> ## Documentation Index > Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # EC2 Service inputs > Reference the EC2 Service module's Inputs, EC2 service, Build config, Docker, Railpack, Deployment, HTTP routing, HTTP listener rules and more inputs. **Type:** `rvn-ec2-service` / **Latest version:** `2.2.0` See [EC2 Service module reference](/docs/module-definitions/catalog/rvn-ec2-service) for the full module page. **network** `$ref:rvn-aws-network` *required* **VPC network.** Existing Ravion network that supplies the AWS account, region, VPC, and public and private subnets for the instances. * Immutable after creation Set `network` to `null`. Mapped inputs for `network`: set these keys alongside `network`, not inside it, when supplying existing infrastructure instead of a module reference. **section\_aws** `section` **AWS account & region.** **aws\_account\_id** `string` **AWS account.** * Default: `<< ref.input.aws_account_id >>` * Immutable after creation **aws\_region** `string` **Region.** AWS region for this module. If unset in Terraform, the provider region is used. * Default: `<< ref.input.aws_region >>` * Immutable after creation **execution\_environment\_id** `string` **Terraform execution environment.** Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above. * Default: `<< ref.input.execution_environment_id >>` **section\_vpc** `section` **VPC.** **vpc\_id** `string` *required* **VPC ID.** * Default: `<>` * Immutable after creation **private\_subnet\_ids** `string_array` *required* **Private subnet IDs.** Required by Terraform. Used for private workloads and private load balancers. * Default: `<>` * Immutable after creation **public\_subnet\_ids** `string_array` **Public subnet IDs.** Used for public load balancers. Terraform defaults to \[] when no public load balancer is enabled. * Default: `<>` * Immutable after creation **private\_subnet\_placement\_enabled** `boolean` **Run in private subnets.** Recommended. Requires a NAT gateway or equivalent for internet access and a static IP. * Default: `true` ### EC2 service config **name** `string` *required* **Service name.** Stable service name used to prefix the instance group and name related resources. * Default: `<>-<>-<>` * Immutable after creation * Pattern: `^[a-z0-9]([a-z0-9-]{0,26}[a-z0-9])?$` — 1-28 lowercase letters, numbers, and hyphens. Start and end with a letter or number. **instance\_type** `string` *required* **Instance type.** Pick the family that matches the workload (`t` burstable, `m` general purpose, `c` CPU-bound, `r` memory-bound), then the highest generation number this list offers for it, such as `m8g` rather than `m7g` or `m6i`. Graviton (`g`) types give the best price and performance and need an `arm64` image. Never copy an instance type from an example or from memory; see the README for the full selection guide. **ami\_id** `string` **Custom AMI ID.** Custom AMI for new instances. Leave blank for the latest architecture-matched Amazon Linux 2023 AMI. **key\_name** `string` **SSH key pair name.** Optional EC2 key pair for SSH access. **additional\_user\_data** `text` **Additional user data.** Shell script run as root after Ravion's bootstrap on every newly launched instance. **http\_traffic\_enabled** `boolean` **Serve HTTP traffic.** Off for a worker. On to serve HTTP traffic through a load balancer. * Default: `true` **deploy\_type** `string` *required* **Deploy type.** Choose in-place container image deploys or host-level shell commands. * Default: `container` * Allowed values: `container` (Container), `manual` (Manual) ### Build config **build\_source** `string` *required* **Build source.** Build a container image from source with Dockerfile or Railpack, use a Ravion-managed ECR repository populated by a pipeline, or deploy an existing image from a configured registry repository. * Default: `dockerfile` * Allowed values: `dockerfile` (Dockerfile), `railpack` (Railpack), `image_registry` (Pull from image registry), `ecr` (Managed ECR repository) * Shown when: `{"deploy_type":"container"}` **source\_repo** `gitrepo` *required* **Git repository.** Repository containing the application source for Dockerfile or Railpack builds. * Shown when: `{"build_source":["dockerfile","railpack"],"deploy_type":"container"}` **source\_base\_path** `string` **Source base path.** Repository-relative source and build root. * Default: `.