@swamp/s3-datastore-bootstrap

One-shot bootstrap for @swamp/s3-datastore. Ships a single provisioner model that creates an S3 bucket and a least-privilege IAM managed policy, plus a workflow that runs the provisioner and then switches the current swamp repository over to the S3 datastore. ## Prerequisites - AWS credentials in the default credential chain (env / profile / role) with permissions to create the bucket, create the managed policy, and exercise the runtime actions documented in @swamp/s3-datastore. - The caller that will run swamp after setup must already hold, or will attach, the managed policy produced by this workflow. ## What it does 1. `provision` creates a private S3 bucket (versioning on, SSE-S3, public access blocked) and a scoped IAM managed policy granting the four runtime IAM actions (`ListBucket`, `GetObject`, `PutObject`, `DeleteObject`) limited to that bucket. 2. A final `command/shell` step runs `swamp datastore setup extension @swamp/s3-datastore --config ...` to flip the repo's datastore to S3. ## Running ```bash swamp extension pull @swamp/s3-datastore-bootstrap swamp model create @swamp/s3-datastore-bootstrap/provisioner \ swamp-s3-datastore-provisioner # Edit the instance so globalArguments are wired to workflow inputs: # bucket_name: ${{ inputs.bucket_name }} # region: ${{ inputs.region }} # prefix: ${{ inputs.prefix }} # policy_name: ${{ inputs.policy_name }} swamp model edit swamp-s3-datastore-provisioner # The command/shell instance used by the final workflow step swamp model create command/shell swamp-s3-datastore-setup swamp workflow run bootstrap-s3-datastore \ --input bucket_name=my-swamp-state \ --input region=us-east-1 swamp datastore status ``` See the bundled README for optional inputs (`prefix`, `policy_name`), the exact IAM policy produced, and idempotency notes.

One-shot bootstrap for @swamp/s3-datastore. Ships a single provisioner model that creates an S3 bucket and a least-privilege IAM managed policy, plus a workflow that runs the provisioner and then switches the current swamp repository over to the S3 datastore. ## Prerequisites - AWS credentials in the default credential chain (env / profile / role) with permissions to create the bucket, create the managed policy, and exercise the runtime actions documented in @swamp/s3-datastore. - The caller that will run swamp after setup must already hold, or will attach, the managed policy produced by this workflow. ## What it does 1. `provision` creates a private S3 bucket (versioning on, SSE-S3, public access blocked) and a scoped IAM managed policy granting the four runtime IAM actions (`ListBucket`, `GetObject`, `PutObject`, `DeleteObject`) limited to that bucket. 2. A final `command/shell` step runs `swamp datastore setup extension @swamp/s3-datastore --config ...` to flip the repo's datastore to S3. ## Running ```bash swamp extension pull @swamp/s3-datastore-bootstrap swamp model create @swamp/s3-datastore-bootstrap/provisioner \ swamp-s3-datastore-provisioner # Edit the instance so globalArguments are wired to workflow inputs: # bucket_name: ${{ inputs.bucket_name }} # region: ${{ inputs.region }} # prefix: ${{ inputs.prefix }} # policy_name: ${{ inputs.policy_name }} swamp model edit swamp-s3-datastore-provisioner # The command/shell instance used by the final workflow step swamp model create command/shell swamp-s3-datastore-setup swamp workflow run bootstrap-s3-datastore \ --input bucket_name=my-swamp-state \ --input region=us-east-1 swamp datastore status ``` See the bundled README for optional inputs (`prefix`, `policy_name`), the exact IAM policy produced, and idempotency notes.

One-shot bootstrap for @swamp/s3-datastore. Ships a single provisioner model that creates an S3 bucket and a least-privilege IAM managed policy, plus a workflow that runs the provisioner and then switches the current swamp repository over to the S3 datastore. ## Prerequisites - AWS credentials in the default credential chain (env / profile / role) with permissions to create the bucket, create the managed policy, and exercise the runtime actions documented in @swamp/s3-datastore. - The caller that will run swamp after setup must already hold, or will attach, the managed policy produced by this workflow. ## What it does 1. `provision` creates a private S3 bucket (versioning on, SSE-S3, public access blocked) and a scoped IAM managed policy granting the four runtime IAM actions (`ListBucket`, `GetObject`, `PutObject`, `DeleteObject`) limited to that bucket. 2. A final `command/shell` step runs `swamp datastore setup extension @swamp/s3-datastore --config ...` to flip the repo's datastore to S3. ## Running ```bash swamp extension pull @swamp/s3-datastore-bootstrap swamp model create @swamp/s3-datastore-bootstrap/provisioner \ swamp-s3-datastore-provisioner # Edit the instance so globalArguments are wired to workflow inputs: # bucket_name: ${{ inputs.bucket_name }} # region: ${{ inputs.region }} # prefix: ${{ inputs.prefix }} # policy_name: ${{ inputs.policy_name }} swamp model edit swamp-s3-datastore-provisioner # The command/shell instance used by the final workflow step swamp model create command/shell swamp-s3-datastore-setup swamp workflow run bootstrap-s3-datastore \ --input bucket_name=my-swamp-state \ --input region=us-east-1 swamp datastore status ``` See the bundled README for optional inputs (`prefix`, `policy_name`), the exact IAM policy produced, and idempotency / self-reentrancy notes.