A Rollout that Can Still Be Taken Back
AppConfig exists to deploy a configuration slowly and roll it back automatically, and both halves are opt-in - the predefined AllAtOnce strategy is 100% of the fleet with zero bake time. Gradual here, and a precondition refuses an environment with no alarms, where automatic rollback has nothing to fire on.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "appconfig" {
source = "www.iac-bazaar.com/iac-bazaar/aws-appconfig/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-appconfig
An AppConfig application whose deployments are gradual, watched, and validated
before they reach anything. Works with Terraform and OpenTofu (>= 1.6),
AWS provider >= 6.0, < 7.0.
AppConfig exists to roll a change out slowly and take it back automatically,
and both halves are opt-in. The predefined AppConfig.AllAtOnce strategy -
the one most consoles land on - deploys to 100% of the fleet immediately with
zero bake time. That gives a configuration change the same blast radius as a bad
deploy and none of the controls, which is the exact thing this service was built
to avoid. Five equal steps over twenty minutes here, then ten more minutes of
watching, and rolls_out_gradually is an output.
Automatic rollback needs an alarm to roll back from. The environment's
monitor block is optional, and with no monitors nothing ever triggers a
rollback - the deployment runs to completion whatever it breaks - while the
console still describes it as monitored. That is a safety net that is described
but not attached. A precondition refuses an unmonitored environment unless
accept_unmonitored_environment says it was meant, and
environments_without_rollback_alarms is an output so a policy test can check
it stays empty.
A configuration profile with no validator accepts any content. A
JSON_SCHEMA validator rejects a malformed configuration at publish time,
before the rollout, rather than leaving it to whichever host picked it up first.
Smaller things: a precondition refuses a profile whose location_uri points
outside AppConfig with no retrieval_role_arn, which otherwise creates a profile
that fails every single retrieval; and the validators variable is deliberately
not marked sensitive even though the provider marks the validator's
content attribute sensitive - a sensitive value cannot be a for_each
argument, and this map is iterated.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-codebuild
privileged_mode hands the build the Docker socket, so anything it runs can read every environment variable and assume the service role. Off by default, and a PLAINTEXT variable whose name looks like a secret is refused.
aws-codeartifact
A repository with a public external connection serves whatever the public registry holds for any name it does not. This puts the connection on its own repository, reached through an upstream, and emits the origin-control commands Terraform cannot apply.
aws-mwaa
webserver_access_mode defaults to PUBLIC_ONLY, and the Airflow UI is not a dashboard: anyone who reaches it can trigger a DAG, which is arbitrary Python running as the execution role. PRIVATE_ONLY here, all five log streams on, and a precondition refuses an unpinned requirements.txt or plugins.zip - where bucket write access is otherwise the same permission as code execution.
aws-codedeploy
CodeDeploy application, deployment groups, and the platform-correct service role for automated EC2/ECS/Lambda rollouts with auto-rollback on failure.
aws-codepipeline
AWS-native CI/CD: CodePipeline orchestrating a CodeBuild project, with an encrypted private artifact bucket and least-privilege roles. Sources from S3 (or GitHub).
aws-jenkins
Self-hosted Jenkins controller on a hardened EC2 instance - restricted security group, IMDSv2 enforced, SSM access, encrypted root volume, Jenkins auto-installed via user-data.