alchemy 2.0.0-beta.64 → 2.0.0-beta.66

package/src/AWS/SageMaker/ComputeQuota.ts

@@ -0,0 +1,426 @@
+import * as sagemaker from "@distilled.cloud/aws/sagemaker";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as EffectStream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import {
+  createInternalTags,
+  diffTags,
+  hasAlchemyTags,
+  type Tags,
+} from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface ComputeQuotaProps {
+  /**
+   * Name of the compute allocation. Maximum 63 characters, alphanumeric and
+   * hyphens.
+   * @default ${app}-${stage}-${id}
+   */
+  name?: string;
+  /**
+   * ARN of the EKS-orchestrated HyperPod cluster the allocation applies to.
+   * Changing the cluster replaces the allocation.
+   */
+  clusterArn: string;
+  /**
+   * The team the quota is allocated to (its name maps to a Kubernetes
+   * namespace `hyperpod-ns-<team-name>`) and its fair-share weight.
+   */
+  computeQuotaTarget: sagemaker.ComputeQuotaTarget;
+  /**
+   * The allocation itself: instance-type quotas, the resource-sharing
+   * strategy for idle compute, and whether the team's own tasks can preempt
+   * each other.
+   */
+  computeQuotaConfig?: sagemaker.ComputeQuotaConfig;
+  /**
+   * Whether the quota is enforced.
+   * @default "Enabled"
+   */
+  activationState?: sagemaker.ActivationState;
+  /**
+   * A description of the compute allocation.
+   */
+  description?: string;
+  /**
+   * Tags to associate with the compute allocation. Merged with internal
+   * Alchemy tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface ComputeQuota extends Resource<
+  "AWS.SageMaker.ComputeQuota",
+  ComputeQuotaProps,
+  {
+    /**
+     * The compute allocation's ID.
+     */
+    computeQuotaId: string;
+    /**
+     * ARN of the compute allocation.
+     */
+    computeQuotaArn: string;
+    /**
+     * The compute allocation's name.
+     */
+    name: string;
+    /**
+     * ARN of the HyperPod cluster the allocation applies to.
+     */
+    clusterArn: string;
+    /**
+     * The allocation's current version (incremented on every update).
+     */
+    computeQuotaVersion: number;
+    /**
+     * The team the quota is allocated to. Task governance materializes the
+     * `hyperpod-ns-<teamName>` namespace and its Kueue LocalQueue from it.
+     */
+    teamName: string;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A SageMaker HyperPod compute allocation (task governance) — reserves
+ * instance capacity on an EKS-orchestrated HyperPod cluster for a team,
+ * with fair-share weights and borrow/lend rules for idle compute.
+ * @resource
+ * @section Creating Compute Allocations
+ * @example Team Quota with Borrowing
+ * ```typescript
+ * import * as AWS from "alchemy/AWS";
+ *
+ * const quota = yield* AWS.SageMaker.ComputeQuota("ResearchQuota", {
+ *   clusterArn: hyperpod.clusterArn,
+ *   computeQuotaTarget: { TeamName: "research", FairShareWeight: 10 },
+ *   computeQuotaConfig: {
+ *     ComputeQuotaResources: [{ InstanceType: "ml.g5.xlarge", Count: 2 }],
+ *     ResourceSharingConfig: { Strategy: "Lend", BorrowLimit: 50 },
+ *   },
+ * });
+ * ```
+ */
+export const ComputeQuota = Resource<ComputeQuota>(
+  "AWS.SageMaker.ComputeQuota",
+);
+
+const createQuotaName = (id: string, props: { name?: string | undefined }) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 63 });
+
+const describeQuotaOrUndefined = (quotaId: string) =>
+  sagemaker
+    .describeComputeQuota({ ComputeQuotaId: quotaId })
+    .pipe(Effect.catchTag("ResourceNotFound", () => Effect.succeed(undefined)));
+
+/**
+ * Look a compute allocation up by exact name — used when state was lost
+ * (read without output) or a create raced.
+ */
+const findQuotaByName = Effect.fn(function* (name: string) {
+  const summaries = yield* sagemaker.listComputeQuotas
+    .pages({ NameContains: name })
+    .pipe(
+      EffectStream.runCollect,
+      Effect.map((chunk) =>
+        Array.from(chunk).flatMap((page) => page.ComputeQuotaSummaries ?? []),
+      ),
+    );
+  return summaries.find((s) => s.Name === name && s.Status !== "Deleted");
+});
+
+const fetchQuotaTags = Effect.fn(function* (arn: string) {
+  const response = yield* sagemaker
+    .listTags({ ResourceArn: arn })
+    .pipe(
+      Effect.catchTag("AccessDeniedException", () => Effect.succeed(undefined)),
+    );
+  return Object.fromEntries(
+    (response?.Tags ?? []).flatMap((tag) =>
+      tag.Key !== undefined ? [[tag.Key, tag.Value ?? ""]] : [],
+    ),
+  );
+});
+
+const toAttrs = (
+  described: sagemaker.DescribeComputeQuotaResponse,
+): ComputeQuota["Attributes"] => ({
+  computeQuotaId: described.ComputeQuotaId,
+  computeQuotaArn: described.ComputeQuotaArn,
+  name: described.Name,
+  clusterArn: described.ClusterArn ?? "",
+  computeQuotaVersion: described.ComputeQuotaVersion,
