feat(cli): db + s3 resource verbs (spec 29)

go.mod

@@ -10,6 +10,10 @@ require (
 	charm.land/lipgloss/v2 v2.0.1
 	filippo.io/age v1.3.1
 	github.com/adrg/xdg v0.5.3
+	github.com/aws/aws-sdk-go-v2 v1.42.0
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.25
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.104.1
+	github.com/aws/smithy-go v1.27.1
 	github.com/compose-spec/compose-go/v2 v2.12.1
 	github.com/go-playground/validator/v10 v10.30.3
 	github.com/goccy/go-yaml v1.19.2
@@ -31,6 +35,14 @@ require (
 	filippo.io/hpke v0.4.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.30 // indirect
 	github.com/catppuccin/go v0.2.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.2 // indirect
 	github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 // indirect

go.sum

@@ -22,6 +22,30 @@ github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
 github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
+github.com/aws/aws-sdk-go-v2 v1.42.0 h1:XvXMJTkFQtpBKIWZnmr9ZEOc2InWM2yldjXEJ/bymhA=
+github.com/aws/aws-sdk-go-v2 v1.42.0/go.mod h1:27+ACypSLljLAEKsCYOmrjKh83vuTRkuAe9Uv/3A4bg=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 h1:p1BBrg/Hhp6uK7zpejeI8QFXHJeC/mynzi04Sl03k9g=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13/go.mod h1:8cIfkE9MDhkRZGpQ22aV6/lkYeYSozpz16Smrs5x4Ls=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.25 h1:TzPVjfUZ1hsKafvYE+DIzKXIik2KufQxsPHanlkttbo=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.25/go.mod h1:K4hw0buguVvtC74HnVfTRr0LzQQHAWPqJbBU9QGk2Pg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 h1:f3vKqSo13fhTYb+JEcXwXefZQE26I1FB5eTSniU67ko=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29/go.mod h1:MzoLFUArKGpGD+ukmPiTPG1X5x4o6M2kq4v2dr1FiEc=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 h1:RdwIf/CuUsvJX3RgJagbOyotl/cxoLY4xviKuE7p2GY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29/go.mod h1:71wt8W2EgswdZy9Mf9KNnzxZ3TiZlv4caKghPktDOkA=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 h1:VTGy885W5DKBxWRUJbym9hytNaYzsyaPkCHGRRMAOhU=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30/go.mod h1:AS0HycUvJRFvTt613AYDOgO2jzw+00cVSMny8XB3yMY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 h1:ZD2+BSw9vFsNlKYIasSNt3uDbjqqXIBcM13UJv/Lx2k=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12/go.mod h1:Ms4zlcVBbXbiP7EVLhl+lgjvA/a7YphqQ3Ih3174EmI=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 h1:V51LGlOq/1VsDsHUdoklAQi7rMmx4qQubvFYAlP2254=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22/go.mod h1:4Pzhyz8hJOm2bepgl+NjvRx8vlUFAIIvJnZ/MkcNPpU=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 h1:DRebniUGZ2MqiiIVmQJ04vIXr918hubdHMnarSLEWyU=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29/go.mod h1:LfRkPCD8YHDM2E5eTkos2UpwYeZnBcVarTa8L59bJHA=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.30 h1:4HbXxyipSYxexU0juMIpdS05dilL6dbB2VQHxxN2vGU=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.30/go.mod h1:G7RP+uhagpKtKhd1BM9N6JQqjCcGEU47K5lBVZQyRQw=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.104.1 h1:yb03KevaOAG5e8suo79Af74vjIQvoeKmjl79WQchLrs=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.104.1/go.mod h1:mreYODw0Y4yv7xeczvqC6vciwFao8lPE9k1l1ulfY6E=
+github.com/aws/smithy-go v1.27.1 h1:4T340VFndXtADGF52gYa1POyL7s9E4Z1OeZ1hCscIw8=
+github.com/aws/smithy-go v1.27.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
 github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
 github.com/catppuccin/go v0.2.0 h1:ktBeIrIP42b/8FGiScP9sgrWOss3lw0Z5SktRoithGA=

