request:
+    types: [closed]
+
+env:
+  AWS_REGION: {{REGION}}
+  WORKSPACE: pr-${{ github.event.pull_request.number }}
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  destroy-preview:
+    name: Teardown Preview Environment
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Init & Destroy
+        working-directory: ./terraform
+        run: |
+          terraform init
+          # Select the PR workspace
+          terraform workspace select ${{ env.WORKSPACE }}
+          # Destroy all resources in this workspace safely
+          terraform destroy -auto-approve
+          # Switch back to default and delete the PR workspace
+          terraform workspace select default
+          terraform workspace delete ${{ env.WORKSPACE }}

package/templates/terraform/addons/bedrock.tf

@@ -0,0 +1,34 @@
+# grada addon: ai:bedrock
+# Generated by `grada add ai:bedrock`. Do not edit by hand unless
+# you know what you are doing — re-running with --force overwrites this file.
+#
+# Billing: no fixed hourly instance cost (usage-billed per 1K input/output
+# tokens on InvokeModel calls). Remember to enable model access for your
+# chosen model in the AWS Bedrock console first.
+
+# --- Least-Privilege IAM Policy for the ECS Task Role ---
+resource "aws_iam_role_policy" "ai_bedrock_access" {
+  name = "${local.app_name}-ai-bedrock-access"
+  role = aws_iam_role.task_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "bedrock:InvokeModel",
+          "bedrock:InvokeModelWithResponseStream"
+        ]
+        Resource = [
+          "arn:aws:bedrock:*::foundation-model/*",
+          "arn:aws:bedrock:*:*:inference-profile/*"
+        ]
+      }
+    ]
+  })
+}
+
+# --- Outputs ---
+output "bedrock_model_id" {
+  value = "{{BEDROCK_MODEL_ID}}"
+}

package/templates/terraform/addons/cron-lambda.tf

@@ -0,0 +1,78 @@
+# grada addon: cron (Lambda target)
+# Generated by `grada add cron` on a --target lambda project. Do not
+# edit by hand unless you know what you are doing — re-running with --force
+# overwrites this file.
+#
+# Billing: $0/mo fixed baseline (first 14M EventBridge Scheduler
+# invocations/mo free); billed only for Lambda invocations while the job runs.
+#
+# NOTE: unlike the ECS variant, the scheduler invokes the web function
+# directly instead of running a container command. Handle the scheduled event
+# in application code (the payload below carries the configured command), or
+# point the schedule at a dedicated function.
+
+# --- IAM Role assumed by EventBridge Scheduler ---
+resource "aws_iam_role" "scheduler_cron_role" {
+  name = "${local.app_name}-cron-scheduler-role"
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "scheduler.amazonaws.com"
+        }
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+}
+
+# --- Least-privilege permission to invoke the function ---
+resource "aws_iam_role_policy" "scheduler_cron_policy" {
+  name = "${local.app_name}-cron-scheduler-policy"
+  role = aws_iam_role.scheduler_cron_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["lambda:InvokeFunction"]
+        Resource = [
+          aws_lambda_function.app.arn,
+          "${aws_lambda_function.app.arn}:*"
+        ]
+      }
+    ]
+  })
+}
+
+# --- Scheduled invocation (single schedule per project) ---
+resource "aws_scheduler_schedule" "cron" {
+  name                         = "${local.app_name}-cron-{{CRON_NAME}}"
+  schedule_expression          = "{{SCHEDULE_EXPRESSION}}"
+  schedule_expression_timezone = "{{SCHEDULE_TIMEZONE}}"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.app.arn
+    role_arn = aws_iam_role.scheduler_cron_role.arn
+
+    input = jsonencode({
+      source  = "grada-cron"
+      command = {{CRON_COMMAND_JSON}}
+    })
+  }
+}
+
+# --- Outputs ---
+output "cron_schedule_name" {
+  value = aws_scheduler_schedule.cron.name
+}
+
+output "cron_schedule_arn" {
+  value = aws_scheduler_schedule.cron.arn
+}