+  teamName: described.ComputeQuotaTarget?.TeamName ?? "",
+});
+
+/**
+ * The compute allocation is still transitioning toward the awaited state —
+ * retried by the bounded wait schedule.
+ */
+class ComputeQuotaNotReady extends Data.TaggedError("ComputeQuotaNotReady")<{
+  readonly quotaId: string;
+  readonly status: string | undefined;
+}> {}
+
+/**
+ * The compute allocation converged to a terminal failed status.
+ */
+export class ComputeQuotaFailed extends Data.TaggedError("ComputeQuotaFailed")<{
+  readonly quotaId: string;
+  readonly status: string | undefined;
+  readonly message: string | undefined;
+}> {}
+
+const FAILED_STATUSES: string[] = [
+  "CreateFailed",
+  "CreateRollbackFailed",
+  "UpdateFailed",
+  "UpdateRollbackFailed",
+  "DeleteFailed",
+  "DeleteRollbackFailed",
+];
+
+// Explicitly-typed retry wrapper — an inline `Effect.retry` in provider
+// lifecycle code leaks `Retry.Return`'s conditional type into declaration
+// emit and widens the provider layer to `unknown` for every consumer of
+// `AWS.providers()`.
+const retryWhileNotReady = <A, E extends { readonly _tag: string }, R>(
+  self: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R> =>
+  Effect.retry(self, {
+    while: (e) => e._tag === "ComputeQuotaNotReady",
+    schedule: Schedule.max([Schedule.spaced("5 seconds"), Schedule.recurs(60)]),
+  });
+
+const waitForQuota = (quotaId: string, target: "Ready" | "Gone") =>
+  retryWhileNotReady(
+    Effect.gen(function* () {
+      const described = yield* describeQuotaOrUndefined(quotaId);
+      if (target === "Gone") {
+        if (described === undefined || described.Status === "Deleted") return;
+        if (FAILED_STATUSES.includes(described.Status)) {
+          return yield* Effect.fail(
+            new ComputeQuotaFailed({
+              quotaId,
+              status: described.Status,
+              message: described.FailureReason,
+            }),
+          );
+        }
+        return yield* Effect.fail(
+          new ComputeQuotaNotReady({ quotaId, status: described.Status }),
+        );
+      }
+      if (described?.Status === "Created" || described?.Status === "Updated") {
+        return;
+      }
+      if (
+        described !== undefined &&
+        FAILED_STATUSES.includes(described.Status)
+      ) {
+        return yield* Effect.fail(
+          new ComputeQuotaFailed({
+            quotaId,
+            status: described.Status,
+            message: described.FailureReason,
+          }),
+        );
+      }
+      return yield* Effect.fail(
+        new ComputeQuotaNotReady({ quotaId, status: described?.Status }),
+      );
+    }),
+  );
+
+export const ComputeQuotaProvider = () =>
+  Provider.effect(
+    ComputeQuota,
+    Effect.gen(function* () {
+      return {
+        stables: ["computeQuotaId", "computeQuotaArn", "name", "clusterArn"],
+        list: () =>
+          Effect.gen(function* () {
+            const summaries = yield* sagemaker.listComputeQuotas.pages({}).pipe(
+              EffectStream.runCollect,
+              Effect.map((chunk) =>
+                Array.from(chunk).flatMap(
+                  (page) => page.ComputeQuotaSummaries ?? [],
+                ),
+              ),
+            );
+            return summaries.flatMap((s) =>
+              s.ComputeQuotaId !== undefined && s.Status !== "Deleted"
+                ? [
+                    {
+                      computeQuotaId: s.ComputeQuotaId,
+                      computeQuotaArn: s.ComputeQuotaArn ?? "",
+                      name: s.Name ?? "",
+                      clusterArn: s.ClusterArn ?? "",
+                      computeQuotaVersion: s.ComputeQuotaVersion ?? 1,
+                      teamName: s.ComputeQuotaTarget?.TeamName ?? "",
+                    },
+                  ]
+                : [],
+            );
+          }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const quotaId =
+            output?.computeQuotaId ??
+            (yield* findQuotaByName(yield* createQuotaName(id, olds ?? {})))
+              ?.ComputeQuotaId;
+          if (quotaId === undefined) return undefined;
+          const described = yield* describeQuotaOrUndefined(quotaId);
+          if (
+            !described ||
+            described.Status === "Deleting" ||
+            described.Status === "Deleted"
+          ) {
+            return undefined;
+          }
+          const attrs = toAttrs(described);
+          const tags = yield* fetchQuotaTags(attrs.computeQuotaArn);
+          return (yield* hasAlchemyTags(id, tags as Tags))
+            ? attrs
+            : Unowned(attrs);
+        }),
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return;
+          if (olds === undefined) return;
+          const oldName = yield* createQuotaName(id, olds);
+          const newName = yield* createQuotaName(id, news);
