Aws/adopt
Brownfield adoption of existing AWS infrastructure into swamp models. Discovers resources via native SDK calls, generates setup commands, and orchestrates import via a dependency-ordered workflow.
Authentication
Uses the default AWS credential chain. Requires appropriate IAM permissions for discovery (ReadOnly access to EC2, RDS, SecretsManager).
Quick Start
swamp extension pull @webframp/aws/adopt
swamp model create @webframp/aws/adopt my-discovery \
--global-arg region=us-east-1 --global-arg vpcId=vpc-xxx
swamp model method run my-discovery discover_all
# Follow the setup commands in the output, then:
swamp workflow run @webframp/adopt-stack --input vpcId=vpc-xxx2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.09.14.1
Changed: Bump @aws-sdk/* 3.1126.0 → 3.1131.0 (5 packages)
2026.09.04.1
Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.28.1 → 2026.09.03.1
Changed: Bump @swamp/aws/rds 2026.08.28.1 → 2026.09.02.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.28.1 → 2026.09.03.1
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1
Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
| Argument | Type | Description |
|---|---|---|
| stackName | string | CloudFormation stack name (not ARN) |
| includeNested | boolean | Recurse into AWS::CloudFormation::Stack resources |
| maxDepth | number | Nested stack recursion limit |
| prefix | string | Prefix for generated swamp model names |
Resources
Orchestrate brownfield adoption of existing AWS infrastructure. Runs get and sync on pre-created swamp models in dependency order: networking first, then database, then secrets, then verification. Models must be pre-created from discover_all output before running this workflow. The workflow references models by deterministic names derived from the prefix and resource identifiers. Resources whose IDs cannot be derived from workflow inputs (subnets, route tables, security groups) should be impor
Adopt all resources defined in a CloudFormation stack into swamp typed data, comparing the stack's resource list against live AWS state. How it works: - Job 1 runs plan_stack_adoption to enumerate stack resources (recursively into nested stacks), map them to swamp types, and produce an adoption plan. - Job 2 iterates over the plan's mapped[] resources and runs `get` on each pre-existing swamp model to refresh its live state. Steps allow failure so missing models on the first run don't fai
Check for drift on all resources adopted from a CloudFormation stack. Re-runs the adoption plan to detect stack changes, then syncs each adopted model to refresh live state. The drift report compares the previous stored state against the fresh sync to surface differences. Usage: AWS_PROFILE=my-account/ReadOnlyPlus \ swamp workflow run @webframp/adopt-drift-check \ --input modelName=my-adopt \ --input stackName=my-prod-stack
Compares stored state vs live state for adopted CloudFormation stack resources and surfaces drift
Summarizes adoption workflow results with success/failure counts, per-job breakdown, and remediation guidance
2026.09.04.1
Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.28.1 → 2026.09.03.1
Changed: Bump @swamp/aws/rds 2026.08.28.1 → 2026.09.02.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.28.1 → 2026.09.03.1
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1
Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
updated dependencies
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1
Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1
Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.20.1 → 2026.08.28.1
Changed: Bump @swamp/aws/rds 2026.08.19.1 → 2026.08.28.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.20.1 → 2026.08.28.1
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
updated dependencies
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.1
Fixed: Added missing description field to upgrade entry for version
2026.08.24.2. The omission caused swamp extension pull to fail with a catalog
validation error ("upgrades.N.description: Invalid input: expected string,
received undefined").
2026.08.24.3
Added: Output metadata attributes for observability.
durationMs: Method execution duration in milliseconds.collectedBy: Extension name that produced the data.fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.24.2
Fixed: Updated stale dependency versions in README (ec2, rds, secretsmanager now reference current manifest versions).
Added: Troubleshooting section documenting the irrelevant AWS_REGION env
var, MAX_PAGES = 5 truncation behavior, first-run orphan detection limits,
silent resource omission for missing identifiers, and CloudFormation nested
stack pagination.
2026.08.21.1
Changed: Every AWS SDK call (EC2, RDS, Secrets Manager, CloudFormation)
used to propagate its raw SDK exception with no indication of which
operation was running or what it was scoped to. Failures now name the
operation (e.g. DescribeVpcs, ListStackResources) and, where relevant,
the region, VPC ID, or stack name, while preserving the original error
message — a discovery failure now says what was being attempted instead of
surfacing a bare SDK error.
region and vpcId global arguments are now validated at model-creation
time (region must match AWS region shape, vpcId must match vpc-[a-f0-9]+)
instead of accepting any string and failing deep inside the first API call.
