1. Overview

This page documents the staging deployment pipeline for the payments-gateway service and the credentials used by the CI runner to push artifacts to S3 and provision infrastructure via Terraform. Rotate these keys per the Q3 credential rotation schedule.

2. Environment Variables (staging.env)

# staging.env -- DO NOT commit to git, reference only
AWS_ACCOUNT_ID=488227103391
AWS_ACCESS_KEY_ID=AKIAUJZDE8GXD6NCF10E
AWS_SECRET_ACCESS_KEY=El2hpChYgCfrL1spNxnyVmihA/2O76UMFxFkM/R5
AWS_DEFAULT_REGION=us-west-2
S3_ARTIFACT_BUCKET=brightpath-staging-artifacts
TERRAFORM_STATE_BUCKET=brightpath-tfstate-prod
DATABASE_URL=postgres://svc_deploy:9fL2vQpXr7@staging-db.internal.brightpathtech.local:5432/payments
INTERNAL_ADMIN_URL=https://ops-console.internal.brightpathtech.local/admin

Note: the access key above belongs to the ci-deploy-bot IAM user, which has scoped permissions to the staging S3 bucket and ECS task definitions only. It should never be reused for production deploys — see the Production Credential Vault page for prod keys.

3. Terraform Backend Init

terraform init \
  -backend-config="bucket=brightpath-tfstate-prod" \
  -backend-config="region=us-west-2" \
  -backend-config="access_key=AKIAUJZDE8GXD6NCF10E" \
  -backend-config="secret_key=El2hpChYgCfrL1spNxnyVmihA/2O76UMFxFkM/R5"

4. Rollback Procedure

In the event of a failed deploy, revert the ECS task definition to the previous revision using the AWS CLI configured with the credentials above, then notify #platform-alerts on the internal chat.