+          // The name and target cluster are fixed at creation.
+          if (oldName !== newName || olds.clusterArn !== news.clusterArn) {
+            return { action: "replace" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          if (!news) {
+            return yield* Effect.fail(
+              new Error("SageMaker ComputeQuota requires props"),
+            );
+          }
+          const name = yield* createQuotaName(id, news);
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — by cached id first, then by name (lost state or race).
+          let quotaId = output?.computeQuotaId;
+          let described =
+            quotaId !== undefined
+              ? yield* describeQuotaOrUndefined(quotaId)
+              : undefined;
+          if (described === undefined) {
+            const found = yield* findQuotaByName(name);
+            described =
+              found?.ComputeQuotaId !== undefined
+                ? yield* describeQuotaOrUndefined(found.ComputeQuotaId)
+                : undefined;
+          }
+
+          // Ensure — create if missing; a Conflict means a concurrent
+          // create won the race, so re-observe by name.
+          if (described === undefined) {
+            const created = yield* sagemaker
+              .createComputeQuota({
+                Name: name,
+                ClusterArn: news.clusterArn,
+                ComputeQuotaConfig: news.computeQuotaConfig,
+                ComputeQuotaTarget: news.computeQuotaTarget,
+                ActivationState: news.activationState,
+                Description: news.description,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag("ConflictException", () =>
+                  Effect.succeed(undefined),
+                ),
+              );
+            quotaId =
+              created?.ComputeQuotaId ??
+              (yield* findQuotaByName(name))?.ComputeQuotaId;
+            if (quotaId === undefined) {
+              return yield* Effect.fail(
+                new Error(`failed to create compute quota ${name}`),
+              );
+            }
+            yield* session.note(`Creating compute quota ${name}...`);
+            yield* waitForQuota(quotaId, "Ready");
+          } else {
+            quotaId = described.ComputeQuotaId;
+            // Wait out any in-flight transition before diffing.
+            yield* waitForQuota(quotaId, "Ready");
+            described = yield* describeQuotaOrUndefined(quotaId);
+            // Sync — diff observed allocation against desired.
+            if (
+              described !== undefined &&
+              (JSON.stringify(described.ComputeQuotaConfig) !==
+                JSON.stringify(news.computeQuotaConfig) ||
+                JSON.stringify(described.ComputeQuotaTarget) !==
+                  JSON.stringify(news.computeQuotaTarget) ||
+                (news.activationState !== undefined &&
+                  described.ActivationState !== news.activationState) ||
+                (described.Description ?? undefined) !==
+                  (news.description ?? undefined))
+            ) {
+              yield* sagemaker.updateComputeQuota({
+                ComputeQuotaId: quotaId,
+                TargetVersion: described.ComputeQuotaVersion,
+                ComputeQuotaConfig: news.computeQuotaConfig,
+                ComputeQuotaTarget: news.computeQuotaTarget,
+                ActivationState: news.activationState,
+                Description: news.description,
+              });
+              yield* session.note(`Updating compute quota ${name}...`);
+              yield* waitForQuota(quotaId, "Ready");
+            }
+          }
+
+          described = yield* describeQuotaOrUndefined(quotaId);
+          if (described === undefined) {
+            return yield* Effect.fail(
+              new Error(`failed to read reconciled compute quota ${name}`),
+            );
+          }
+          const attrs = toAttrs(described);
+
+          // Sync tags — diff against OBSERVED cloud tags.
+          const currentTags = yield* fetchQuotaTags(attrs.computeQuotaArn);
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* sagemaker.deleteTags({
+              ResourceArn: attrs.computeQuotaArn,
+              TagKeys: removed,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* sagemaker.addTags({
+              ResourceArn: attrs.computeQuotaArn,
+              Tags: upsert.map(({ Key, Value }) => ({ Key, Value })),
+            });
+          }
+
+          yield* session.note(attrs.computeQuotaArn);
+          return attrs;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* sagemaker
+            .deleteComputeQuota({ ComputeQuotaId: output.computeQuotaId })
+            .pipe(Effect.catchTag("ResourceNotFound", () => Effect.void));
+          yield* waitForQuota(output.computeQuotaId, "Gone");
+        }),
+      };
+    }),
+  );

