Shared buckets

Progress checklist

• Primary + replica package buckets (ps3p-pkgs-…)
• Public catalog UI bucket in Sydney (ps3p-ui-…)
• Versioning and SSE-S3 on package buckets
• Replication role + rule filtered to repos/
• Publisher role (Packages/ + pool/ Put only)
• Rebuild Lambda + ECR image + EventBridge on .rpm/.deb Put

Overview

demo.sh up-shared creates the shared account side of the lab (Docker required to build the rebuild Lambda image):

Resource	Region	Notes
ps3p-pkgs-**ACCOUNT**-syd	ap-southeast-2	Private primary; versioning + SSE-S3
ps3p-pkgs-**ACCOUNT**-akl	ap-southeast-6	Private replica; CRR target for repos/
ps3p-ui-**ACCOUNT**-syd	ap-southeast-2	Public website; syncs catalog-ui/ + seeds catalog.json
CRR role + rule repos-to-akl	—	Filter prefix repos/ only
Publisher role	—	Assumable by bypass principal; Put under …/Packages/* and …/pool/*
Rebuild Lambda (Image, 2048 MB / 300s) + ECR ps3p-rebuild	ap-southeast-2	Env: PACKAGE_BUCKET, UI_BUCKET
EventBridge rule ps3p-pkg-put-<suffix>	ap-southeast-2	Object Created for *.rpm / *.deb on primary

IDs land in .lab-state.json (gitignored). Package-bucket policies start bootstrap-open for admin, CRR, publisher, and Lambda; allowlist locks GetObject to regional gateway VPCEs later. The UI bucket stays public-read for the static site (not packages).

Close

Note

up-shared creates a lab GPG key in Secrets Manager, publishes the public key to the UI bucket and repos/gpg/lab-signing.asc, and configures the rebuild Lambda to sign repomd.xml.asc / InRelease on every package Put. See Package formats.

Steps

1. Create shared resources:

   export AWS_PROFILE=sandbox
   aws sts get-caller-identity
   ./scripts/demo.sh up-shared

   On success the script prints something like:

   rebuild Lambda ready: arn:aws:lambda:ap-southeast-2:**ACCOUNT**:function:ps3p-rebuild-<suffix>
   up-shared complete: ps3p-pkgs-**ACCOUNT**-syd → ps3p-pkgs-**ACCOUNT**-akl; ui=http://ps3p-ui-**ACCOUNT**-syd.s3-website-ap-southeast-2.amazonaws.com

2. Check state:

   ./scripts/demo.sh status

   Example shape (account id redacted; suffix is a UTC timestamp):

   {
     "suffix": "<suffix>",
     "account_id": "**ACCOUNT**",
     "name_prefix": "ps3p",
     "primary_region": "ap-southeast-2",
     "replica_region": "ap-southeast-6",
     "repos_prefix": "repos/",
     "consumers": {},
     "primary_bucket": "ps3p-pkgs-**ACCOUNT**-syd",
     "replica_bucket": "ps3p-pkgs-**ACCOUNT**-akl",
     "ui_bucket": "ps3p-ui-**ACCOUNT**-syd",
     "ui_website_url": "http://ps3p-ui-**ACCOUNT**-syd.s3-website-ap-southeast-2.amazonaws.com",
     "crr_role_arn": "arn:aws:iam::**ACCOUNT**:role/ps3p-crr-<suffix>",
     "publisher_role_arn": "arn:aws:iam::**ACCOUNT**:role/ps3p-publisher-<suffix>",
     "rebuild_lambda_role_arn": "arn:aws:iam::**ACCOUNT**:role/ps3p-rebuild-<suffix>",
     "rebuild_lambda_arn": "arn:aws:lambda:ap-southeast-2:**ACCOUNT**:function:ps3p-rebuild-<suffix>",
     "rebuild_lambda_name": "ps3p-rebuild-<suffix>",
     "ecr_repository": "ps3p-rebuild",
     "eventbridge_rule_name": "ps3p-pkg-put-<suffix>",
     "bypass_principal_arn": "arn:aws:iam::**ACCOUNT**:role/aws-reserved/sso.amazonaws.com/…/AWSReservedSSO_…"
   }

Verify

Load names from state once:

PRIMARY="$(jq -r .primary_bucket .lab-state.json)"
REPLICA="$(jq -r .replica_bucket .lab-state.json)"
UI="$(jq -r .ui_bucket .lab-state.json)"
UI_URL="$(jq -r .ui_website_url .lab-state.json)"
LAM="$(jq -r .rebuild_lambda_arn .lab-state.json)"

Primary (Sydney pkgs)

aws s3api head-bucket --bucket "$PRIMARY" --region ap-southeast-2

{ "BucketRegion": "ap-southeast-2" }

aws s3api get-bucket-versioning --bucket "$PRIMARY" --region ap-southeast-2

{ "Status": "Enabled" }

aws s3api get-bucket-replication --bucket "$PRIMARY" --region ap-southeast-2 \
  --query 'ReplicationConfiguration.Rules[0].{ID:ID,Prefix:Filter.Prefix,Status:Status}'

{ "ID": "repos-to-akl", "Prefix": "repos/", "Status": "Enabled" }

Rebuild Lambda (Sydney)

aws lambda get-function --function-name "$LAM" --region ap-southeast-2 \
  --query 'Configuration.{PackageType:PackageType,Timeout:Timeout,MemorySize:MemorySize}' --output json

{ "PackageType": "Image", "Timeout": 300, "MemorySize": 2048 }

Replica (Auckland pkgs)

aws s3api head-bucket --bucket "$REPLICA" --region ap-southeast-6

{ "BucketRegion": "ap-southeast-6" }

UI (Sydney catalog website)

aws s3api head-bucket --bucket "$UI" --region ap-southeast-2

{ "BucketRegion": "ap-southeast-2" }

aws s3api get-bucket-website --bucket "$UI" --region ap-southeast-2

{
  "IndexDocument": { "Suffix": "index.html" },
  "ErrorDocument": { "Key": "index.html" }
}

aws s3 ls "s3://${UI}/" --region ap-southeast-2

app.js  catalog.json  favicon.svg  index.html  styles.css

Close

curl -sS -o /dev/null -w "index %{http_code}\n" "${UI_URL}/"
curl -sS "${UI_URL}/catalog.json"

index 200
{"generated_at":null,"packages":[]}

Empty catalog right after up-shared (same walkthrough favicon as the docs site):

Close

Next

Consumer