/mpc-key-store-aws-nitro; set to point it at a different repo. | `string` | `null` | no |
| observability | OTLP export for the non-enclave services (orchestrator + policy-server). Leave otlp\_endpoint empty to keep export off (stdout only). See the module's observability variable for the full field set and validations. | object(\{
otlp\_endpoint = optional(string, "")
otlp\_protocol = optional(string, "grpc") # "grpc" or "http/protobuf"
otlp\_console = optional(bool, true) # also keep logging to stdout
otlp\_timeout = optional(string, "")
otlp\_resource\_attributes = optional(string, "")
otlp\_log\_filter = optional(string, "")
otlp\_headers\_secret\_name = optional(string, "")
otlp\_headers\_secret\_key = optional(string, "")
}) | `{}` | no |
| orchestrator\_cert\_domain | Domain of an ISSUED ACM certificate to look up for the orchestrator API NLB's TLS listener (e.g. "*.example.com"). The lookup runs in the HUB cluster's region/account. Ignored when orchestrator\_load\_balancer.certificate\_arn is set directly; required (one of the two) when the orchestrator API load balancer is enabled. | `string` | `""` | no |
| orchestrator\_load\_balancer | Expose the orchestrator REST API via an NLB — the SAME mechanism as the UI LB. `enabled` and `internet_facing` each override the matching master (`load_balancer_enabled` / `internet_facing`) for this LB; leave null to inherit. `host` (REQUIRED when enabled) is YOUR API hostname (e.g. vault-api.example.com), distinct from the UI host; SDK clients dial it. TLS: set `certificate_arn` to an ISSUED ACM cert in the hub region, or leave it empty and set `orchestrator_cert_domain` to look one up by domain. DNS: a Route53 alias for `host` is created in `ui_dns_zone` (the API host must live in the same zone); with it empty, point your own DNS at the `orchestrator_nlb_dns_name` output. | object(\{
enabled = optional(bool)
internet\_facing = optional(bool)
host = optional(string, "")
certificate\_arn = optional(string, "")
}) | `{}` | no |
| otlp\_exporter\_enabled | Run the enclave OTLP-exporter sidecar (OTEL logs -> stdout -> `kubectl logs`). Enabled by default — it is the enclave's only log path in production (the console is sealed). Set false only if you have an alternative. | `bool` | `true` | no |
| otlp\_exporter\_endpoint | Optional downstream OTLP collector for the enclave exporter's tee — a BASE URL (http://host:port, NO path; http:// only, the exporter has NO TLS, so use a plaintext in-cluster collector that handles any TLS egress to a vendor). Empty (default) = stdout only (`kubectl logs` still works). When set, the chart opens keystore egress to the endpoint's port. | `string` | `""` | no |
| otlp\_exporter\_format | Enclave OTLP-exporter stdout format for LOG records: "text" (a tracing-style line per record) or "json" (one JSON object per record, for a structured log pipeline). | `string` | `"text"` | no |
| otlp\_exporter\_protocol | Transport the enclave exporter's downstream tee speaks: "http" (default) or "grpc". Ignored when otlp\_exporter\_endpoint is empty. | `string` | `"http"` | no |
| prebuilt\_eif\_enabled | Mode B (pre-built measured EIF), the production default: the keystore runner consumes a CI-built, *measured* EIF (reproducible PCR0, pinnable in the KMS key policy) instead of building it in-container. Threaded into every cluster's nitro\_enclave via local.nitro\_enclave\_image\_tags. Requires prebuilt\_eif\_ref when enabled. Set false to fall back to Mode A (in-container build, non-deterministic PCR0) — DEV-ONLY: Mode A mounts the host docker.sock and cannot pin PCR0, so do not use it in production. | `bool` | `true` | no |
| prebuilt\_eif\_ref | Mode B: OCI ref of the pre-built measured EIF. Defaults to the published v0.1.15 unified EIF on the sodot-docker-oci production registry; override to pin a different reviewed release tag. Required non-empty whenever prebuilt\_eif\_enabled is true. | `string` | `"repo.sodot.dev/sodot-docker-oci/mpc-key-store-eif:v0.1.15"` | no |
| secrets\_recovery\_window\_days | Recovery window (in days) for the Secrets Manager secrets the clusters create. Set 0 to force-delete on destroy (no recovery window) so a re-deploy with the same deployment\_name does not collide with secrets pending deletion — handy for throwaway/CI runs. Default 30 (AWS default, production-safe). Passed through to all three clusters. | `number` | `30` | no |
| tags | Tags merged onto every taggable resource. | `map(string)` | \{
"Project": "crypto-vault"
} | no |
| ui\_cert\_domain | Domain of an ISSUED ACM certificate to look up for the UI NLB's TLS listener (e.g. "*.example.com"). The lookup runs in the HUB cluster's region/account — the certificate must live there. Ignored when ui\_load\_balancer.certificate\_arn is set directly; required (one of the two) when the UI load balancer is enabled. | `string` | `""` | no |
