# Preflight and Review

> The read-only checks that run before any write, and the review step that lists what will be written.

## Preflight

Preflight is **read-only**: it reads and reports, and changes nothing. It
checks, per service:

- **Compatibility**: for example table and key schema for DynamoDB.
- **KMS posture**: what protects the source and the destination.
- **TTL** for DynamoDB: the decision each mapping needs.
- **Overlap**: source and destination must not be the same resource.
- **Credential expiry**: warn or block when credentials would expire mid-run.
- **S3 path recommendation**: Sync or Batch, from configurable thresholds.

From the CLI, `douklar sync plan` shows the plan without writing anything.

## Review

Review lists what will be written, per service, and you start one explicit
run.
Some cases need a separate, explicit consent:

- S3 Batch into a non-empty destination.
- A non-empty CodeCommit destination (this allows deleting destination-only refs).
- Replacing objects with S3 local upload.

S3 sync replaces changed objects without a separate consent, by design.
Server-side copy uses conditional writes bound to the state you reviewed.

## KMS keys

Douklar reads key posture and lets you choose a destination key by its **full
key ARN**; aliases are refused because they resolve in the writer's account.
It refuses a destination that is certainly less protected than the source,
unless you accept that per mapping. When a read is denied, the result shows
"unknown" and does not block. For a key or policy change, Douklar hands over
the exact statement for the key's owner to apply.

## DynamoDB TTL decision

Each DynamoDB mapping needs one of:

- `preserve_all`: copy every item, including ones already expired.
- `exclude_expired_at_cutoff`: leave out items that are expired at a cutoff
  recorded just before the DynamoDB phase.

The decision is bound to the TTL configuration Douklar observed. If that
configuration changes before the copy, the run refuses. Neither option
changes TTL on either table.

Source: https://douklar.app/docs/douklar/preflight-and-review (Douklar docs, last checked 2026-10-23)