Prerequisites

Progress checklist

• AWS CLI v2 installed and logged in
• jq installed
• Docker available (build rebuild Lambda image)
• Shared account profile (docs use sandbox)
• Opted into ap-southeast-6 if needed

Overview

Everything goes through ./scripts/demo.sh. You need permission to create S3 buckets, IAM roles, VPC endpoints, Lambda/ECR, and (for prove) EC2 + SSM. Each Region gets two probe AMIs: Amazon Linux 2023 and Ubuntu 24.04.

AWS CLI and Region

Install AWS CLI v2 if you do not have it yet.

macOS

brew install awscli
# already installed:
brew upgrade awscli

Linux

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
# already installed:
sudo ./aws/install --update

Check the version and that credentials work:

aws --version
aws sts get-caller-identity

Primary Region is ap-southeast-2 (Sydney). Replica is ap-southeast-6 (Auckland). Your credentials need S3, IAM, and EC2 in both.

jq

demo.sh uses jq for state and policy JSON. Install it if you need to:

macOS

brew install jq

Linux

# Fedora / RHEL
sudo dnf install jq
# Debian / Ubuntu
sudo apt install jq

Check the version:

jq --version

Docker

Docker is required for up-shared: it builds and pushes the rebuild Lambda image to ECR. Index rebuild always runs in that Lambda — there is no laptop fallback.

Install Docker if you do not have it yet.

macOS

brew install --cask docker
# then launch Docker Desktop once so the daemon starts
open -a Docker

Linux

# Fedora / RHEL
sudo dnf install docker
sudo systemctl enable --now docker
# Debian / Ubuntu
sudo apt install docker.io
sudo systemctl enable --now docker
# run docker without sudo (log out/in after):
sudo usermod -aG docker "$USER"

Check the daemon is running:

docker version

Note

Without Docker, up-shared fails before the Lambda is wired, and publish cannot rebuild indexes.

Environment

export AWS_PROFILE=sandbox

That is enough. demo.sh picks the Region per command (and passes --region explicitly), so a leftover AWS_REGION in your shell will not send Auckland calls to Sydney.

up-consumer builds its own private VPC. You do not pass a VPC or subnet ID.

Next

Shared buckets