Module provision 

AWS S3 vault provisioning (git-ark vault provision).

Automates what docs/provisioning.md / scripts/provision.sh do by hand: create the S3 bucket (Object Lock capable, versioned, SSE, public access blocked, history/ lifecycle) and a write-only IAM user scoped to s3:PutObject on the vault prefix, then mint an access key. It shells to the aws CLI so it uses the operator’s existing credentials/SSO, discovers the configured profiles, and lets the operator pick one.

AWS S3 only. The write-only guarantee relies on AWS IAM, so provisioning does not apply to MinIO, Cloudflare R2, or other S3-compatible stores — for those, create a bucket yourself and pass --bucket/--endpoint to git-ark host add.

Structs

ProvisionArgs

Inputs for vault provision, mirrored from the CLI.

Provisioned

The write-only credential the provisioned vault hands back.

Functions

lifecycle_config

The lifecycle config that expires <prefix>/ objects + noncurrent versions after days. Retention is enforced here, since the vault itself can’t delete.

parse_access_key

Extract (AccessKeyId, SecretAccessKey) from iam create-access-key JSON.

put_only_policy

The IAM inline policy: s3:PutObject and nothing else, scoped to the vault prefix. No Get/List/Delete — a compromised host can only add objects.

run

Run the full vault provision flow: banner, profile selection, account confirmation, provisioning, and the write-only key + next-step output.