> **Page index:** https://km.oslo.systems/llms.txt lists every page on this site, with a link to its Markdown version.

# Debug CD permissions locally

> [!WARNING]
>
> **Deprecated**
>
> This guide applies to the old CI/CD setup and is no longer maintained. If you have moved to the new CI/CD, it no longer applies — see [Migrate to the latest CI/CD](<https://km.oslo.systems/application/migrate-to-latest-cicd/configure-infrastructure/index.md>).

This guide describes how to run Terraform with the same permissions used by GitHub Actions for continuous deployment (CD) for the [`app`](<https://km.oslo.systems/application/templates/app/index.md>) template.

This accelerates debugging and testing of CD permissions, as you can run `terraform` locally with the same permissions as the CD workflow used by GitHub Actions.

## Before you begin

- This guide only applies to the [`app`](<https://km.oslo.systems/application/templates/app/index.md>) template.
- You must be authenticated with the AWS CLI. Verify this by running `aws s3 ls`, which should give no errors.

## Step 1: Configure template

In `package-config.yml`, set the following:

repo-iac/environments/dev/my-app/package-config.yml

```
IamForCicd:
  # ... other settings
  AssumableCdRole: true
```

## Step 2: Generate Terraform code

repo-iac/environments/dev/app-example/

```
ok pkg install
```

## Step 3: Create a role for CD

repo-iac/environments/dev/my-app/

```
terraform init
terraform apply
```

This creates a role that is the same as the role assumed by GitHub Actions. The only difference is that it can be assumed by you, instead of GitHub actions.

## Step 4: Run Terraform with the CD role

Now you can run Terraform while assuming the CD role:

repo-iac/environments/dev/my-app/

```
terraform apply -var assume_cd_role=true
```

This means you can now reproduce any errors you get in your GitHub actions continuous deployment workflow.

## Verify

To verify that the role used was in fact the one you created in step 3, run:

repo-iac/environments/dev/my-app/

```
terraform state show \
  module.iam_assumable_role_cd_debug.data.aws_caller_identity.current
```

Verify that the `arn` field is the same as the ARN in the file `_gp_app_iam_cd_assumable_role.tf`, in the variable `trusted_role_arns`.

## Clean up

To remove everything you've created, undo the previous steps in the following order:

- Undo step 1, to reset the configuration.
- Run step 2, to re-generate the stack.
- Run step 3, to apply the changes.