putpaws 0.0.8 → 0.1.0

data/lib/putpaws/ecs/task_command.rb

@@ -1,3 +1,4 @@
+require 'socket'
 require 'aws-sdk-ecs'
 require 'aws-sdk-ssm'
 
@@ -8,18 +9,20 @@ module Putpaws::Ecs
     end
 
     attr_reader :ecs_client
-    attr_reader :region, :cluster, :task_name_prefix
+    attr_reader :region, :cluster, :service, :task_name_prefix
     attr_accessor :ecs_task
-    def initialize(region:, cluster:, task_name_prefix: nil)
+    def initialize(region:, cluster:, service: nil, task_name_prefix: nil)
       @ecs_client = Aws::ECS::Client.new({region: region})
       @region = region
       @cluster = cluster
+      @service = service
       @task_name_prefix = task_name_prefix
       @ecs_task = nil
     end
 
     def list_ecs_tasks
       res = ecs_client.list_tasks(cluster: cluster)
+      return [] if res.task_arns.empty?
       res = ecs_client.describe_tasks(tasks: res.task_arns, cluster: cluster)
       return res.tasks unless task_name_prefix
       res.tasks.select{|t| 
@@ -28,6 +31,36 @@ module Putpaws::Ecs
       }
     end
 
+    def list_ecs_services
+      res = ecs_client.list_services(cluster: cluster, max_results: 100)
+      return [] if res.service_arns.empty?
+      res = ecs_client.describe_services(cluster: cluster, services: res.service_arns)
+      services = res.services.select{|s| s.status == 'ACTIVE'}
+      return services unless task_name_prefix
+      filtered = services.select{|s| s.service_name.start_with?(task_name_prefix)}
+      filtered.empty? ? services : filtered
+    end
+
+    def update_ecs_service(service:, desired_count: nil, task_definition: nil)
+      params = {
+        cluster: cluster,
+        service: service,
+        force_new_deployment: true,
+      }
+      params[:desired_count] = desired_count.to_i if desired_count
+      params[:task_definition] = task_definition if task_definition
+      res = ecs_client.update_service(**params)
+      res.service
+    end
+
+    def wait_ecs_service_stable(service:, timeout: 600)
+      ecs_client.wait_until(
+        :services_stable,
+        {cluster: cluster, services: [service]},
+        {delay: 15, max_attempts: (timeout / 15.0).ceil}
+      )
+    end
+
     def get_session_target(container: 'app')
       raise "ECS Task Not Set" unless ecs_task
       ctn = ecs_task.containers.detect{|c| c.name == container}
@@ -36,11 +69,31 @@ module Putpaws::Ecs
       "ecs:#{cluster}_#{task_id}_#{ctn.runtime_id}"
     end
 
+    def local_port_available?(port)
+      TCPServer.new('127.0.0.1', port.to_i).close
+      true
+    rescue Errno::EADDRINUSE, Errno::EACCES
+      false
+    end
+
+    def resolve_local_port(local_port)
+      if local_port
+        unless local_port_available?(local_port)
+          raise "Local port #{local_port} is already in use"
+        end
+        local_port.to_s
+      else
+        port = (1050..1079).to_a.shuffle.detect{|p| local_port_available?(p)}
+        raise "No available local port between 1050 and 1079. Please specify one like: local=:8080" unless port
+        port.to_s
+      end
+    end
+
     def get_port_forwarding_command(container: nil, remote_port:, remote_host:, local_port: nil)
       container ||= 'app'
       target = get_session_target(container: container)
       ssm_client = Aws::SSM::Client.new({region: region})
-      local_port ||= (1050..1079).map(&:to_s).shuffle.first
+      local_port = resolve_local_port(local_port)
       puts "Starting to use local port: #{local_port}"
       res = ssm_client.start_session({
         target: target,
@@ -67,10 +120,12 @@ module Putpaws::Ecs
       build_session_manager_plugin_command(session: res.session, target: target)
     end
 