` * Shown when: `{"build_source":["dockerfile","railpack"],"deploy_type":"container"}` **image\_repository** `string` *required* **Image repository.** Repository without a tag or digest, such as `nginx` or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`. Registries requiring Docker credentials are unsupported. Same-region private ECR also needs a repository policy that lets the service instance role pull images. * Shown when: `{"build_source":"image_registry","deploy_type":"container"}` **container\_start\_command** `string` **Start command override.** Optional command string that overrides the image CMD. The image ENTRYPOINT is preserved. * Shown when: `{"deploy_type":"container"}` **docker\_socket\_mount\_enabled** `boolean` **Docker socket mount.** Mount the host Docker socket into the container and add the host docker group's GID. This grants the container root-equivalent control of the instance: it can start privileged containers, read the host filesystem, and use the instance role. The container image must include a docker CLI for this to be useful. * Default: `false` * Shown when: `{"deploy_type":"container"}` ### Docker **dockerfile** `string` **Dockerfile path.** Path to the Dockerfile to use for the build, relative to the repository root or configured source base path. * Shown when: `{"build_source":"dockerfile","deploy_type":"container"}` **dockerfile\_context** `string` **Docker build context path.** Directory to use as the Docker build context, relative to the repository root or configured source base path. * Shown when: `{"build_source":"dockerfile","deploy_type":"container"}` ### Railpack **railpack\_version** `string` **Railpack version.** Optional Railpack version to use for the build. Leave blank to use the Ravion default. * Pattern: `^(|latest|v?[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?)$` — Leave blank, use latest, a semantic version like 0.29.0, or a v-prefixed version like v0.29.0. * Shown when: `{"build_source":"railpack","deploy_type":"container"}` **railpack\_install\_cmd** `string` **Install command.** Optional dependency installation command. Leave blank to use Railpack detection. * Shown when: `{"build_source":"railpack","deploy_type":"container"}` **railpack\_build\_cmd** `string` **Build command.** Optional application build command. Leave blank to use Railpack detection. * Shown when: `{"build_source":"railpack","deploy_type":"container"}` **railpack\_start\_cmd** `string` **Start command.** Optional start command embedded in the Railpack-built image. Leave blank to use Railpack detection. * Shown when: `{"build_source":"railpack","deploy_type":"container"}` ### Deployment **deploy\_source\_repo** `gitrepo` **Git repository.** Optional repository to check out before manual deploy commands run. Leave blank to run the commands without a managed source checkout. * Shown when: `{"deploy_type":"manual"}` **deploy\_source\_base\_path** `string` **Source base path.** Repository-relative working directory for manual deploy and start commands when a Git repository is selected. * Default: `.` * Shown when: `{"deploy_source_repo":{"not":""},"deploy_type":"manual"}` **deploy\_commands** `string_array` *required* **Deploy commands.** Release preparation commands run as root, in order, on every instance during each manual deploy. Keep them idempotent; any command that exits non-zero fails that instance's deploy. * Shown when: `{"deploy_type":"manual"}` **start\_command** `string` *required* **Start command.** Long-running foreground app command that supervisord runs as root after preparation and restarts if it exits. Use a wrapper to drop privileges when needed; the command must not daemonize. * Shown when: `{"deploy_type":"manual"}` **deployment\_concurrency\_max** `string` *required* **Maximum concurrent instances.** Maximum instances updated at once. Use an instance count such as 1 or a percentage such as 25%. * Default: `1` * Pattern: `^([1-9][0-9]*|[1-9][0-9]?%|100%)$` — Positive instance count or percentage from 1% to 100%. **deployment\_errors\_max** `string` *required* **Maximum deployment errors.** Number or percentage of failed instances tolerated before the deployment stops on remaining instances. * Default: `0` * Pattern: `^(0|[1-9][0-9]*|[1-9][0-9]?%|100%)$` — Zero, a positive error count, or percentage from 1% to 100%. **deploy\_timeout\_seconds** `number` **Per-instance deploy timeout (secs).