From 9e41e29d83a57c1dc8c7fe21906eeafe02bf2b2d Mon Sep 17 00:00:00 2001 From: Jay Dreyer Date: Fri, 14 Aug 2026 11:26:04 -0500 Subject: [PATCH] Fix CloudShell VPC bootstrap instructions --- docs/aws-deployment.md | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/docs/aws-deployment.md b/docs/aws-deployment.md index da89673..1e4a128 100644 --- a/docs/aws-deployment.md +++ b/docs/aws-deployment.md @@ -36,11 +36,18 @@ RDS-managed administrator credential out of ECS: 1. Create an AWS CloudShell VPC environment in one Terraform output `public_subnet_ids` subnet and attach the Terraform output `task_security_group_id`. Delete that CloudShell VPC environment after bootstrap. This gives the short-lived operator shell the same database network path as - the application without making RDS public. After entering that VPC environment, use the - CloudShell **Actions → Upload file** control to upload the reviewed - `scripts/bootstrap_database_roles.sql`; do not depend on internet access or persistent storage. - Compare `sha256sum scripts/bootstrap_database_roles.sql` there with the checksum from the - reviewed `main` checkout before executing it. + the application without making RDS public. CloudShell does not provide its upload/download + controls inside VPC environments, and this public-subnet shell has no public IP or NAT path. + Create the reviewed file interactively instead: + + ```bash + mkdir -p scripts + nano scripts/bootstrap_database_roles.sql + ``` + + Paste the exact contents from the reviewed `main` checkout, save, and exit. Do not depend on + internet access or persistent storage. Compare `sha256sum scripts/bootstrap_database_roles.sql` + there with the checksum from the reviewed `main` checkout before executing it. 2. In CloudShell, confirm the account and retrieve the non-secret outputs: ```bash