+    # Returns an argument array so that callers can spawn session-manager-plugin
+    # without a shell like `system(*cmd)`.
+    # https://github.com/aws/aws-cli/blob/2a6136010d8656a605d41d1e7b5fdab3c2930cad/awscli/customizations/ecs/executecommand.py#L105
     def build_session_manager_plugin_command(session:, target:)
       ssm_region = ENV['AWS_REGION_SSM'] || @region
 
-      # https://github.com/aws/aws-cli/blob/2a6136010d8656a605d41d1e7b5fdab3c2930cad/awscli/customizations/ecs/executecommand.py#L105
       session_json = if session.respond_to?(:session_id)
         {
           "SessionId" => session.session_id,
@@ -85,16 +140,15 @@ module Putpaws::Ecs
       target_json = {
         "Target" => target
       }.to_json
-      cmd = [
+      [
         "session-manager-plugin",
-        session_json.dump,
+        session_json,
         @region,
         "StartSession",
-        'test',
-        target_json.dump,
+        ENV['AWS_PROFILE'].to_s,
+        target_json,
         "https://ssm.#{ssm_region}.amazonaws.com"
       ]
-      cmd.join(' ')
     end
   end
 end

data/lib/putpaws/ecs/tasks/ecs_task.rake

@@ -1,15 +1,23 @@
+require "shellwords"
 require "putpaws/prompt"
 require "putpaws/ecs/task_command"
+require "putpaws/ecs/run_command"
 
 namespace :ecs do
   desc "Set ECS task."
   task :set_task do
     aws = Putpaws::Ecs::TaskCommand.config(fetch(:app))
-    ecs_tasks = aws.list_ecs_tasks.map{|t| 
+    ecs_tasks = aws.list_ecs_tasks.map{|t|
       task_id = t.task_arn.split('/').last
       task_def = t.task_definition_arn.split('/').last
-      ["#{task_id} (#{task_def}) #{t.last_status}", t]
+      label = "#{task_id} (#{task_def}) #{t.last_status}"
+      label += " [#{t.group}]" unless t.group.to_s.start_with?('family:')
+      [label, t]
     }.to_h
+    if ecs_tasks.empty?
+      raise "No running ECS tasks found on cluster: #{aws.cluster}" +
+        (aws.task_name_prefix ? " (task_name_prefix: #{aws.task_name_prefix})" : "")
+    end
     prompt = Putpaws::Prompt.safe
     selected = prompt.select("Choose a task you're going to operate", ecs_tasks.keys)
     ecs_task = ecs_tasks[selected]
@@ -23,8 +31,8 @@ namespace :ecs do
     aws = Putpaws::Ecs::TaskCommand.config(fetch(:app))
     aws.ecs_task = ecs_task
     cmd = aws.get_attach_command(container: ENV['container'])
-    puts cmd
-    system(cmd)
+    puts Shellwords.join(cmd)
+    system(*cmd)
   end
 
   desc "Run port forwarding session. You need to enable ECS Exec on a specified task and also install session-manager-plugin."
@@ -44,7 +52,106 @@ namespace :ecs do
       remote_port: remote_port,
       local_port: local_port
     )
-    puts cmd
-    system(cmd)
+    puts Shellwords.join(cmd)
+    system(*cmd)
+  end
+
+  desc "Run a command on a temporary ECS task. The task terminates itself when the command finishes. (Ex) cmd='bundle exec rake db:migrate' wait=true"
+  task :run do
+    runner = Putpaws::Ecs::RunCommand.config(fetch(:app))
+    command = ENV['cmd']
+    if command.nil? || command.strip.empty?
+      raise "Please specify a command like: cmd='bundle exec rake db:migrate'"
+    end
+
+    ecs_task = runner.run_ecs_task(
+      command: command,
+      started_by: 'putpaws-run',
+      group: 'putpaws-run',
+      container: ENV['container']
+    )
+    task_id = ecs_task.task_arn.split('/').last
+    puts "Task started: #{task_id} [putpaws-run]"
+
+    if ENV['wait']
+      puts "Waiting for the task to stop..."
+      ecs_task = runner.wait_until_stopped(ecs_task.task_arn)
+      ctn_name = ENV['container'] || runner.container_name
+      ctn = ecs_task.containers.detect{|c| c.name == ctn_name}
+      exit_code = ctn && ctn.exit_code
+      puts "Task stopped: #{ecs_task.stopped_reason}"
+      raise "Command failed with exit code: #{exit_code.inspect}" unless exit_code == 0
+      puts "Command succeeded."
+    else
+      puts "The task terminates itself when the command finishes."
+    end
+  end
+
+  desc "Update ECS service with force new deployment (redeploy). (Ex) desired=2 taskdef=my-family wait=true"
+  task :deploy do
+    aws = Putpaws::Ecs::TaskCommand.config(fetch(:app))
+    service_name = aws.service
+    if service_name.nil?
+      services = aws.list_ecs_services
+      raise "No ECS services found on cluster: #{aws.cluster}" if services.empty?
+      service_name = if services.one?
+        services.first.service_name
+      else
+        prompt = Putpaws::Prompt.safe
+        prompt.select("Choose a service to update", services.map(&:service_name))
+      end
+    end
+
+    svc = aws.update_ecs_service(
+      service: service_name,
+      desired_count: ENV['desired'],
+      task_definition: ENV['taskdef']
+    )
+    task_def = svc.task_definition.to_s.split('/').last
+    puts "Deployment started: service=#{svc.service_name} task_definition=#{task_def} desired_count=#{svc.desired_count}"
+
+    if ENV['wait']
+      puts "Waiting for the service to be stable..."
+      aws.wait_ecs_service_stable(service: service_name)
+      puts "Service is stable."
+    else
+      puts "Check progress with: bundle exec putpaws #{fetch(:app).name} log:tailf"
+    end
+  end
+
+  desc "Launch a temporary ECS task for operation and attach to it. The task terminates itself when ttl passes (default 30m). (Ex) ttl=45m keep=true"
+  task :shell do
+    runner = Putpaws::Ecs::RunCommand.config(fetch(:app))
+    ttl = Putpaws::Ecs::RunCommand.parse_ttl(ENV['ttl'])
+
+    puts "Launching a temporary task which terminates itself after #{ttl} seconds"
+    ecs_task = runner.run_ecs_task(
+      command: "sleep #{ttl}",
+      started_by: 'putpaws-shell',
+      group: 'putpaws-shell'
+    )
+    task_id = ecs_task.task_arn.split('/').last
+    puts "Task started: #{task_id} [putpaws-shell]"
+
+    begin
+      puts "Waiting for the task to be attachable..."
+      ecs_task = runner.wait_until_attachable(ecs_task.task_arn)
+
+      aws = Putpaws::Ecs::TaskCommand.new(
+        region: runner.region,
+        cluster: runner.cluster_name
+      )
+      aws.ecs_task = ecs_task
+      cmd = aws.get_attach_command(container: ENV['container'] || runner.container_name)
+      puts Shellwords.join(cmd)
+      system(*cmd)
+    ensure
+      if ENV['keep']
+        puts "Task #{task_id} keeps running and terminates itself within #{ttl} seconds."
+      else
+        runner.stop_ecs_task(ecs_task.task_arn, reason: 'Stopped by putpaws ecs:shell')
+        puts "Task #{task_id} stopped."
+      end
+    end
   end
 end

data/lib/putpaws/iam/grant_command.rb

@@ -0,0 +1,205 @@
+require 'json'
+require 'uri'
+require 'putpaws/iam/operator_config'
+
+module Putpaws
+  module Iam
+    # Resolves operator managed policies idempotently.
+    # Policy names are derived from the profile name
+    # ({service}-operator-{profile}), so re-running converges to
+    # CREATE / UPDATE (new policy version) / SKIP instead of piling up policies.
+    # The group -> IAM action mapping lives here in code: when putpaws commands
+    # evolve, the next `iam:grant` surfaces the permission diff as an UPDATE.
+    class GrantCommand
+      GROUPS = %w[attach shell deploy logs codebuild scheduler]
+
+      attr_reader :app
+      def initialize(app:, account_id: nil, iam_client: nil, sts_client: nil)
+        @app = app
+        @account_id = account_id
+        @iam_client = iam_client
+        @sts_client = sts_client
+      end
+
+      def iam_client
+        @iam_client ||= begin
+          require 'aws-sdk-iam'
+          Aws::IAM::Client.new(region: app.region)
+        end
+      end
+
+      def sts_client
+        @sts_client ||= Aws::STS::Client.new(region: app.region)
+      end
+
+      def account_id
+        @account_id ||= sts_client.get_caller_identity.account
+      end
+
+      def region
+        app.region
+      end
+
+      def cluster_arn
+        "arn:aws:ecs:#{region}:#{account_id}:cluster/#{app.cluster}"
+      end
+
+      def policy_name(profile)
+        "#{app.name}-operator-#{profile.name}"
+      end
+
+      def policy_arn(profile)
+        "arn:aws:iam::#{account_id}:policy/#{policy_name(profile)}"
+      end
+
+      def build_policy_document(profile)
+        statements = profile.groups.flat_map{|g| statements_for(g.to_s)}
+        statements += (profile.extra_statements || [])
+        {Version: '2012-10-17', Statement: statements}
+      end
+
+      def current_document(profile)
+        policy = iam_client.get_policy(policy_arn: policy_arn(profile)).policy
+        ver = iam_client.get_policy_version(
+          policy_arn: policy_arn(profile),
+          version_id: policy.default_version_id
+        )
+        JSON.parse(URI.decode_www_form_component(ver.policy_version.document))
+      rescue Aws::IAM::Errors::NoSuchEntityException
+        nil
+      end
+
+      def plan(profile)
+        current = current_document(profile)
+        return :create if current.nil?
+        desired = JSON.parse(JSON.generate(build_policy_document(profile)))
+        current == desired ? :skip : :update
+      end
+
+      def apply!(profile)
+        doc = JSON.generate(build_policy_document(profile))
+        if current_document(profile).nil?
+          iam_client.create_policy(
+            policy_name: policy_name(profile),
+            policy_document: doc,
+            description: "putpaws operator policy for #{app.name} (profile: #{profile.name})"
+          )
+        else
+          prune_versions!(profile)
+          iam_client.create_policy_version(
+            policy_arn: policy_arn(profile),
+            policy_document: doc,
+            set_as_default: true
+          )
+        end
+        policy_arn(profile)
+      end
+
+      # Managed policies keep at most 5 versions.
+      def prune_versions!(profile)
+        versions = iam_client.list_policy_versions(policy_arn: policy_arn(profile)).versions
+        return if versions.size < 5
+        oldest = versions.reject(&:is_default_version).min_by(&:create_date)
+        return unless oldest
+        iam_client.delete_policy_version(policy_arn: policy_arn(profile), version_id: oldest.version_id)
+      end
+
+      def statements_for(group)
+        case group
+        when 'attach'
+          [
+            {Sid: 'AttachListTasks', Effect: 'Allow',
+             Action: %w[ecs:ListTasks ecs:DescribeTasks],
+             Resource: '*',
+             Condition: {ArnEquals: {'ecs:cluster' => cluster_arn}}},
+            {Sid: 'AttachExec', Effect: 'Allow',
+             Action: %w[ecs:ExecuteCommand],
+             Resource: "arn:aws:ecs:#{region}:#{account_id}:task/#{app.cluster}/*"},
+            {Sid: 'AttachPortForward', Effect: 'Allow',
+             Action: %w[ssm:StartSession],
+             Resource: [
+               "arn:aws:ssm:#{region}::document/AWS-StartPortForwardingSessionToRemoteHost",
+               "arn:aws:ecs:#{region}:#{account_id}:task/#{app.cluster}/*",
+             ]},
+          ]
+        when 'shell'
+          prefix = app.task_name_prefix || app.name
+          [
+            {Sid: 'ShellRunTask', Effect: 'Allow',
+             Action: %w[ecs:RunTask ecs:StopTask],
+             Resource: [
+               "arn:aws:ecs:#{region}:#{account_id}:task-definition/#{prefix}*",
+               "arn:aws:ecs:#{region}:#{account_id}:task-definition/#{prefix}*:*",
+               "arn:aws:ecs:#{region}:#{account_id}:task/#{app.cluster}/*",
+             ]},
+            {Sid: 'ShellDescribeTasks', Effect: 'Allow',
+             Action: %w[ecs:DescribeTasks],
+             Resource: '*',
+             Condition: {ArnEquals: {'ecs:cluster' => cluster_arn}}},
+            {Sid: 'ShellExec', Effect: 'Allow',
+             Action: %w[ecs:ExecuteCommand],
+             Resource: "arn:aws:ecs:#{region}:#{account_id}:task/#{app.cluster}/*"},
+            {Sid: 'ShellPassRole', Effect: 'Allow',
+             Action: %w[iam:PassRole],
+             Resource: "arn:aws:iam::#{account_id}:role/#{app.name}-*"},
+          ]
+        when 'deploy'
+          [
+            {Sid: 'DeployListServices', Effect: 'Allow',
+             Action: %w[ecs:ListServices],
+             Resource: '*',
+             Condition: {ArnEquals: {'ecs:cluster' => cluster_arn}}},
+            {Sid: 'DeployUpdateService', Effect: 'Allow',
+             Action: %w[ecs:UpdateService ecs:DescribeServices],
+             Resource: "arn:aws:ecs:#{region}:#{account_id}:service/#{app.cluster}/#{app.service || '*'}"},
+          ]
+        when 'logs'
+          r = app.log_region || region
+          [
+            {Sid: 'LogsDescribeGroups', Effect: 'Allow',
+             Action: %w[logs:DescribeLogGroups],
+             Resource: "arn:aws:logs:#{r}:#{account_id}:log-group:*"},
+            {Sid: 'LogsRead', Effect: 'Allow',
+             Action: %w[logs:DescribeLogStreams logs:FilterLogEvents logs:GetLogEvents],
+             Resource: [
+               "arn:aws:logs:#{r}:#{account_id}:log-group:#{app.log_group_prefix}*",
+               "arn:aws:logs:#{r}:#{account_id}:log-group:#{app.log_group_prefix}*:*",
+             ]},
+          ]
+        when 'codebuild'
+          r = app.build_region || region
+          [
+            {Sid: 'BuildList', Effect: 'Allow',
+             Action: %w[codebuild:ListProjects],
+             Resource: '*'},
+            {Sid: 'BuildStart', Effect: 'Allow',
+             Action: %w[codebuild:StartBuild codebuild:StopBuild codebuild:BatchGetBuilds codebuild:BatchGetProjects],
+             Resource: "arn:aws:codebuild:#{r}:#{account_id}:project/#{app.build_project_name_prefix}*"},
+            {Sid: 'BuildLogsRead', Effect: 'Allow',
+             Action: %w[logs:DescribeLogStreams logs:FilterLogEvents logs:GetLogEvents],
+             Resource: [
+               "arn:aws:logs:#{r}:#{account_id}:log-group:#{app.build_log_group_prefix}*",
+               "arn:aws:logs:#{r}:#{account_id}:log-group:#{app.build_log_group_prefix}*:*",
+             ]},
+          ]
+        when 'scheduler'
+          scheduler_role = (app.target && app.target.scheduler_role) ||
+            "arn:aws:iam::#{account_id}:role/#{app.name}-*"
+          [
+            {Sid: 'ScheduleList', Effect: 'Allow',
+             Action: %w[scheduler:ListSchedules],
+             Resource: '*'},
+            {Sid: 'ScheduleManage', Effect: 'Allow',
+             Action: %w[scheduler:GetSchedule scheduler:CreateSchedule scheduler:UpdateSchedule],
+             Resource: "arn:aws:scheduler:#{region}:#{account_id}:schedule/default/*"},
+            {Sid: 'SchedulePassRole', Effect: 'Allow',
+             Action: %w[iam:PassRole],
+             Resource: scheduler_role},
+          ]
+        else
+          raise "Unknown group: #{group} (available: #{GROUPS.join(', ')})"
+        end
+      end
+    end
+  end
+end

data/lib/putpaws/iam/iam_task.rb

@@ -0,0 +1 @@
+load File.expand_path("../tasks/iam_task.rake", __FILE__)

data/lib/putpaws/iam/operator_config.rb

@@ -0,0 +1,46 @@
+require 'json'
+require 'pathname'
+
+module Putpaws
+  module Iam
+    # Named operator profiles declared in .putpaws/operators.json.
+    # A profile gives an organization-level name (Ex: developer, viewer)
+    # to a combination of putpaws command groups.
+    class OperatorConfig < Struct.new(:name, :groups, :extra_statements, keyword_init: true)
+      EXAMPLE = {
+        developer: {groups: %w[attach shell deploy logs codebuild]},
+        viewer: {groups: %w[logs]},
+      }
+
+      def self.path(path_prefix: '.putpaws')
+        Pathname.new(path_prefix).join('operators.json')
+      end
+
+      def self.exist?(path_prefix: '.putpaws')
+        path(path_prefix: path_prefix).exist?
+      end
+
+      def self.scaffold!(path_prefix: '.putpaws')
+        p = path(path_prefix: path_prefix)
+        File.write(p, JSON.pretty_generate(EXAMPLE) + "\n")
+        p.to_s
+      end
+
+      def self.load(path_prefix: '.putpaws')
+        p = path(path_prefix: path_prefix)
+        return {} unless p.exist?
+        JSON.parse(File.read(p), symbolize_names: true)
+      end
+
+      def self.all(path_prefix: '.putpaws')
+        load(path_prefix: path_prefix).map{|k, v|
+          new(name: k.to_s, groups: v[:groups] || [], extra_statements: v[:extra_statements] || [])
+        }
+      end
+
+      def self.find(name, path_prefix: '.putpaws')
+        all(path_prefix: path_prefix).detect{|x| x.name == name.to_s}
+      end
+    end
+  end
+end

data/lib/putpaws/iam/tasks/iam_task.rake

@@ -0,0 +1,65 @@
+require "json"
+require "fileutils"
+require "putpaws/prompt"
+require "putpaws/iam/operator_config"
+require "putpaws/iam/grant_command"
+
+namespace :iam do
+  desc "Resolve operator managed policies for this service from .putpaws/operators.json profiles. Idempotent. (Ex) profile=developer all=true"
+  task :grant do
+    app = fetch(:app)
+
+    unless Putpaws::Iam::OperatorConfig.exist?
+      path = Putpaws::Iam::OperatorConfig.scaffold!
+      puts "Generated #{path} with example profiles."
+      puts "Review and edit it, then run `putpaws #{app.name} iam:grant` again."
+      next
+    end
+
+    profiles = Putpaws::Iam::OperatorConfig.all
+    raise "No profiles defined in #{Putpaws::Iam::OperatorConfig.path}" if profiles.empty?
+
+    selected = if ENV['all']
+      profiles
+    elsif ENV['profile']
+      p = Putpaws::Iam::OperatorConfig.find(ENV['profile'])
+      raise "Profile not found: #{ENV['profile']} (available: #{profiles.map(&:name).join(', ')})" unless p
+      [p]
+    elsif profiles.one?
+      profiles
+    else
+      prompt = Putpaws::Prompt.safe
+      name = prompt.select("Choose a profile to grant", profiles.map(&:name))
+      [profiles.detect{|x| x.name == name}]
+    end
+
+    prompt = Putpaws::Prompt.safe
+    cmd = Putpaws::Iam::GrantCommand.new(app: app)
+    puts "Service: #{app.name} / Account: #{cmd.account_id} / Region: #{app.region}"
+
+    selected.each do |profile|
+      policy_name = cmd.policy_name(profile)
+      action = cmd.plan(profile)
+      if action == :skip
+        puts "SKIP     #{policy_name}"
+        next
+      end
+
+      doc = cmd.build_policy_document(profile)
+      puts ""
+      puts "=== #{action.to_s.upcase} managed policy: #{policy_name} ==="
+      puts JSON.pretty_generate(doc)
+      unless prompt.yes?("Apply this content as policy #{policy_name}?")
+        puts "Skipped #{policy_name}"
+        next
+      end
+
+      arn = cmd.apply!(profile)
+      copy_dir = File.join('.putpaws', 'provisioning', app.name, 'policies')
+      FileUtils.mkdir_p(copy_dir)
+      File.write(File.join(copy_dir, "operator-#{profile.name}.json"), JSON.pretty_generate(doc) + "\n")
+      puts "Applied: #{arn}"
+      puts "Attach example: aws iam attach-user-policy --user-name <USER> --policy-arn #{arn}"
+    end
+  end
+end