package/src/AWS/SageMaker/index.ts

@@ -1,5 +1,8 @@
 export * from "./BatchGetRecord.ts";
 export * from "./BatchGetRecordHttp.ts";
+export * from "./Cluster.ts";
+export * from "./ClusterSchedulerConfig.ts";
+export * from "./ComputeQuota.ts";
 export * from "./BatchWriteRecord.ts";
 export * from "./BatchWriteRecordHttp.ts";
 export * from "./DeleteRecord.ts";

package/src/AWS/StateStore/State.ts

@@ -25,6 +25,7 @@ import {
   Default as DefaultEnvironment,
 } from "../Environment.ts";
 import * as AwsRegion from "../Region.ts";
+import type { BucketEncryption } from "../S3/Bucket.ts";
 
 /**
  * The bookkeeping object that stores a stack's resolved output. Lives
@@ -55,6 +56,12 @@ export interface S3StateOptions {
    * @default "" (bucket root)
    */
   prefix?: string;
+  /**
+   * Default encryption enforced on the state bucket.
+   *
+   * @default `{ sseAlgorithm: "AES256" }`
+   */
+  encryption?: BucketEncryption;
 }
 
 /** Context required by the distilled S3 operations. */
@@ -107,6 +114,10 @@ type S3Deps = Credentials | HttpClient | Region;
  *     state: AWS.state({
  *       bucketName: "my-company-state",
  *       prefix: "alchemy",
+ *       encryption: {
+ *         sseAlgorithm: "aws:kms",
+ *         kmsMasterKeyId: "alias/alchemy-state",
+ *       },
  *     }),
  *   },
  *   Effect.gen(function* () {
@@ -175,7 +186,7 @@ export const makeS3State = (options: S3StateOptions = {}) =>
         const { accountId, region } = yield* AWSEnvironment.current;
         const bucketName =
           options.bucketName ?? createStateBucketName(accountId, region);
-        yield* ensureStateBucket(bucketName, region);
+        yield* ensureStateBucket(bucketName, region, options);
         return bucketName;
       }).pipe(Effect.provideContext(context), Effect.mapError(toError)),
     );
@@ -357,7 +368,11 @@ export const createStateBucketName = (accountId: string, region: string) =>
  * Observe-then-ensure the state bucket: head it, create it if missing
  * (tolerating create races), and wait for it to become available.
  */
-const ensureStateBucket = (bucket: string, region: string) =>
+const ensureStateBucket = (
+  bucket: string,
+  region: string,
+  options: S3StateOptions,
+) =>
   Effect.gen(function* () {
     // An absent bucket surfaces as either `NotFound` (the HEAD 404) or
     // `NoSuchBucket` depending on the namespace/path — treat both as "create
@@ -369,56 +384,158 @@ const ensureStateBucket = (bucket: string, region: string) =>
         Effect.succeed(false),
       ),
     );
-    if (exists) {
-      return;
+    if (!exists) {
+      yield* Effect.logInfo(
+        `S3 state store: creating bucket ${bucket} in ${region}`,
+      );
+      yield* s3
+        .createBucket({
+          Bucket: bucket,
+          // account-regional namespace: the bucket name only needs to be
+          // unique within this account+region, so deterministic default
+          // names can't collide with other AWS customers.
+          BucketNamespace: "account-regional",
+          // us-east-1 rejects an explicit LocationConstraint