** Maximum time allowed for the SSM deploy script on each instance, for both container and manual deploys. * Default: `1200` * Min: `60` * Max: `14400` ### HTTP routing **load\_balancer\_source** `string` *required* **Load balancer source.** Must use the same AWS account, region, and VPC as the VPC network. * Default: `standalone_alb` * Allowed values: `standalone_alb` (Standalone ALB module), `ecs_cluster` (ALB from ECS Cluster module) * Immutable after creation * Shown when: `{"http_traffic_enabled":true}` **alb** `$ref:rvn-aws-alb` *required* **Standalone ALB module.** Attach listener rules to this. * Immutable after creation * Shown when: `{"http_traffic_enabled":true,"load_balancer_source":"standalone_alb"}` Set `alb` to `null`. Mapped inputs for `alb`: set these keys alongside `alb`, not inside it, when supplying existing infrastructure instead of a module reference. **alb\_http\_listener\_arn** `string` **ALB HTTP listener ARN.** * Default: `<>` * Immutable after creation **alb\_https\_listener\_arn** `string` **ALB HTTPS listener ARN.** * Default: `<>` * Immutable after creation **alb\_security\_group\_id** `string` *required* **ALB security group ID.** * Default: `<>` * Immutable after creation **alb\_arn\_suffix** `string` *required* **ALB ARN suffix.** * Default: `<>` * Immutable after creation **alb\_dns\_name** `string` **ALB DNS name.** * Default: `<>` * Immutable after creation **alb\_http\_listener\_port** `number` **ALB HTTP listener port.** * Default: `<>` * Immutable after creation **alb\_https\_listener\_port** `number` **ALB HTTPS listener port.** * Default: `<>` * Immutable after creation **ecs\_cluster** `$ref:rvn-ecs-cluster` *required* **ECS Cluster.** Attach listener rules to the ALB in this cluster. * Immutable after creation * Shown when: `{"http_traffic_enabled":true,"load_balancer_source":"ecs_cluster"}` Set `ecs_cluster` to `null`. Mapped inputs for `ecs_cluster`: set these keys alongside `ecs_cluster`, not inside it, when supplying existing infrastructure instead of a module reference. **section\_cluster\_alb** `section` **Cluster load balancers.** **public\_alb\_http\_listener\_arn** `string` **Public ALB HTTP listener ARN.** * Default: `<>` * Immutable after creation **public\_alb\_https\_listener\_arn** `string` **Public ALB HTTPS listener ARN.** HTTPS listener ARN from the selected public ALB. Ravion uses it when present, otherwise falls back to HTTP. * Default: `<>` * Immutable after creation **public\_alb\_security\_group\_id** `string` **Public ALB security group ID.** * Default: `<>` * Immutable after creation **private\_alb\_http\_listener\_arn** `string` **Private ALB HTTP listener ARN.** * Default: `<>` * Immutable after creation **private\_alb\_https\_listener\_arn** `string` **Private ALB HTTPS listener ARN.** HTTPS listener ARN from the selected private ALB. Ravion uses it when present, otherwise falls back to HTTP. * Default: `<>` * Immutable after creation **private\_alb\_security\_group\_id** `string` **Private ALB security group ID.** * Default: `<>` * Immutable after creation **public\_alb\_arn\_suffix** `string` **Public ALB ARN suffix.** * Default: `<>` * Immutable after creation **private\_alb\_arn\_suffix** `string` **Private ALB ARN suffix.** * Default: `<>` * Immutable after creation **public\_alb\_dns\_name** `string` **Public ALB DNS name.** * Default: `<>` * Immutable after creation **private\_alb\_dns\_name** `string` **Private ALB DNS name.** * Default: `<>` * Immutable after creation **ecs\_cluster\_alb\_visibility** `string` *required* **ALB to use from ECS Cluster module.** The selected load balancer must be enabled on the cluster. * Default: `public` * Allowed values: `public` (Public), `private` (Private) * Shown when: `{"http_traffic_enabled":true,"load_balancer_source":"ecs_cluster"}` **app\_port** `number` *required* **App port.** Port the host application listens on. Container mode publishes the same container port, and PORT is set automatically. * Default: `80` * Min: `1` * Max: `65535` * Immutable after creation * Shown when: `{"http_traffic_enabled":true}` ### HTTP listener rules **host\_header\_values** `string_array` **Domain host rules.** Hostnames that should route to this service, such as app.example.com or \*.example.com. Leave empty to use path-based routing. * Shown when: `{"http_traffic_enabled":true}` **path\_pattern\_values** `string_array` **Path rules.