package/templates/terraform/addons/cron.tf

@@ -0,0 +1,101 @@
+# grada addon: cron
+# Generated by `grada add cron`. Do not edit by hand unless
+# you know what you are doing — re-running with --force overwrites this file.
+#
+# Billing: $0/mo fixed baseline (first 14M EventBridge Scheduler
+# invocations/mo free); billed only for Fargate seconds while the task runs.
+
+# --- IAM Role assumed by EventBridge Scheduler ---
+resource "aws_iam_role" "scheduler_cron_role" {
+  name = "${local.app_name}-cron-scheduler-role"
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "scheduler.amazonaws.com"
+        }
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+}
+
+# --- Least-privilege permission to launch the scheduled task ---
+resource "aws_iam_role_policy" "scheduler_cron_policy" {
+  name = "${local.app_name}-cron-scheduler-policy"
+  role = aws_iam_role.scheduler_cron_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["ecs:RunTask"]
+        Resource = [
+          aws_ecs_task_definition.app.arn,
+          "${aws_ecs_task_definition.app.arn_without_revision}:*"
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = ["iam:PassRole"]
+        Resource = [
+          aws_iam_role.execution_role.arn,
+          aws_iam_role.task_role.arn
+        ]
+        Condition = {
+          StringLike = {
+            "iam:PassedToService" = "ecs-tasks.amazonaws.com"
+          }
+        }
+      }
+    ]
+  })
+}
+
+# --- Scheduled task (single schedule per project) ---
+resource "aws_scheduler_schedule" "cron" {
+  name                         = "${local.app_name}-cron-{{CRON_NAME}}"
+  schedule_expression          = "{{SCHEDULE_EXPRESSION}}"
+  schedule_expression_timezone = "{{SCHEDULE_TIMEZONE}}"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_ecs_cluster.main.arn
+    role_arn = aws_iam_role.scheduler_cron_role.arn
+
+    ecs_parameters {
+      task_definition_arn = aws_ecs_task_definition.app.arn
+      launch_type         = "FARGATE"
+      task_count          = 1
+
+      network_configuration {
+        subnets          = aws_subnet.public[*].id
+        security_groups  = [aws_security_group.ecs_tasks.id]
+        assign_public_ip = true
+      }
+    }
+
+    input = jsonencode({
+      containerOverrides = [
+        {
+          name    = "${local.app_name}-container"
+          command = ["sh", "-c", {{CRON_COMMAND_JSON}}]
+        }
+      ]
+    })
+  }
+}
+
+# --- Outputs ---
+output "cron_schedule_name" {
+  value = aws_scheduler_schedule.cron.name
+}
+
+output "cron_schedule_arn" {
+  value = aws_scheduler_schedule.cron.arn
+}

