fix(cfn): retire the CloudFormation install stack

.github/workflows/ci.yml

@@ -1536,8 +1536,8 @@ jobs:
       - name: Run parity script self-tests
         run: bash scripts/test-azure-role-parity.sh
 
-  # Assert that the AWS IAM action lists are identical across the CFN stack,
-  # the TF lambda/fargate modules, and the federation CFN/TF/CLI templates.
+  # Assert that the AWS IAM action lists are identical across the TF
+  # lambda/fargate modules and across the federation CFN/TF/CLI templates.
   # Fast (shell only), so it always runs.
   aws-iam-parity:
     name: AWS IAM actions parity (CFN vs TF)

.pre-commit-config.yaml

@@ -163,9 +163,9 @@ repos:
   # with the version pinned in additional_dependencies, like zizmor above.
   #
   # --non-zero-exit-code error: errors (templates CloudFormation rejects)
-  # fail the hook. Warnings do not fail it, because the
-  # cloudformation/stacks/CUDly and aws-cross-account templates carry a W3005
-  # (redundant DependsOn) that is not a load or deploy failure.
+  # fail the hook. Warnings do not fail it, because the aws-cross-account
+  # template carries a W3005 (redundant DependsOn) that is not a load or
+  # deploy failure.
   - repo: local
     hooks:
       - id: cfn-lint

CHANGELOG.md

@@ -43,6 +43,16 @@ are the full record until the next release.
   new-style `es:*ReservedInstance*` OpenSearch actions (replacing the legacy
   `es:*ReservedElasticsearch*` names).
 
+### Removed
+
+- The CloudFormation install stack (`cloudformation/stacks/CUDly`). It still
+  created DynamoDB tables and set no `DB_HOST`, so the Postgres-only server it
+  deployed failed at startup and the stack could not serve any request or
+  scheduled task. Install on AWS with Terraform (`terraform/environments/aws`,
+  Lambda or Fargate) instead; see `docs/DEPLOYMENT.md`. The target-account role
+  templates (`cloudformation/stacks/CUDly-CrossAccount` and the federation
+  CloudFormation templates under `iac/federation/`) are unchanged (#1432)
+
 ### Fixed
 
 - Account scopes match `allowed_accounts` entries by account ID only. A

CLAUDE.md

@@ -22,6 +22,8 @@
 - `internal/`: backend application code (API, auth, purchase, scheduler, ...)
 - `frontend/`: TypeScript web frontend (webpack + jest)
 - `terraform/`, `cloudformation/`, `arm/`, `iac/`: infrastructure as code
+  (Terraform is the only install path; the CloudFormation and ARM templates
+  create CUDly's role in target accounts)
 - `docs/`: documentation and markdown files
 - `scripts/`: utility scripts
 - `tests/`: end-to-end tests (Go unit tests live next to the code they test)

CONTRIBUTING.md

@@ -201,7 +201,8 @@ cloud-commitments-platform/
 ├── internal/                 # application code (API, auth, purchase, scheduler, ...)
 ├── iac/                      # infrastructure-as-code helpers
 ├── frontend/                 # web dashboard (TypeScript)
-├── terraform/, cloudformation/, arm/   # deployment definitions
+├── terraform/                # deployment definitions (the only install path)
+├── cloudformation/, arm/     # target-account role templates
 ├── tests/e2e/                # black-box suite (separate stdlib-only module)
 ├── known_issues/             # tracked tech debt and deferred fixes
 ├── scripts/                  # Repository hook and helper scripts

README.md

@@ -37,7 +37,8 @@ Per-account service overrides are available from **Settings -> Accounts**. Expan
 - `cmd/lambda` contains the Lambda entry point.
 - `internal` contains platform services and API code.
 - `frontend` contains the web dashboard.
-- `terraform`, `cloudformation`, `arm`, and related infrastructure directories contain deployment definitions.
+- `terraform` contains the deployment definitions; install CUDly with it (see [deployment](docs/DEPLOYMENT.md)). There is no CloudFormation install.
+- `cloudformation`, `arm`, and `iac` contain the templates that create CUDly's role in each target cloud account. They do not install CUDly.
 
 This component does not provide the `cudly` CLI. Use the [CLI component](https://github.com/LeanerCloud/cloud-commitments-cli) for command-line workflows.