The module interface in terraform/variables.tf and terraform/outputs.tf. Frozen: a rename here would need every consumer (docs, examples, the chart) updated in the same change.
Prefix for every AWS, Kubernetes and Grafana object this module creates. Must be unique per AWS account and per Grafana stack: two deployments with the same name collide on account-global IAM roles, Secrets Manager paths and the stack's prefixed Grafana objects (dashboards, rules, evaluators), and one apply or destroy then changes the other's resources. Must match ^[a-z][a-z0-9-]{1,20}$.
Name of the existing EKS cluster the Kubernetes and Helm providers point at. Used only for EKS Pod Identity associations; the cluster needs the eks-pod-identity-agent add-on (built in on Auto Mode).
namespace
string
"touchline"
Kubernetes namespace for the in-app agents and site. Created and owned by this module.
deploy_workloads
bool
true
Install the Helm chart with helm_release. Set false to deploy charts/touchline yourself with Argo CD, Flux or kubectl; the module still creates the namespace, Secrets, IAM and Grafana objects and outputs the chart values.
agent_host_enabled
bool
true
Create the EC2 agent host that runs the Claude apps gateway and the developer containers.
agent_host_subnet_id
string
null
Subnet for the agent host. It needs outbound internet (NAT or equivalent) for SSM, container images, the Claude Code download, Bedrock and Grafana Cloud. Required when agent_host_enabled.
agent_host_instance_type
string
"t4g.xlarge"
Agent host instance type. The AMI architecture follows it (Graviton types use arm64).
Slug of the Grafana Cloud stack that receives all telemetry and holds the dashboards, rules and Agent Observability objects. The grafana.cloud provider alias must hold a Cloud access policy token that can manage access policies, PDC and the stack; grafana.stack must point at this stack with an Admin service account token.
alert_contact_point
object({ name = string })
null
Where the demo alerts route. null creates a contact point that delivers nowhere (a webhook to a blackhole address), so the alerts fire visibly without paging anyone.
Model key to system cross-region inference profile id, copied per team. The profile prefix (eu., us., apac., global.) must be valid for the provider region. Model access and Anthropic's one-time use-case form must already be done in the account.
bedrock_models key used by the Agent Observability LLM-judge evaluators.
bedrock_invocation_logging_enabled
bool
false
Turn on Bedrock model invocation logging and ship it to Grafana Cloud Logs. Account- and region-wide, captures prompt and completion text for every Bedrock call in the region (not just this demo), replaces any existing configuration, and destroy removes it rather than restoring a previous one. Enable in a dedicated sandbox account.
bedrock_metric_stream_enabled
bool
true
Stream the AWS/Bedrock CloudWatch namespace to Grafana Cloud Metrics with a CloudWatch metric stream and Firehose.
Team names. Each becomes a Cognito group (gateway policies, per-group spend caps, user.groups in telemetry) and a set of per-team Bedrock application inference profiles.
Gateway spend caps in whole USD. user keys are developer names, group keys are team names. Caps are per-seat defaults, most restrictive wins.
content_capture
bool
true
Capture prompt text, assistant responses and tool content in telemetry (Claude Code OTEL_LOG_* settings pushed by the gateway, and the in-app agents). Needed for the prompt-level panels and content evaluators. Treat captured telemetry as sensitive.
Master switch for all synthetic traffic: developer sessions, the site load generator and the experiment schedule. false leaves everything deployed but idle.
developer_session_interval_minutes
number
20
Mean minutes between Claude Code sessions per developer (jittered).
site_requests_per_minute
number
2
Load generator rate against the site (each request fans out to Bedrock).
Claude Code release installed at container start on the agent host (gateway and developers). Never baked into images. The login bot is tested against this version.
agento11y_cli_version
string
"latest"
agento11y CLI and Claude Code plugin version for the developer containers. latest keeps the build pinned in the dev-workstation image and a version installs that release; either way the plugin marketplace is pinned to the matching tag.
Container image registry, name prefix and tag for this repo's images. Every image reference is <registry>/<name_prefix><app>:<tag>. tag is a plain tag and defaults to this module's release; digests (image name to sha256:...) pins individual images immutably; verify an image with cosign before pinning it (see Security). Override registry to use a private mirror; set name_prefix = "" for a mirror whose repositories are already <registry>/<app>.
Let this module switch Application Observability on. Stack-wide singleton: destroy switches the product off for the whole stack, so leave false on a shared stack where it is already on.
manage_knowledge_graph
bool
false
Let this module perform Knowledge Graph (Asserts) onboarding, using its own Cloud access policy token and stack Admin service account token, which exist only while this is true. Stack-wide singleton: destroy calls the same API the onboarding wizard's disable control uses, switching Knowledge Graph off for the whole stack, so leave false on a shared stack where it is already on.
knowledge_graph_enabled
bool
true
Create the Knowledge Graph service-graph rule and this demo's own trace configuration (entity properties for its services, scoped to var.namespace, at a low priority so it never overrides another config on a shared stack). The Knowledge Graph must already be initialized on the stack, either by manage_knowledge_graph or by hand.
Values for charts/touchline when you deploy it yourself (deploy_workloads = false). Contains no secrets: the chart reads the Terraform-created Secrets by name.
gateway_ca_pem
no
Private CA that signs the gateway certificate, for curl --cacert over just gateway-tunnel only. Never add it to a system or browser trust store: it can sign a certificate for any hostname.
gateway_cert_pem
no
The gateway's public leaf certificate. just login-tunnel derives its SPKI pin from this and passes it to a throwaway browser profile.