Elasticache Datastore Bootstrap

One-shot bootstrap for @webframp/valkey-datastore targeting AWS ElastiCache Serverless (Valkey). Creates a serverless cache, a VPC security group for access, and a least-privilege IAM managed policy, then switches the current swamp repository to the Valkey datastore.

Prerequisites

• AWS credentials with permissions to create ElastiCache serverless caches, EC2 security groups, and IAM managed policies
• A VPC with at least one subnet (the cache is deployed into the default VPC unless overridden)

What it does

1. provision creates an ElastiCache Serverless cache (Valkey engine, TLS enabled), a security group allowing inbound on port 6379 from the caller's VPC CIDR, and a scoped IAM managed policy.
2. A final command/shell step runs swamp datastore setup extension @webframp/valkey-datastore --config ... to flip the repo's datastore to Valkey.

Running

swamp extension pull @webframp/elasticache-datastore-bootstrap

swamp model create @webframp/elasticache-datastore-bootstrap/provisioner \
  swamp-valkey-provisioner

swamp model create command/shell swamp-valkey-setup

swamp workflow run @webframp/bootstrap-elasticache-datastore \
  --input region=us-east-1

swamp datastore status

See the bundled README for optional inputs (cache_name, vpc_id, subnet_ids, policy_name) and the exact IAM policy produced.

2026.07.23.1

Added: Initial release of @webframp/elasticache-datastore-bootstrap — one-shot provisioner for AWS ElastiCache Serverless (Valkey engine) targeting @webframp/valkey-datastore.

Creates an ElastiCache Serverless cache with TLS, a VPC security group (TCP/6379 from VPC CIDR), and a least-privilege IAM managed policy, then configures the swamp repo datastore via a two-job workflow.

Fixed:

• Subnet IDs from user input are validated per-element against /^subnet-[a-f0-9]+$/ after split, preventing CLI argument injection
• key_prefix constrained to max 64 chars and safe characters only ([a-zA-Z0-9_\-:.]) — prevents shell injection via workflow template
• --policy-document values are redacted from AWS CLI error messages to avoid leaking ARNs and account IDs in logs
• waitForCacheAvailable throws immediately when cache returns null (deleted mid-wait) or enters deleting/deleted terminal state
• getDefaultVpcId throws if multiple default VPCs found, requiring explicit vpc_id
• Idempotency path waits for cache availability when re-running against a cache in creating state, preventing broken endpoint URLs
• describeServerlessCache only swallows ServerlessCacheNotFoundFault — other errors propagate correctly
• ensureSecurityGroup verifies port 6379/tcp ingress on reused security groups and adds it if missing
• getSubnetIds validates filtered subnet IDs are non-empty
• security_group_name schema rejects commas to prevent tag argument injection
• Empty cache ARN or endpoint address throws immediately instead of producing malformed output