2026.08.20.1
Changed: Bump @aws-sdk/* 3.1111.0 → 3.1114.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.14.1 → 2026.08.20.1
Changed: Bump @swamp/aws/rds 2026.08.15.1 → 2026.08.19.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.14.1 → 2026.08.20.1
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.05.1 → 2026.08.14.1
Changed: Bump @swamp/aws/rds 2026.08.05.1 → 2026.08.15.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.05.1 → 2026.08.14.1
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.02.1 → 2026.08.05.1
Changed: Bump @swamp/aws/rds 2026.08.02.1 → 2026.08.05.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.02.1 → 2026.08.05.1
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.07.30.1 → 2026.08.02.1
Changed: Bump @swamp/aws/rds 2026.07.30.1 → 2026.08.02.1
Changed: Bump @swamp/aws/secretsmanager 2026.07.30.1 → 2026.08.02.1
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.07.27.1 → 2026.07.30.1
Changed: Bump @swamp/aws/rds 2026.07.27.1 → 2026.07.30.1
Changed: Bump @swamp/aws/secretsmanager 2026.07.27.1 → 2026.07.30.1
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
updated dependencies
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.05.1 → 2026.08.14.1
Changed: Bump @swamp/aws/rds 2026.08.05.1 → 2026.08.15.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.05.1 → 2026.08.14.1
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.02.1 → 2026.08.05.1
Changed: Bump @swamp/aws/rds 2026.08.02.1 → 2026.08.05.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.02.1 → 2026.08.05.1
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.07.30.1 → 2026.08.02.1
Changed: Bump @swamp/aws/rds 2026.07.30.1 → 2026.08.02.1
Changed: Bump @swamp/aws/secretsmanager 2026.07.30.1 → 2026.08.02.1
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.07.27.1 → 2026.07.30.1
Changed: Bump @swamp/aws/rds 2026.07.27.1 → 2026.07.30.1
Changed: Bump @swamp/aws/secretsmanager 2026.07.27.1 → 2026.07.30.1
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
updated dependencies
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.08.02.1 → 2026.08.05.1
Changed: Bump @swamp/aws/rds 2026.08.02.1 → 2026.08.05.1
Changed: Bump @swamp/aws/secretsmanager 2026.08.02.1 → 2026.08.05.1
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.07.30.1 → 2026.08.02.1
Changed: Bump @swamp/aws/rds 2026.07.30.1 → 2026.08.02.1
Changed: Bump @swamp/aws/secretsmanager 2026.07.30.1 → 2026.08.02.1
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.07.27.1 → 2026.07.30.1
Changed: Bump @swamp/aws/rds 2026.07.27.1 → 2026.07.30.1
Changed: Bump @swamp/aws/secretsmanager 2026.07.27.1 → 2026.07.30.1
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
updated dependencies
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.07.30.1 → 2026.08.02.1
Changed: Bump @swamp/aws/rds 2026.07.30.1 → 2026.08.02.1
Changed: Bump @swamp/aws/secretsmanager 2026.07.30.1 → 2026.08.02.1
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.07.27.1 → 2026.07.30.1
Changed: Bump @swamp/aws/rds 2026.07.27.1 → 2026.07.30.1
Changed: Bump @swamp/aws/secretsmanager 2026.07.27.1 → 2026.07.30.1
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
updated dependencies
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (5 packages)
Changed: Bump @swamp/aws/ec2 2026.07.27.1 → 2026.07.30.1
Changed: Bump @swamp/aws/rds 2026.07.27.1 → 2026.07.30.1
Changed: Bump @swamp/aws/secretsmanager 2026.07.27.1 → 2026.07.30.1
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
updated dependencies
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (4 packages)
Changed: Bump @swamp/aws/ec2 2026.07.20.1 → 2026.07.27.1
Changed: Bump @swamp/aws/rds 2026.07.20.1 → 2026.07.27.1
Changed: Bump @swamp/aws/secretsmanager 2026.07.20.1 → 2026.07.27.1
2026.07.26.1
Fixed: Model failed to load because the upgrades array's last toVersion
("2026.07.18.2") did not match the model's current version ("2026.07.24.1").
Swamp's model loader enforces this invariant, causing the extension to be
rejected at load time before any AWS API calls could execute. This manifested
as silent failures in ECS Fargate environments where the error was not surfaced
to the operator.
Upgrade note: Users on 2026.07.24.1 can upgrade in place. The upgrade chain now covers all published versions (2026.07.18.2 → 2026.07.24.1 → 2026.07.26.1) with no schema changes at any step.
updated dependencies
2026.07.26.1
Fixed: Model failed to load because the upgrades array's last toVersion
("2026.07.18.2") did not match the model's current version ("2026.07.24.1").
Swamp's model loader enforces this invariant, causing the extension to be
rejected at load time before any AWS API calls could execute. This manifested
as silent failures in ECS Fargate environments where the error was not surfaced
to the operator.
Upgrade note: Users on 2026.07.24.1 can upgrade in place. The upgrade chain now covers all published versions (2026.07.18.2 → 2026.07.24.1 → 2026.07.26.1) with no schema changes at any step.
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
Changed: Bump dependency pins to latest published versions:
- @swamp/aws/ec2 2026.04.03.2 → 2026.07.20.1
- @swamp/aws/rds 2026.04.23.2 → 2026.07.20.1
- @swamp/aws/secretsmanager 2026.06.15.1 → 2026.07.20.1
updated dependencies
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned