How Douklar writes to AWS
The rules the code follows when it writes, the list of every write it can make, and how it handles keys and credentials.
The rules
- It never deletes your AWS data.No code path calls an AWS Delete, Remove, Terminate, Purge, Deregister or Abort operation. The only exception cancels an incomplete multipart upload that Douklar started itself.
- Your source is only read.Douklar never writes source objects, images, refs or items, and never changes source configuration. When the source needs a change, it shows the exact statement for that account’s admin.
- You own data-protection settings.Legal holds, Object Lock, retention and deletion protection are never set, copied, removed or bypassed. Read-only checks may report them.
- It never creates resources on its own.The one exception is S3 Batch “Prepare”: a support bucket, role and policy in the destination account, created only after you confirm the listed writes.
- Copies add, they don’t remove.S3 sync never deletes destination extras and DynamoDB only inserts missing items. A changed S3 object or a moved ECR tag can replace what the destination holds under the same name.
- One consented delete.CodeCommit can remove destination-only branches and tags, and only after you allow overwrite of a non-empty destination.
Every write it can make
11 kinds of write, in two groups.
Normal sync writes
Source-derived content copied into existing destinations that you chose.
| Service | Write | How |
|---|---|---|
| ECR | Tag copy | oras cp --recursive into an existing repository, user-approved tag only |
| S3 | Relay upload | upload_file from worker staging (pinned paths) |
| DynamoDB | Seeding | PutItem insert-only (attribute_not_exists) |
| CodeCommit | Push | Git push to an existing repository |
Other writes
Each one is triggered by an action you take in the console.
| Service | Write | How |
|---|---|---|
| Credentials | SSO credential issuance and renewal | RegisterClient, StartDeviceAuthorization, CreateToken, optional STS AssumeRole (credentials only) |
| S3 | S3 Batch preparation | CreateBucket, CreateRole, PutRolePolicy in the destination account; never a source policy |
| S3 | S3 Batch run and monitor | PutObject (manifest), CreateJob (job tagged ManagedBy=douklar, never user objects), UpdateJobStatus (cancel, or Ready only on explicit Start) |
| CodeCommit | Reconcile after consent | git push --mirror or incremental pushes, plus deletes of destination-only refs |
| S3 | Server-side copy | Conditional CopyObject, multipart copy parts, conditional complete; abort of its own upload |
| S3 | Local-file upload | Presigned PutObject or multipart, condition-bound; abort of its own upload |
| S3 | Log delivery | PutObject under the admin-named bucket and prefix, IfNoneMatch |
KMS keys
- Never creates, edits, grants on or deletes KMS keys, key policies, grants, aliases or IAM policies.
- Reads key posture and lets you choose a destination key by full ARN; aliases are refused because they resolve in the writer’s account.
- Refuses a destination that is certainly less protected than the source, unless you accept it per mapping.
- Denied reads show “unknown” and never block; missing permissions are handed over as exact statements.
Credentials and secrets
- Static keys and SSO sessions are encrypted at rest in the app’s credential store.
- Host or container ambient AWS credentials are never used as a fallback.
- Logs and errors redact bearer and basic auth, cookies, session ids and presigned URL signatures.
- Commands run without a shell, from an executable allowlist (aws, git, oras), by absolute path.