package/templates/terraform/addons/dynamodb.tf

@@ -0,0 +1,73 @@
+# grada addon: db:dynamodb
+# Generated by `grada add db:dynamodb`. Do not edit by hand unless
+# you know what you are doing — re-running with --force overwrites this file.
+
+# --- Scale-to-Zero DynamoDB Table ---
+resource "aws_dynamodb_table" "main" {
+  name         = "${local.app_name}-table"
+  billing_mode = "PAY_PER_REQUEST"
+  hash_key     = "{{PARTITION_KEY}}"
+
+  attribute {
+    name = "{{PARTITION_KEY}}"
+    type = "S"
+  }
+
+  point_in_time_recovery {
+    enabled = true
+  }
+
+  server_side_encryption {
+    enabled = true
+  }
+}
+
+# --- VPC Gateway Endpoint (keeps traffic on the AWS network) ---
+# The endpoint itself carries no hourly or data-processing charge. The table
+# above has no fixed hourly instance cost (usage-billed): table storage
+# ($0.25/GB-mo), read/write requests, and PITR continuous backups
+# ($0.20/GB-mo once data is written) are billed by usage.
+resource "aws_vpc_endpoint" "dynamodb" {
+  vpc_id            = aws_vpc.main.id
+  service_name      = "com.amazonaws.{{REGION}}.dynamodb"
+  vpc_endpoint_type = "Gateway"
+  route_table_ids   = [aws_route_table.public.id]
+}
+
+# --- Least-Privilege IAM Policy for the ECS Task Role ---
+resource "aws_iam_role_policy" "dynamodb_access" {
+  name = "${local.app_name}-dynamodb-access"
+  role = aws_iam_role.task_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "dynamodb:GetItem",
+          "dynamodb:PutItem",
+          "dynamodb:UpdateItem",
+          "dynamodb:DeleteItem",
+          "dynamodb:Query",
+          "dynamodb:Scan",
+          "dynamodb:BatchGetItem",
+          "dynamodb:BatchWriteItem",
+          "dynamodb:DescribeTable"
+        ]
+        Resource = [
+          aws_dynamodb_table.main.arn,
+          "${aws_dynamodb_table.main.arn}/index/*"
+        ]
+      }
+    ]
+  })
+}
+
+# --- Outputs ---
+output "dynamodb_table_name" {
+  value = aws_dynamodb_table.main.name
+}
+
+output "dynamodb_table_arn" {
+  value = aws_dynamodb_table.main.arn
+}

package/templates/terraform/addons/redis.tf

@@ -0,0 +1,64 @@
+# grada addon: db:redis
+# Generated by `grada add db:redis`. Do not edit by hand unless
+# you know what you are doing — re-running with --force overwrites this file.
+#
+# Billing: fixed ~$9.49/mo baseline (cache.t4g.micro Valkey 8.0 at $0.013/hr
+# in us-east-2); $0 intra-AZ VPC data transfer.
+
+# --- ElastiCache Subnet Group ---
+resource "aws_elasticache_subnet_group" "redis" {
+  name       = "${local.app_name}-redis-subnets"
+  subnet_ids = aws_subnet.public[*].id
+}
+
+# --- Redis Security Group (ECS tasks only) ---
+resource "aws_security_group" "redis" {
+  name        = "${local.app_name}-redis-sg"
+  description = "Allow Redis/Valkey traffic strictly from ECS tasks"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    from_port       = 6379
+    to_port         = 6379
+    protocol        = "tcp"
+    security_groups = [aws_security_group.ecs_tasks.id]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    # trivy:ignore:AVD-AWS-0104 - Allow cache nodes to reach standard AWS services
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+# --- ElastiCache for Valkey Replication Group ---
+# Valkey requires aws_elasticache_replication_group even for a single node:
+# the aws_elasticache_cluster API rejects engine = "valkey".
+resource "aws_elasticache_replication_group" "redis" {
+  # replication_group_id allows at most 40 chars and must start with a letter.
+  # The ds- prefix guarantees a leading letter and the md5 suffix keeps
+  # default and PR-preview workspaces unique.
+  replication_group_id       = "ds-${trim(substr(replace(lower(local.app_name), "/[^a-z0-9-]+/", "-"), 0, 5), "-")}-${substr(md5(local.app_name), 0, 5)}-redis"
+  description                = "Valkey cache for ${local.app_name}"
+  engine                     = "valkey"
+  engine_version             = "8.0"
+  node_type                  = "cache.t4g.micro"
+  num_cache_clusters         = 1
+  parameter_group_name       = "default.valkey8"
+  port                       = 6379
+  subnet_group_name          = aws_elasticache_subnet_group.redis.name
+  security_group_ids         = [aws_security_group.redis.id]
+  automatic_failover_enabled = false
+  tags                       = { Name = "${local.app_name}-redis" }
+}
+
+# --- Outputs ---
+output "redis_endpoint" {
+  value = "redis://${aws_elasticache_replication_group.redis.primary_endpoint_address}:${aws_elasticache_replication_group.redis.port}"
+}
+
+output "redis_port" {
+  value = aws_elasticache_replication_group.redis.port
+}