internal/cli/aws.go

@@ -0,0 +1,100 @@
+package cli
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+
+	"github.com/spf13/cobra"
+
+	"github.com/open-source-cloud/devstack/internal/orchestrate"
+)
+
+// newAwsCmd wires the thin `devstack aws -- <args...>` shim (spec 29 §aws): a pure
+// argv passthrough over the user's own `aws` binary with --endpoint-url +
+// --region prepended and dev creds injected via the child ENV (never argv). It
+// never reimplements any AWS call; it just removes the endpoint/port lookup. The
+// aws binary is an external dependency — absence is a clear error, never a panic.
+func newAwsCmd(g *GlobalOpts) *cobra.Command {
+	return &cobra.Command{
+		Use:   "aws -- <args...>",
+		Short: "Run the host `aws` CLI against the local LocalStack/MinIO endpoint",
+		Long: "A thin argv shim over your own `aws` binary: devstack resolves the\n" +
+			"LocalStack/MinIO host port and prepends --endpoint-url/--region plus dev\n" +
+			"credentials (via the child environment). It does not reimplement any AWS call.\n\n" +
+			"Example: devstack aws -- s3 ls",
+		Args:               cobra.MinimumNArgs(1),
+		DisableFlagParsing: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			args = stripLeadingDashDash(args)
+			if len(args) == 0 {
+				return fmt.Errorf("usage: devstack aws -- <args...> (e.g. devstack aws -- s3 ls)")
+			}
+			awsPath, err := lookupAws()
+			if err != nil {
+				return err
+			}
+			d, closeFn, err := buildUpDeps(cmd)
+			if err != nil {
+				return err
+			}
+			defer closeFn()
+			endpoint, region, access, secret, err := orchestrate.ResolveAwsEndpoint(cmd.Context(), d)
+			if err != nil {
+				return err
+			}
+			argv := awsArgs(endpoint, region, args)
+			child := exec.CommandContext(cmd.Context(), awsPath, argv...)
+			child.Env = awsEnv(os.Environ(), access, secret, region)
+			child.Stdin = cmd.InOrStdin()
+			child.Stdout = cmd.OutOrStdout()
+			child.Stderr = cmd.ErrOrStderr()
+			if err := child.Run(); err != nil {
+				var ee *exec.ExitError
+				if errors.As(err, &ee) {
+					return fmt.Errorf("aws exited with code %d", ee.ExitCode())
+				}
+				return fmt.Errorf("run aws: %w", err)
+			}
+			return nil
+		},
+	}
+}
+
+// lookupAws resolves the host `aws` binary or returns an install remediation.
+func lookupAws() (string, error) {
+	p, err := exec.LookPath("aws")
+	if err != nil {
+		return "", fmt.Errorf("the `aws` CLI is not installed or not on PATH — install it (https://aws.amazon.com/cli/) to use `devstack aws --`")
+	}
+	return p, nil
+}
+
+// stripLeadingDashDash drops a leading "--" separator (cobra with
+// DisableFlagParsing keeps it in args).
+func stripLeadingDashDash(args []string) []string {
+	if len(args) > 0 && args[0] == "--" {
+		return args[1:]
+	}
+	return args
+}
+
+// awsArgs prepends the endpoint + region flags to the user's args (creds go in the
+// env, never argv, per spec 29 / §7.5 secret hygiene).
+func awsArgs(endpoint, region string, args []string) []string {
+	out := []string{"--endpoint-url=" + endpoint, "--region=" + region}
+	return append(out, args...)
+}
+
+// awsEnv layers the LocalStack/MinIO dev credentials over the parent environment.
+func awsEnv(parent []string, access, secret, region string) []string {
+	env := append([]string{}, parent...)
+	env = append(env,
+		"AWS_ACCESS_KEY_ID="+access,
+		"AWS_SECRET_ACCESS_KEY="+secret,
+		"AWS_DEFAULT_REGION="+region,
+		"AWS_REGION="+region,
+	)
+	return env
+}