From b081cea835bdb50548da2a301e29fb57e05f5afd Mon Sep 17 00:00:00 2001 From: nourshoreibah Date: Wed, 29 Jul 2026 00:47:24 -0400 Subject: [PATCH] fix(infra): drop backup_window so the RDS change can apply MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit terraform-apply failed on main after #293: InvalidParameterValue: The backup window and maintenance window must not overlap. `backup_retention_period = 0 -> 7` was the change that mattered — production had no point-in-time recovery. The `backup_window = "07:00-08:00"` next to it was an unnecessary timing tweak, and AWS assigns both the backup and maintenance windows without Terraform managing either, so pinning one guesses against the other. Dropping it. The windows AWS assigned already don't overlap, and a backup of a few MB on a db.t3.micro is seconds of I/O, so there was nothing to gain. If specific times are ever wanted, pin backup_window and maintenance_window together. The failed apply had already created aws_iam_role.ci_migrate before erroring; re-applying reconciles the rest, nothing needs manual cleanup. Co-Authored-By: Claude Opus 5 --- infrastructure/aws/main.tf | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/infrastructure/aws/main.tf b/infrastructure/aws/main.tf index a7aa597..142a2cd 100644 --- a/infrastructure/aws/main.tf +++ b/infrastructure/aws/main.tf @@ -13,14 +13,11 @@ resource "aws_db_instance" "branch_rds" { password = data.infisical_secrets.rds_folder.secrets["password"].value skip_final_snapshot = true - # Set explicitly because CI now applies schema migrations to this instance - # automatically (the `migrate` job in .github/workflows/lambda-deploy.yml). That - # job takes a named pre-migration snapshot, but point-in-time recovery is the - # backstop for everything else, and this was previously left to whatever the API - # defaulted to. Backup storage up to allocated_storage (10 GB) is free, so 7 - # days of PITR costs nothing. + # Was 0 -- no point-in-time recovery at all. Free at this size, and the backstop + # for CI-applied migrations. backup_window is deliberately unset: AWS rejects a + # backup window that overlaps the maintenance window, and neither is managed here, + # so pinning one guesses against the other. Pin both or neither. backup_retention_period = 7 - backup_window = "07:00-08:00" # UTC — off-hours for a US-based club # The lambdas in lambda.tf have no vpc_config, so they run outside any VPC and # had no route to this instance while it was private -- every DB-backed request