Files

T

Jon Chery 3508671377 refactor(modules): remove thin-composition layer; rewrite all module READMEs

The L2 thin-composition layer (composition.json + contract_resolver.py +
contract schema + sample contracts) has been removed completely. The
implementation was unsatisfactory and is deferred for a later redesign.

- Delete: composition.json x2, contract_resolver.py, contracts/ x2,
  contract.schema.json
- Patch: run_platform.sh now loads a pre-existing IR instance instead of
  resolving a contract (the downstream adapter/checkov/confidence/outbox
  pipeline is unchanged)
- Prune: L2 entries removed from registry.json (L1 entries unchanged)
- Rewrite: all 7 L1 module READMEs in plain language (no jargon), each
  with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning
  sections derived from interface.json
- Add: 2 L2 placeholder READMEs noting the composition is under redesign
- Add: modules-ir/README.md catalog index + README-TEMPLATE.md

---ci---
project: acdl
phase: 17
milestone: v1.3
status: execute
---/ci---

2026-07-22 13:54:40 +00:00

2.1 KiB

Raw Blame History

l1-s3 — S3 bucket

Module kind: L1 primitive | Version: 1.0.0

A single S3 bucket for object storage. The simplest module — one resource, two inputs, two outputs. Versioning is enabled by default.

Resources

Resource	Type	Purpose
bucket	`aws_s3_bucket`	The S3 bucket itself

Inputs

Name	Type	Required	Default	Description
`bucket_name`	string	yes	—	Globally-unique S3 bucket name
`region`	string	yes	—	AWS region the bucket is created in

Outputs

Name	Type	Description
`bucket_arn`	arn	The S3 bucket ARN
`bucket_name`	string	The bucket name (echoes the input)

NFRs

Name	Type	Default	Description
`versioning`	boolean	true	Enable S3 versioning

Usage

{
  "id": "s3",
  "type": "aws:s3:bucket",
  "module": "l1-s3@1.0.0",
  "inputs": {
    "bucket_name": "acdl-spike-bucket",
    "region": "us-east-1"
  }
}

A concrete instance is at spike_instance.json (used by the platform pipeline as the regression baseline).

Compliance extension points

Encryption at rest — add aws_s3_bucket_server_side_encryption_configuration with a customer-managed KMS key (SOC2 CC6.1, HIPAA §164.312(a)(2)(iv), GDPR Art.32).
Object Lock — add aws_s3_bucket_object_lock_configuration in compliance mode with 7-year retention for immutable evidence (SOX §802, DORA audit trail).
Access logging — add aws_s3_bucket_logging to a target logging bucket (SOC2 CC7.2).
Public access block — add aws_s3_bucket_public_access_block to prevent data exfiltration (SOC2 CC6.1, GDPR Art.32).
Lifecycle policy — add aws_s3_bucket_lifecycle_configuration for retention enforcement (GDPR Art.5(2), HIPAA §164.530(j)).

Versioning

1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps require a new registry entry (immutable publication); old entries enter a 12-month deprecation window.

2.1 KiB Raw Blame History