Deprecation notices
These are the layouts, paths and conventions that the current release replaced. A fresh deployment never meets them. A deployment applied before a change reached the repositories follows the matching runbook, indexed under upgrade guides, before merging the update.
The leaf layout, replaced by Terragrunt Stacks
What was deprecated. One checked-in terragrunt.hcl per unit per account or stage under environments/ (83 files in the landing zone, 42 in the web platform, 18 in the ETL platform), formerly called leaves.
What replaced it. One definition per unit type in units/<unit>/terragrunt.hcl, a terragrunt.stack.hcl per region, global or stage folder, templates under stacks/ and git-ignored generated trees. A hand-written terragrunt.hcl under environments/ now fails scripts/check-stack-layout.py.
Effect on state. None. The generated paths keep the former folder names, and root.hcl strips the .terragrunt-stack/ segments from the key, so every state key is unchanged by construction. The update lifecycle notes that the layout change was made before any deployment. See Terragrunt units and stacks.
Regional paths for global units, replaced by global/ folders
What was deprecated. Org-wide singletons and global-service units under a region folder, for example core/root/us-west-2/organizations.
What replaced it. A global/ folder inside the owning account, with environment = "glob" and the home region as aws_region. Nine units moved:
| Old state key prefix | New state key prefix |
|---|---|
core/root/us-west-2/organizations | core/root/global/organizations |
core/root/us-west-2/s3-state-backend | core/root/global/s3-state-backend |
core/dns/us-west-2/route53-zones | core/dns/global/route53-zones |
core/identity/us-west-2/iam-identity-center | core/identity/global/iam-identity-center |
core/auto/us-west-2/github-oidc | core/auto/global/github-oidc |
core/auto/us-west-2/ssm-cross-account-role | core/auto/global/ssm-cross-account-role |
core/network/us-west-2/client-vpn | core/network/global/client-vpn |
core/network/us-west-2/ipam | core/network/global/ipam |
core/security/us-west-2/shield | core/security/global/shield |
Effect on state. The state key is the unit path, so an already-applied deployment copies each moved unit's state object to its new key before the change reaches main; otherwise the next apply tries to create everything again. Accounts, IAM trust chains and hosted zones are unchanged. Global units are now named acme-glob-<stage>-*; the Client VPN security group is the one resource replaced by the rename.
The runner VPC unit name vpc, replaced by vpc-runner
What was deprecated. The self-hosted runner VPC in core-auto under the path core/auto/us-west-2/vpc.
What replaced it. The path core/auto/us-west-2/vpc-runner (definition units/vpc-runner, VPC map entry core.auto-runner). The vpc/ name in core-auto is reserved for a planned automation VPC. A deployment that applied the runner VPC under the old name copies its state key the same way as the moved global units; a deployment that never enabled runners has nothing to copy.
The default Transit Gateway route table, replaced by isolation domains
What was deprecated. Every Transit Gateway attachment associated with the gateway's default route table, so that every workload stage could reach every other.
What replaced it. Default association and propagation disabled on the gateway and every route table owned by the transit-gateway-routes unit: shared plus one table per isolation domain from network.hcl (prod and nonprod by default). On a live deployment the change re-associates every attachment, which interrupts each spoke's Transit Gateway connectivity for a few seconds, so it is applied in a maintenance window following the runbook.
Per-unit security switches, replaced by security.hcl
What was deprecated. enable_delegated_admin, enable_org_config and the standards inputs set in each security unit, in both the management and the security account.
What replaced it. One file, environments/core/security/security.hcl, read by both accounts, with one org_auto_enable.<service> flag per service. Its defaults equal the old hard-coded values, with every organization flag set to false; an existing deployment carries each unit's previous enable_org_config value into the matching flag and confirms an empty plan before merging, or the merge removes that service's organization configuration.
A hand-created DocumentDB password parameter, replaced by a generated password
What was deprecated. Reading the DocumentDB master password with run_cmd from an SSM parameter a person created by hand before the first apply, which also placed the password in state.
What replaced it. The module generates the password with an ephemeral resource and writes it through write-only arguments to the cluster and to the SecureString parameter, so it never appears in plan or state. Rotation is bumping master_password_version.
The latest image tag
latest was never used by the platform's pipelines and cannot be: ECR repositories are created with immutable tags, so a second push of the same tag fails. Images are main-<short sha> per build, with vX.Y.Z added at release; see immutable artifacts.