docs(terraform): publish AWS ECS Fargate and GCP Cloud Run deployment guides (LIT-3173)

[yassin-berriai]

Summary

Publishes documentation for the official LiteLLM Terraform stacks that deploy the componentized proxy (gateway + backend + UI) on AWS ECS Fargate and GCP Cloud Run. The Terraform code already lives in terraform/litellm/aws/ and terraform/litellm/gcp/ in the main repo; this PR makes them discoverable through the docs site.

• docs/proxy/deploy_terraform_aws.md — Full AWS quickstart: ECS Fargate, Aurora Postgres (IAM auth), ElastiCache Redis (HA, TLS), S3, Application Load Balancer. Covers proxy_config, extra env/secrets, autoscaling, multi-tenant naming, TLS, data retention tripwires, and the full variable/output reference.
• docs/proxy/deploy_terraform_gcp.md — Full GCP quickstart: Cloud Run v2, Cloud SQL (writer + read replica, password auth), Memorystore Redis (TLS), GCS, External HTTPS Load Balancer. Covers Artifact Registry image setup (required since Cloud Run rejects ghcr.io), TLS + managed cert, multi-tenant naming, and the full variable/output reference.
• docs/proxy/deploy.md — Terraform section updated to link both new guides; AWS ECS paragraph modernised (was pointing at a legacy third-party tutorial repo).
• sidebars.js — New "Terraform" category under Setup & Deployment linking both pages.

Resolves LIT-3173

Behavioral test matrix

Scenario	Expected behaviour	Verified by
terraform apply with allow_plaintext_alb = true (AWS)	ALB created with HTTP-only listener; no ACM cert required	variables.tf precondition + README
terraform apply with acm_certificate_arn set (AWS)	443 listener with path routing; 80 listener redirects to HTTPS	alb.tf conditional listener
terraform apply with allow_plaintext_lb = true (GCP)	LB created HTTP-only; no managed cert provisioned	load_balancer.tf precondition
terraform apply with lb_domains set (GCP)	443 forwarding rule + Google-managed cert; 80 → 301 HTTPS redirect	load_balancer.tf conditional cert resource
terraform apply with litellm_master_key = ""	Auto-generated sk-… key stored in Secrets Manager / Secret Manager	secrets.tf random_password
terraform apply with litellm_license = ""	No license secret created; gateway/backend run OSS-only	secrets.tf count = 0 path
terraform destroy with skip_final_snapshot = false (AWS)	Aurora takes final snapshot before cluster deletion	rds.tf final_snapshot_identifier
terraform destroy with s3_force_destroy = false (AWS)	Destroy fails if S3 bucket is non-empty	s3.tf force_destroy = false
terraform destroy with cloudsql_deletion_protection = true (GCP)	Destroy fails with Cloud SQL deletion protection error	cloudsql.tf deletion_protection = true
terraform destroy with gcs_force_destroy = false (GCP)	Destroy fails if GCS bucket is non-empty	gcs.tf force_destroy = false
Gateway receives LLM request (/v1/chat/completions)	ALB/LB routes to ECS gateway service / Cloud Run gateway	locals.tf gateway path prefixes
Dashboard request (/)	ALB/LB routes to ECS UI service / Cloud Run UI service	alb.tf / load_balancer.tf UI rules
Management request (/key/generate)	ALB/LB routes to ECS backend service / Cloud Run backend	Default forwarding rule
Aurora IAM bootstrap (AWS)	bootstrap.tf one-shot Fargate task creates litellm_app user with rds_iam	bootstrap.tf local-exec + outputs.tf db_bootstrap_sql
Prisma migration (both)	One-off ECS task / Cloud Run Job runs prisma migrate deploy before services start	migrations.tf / Cloud Run Job depends_on in bootstrap.tf
gateway_extra_secrets (AWS)	Execution role gains GetSecretValue on each ARN; secret injected as env var	iam.tf policy attachment
gateway_extra_secrets (GCP)	Runtime SA gains roles/secretmanager.secretAccessor on each secret	iam.tf IAM binding
Cloud Run image pull from ghcr.io (GCP)	Apply-time error from Cloud Run — must use Artifact Registry remote repo	Documented prerequisite; variables.tf default note
tenant + env combination uniqueness	All resources namespaced; two stacks coexist in same account/project	locals.tf local.name

Test plan

• Review that all output names in docs match outputs.tf exactly (cross-checked manually ✓)
• Review that all variable names and defaults match variables.tf exactly (cross-checked manually ✓)
• Verify sidebar renders correctly in Docusaurus dev server
• Verify links in deploy.md resolve to new pages

https://claude.ai/code/session_01N6myMC1QzDj2NtpqfACDPn

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	May 23, 2026 10:39pm