Preflight and Review
The read-only checks that run before any write, and the review step that lists what will be written.
Preflight
Preflight is read-only: it reads and reports, and changes nothing. It checks, per service:
- Compatibility: for example table and key schema for DynamoDB.
- KMS posture: what protects the source and the destination.
- TTL for DynamoDB: the decision each mapping needs.
- Overlap: source and destination must not be the same resource.
- Credential expiry: warn or block when credentials would expire mid-run.
- S3 path recommendation: Sync or Batch, from configurable thresholds.
From the CLI, douklar sync plan shows the plan without writing anything.
Review
Review lists what will be written, per service, and you start one explicit run. Some cases need a separate, explicit consent:
- S3 Batch into a non-empty destination.
- A non-empty CodeCommit destination (this allows deleting destination-only refs).
- Replacing objects with S3 local upload.
S3 sync replaces changed objects without a separate consent, by design. Server-side copy uses conditional writes bound to the state you reviewed.
KMS keys
Douklar reads key posture and lets you choose a destination key by its full key ARN; aliases are refused because they resolve in the writer's account. It refuses a destination that is certainly less protected than the source, unless you accept that per mapping. When a read is denied, the result shows "unknown" and does not block. For a key or policy change, Douklar hands over the exact statement for the key's owner to apply.
DynamoDB TTL decision
Each DynamoDB mapping needs one of:
preserve_all: copy every item, including ones already expired.exclude_expired_at_cutoff: leave out items that are expired at a cutoff recorded just before the DynamoDB phase.
The decision is bound to the TTL configuration Douklar observed. If that configuration changes before the copy, the run refuses. Neither option changes TTL on either table.