data/lib/putpaws/info.rb

@@ -0,0 +1 @@
+load File.expand_path("../tasks/info.rake", __FILE__)

data/lib/putpaws/provision/all.rb

@@ -0,0 +1,29 @@
+require 'putpaws/provision/util'
+require 'putpaws/provision/preset'
+require 'putpaws/provision/provision_config'
+require 'putpaws/provision/state'
+require 'putpaws/provision/aws_clients'
+require 'putpaws/provision/policy_generator'
+require 'putpaws/provision/config_writer'
+require 'putpaws/provision/runner'
+
+module Putpaws
+  module Provision
+    # Resolve which service to operate on: ENV['service'], the only one,
+    # or an interactive selection.
+    def self.resolve_config(path_prefix: '.putpaws')
+      name = ENV['service']
+      if Util.blank?(name)
+        services = ProvisionConfig.services(path_prefix: path_prefix)
+        raise "No provisioned service found. Please run `putpaws ready` first." if services.empty?
+        name = if services.one?
+          services.first
+        else
+          require 'putpaws/prompt'
+          Putpaws::Prompt.safe.select("Choose a service", services)
+        end
+      end
+      ProvisionConfig.load(name, path_prefix: path_prefix)
+    end
+  end
+end

data/lib/putpaws/provision/aws_clients.rb

@@ -0,0 +1,59 @@
+module Putpaws
+  module Provision
+    # Lazy client factory. Clients can be injected for testing.
+    class AwsClients
+      attr_reader :region
+      def initialize(region:, ec2: nil, ecs: nil, logs: nil, codebuild: nil, ssm: nil, iam: nil)
+        @region = region
+        @ec2 = ec2
+        @ecs = ecs
+        @logs = logs
+        @codebuild = codebuild
+        @ssm = ssm
+        @iam = iam
+      end
+
+      def iam
+        @iam ||= begin
+          require 'aws-sdk-iam'
+          Aws::IAM::Client.new(region: region)
+        end
+      end
+
+      def ec2
+        @ec2 ||= begin
+          require 'aws-sdk-ec2'
+          Aws::EC2::Client.new(region: region)
+        end
+      end
+
+      def ecs
+        @ecs ||= begin
+          require 'aws-sdk-ecs'
+          Aws::ECS::Client.new(region: region)
+        end
+      end
+
+      def logs
+        @logs ||= begin
+          require 'aws-sdk-cloudwatchlogs'
+          Aws::CloudWatchLogs::Client.new(region: region)
+        end
+      end
+
+      def codebuild
+        @codebuild ||= begin
+          require 'aws-sdk-codebuild'
+          Aws::CodeBuild::Client.new(region: region)
+        end
+      end
+
+      def ssm
+        @ssm ||= begin
+          require 'aws-sdk-ssm'
+          Aws::SSM::Client.new(region: region)
+        end
+      end
+    end
+  end
+end