# Debug CD permissions locally

<!-- prettier-ignore-start -->
!!! warning "Deprecated"
    This guide applies to the old CI/CD setup and is no longer maintained. If you have moved to the new CI/CD, it no longer applies — see [Migrate to the latest CI/CD](../migrate-to-latest-cicd/configure-infrastructure.md).
<!-- prettier-ignore-end -->

This guide describes how to run Terraform with the same permissions used by GitHub Actions for continuous deployment
(CD) for the [`app`](../templates/app.md) template.

This accelerates debugging and testing of CD permissions, as you can run `terraform` locally with the same
permissions as the CD workflow used by GitHub Actions.

## Before you begin

- This guide only applies to the [`app`](../templates/app.md) template.
- You must be authenticated with the AWS CLI. Verify this by running `aws s3 ls`, which should give no errors.

## Step 1: Configure template

In `package-config.yml`, set the following:

```yaml title="repo-iac/environments/dev/my-app/package-config.yml"
IamForCicd:
  # ... other settings
  AssumableCdRole: true
```

## Step 2: Generate Terraform code

```sh title="repo-iac/environments/dev/app-example/"
ok pkg install
```

## Step 3: Create a role for CD

```sh title="repo-iac/environments/dev/my-app/"
terraform init
terraform apply
```

This creates a role that is the same as the role assumed by GitHub Actions. The only difference is that it can be
assumed by you, instead of GitHub actions.

## Step 4: Run Terraform with the CD role

Now you can run Terraform while assuming the CD role:

```sh title="repo-iac/environments/dev/my-app/"
terraform apply -var assume_cd_role=true
```

This means you can now reproduce any errors you get in your GitHub actions continuous deployment workflow.

## Verify

To verify that the role used was in fact the one you created in step 3, run:

```sh title="repo-iac/environments/dev/my-app/"
terraform state show \
  module.iam_assumable_role_cd_debug.data.aws_caller_identity.current
```

Verify that the `arn` field is the same as the ARN in the file `_gp_app_iam_cd_assumable_role.tf`, in the variable
`trusted_role_arns`.

## Clean up

To remove everything you've created, undo the previous steps in the following order:

- Undo step 1, to reset the configuration.
- Run step 2, to re-generate the stack.
- Run step 3, to apply the changes.