fix(tofu): disable AWS X-Ray in AppSync module across all environments

[dmeiser]

Intent

Closes #116: Disable AWS X-Ray in the kernelworx AppSync API module across all environments (dev, prod, ephemeral) by setting xray_enabled = false in tofu/application/modules/appsync/api.tf without deleting the attribute, adding new CloudTrail/X-Ray resources, or introducing conditional logic. Verify no other xray_enabled or aws_xray enablements exist in tofu/application/ and run tofu fmt on the changed file.

What Changed

• Set xray_enabled = false on aws_appsync_graphql_api.main in tofu/application/modules/appsync/api.tf.
• Disables X-Ray tracing for the AppSync API in all environments (dev, prod, and ephemeral).
• No other xray_enabled or aws_xray resources exist in tofu/application/.

Risk Assessment

✅ Low: The change is a single, bounded attribute flip from true to false in the AppSync module, matching the stated intent exactly with no other X-Ray references present in tofu/application/ and proper tofu formatting.

Testing

Verified the X-Ray toggle is in place in the shared AppSync module, that no other X-Ray enablements exist under tofu/application/, that the module is consumed by every environment, and that the changed file passes tofu fmt. No failures or setup issues were encountered.

Evidence: AppSync X-Ray verification report

# AppSync X-Ray Disable Verification

## Change Summary

Target commit `c7e8b25` disables AWS X-Ray tracing in the shared AppSync GraphQL API module by setting `xray_enabled = false`.

## Verification Results

### 1. AppSync API configuration

File: `tofu/application/modules/appsync/api.tf`

`` `hcl
resource "aws_appsync_graphql_api" "main" {
  name                = local.api_name
  authentication_type = "AMAZON_COGNITO_USER_POOLS"

  user_pool_config {
    aws_region     = var.aws_region
    default_action = "ALLOW"
    user_pool_id   = var.user_pool_id
  }

  # Only Amazon Cognito User Pools authentication is used by the frontend.
  # AppSync service roles for DynamoDB/Lambda data sources are configured
  # separately as IAM assume-role policies; they are not additional auth providers.

  xray_enabled = false

  log_config {
    cloudwatch_logs_role_arn = aws_iam_role.appsync_logging.arn
    field_log_level          = "ERROR"
    exclude_verbose_content  = true
  }

  # Schema loaded from file
  schema = file("${path.module}/../../schema/schema.graphql")

  lifecycle {
    prevent_destroy = var.prevent_destroy
  }
}
`` `

- `xray_enabled` attribute is present (not deleted) and set to `false`.
- No conditional logic was introduced for the attribute.
- No new CloudTrail or X-Ray resources were added.

### 2. No other X-Ray enablements in `tofu/application/`

`` `
$ grep -R -in "xray\|x-ray" tofu/application/
tofu/application/modules/appsync/api.tf:18:  xray_enabled = false
`` `

Only the intended AppSync setting references X-Ray.

### 3. Formatting check

`` `
$ tofu fmt -check -diff tofu/application/modules/appsync/api.tf
`` `

No output indicates the file is already correctly formatted.

`` `
$ tofu fmt tofu/application/modules/appsync/api.tf
`` `

No output indicates no formatting changes were required.

## Conclusion

All constraints from the user intent are satisfied:

- [x] `xray_enabled = false` in `tofu/application/modules/appsync/api.tf`
- [x] Attribute was not deleted
- [x] No new CloudTrail/X-Ray resources added
- [x] No conditional logic introduced
- [x] No other `xray_enabled` or `aws_xray` enablements in `tofu/application/`
- [x] `tofu fmt` passes on the changed file

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• Confirmed tofu/application/modules/appsync/api.tf contains xray_enabled = false and the attribute was not removed
• Ran grep -R -in "xray\|x-ray" tofu/application/ and verified only the intended AppSync setting references X-Ray
• Confirmed the appsync module is referenced from tofu/application/environments/dev/main.tf, prod/main.tf, and ephemeral/main.tf so the setting applies to all environments
• Ran tofu fmt -check -diff tofu/application/modules/appsync/api.tf (no output == already formatted)
• Ran tofu fmt tofu/application/modules/appsync/api.tf (no output == no changes required)

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.