diff --git a/docs/aws-deployment.md b/docs/aws-deployment.md
index da89673..1e4a128 100644
--- a/docs/aws-deployment.md
+++ b/docs/aws-deployment.md
@@ -36,11 +36,18 @@ RDS-managed administrator credential out of ECS:
 1. Create an AWS CloudShell VPC environment in one Terraform output `public_subnet_ids` subnet and
    attach the Terraform output `task_security_group_id`. Delete that CloudShell VPC environment
    after bootstrap. This gives the short-lived operator shell the same database network path as
-   the application without making RDS public. After entering that VPC environment, use the
-   CloudShell **Actions → Upload file** control to upload the reviewed
-   `scripts/bootstrap_database_roles.sql`; do not depend on internet access or persistent storage.
-   Compare `sha256sum scripts/bootstrap_database_roles.sql` there with the checksum from the
-   reviewed `main` checkout before executing it.
+   the application without making RDS public. CloudShell does not provide its upload/download
+   controls inside VPC environments, and this public-subnet shell has no public IP or NAT path.
+   Create the reviewed file interactively instead:
+
+   ```bash
+   mkdir -p scripts
+   nano scripts/bootstrap_database_roles.sql
+   ```
+
+   Paste the exact contents from the reviewed `main` checkout, save, and exit. Do not depend on
+   internet access or persistent storage. Compare `sha256sum scripts/bootstrap_database_roles.sql`
+   there with the checksum from the reviewed `main` checkout before executing it.
 2. In CloudShell, confirm the account and retrieve the non-secret outputs:
 
    ```bash