S3 Datastore Bootstrap

One-shot bootstrap for @swamp/s3-datastore. Ships a single provisioner model that creates an S3 bucket and a least-privilege IAM managed policy, plus a workflow that runs the provisioner and then switches the current swamp repository over to the S3 datastore.

Prerequisites

• AWS credentials in the default credential chain (env / profile / role) with permissions to create the bucket, create the managed policy, and exercise the runtime actions documented in @swamp/s3-datastore.
• The caller that will run swamp after setup must already hold, or will attach, the managed policy produced by this workflow.

What it does

1. provision creates a private S3 bucket (versioning on, SSE-S3, public access blocked) and a scoped IAM managed policy granting the four runtime IAM actions (ListBucket, GetObject, PutObject, DeleteObject) limited to that bucket.
2. A final command/shell step runs swamp datastore setup extension @swamp/s3-datastore --config ... to flip the repo's datastore to S3.

Running

swamp extension pull @swamp/s3-datastore-bootstrap

swamp model create @swamp/s3-datastore-bootstrap/provisioner \
  swamp-s3-datastore-provisioner

# Edit the instance so globalArguments are wired to workflow inputs:
#   bucket_name: ${{ inputs.bucket_name }}
#   region:      ${{ inputs.region }}
#   prefix:      ${{ inputs.prefix }}
#   policy_name: ${{ inputs.policy_name }}
swamp model edit swamp-s3-datastore-provisioner

# The command/shell instance used by the final workflow step
swamp model create command/shell swamp-s3-datastore-setup

swamp workflow run bootstrap-s3-datastore \
  --input bucket_name=my-swamp-state \
  --input region=us-east-1

swamp datastore status

See the bundled README for optional inputs (prefix, policy_name), the exact IAM policy produced, and idempotency notes.