Aurora Datastore Bootstrap
One-shot bootstrap for @webframp/postgres-datastore targeting AWS Aurora Serverless v2 (PostgreSQL). Creates an Aurora cluster with a serverless writer instance, a DB subnet group, a VPC security group, and a scoped IAM managed policy for RDS IAM authentication, then switches the current swamp repository to the PostgreSQL datastore.
Prerequisites
- AWS credentials with permissions to create RDS clusters, DB subnet groups, EC2 security groups, and IAM managed policies
- A VPC with at least two subnets in different AZs
What it does
provisioncreates a DB subnet group, security group (port 5432 from VPC CIDR), Aurora Serverless v2 cluster (PostgreSQL 16, IAM auth enabled), writer instance, and a scoped IAM managed policy grantingrds-db:connect.- A final
command/shellstep runsswamp datastore setup extension @webframp/postgres-datastore --config ...to flip the repo's datastore to PostgreSQL.
Running
swamp extension pull @webframp/aurora-datastore-bootstrap
swamp model create @webframp/aurora-datastore-bootstrap/provisioner \
swamp-aurora-provisioner
swamp model create command/shell swamp-aurora-setup
swamp workflow run @webframp/bootstrap-aurora-datastore \
--input region=us-east-1 \
--input master_password=<your-password>
swamp datastore statusSee the bundled README for optional inputs and idempotency notes.
2026.08.28.1
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.27.1
Changed: Test suite now builds its method context from the shared
createModelTestContext factory in @systeminit/swamp-testing instead of a
hand-rolled context, wrapping writeResource to preserve the existing assertion
API. No behavioral, schema, or method changes — the published provisioner is
unchanged. The deno.json gains a dev-only @systeminit/swamp-testing
import-map entry and its check task now type-checks the test file.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
Resources
Provision an Aurora Serverless v2 (PostgreSQL) cluster with networking and IAM policy for @webframp/postgres-datastore, then switch the current repo to use PostgreSQL.
2026.08.27.1
Changed: Test suite now builds its method context from the shared
createModelTestContext factory in @systeminit/swamp-testing instead of a
hand-rolled context, wrapping writeResource to preserve the existing assertion
API. No behavioral, schema, or method changes — the published provisioner is
unchanged. The deno.json gains a dev-only @systeminit/swamp-testing
import-map entry and its check task now type-checks the test file.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.1
Changed: Normalized deno.json configuration for repo-wide consistency:
added explicit compilerOptions.strict and migrated zod dependency to the
import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No
behavioral changes — runtime resolution is identical.
2026.08.24.1
Added: Output metadata attributes for observability.
durationMs: Method execution duration in milliseconds.collectedBy: Extension name that produced the data.fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.23.1
Changed: Documentation only — no code changes. Added a ## Troubleshooting
section covering the missing-default-VPC error, the "need 2+ subnets" check in
getSubnetIds, the 600s/15s cluster-available timeout, and a real gotcha found
while reading the code: the provisioner only waits for the cluster to reach
available, never the writer instance, so connections can fail immediately
post-bootstrap. Also documents the rds-db:connect policy being scoped only to
master_username.
2026.08.21.1
Changed: subnet_ids is now validated as a comma-separated list of
subnet-[a-f0-9]+ IDs at model-creation time, instead of accepting any string
and letting a malformed value fail deep inside the AWS CLI call with an opaque
error.
max_acu must now be greater than or equal to min_acu. Previously an inverted
range (e.g. max_acu=2 with min_acu=4) was accepted and passed straight
through to create-db-cluster, which rejects it with a generic RDS validation
error that doesn't identify which argument was wrong.
2026.08.02.1
Fixed: The configure job in @webframp/bootstrap-aurora-datastore failed
with Invalid expression: No such key: attributes. The workflow queried
data.latest("swamp-aurora-provisioner", "state"), but the provisioner writes
its resource under the instance name "main" (via
writeResource("state", "main", ...)) — data.latest()'s second argument
matches the resource's instance name, not its spec name. The configure job now
queries data.latest("swamp-aurora-provisioner", "main"), which resolves
correctly.
Added: The provisioner now writes an optional datastoreConfig field (JSON
string of {connectionString, ssl}), matching the pattern used by the other
datastore bootstrap extensions. The existing connectionString field is
unchanged. The field is optional so resources written by prior versions remain
readable.
Changed: The run-setup step now passes the provisioner's datastoreConfig
through a DATASTORE_CONFIG environment variable instead of building the config
JSON inline inside a single-quoted shell string. The prior pattern embedded the
connection string (which includes the URL-encoded master password) directly into
both a JSON literal and a shell single-quoted argument, so a password containing
a single quote or double quote could corrupt the command or the JSON payload.
Upgrade note: If you provisioned with a prior version, your stored resource
predates the datastoreConfig field. Re-run the infra job (or the whole
workflow) once after upgrading so provision rewrites the resource with
datastoreConfig populated — otherwise the configure job's run-setup step
will receive an empty DATASTORE_CONFIG.
2026.07.27.1
Fixed: The fmt task ran deno fmt --check, so deno task fmt verified
formatting instead of applying it and there was no way to format the extension
through its own task. fmt now formats and a new fmt:check verifies, matching
every other extension in the repository.
Changed: Reformatted files that had drifted from deno fmt. No code
behavior changes.
Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files
are gitignored and never present in CI, but deno fmt does not read .gitignore,
so deno task fmt:check could fail locally on a file CI does not have.
Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned