feat: enables aws teardown/setup as code [#60]

[robert-7]

Summary

• adds a new Python AWS CDK app under infra/ that defines the current AWS deployment as a same-name rebuild stack
• models the AWS-only resources for the course enrollment app so we can recreate and tear down the environment as code going forward
• keeps MongoDB Atlas, Namecheap DNS, and ACM DNS validation out of CDK and treats them as external prerequisites

What Changed

• added infra/app.py, infra/course_enrollment_stack.py, infra/requirements.txt, infra/cdk.json, and infra/.env.example
• defined a single CourseEnrollmentAppStack that creates the ECR repository, GitHub OIDC provider, GitHub Actions deploy role, ECS task execution role, CloudWatch log group, ECS cluster, ALB, target group, listeners, security groups, and ECS Fargate service
• configured the stack to reuse existing network and HTTPS prerequisites via environment inputs (CDK_VPC_ID, CDK_PUBLIC_SUBNET_IDS, CDK_CERTIFICATE_ARN) rather than creating a new VPC or certificate
• bootstraps ECS from an existing ECR image tag via CDK_IMAGE_TAG, while leaving ongoing image rollouts to the existing GitHub Actions deployment workflow
• preserves the current SSM secret shape by creating /course-enrollment-app/SECRET_KEY and /course-enrollment-app/MONGO_URI as SecureString parameters
• added make aws-teardown to run cd infra && cdk destroy CourseEnrollmentAppStack --force
• updated .gitignore for CDK artifacts and expanded docs/aws-architecture.md with the rebuild workflow, required inputs, usage, and limitations

Resource Shape

The CDK stack is aligned to the current deployment naming/behavior and creates:

• ECR repository course-enrollment-app
• IAM OIDC provider for GitHub Actions and deploy role GitHubActions-CourseEnrollmentApp
• ECS task execution role ECSTaskExecutionRole-CourseEnrollmentApp
• CloudWatch log group /ecs/course-enrollment-app
• ECS cluster course-enrollment-app
• ALB course-enrollment-app-alb
• target group course-enrollment-app-tg with /index health checks
• ALB/task security groups matching the current ingress/egress rules
• Fargate task/service using APP_ENV=production, container port 5000, desired count 1, and SSM-backed secrets
• HTTPS listener on 443 using the provided ACM certificate ARN and HTTP 80 redirecting to HTTPS

Important Scope Notes

• this is a fresh-replacement rebuild stack, not a CloudFormation import or in-place adoption of the manually created AWS resources
• first deploy is intended for a clean account or after tearing down the current hand-built environment, because the stack uses the existing production resource names
• MongoDB Atlas stays external and is represented only by the MONGO_URI secret value
• Namecheap DNS and ACM validation records remain manual/external to the stack

Required Inputs

The documented CDK inputs are:

• CDK_VPC_ID
• CDK_PUBLIC_SUBNET_IDS
• CDK_CERTIFICATE_ARN
• CDK_IMAGE_TAG
• CDK_SECRET_KEY
• CDK_MONGO_URI

Validation

• python3 -m py_compile infra/app.py infra/course_enrollment_stack.py ✅
• pre-commit run --files infra/app.py infra/course_enrollment_stack.py infra/requirements.txt infra/cdk.json infra/.env.example Makefile .gitignore docs/aws-architecture.md ✅
• cd infra && cdk synth could not be completed in this environment because the CDK CLI is not installed (cdk: command not found)

Follow-up / Operator Notes

• local CDK usage now needs Node.js + CDK CLI, AWS CLI auth, and a Python environment for infra/
• after those prerequisites are installed locally, the next verification step is cd infra && cdk synth
• make aws-teardown only removes CDK-managed AWS resources and does not touch Atlas, Namecheap DNS, or other external prerequisites

Closes #60

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!