| ui\_client\_secret\_ref | BYO mode: name of an existing Kubernetes Secret in the chart namespace containing the UI's Google OAuth client secret under key CLIENT\_SECRET. Forwarded to the hub module. Leave empty to use the literal-var path (`ui_google_oauth_client_secret`). | `string` | `""` | no |
| ui\_dns\_zone | Name of a public Route53 hosted zone (in the hub account) to create the UI + orchestrator-API host alias records in (e.g. "example.com"). Leave empty to skip DNS entirely — e.g. when your DNS lives outside Route53 or in another account — and point your own DNS at the ui\_nlb\_dns\_name / orchestrator\_nlb\_dns\_name outputs instead. | `string` | `""` | no |
| ui\_google\_oauth\_client\_secret | Convenience mode: literal Google OAuth client secret. Forwarded to the hub module, which creates a Kubernetes Secret and wires `ui.clientSecretRef` to it. Set in terraform.tfvars (gitignored) or via TF\_VAR\_ui\_google\_oauth\_client\_secret. | `string` | `""` | no |
| ui\_load\_balancer | Expose the hub's vault UI via an NLB. `enabled` and `internet_facing` each override the matching master (`load_balancer_enabled` / `internet_facing`) for this LB; leave null to inherit. `host` (REQUIRED when enabled) is YOUR UI hostname (e.g. vault.example.com): it drives the UI's REDIRECT\_URI + WebAuthn origin, must be covered by the TLS certificate, and https://\/auth/callback must be registered on the Google OAuth client. TLS: set `certificate_arn` to an ISSUED ACM certificate in the hub region — or leave it empty and set `ui_cert_domain` to look one up by domain. DNS: a Route53 alias for `host` is created only when `ui_dns_zone` is set; with it empty, point your own DNS provider at the `ui_nlb_dns_name` output instead. | object(\{
enabled = optional(bool)
internet\_facing = optional(bool)
host = optional(string, "")
certificate\_arn = optional(string, "")
}) | `{}` | no |
| vpc\_single\_nat\_gateway | Route all private-subnet egress through one shared NAT gateway (cheap, but an egress SPOF) instead of one NAT per AZ. Defaults to false (HA). terraform.tfvars sets true to keep a PoC cheap (saves ~6 NAT gateways across 3 clusters). | `bool` | `false` | no |
### Outputs
| Name | Description |
| ---- | ----------- |
| helm\_handoff | Where the per-cluster Helm handoff files were written. Follow README.md "Installing the chart" for the Stage 1 / Stage 2 helm commands. |
| hub\_aws\_account\_id | Hub AWS account ID. |
| hub\_eks\_cluster\_name | Hub cluster name (use with `aws eks update-kubeconfig`). |
| kubectl\_hub | Command to update kubeconfig for the hub. |
| kubectl\_spoke\_0 | Command to update kubeconfig for the spoke. |
| kubectl\_spoke\_1 | Command to update kubeconfig for shard-2 spoke. |
| nats\_internal\_lb\_arn | ARN of the hub's NATS NLB (PrivateLink Endpoint Service backend). |
| nats\_internal\_lb\_hostname | DNS hostname of the hub's NATS NLB (handy for debugging — VPC peering case would dial this directly). |
| orchestrator\_nlb\_dns\_name | DNS name of the orchestrator API NLB. With ui\_dns\_zone empty, point your own DNS at this (CNAME orchestrator\_load\_balancer.host -> this name). null when the UI/API load balancer is disabled. |
| orchestrator\_nlb\_zone\_id | Canonical hosted-zone ID of the orchestrator API NLB — for an alias record in a Route53 zone this config doesn't manage. |
| orchestrator\_url | The orchestrator REST API URL (TLS terminates at the NLB). Reachable once DNS for the host points at the NLB — via the managed Route53 alias (ui\_dns\_zone set) or your own DNS (orchestrator\_nlb\_dns\_name). |
| privatelink\_endpoint\_id | Spoke-side PrivateLink Endpoint ID. |
| privatelink\_endpoint\_service\_name | AWS service name of the PrivateLink Endpoint Service on the hub side. |
| spoke\_0\_aws\_account\_id | Spoke AWS account ID. |
| spoke\_0\_eks\_cluster\_name | Spoke cluster name. |
| spoke\_1\_eks\_cluster\_name | Shard-2 spoke cluster name (cross-region). |
| spoke\_nats\_hub\_url | What the spoke cluster's chart reads as `nats.hub.url` — i.e. the PrivateLink-derived NATS endpoint hostname. |
| ui\_nlb\_dns\_name | DNS name of the UI NLB. With ui\_dns\_zone empty, point your own DNS at this (CNAME ui\_load\_balancer.host -> this name). null when the UI load balancer is disabled. |
| ui\_nlb\_zone\_id | Canonical hosted-zone ID of the UI NLB — for an alias record in a Route53 zone this config doesn't manage. |
| ui\_url | The vault UI URL (TLS terminates at the NLB). Reachable once DNS for the host points at the NLB — via the managed Route53 alias (ui\_dns\_zone set) or your own DNS (ui\_nlb\_dns\_name). |