** Path patterns that should route to this service, such as /*, /api/*, or /app/*. If both domain host rules and path rules are empty, the service routes all paths with /*. * Shown when: `{"http_traffic_enabled":true}` **listener\_rule\_priority** `number` **Listener rule priority.** Optional ALB listener rule priority. Leave blank to let AWS assign the next available priority. * Min: `1` * Max: `50000` * Shown when: `{"http_traffic_enabled":true}` ### Health check **health\_check\_path** `string` *required* **Health check path.** HTTP path used by the load balancer health check and by the Container-mode deploy gate on each instance. * Default: `/` * Shown when: `{"http_traffic_enabled":true}` **health\_check\_matcher** `string` *required* **Success codes.** HTTP status codes the ALB treats as healthy, such as 200-399. * Default: `200-399` * Shown when: `{"http_traffic_enabled":true}` **health\_check\_interval** `number` **Interval (secs).** Seconds between Application Load Balancer health checks. * Default: `10` * Min: `5` * Max: `300` * Shown when: `{"http_traffic_enabled":true}` **health\_check\_timeout** `number` **Timeout (secs).** Seconds the Application Load Balancer waits for a health-check response. Must be lower than the interval. * Default: `5` * Min: `2` * Max: `120` * Shown when: `{"http_traffic_enabled":true}` **health\_check\_healthy\_threshold** `number` **Healthy threshold.** Consecutive successful ALB checks required before an instance is healthy. * Default: `2` * Min: `2` * Max: `10` * Shown when: `{"http_traffic_enabled":true}` **health\_check\_unhealthy\_threshold** `number` **Unhealthy threshold.** Consecutive failed ALB checks required before an instance is unhealthy. * Default: `2` * Min: `2` * Max: `10` * Shown when: `{"http_traffic_enabled":true}` **health\_check\_grace\_period** `number` **Instance health check grace period (secs).** Seconds after launch before Auto Scaling health checks apply. * Default: `300` * Min: `0` **target\_group\_slow\_start** `number` **Slow start duration (secs).** Seconds the load balancer gradually increases traffic to a newly healthy instance. Use 0 to disable. * Default: `0` * Min: `0` * Max: `900` * Shown when: `{"http_traffic_enabled":true}` **deregistration\_delay** `number` **Deregistration delay (secs).** Seconds allowed for in-flight requests to drain before a Container-mode in-place swap. * Default: `30` * Min: `0` * Max: `3600` * Shown when: `{"http_traffic_enabled":true}` **target\_group\_stickiness\_enabled** `boolean` **Sticky sessions.** Keep repeat requests on the same instance using a load balancer or application cookie. * Default: `false` * Shown when: `{"http_traffic_enabled":true}` **target\_group\_stickiness\_type** `string` *required* **Stickiness type.** Use a load-balancer-generated cookie or an application cookie. * Default: `lb_cookie` * Allowed values: `lb_cookie` (Load balancer cookie), `app_cookie` (Application cookie) * Shown when: `{"http_traffic_enabled":true,"target_group_stickiness_enabled":true}` **target\_group\_stickiness\_cookie\_name** `string` *required* **Application cookie name.** Application cookie name used for target stickiness. * Shown when: `{"http_traffic_enabled":true,"target_group_stickiness_enabled":true,"target_group_stickiness_type":"app_cookie"}` **target\_group\_stickiness\_cookie\_duration** `number` **Stickiness cookie duration (secs).** How long the cookie keeps a client routed to the same instance. * Default: `86400` * Min: `1` * Max: `604800` * Shown when: `{"http_traffic_enabled":true,"target_group_stickiness_enabled":true}` ### Storage **root\_volume\_size** `number` **Root volume size (GB).** Required encrypted boot disk for the operating system, Docker, and local files. Its contents persist across deploys, restarts, and in-place stack updates, but not instance or group replacement. * Default: `30` * Min: `8` * Max: `16384` **data\_volume\_creation\_enabled** `boolean` **Data volume.** Attach a second encrypted EBS disk to keep application data separate from the boot disk, for example a local database, uploads, or a cache. Each instance gets its own disk, which persists for the life of that instance. * Default: `false` **data\_volume\_size** `number` **Data volume size (GB).