Jon Chery
2a84c0047b
---ci--- project: acdl phase: 20 milestone: v1.5 status: verify ---/ci--- REQ-46: README rewritten — platform-source vs consumer-repo distinction up front; platform flow converted to mermaid flowchart TD; L3A/L3B + spike nomenclature scrubbed from prose (code paths kept verbatim); prereqs pointer to consumer guide added. REQ-47: docs/CONSUMER_GUIDE.md (generic, all L2 modules) replaces docs/consumer-guide-static-asset.md — mermaid diagrams (model LR + pipeline TD), versioned uses: (@v1.4 floating MAJOR+MINOR, bare/@main discouraged), consumer-scoped prerequisites (no Terraform/Checkov/boto3/runner-key), run- time platform fetch via reusable workflow (consumers never invoke scripts/run_platform.sh locally for the happy path), optional local validation note. REQ-48: Credentials section rewritten — zero-trust OIDC + ABAC default (repo-identity + resource-tag scoping, blast-radius containment); static-key override in GitHub Secrets or .env.secrets with platform-managed daily rotation; consumer rotates out of band when using .env.secrets locally. REQ-49: byte-identical .gitea/workflows/deploy.yml + .github/workflows/ deploy.yml — reusable (on: workflow_call), checks out consumer repo + ACDL platform repo, installs deps, runs run_platform.sh, uploads artifacts; OIDC default (permissions: id-token: write) + static-key override via secrets. REQ-50: contracts/static-asset.yaml uses: @v1.4 (MAJOR+MINOR). REQ-51: tests/test_pipeline_contract.py extended — TestDeployPipelineSchema, TestDeployPipelineContract, TestDeployWorkflowConformance (byte-identical, reusable, contract/mode inputs, run_platform invocation, platform-repo checkout, OIDC permissions), TestSampleContractVersioning. 154 tests pass (19 new); run_ci.sh green. Fixes: modules/l2/static-asset/README.md dangling link retargeted to docs/CONSUMER_GUIDE.md.
64 lines
1.8 KiB
Markdown
64 lines
1.8 KiB
Markdown
# static-asset — S3 static asset
|
|
|
|
> **Module kind:** L2 composition | **Version:** 1.0.0
|
|
|
|
A composition that references the `s3` L1 primitive to deploy a single
|
|
S3 bucket for static asset hosting.
|
|
|
|
## Resources
|
|
|
|
The composition references this L1 primitive:
|
|
|
|
| L1 module | Purpose | README |
|
|
|-----------|---------|--------|
|
|
| `s3` | S3 bucket | [README](../l1/s3/README.md) |
|
|
|
|
## Inputs
|
|
|
|
| Name | Type | Required | Description |
|
|
|------|------|----------|-------------|
|
|
| `bucket_name` | string | yes | Globally-unique S3 bucket name |
|
|
| `region` | string | yes | AWS region the bucket is created in |
|
|
|
|
## Outputs
|
|
|
|
| Name | Type | Description |
|
|
|------|------|-------------|
|
|
| `bucket_arn` | arn | The S3 bucket ARN |
|
|
| `bucket_name` | string | The bucket name (echoes the input) |
|
|
|
|
## Usage
|
|
|
|
Define a contract referencing this composition:
|
|
|
|
```yaml
|
|
uses: acdl/pipelines/deploy.yaml@v1
|
|
module: static-asset
|
|
environment: dev
|
|
inputs:
|
|
bucket_name: my-static-assets
|
|
region: us-east-1
|
|
```
|
|
|
|
See the [consumer guide](../../docs/CONSUMER_GUIDE.md) for a
|
|
step-by-step walkthrough, and the [s3 README](../l1/s3/README.md) for the
|
|
underlying L1 primitive.
|
|
|
|
## Compliance extension points
|
|
|
|
The composition can wire compliance resources when the compliance
|
|
milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:
|
|
|
|
- **KMS key** — shared encryption key for S3 SSE.
|
|
- **S3 access logs** — access logging to a separate audit bucket.
|
|
- **Object Lock** — 7-year immutable retention for evidence.
|
|
- **Public access block** — prevent data exfiltration.
|
|
|
|
See the [s3 README](../l1/s3/README.md) for per-module compliance extension
|
|
points.
|
|
|
|
## Versioning
|
|
|
|
`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
|
|
require a new registry entry (immutable publication); old entries enter
|
|
a 12-month deprecation window. |