Add 'integrations add aws' command (onboarding 3/3) - #7
Draft
droth-plerion wants to merge 3 commits into
Draft
Conversation
generate_token now takes Option<&str>: Some(id) keeps the existing integration-scoped behavior (aws generate-token is unchanged), None issues the bare POST that mints an onboarding token for registering a new AWS account. New typed envelope models for the three AWS endpoints; the raw subcommands keep returning serde_json::Value so their output is unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit 2c1bffa)
Library-only orchestration for end-to-end AWS account onboarding, behind an AwsApi trait so the state machine is unit-testable without AWS (aws-sdk-* types are confined to sdk.rs). Covers preflight (STS account resolution, stack conflicts, duplicate detection via IAM roles AND the tenant integration list, advisory IAM simulation tolerant of Identity Center false negatives, template validation), a short-lived registration token minted last, CreateStack with CAPABILITY_NAMED_IAM, polling with failure-event reporting, and an offline dry-run plan renderer with the AuthToken always redacted. No CLI surface change in this commit — the command lands next. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Wires the onboarding engine to a new subcommand under the integrations group. Happy path needs at most --aws-profile/--aws-region: the account is resolved via STS and confirmed interactively (--yes plus --expect-account-id for CI). --dry-run prints a fully offline plan with the AuthToken redacted; --validate-only runs all checks without deploying. Exit codes for scripting: 0 ok, 1 config/API, 2 preflight or aborted, 3 deploy failed, 4 already onboarded (--allow-existing to override) — scoped to this command via an OnboardError downcast in main.rs; every other command still exits 1. Removes the temporary dead_code allowance on the AWS models now that the binary consumes them. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 23, 2026
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
3 of 3 in the
integrations add awsseries (token plumbing → onboarding engine → this). Stacked on the engine PR — review only the last commit. Jira: PL-5466 · APPP-15.What
Wires the engine to a new subcommand under
integrations(provider-extensible:add azure|gcpcan follow). Happy path needs at most the AWS profile and region — the target account is resolved via STS and confirmed interactively;--yes+--expect-account-idfor CI.--dry-runprints the fully offline plan (the security-review artifact; AuthToken redacted),--validate-onlyruns every check without deploying.Exit codes for scripting:
0ok ·1config/API ·2preflight/aborted ·3deploy failed ·4already onboarded (--allow-existing). Implemented via anOnboardErrordowncast inmain.rs; every other command still exits 1.Testing
5 subprocess tests (
tests/cli_onboard_test.rs): offline dry-run incl. redaction assertions, flag validation, exit-code contract, help completeness. Full suite: 326 tests green, clippy clean. Binary exercised manually (dry-run output + help).Docs: README section here; docs.plerion.com page in plerionhq/docs#151.
🤖 Generated with Claude Code