** Size of the dedicated EBS data volume attached to each instance. Take EBS snapshots or back up elsewhere if it holds critical data. * Default: `20` * Min: `1` * Max: `16384` * Shown when: `{"data_volume_creation_enabled":true}` **data\_volume\_mount\_path** `string` *required* **Data volume mount path.** Absolute host path for the data volume. * Default: `/data` * Pattern: `^/` — Use an absolute path. * Shown when: `{"data_volume_creation_enabled":true}` **efs\_enabled** `boolean` **EFS file system.** Mount a shared network filesystem that every instance can access. Use it when multiple instances need the same files, or when files must survive instance replacement without a restore step. * Default: `false` **efs** `$ref:rvn-efs` *required* **EFS file system.** * Shown when: `{"efs_enabled":true}` Set `efs` to `null`. Mapped inputs for `efs`: set these keys alongside `efs`, not inside it, when supplying existing infrastructure instead of a module reference. **efs\_file\_system\_id** `string` **EFS file system ID.** * Default: `<>` **efs\_access\_point\_id** `string` **EFS access point ID.** * Default: `<>` **efs\_client\_security\_group\_id** `string` **EFS client security group ID.** * Default: `<>` **efs\_mount\_path** `string` *required* **EFS mount path.** Host path where the file system is mounted. * Default: `/mnt/efs` * Pattern: `^/` — Use an absolute path. * Shown when: `{"efs_enabled":true}` ### Scaling **min\_instances** `number` *required* **Minimum instances.** * Default: `1` * Min: `0` **max\_instances** `number` *required* **Maximum instances.** * Default: `1` * Min: `1` **cpu\_autoscaling\_enabled** `boolean` **CPU autoscaling.** * Default: `false` **cpu\_target\_value** `number` **CPU target (%).** Average EC2 CPU utilization that target-tracking autoscaling tries to maintain. * Default: `70` * Min: `1` * Max: `100` * Shown when: `{"cpu_autoscaling_enabled":true}` **desired\_capacity** `number` **Desired instances.** Initial group size when CPU autoscaling is off. Leave blank to start at the minimum. * Min: `0` * Shown when: `{"cpu_autoscaling_enabled":false}` ### Environment variables **build\_environment\_variables** `object` **Build environment variables.** Only available during the build, not at runtime. Use environment variables or secrets for runtime values. * Shown when: `{"build_source":["dockerfile","railpack"],"deploy_type":"container"}` **dockerfile\_environment\_variable\_injection\_enabled** `boolean` **Inject environment variables in Dockerfile.** Pass build environment variables into Dockerfile builds as build arguments. * Default: `false` * Shown when: `{"build_source":"dockerfile","deploy_type":"container"}` **environment\_variables** `array` **Runtime environment variables.** Plain, single-line environment variables written to each instance at boot and refreshed on every deploy. **secrets** `array` **Runtime secrets.** Secret environment variables fetched on each instance, as an array of objects with `name` and `value_from` keys (snake\_case, not `valueFrom`). value\_from is a Secrets Manager secret ARN, an SSM parameter ARN, or a bare SSM parameter name. ### Networking **additional\_security\_group\_ids** `string_array` **Additional security groups.** Additional security groups attached to the instances. **direct\_access\_cidr\_blocks** `string_array` **Allowed CIDR blocks.** IPv4 CIDR blocks allowed to reach the app port directly, bypassing the load balancer. * Shown when: `{"http_traffic_enabled":true}` ### Builder config **build\_capacity\_type** `string` *required* **Builder capacity type.** Sandbox starts fastest. EC2 spot costs less but may wait for capacity or be interrupted. * Default: `sandbox` * Allowed values: `sandbox` (Sandbox), `ec2` (EC2), `ec2-spot` (EC2 spot) * Shown when: `{"build_source":["dockerfile","railpack"],"deploy_type":"container"}` **build\_instance\_type** `string` *required* **Builder instance type.** EC2 instance type for builds. Start with the default value, then increase or decrease it based on the resource usage report at the end of builds. * Default: `c7a.4xlarge` * Shown when: `{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack"],"deploy_type":"container"}` **build\_cpu** `number` *required* **Builder vCPUs.** * Default: `14` * Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack"],"deploy_type":"container"}` **build\_memory** `number` *required* **Builder memory (GiB).** * Default: `28` * Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack"],"deploy_type":"container"}` **build\_disk** `number` **Builder disk (GiB).** Space the build reserves on the pool host for what it writes. Larger values let fewer builds share a host. * Default: `30` * Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack"],"deploy_type":"container"}` **build\_interruptible\_enabled** `boolean` **Interruptible build.** Lets the build run on spot hosts and start over if AWS reclaims the host. Turn off if your build commands change anything outside the build, such as running database migrations. * Default: `true` * Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack"],"deploy_type":"container"}` **build\_execution\_environment\_id** `string` **Builder execution environment.** Optional execution environment ID or given ID for builds. Defaults to the module Terraform execution environment. * Shown when: `{"build_source":["dockerfile","railpack"],"deploy_type":"container"}` **build\_ami\_id** `string` **Builder AMI.** Optional AMI ID for build runners. Leave empty to use the default runner image. * Shown when: `{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack"],"deploy_type":"container"}` **build\_default\_policies\_enabled** `boolean` **Include default build policies.** The step's built-in policies (ECR/S3 access, CloudWatch agent) stay attached alongside your Builder IAM policies. Turn off to run the build with only the policies listed below. * Default: `true` * Shown when: `{"build_source":["dockerfile","railpack"],"deploy_type":"container"}` **build\_iam\_policy\_arns** `string_array` **Builder IAM policies.** IAM managed policy ARNs for the EC2 build runner role, applied for the duration of each build. * Default: `[]` * Shown when: `{"build_source":["dockerfile","railpack"],"deploy_type":"container"}` ### Container registry **ecr\_scan\_on\_push\_enabled** `boolean` **Scan images on push.** Scan images for vulnerabilities after they are pushed to the Ravion-created ECR repository. Enabled by default to satisfy SOC 2 vulnerability-scanning requirements. * Default: `true` * Shown when: `{"build_source":["dockerfile","railpack","ecr"],"deploy_type":"container"}` **ecr\_force\_deletion\_enabled** `boolean` **Force delete image repository.** Allow the Ravion-created ECR repository to be deleted while it still contains images. * Default: `false` * Shown when: `{"build_source":["dockerfile","railpack","ecr"],"deploy_type":"container"}` ### Logging **log\_retention\_in\_days** `number` **Log retention (days).** CloudWatch retention for app logs. * Default: `30` * Min: `1` **log\_rotation\_max\_size\_mb** `number` **Log rotation size (MB).** Size at which supervisord rotates the app log file on the instance. Bounds disk usage when the process restarts repeatedly. * Default: `20` * Min: `1` * Max: `1024` **log\_rotation\_backup\_count** `number` **Rotated log files kept.** Number of rotated app log files kept on the instance. On-instance usage is bounded by (this + 1) times the rotation size. * Default: `5` * Min: `1` * Max: `100` **tags** `keyvalue` **Tags.** A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId` ### Terraform settings **opentofu\_version** `string` **OpenTofu version override.** Override the environment's default version for this module **ravion\_state\_backend\_workspace** `string` **Ravion Terraform workspace name.** Override Terraform state backend workspace name. Defaults to project + environment + module given ids. * Immutable after creation **terraform\_plan\_default\_policies\_enabled** `boolean` **Include default plan policies.** Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below. * Default: `true` **terraform\_plan\_iam\_policy\_arns** `string_array` **Terraform plan IAM policies.** IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-\ bucket in this account. * Default: `[]` **terraform\_apply\_default\_policies\_enabled** `boolean` **Include default apply policies.** Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below. * Default: `true` **terraform\_apply\_iam\_policy\_arns** `string_array` **Terraform apply IAM policies.** IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-\ bucket in this account. * Default: `[]` **advanced\_terraform\_variables** `object` **Advanced Terraform variables.** Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above. * Default: `{}` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.