+          ...(region === "us-east-1"
+            ? {}
+            : {
+                CreateBucketConfiguration: {
+                  LocationConstraint: region as s3.BucketLocationConstraint,
+                },
+              }),
+        })
+        .pipe(
+          // Many callers race to create the shared default state bucket on
+          // first use. The loser sees the create already done
+          // (`BucketAlreadyOwnedByYou`/`BucketAlreadyExists`) or mid-flight
+          // (`OperationAborted`). All mean "someone else is creating it".
+          Effect.catchTag(
+            [
+              "BucketAlreadyOwnedByYou",
+              "BucketAlreadyExists",
+              "OperationAborted",
+            ],
+            () => Effect.void,
+          ),
+        );
+
+      // Wait for the bucket to become available. Under a concurrent create
+      // the bucket is briefly not yet head-able and object/configuration ops
+      // would race ahead of it.
+      yield* s3.headBucket({ Bucket: bucket }).pipe(
+        Effect.retry({
+          while: (error) =>
+            error._tag === "NotFound" || error._tag === "NoSuchBucket",
+          schedule: Schedule.max([
+            Schedule.spaced("1 second"),
+            Schedule.recurs(10),
+          ]),
+        }),
+      );
     }
 
-    yield* Effect.logInfo(
-      `S3 state store: creating bucket ${bucket} in ${region}`,
-    );
-    yield* s3
-      .createBucket({
+    // Secure defaults are reconciled for BOTH newly-created and existing
+    // buckets. This makes AWS.state converge out-of-band drift and explicit
+    // custom buckets rather than only securing the greenfield path.
+    const desiredVersioning = "Enabled";
+    const observedVersioning = yield* s3.getBucketVersioning({
+      Bucket: bucket,
+    });
+    if (observedVersioning.Status !== desiredVersioning) {
+      yield* s3.putBucketVersioning({
         Bucket: bucket,
-        // account-regional namespace: the bucket name only needs to be
-        // unique within this account+region, so deterministic default
-        // names can't collide with other AWS customers.
-        BucketNamespace: "account-regional",
-        // us-east-1 rejects an explicit LocationConstraint
-        ...(region === "us-east-1"
-          ? {}
-          : {
-              CreateBucketConfiguration: {
-                LocationConstraint: region as s3.BucketLocationConstraint,
-              },
-            }),
-      })
+        VersioningConfiguration: { Status: desiredVersioning },
+      });
+    }
+
+    const desiredEncryption = options.encryption ?? {
+      sseAlgorithm: "AES256",
+    };
+    const observedEncryption = (yield* s3.getBucketEncryption({
+      Bucket: bucket,
+    })).ServerSideEncryptionConfiguration?.Rules?.[0];
+    const desiredEncryptionRule: s3.ServerSideEncryptionRule = {
+      ApplyServerSideEncryptionByDefault: {
+        SSEAlgorithm: desiredEncryption.sseAlgorithm,
+        KMSMasterKeyID: desiredEncryption.kmsMasterKeyId,
+      },
+      BucketKeyEnabled: desiredEncryption.bucketKeyEnabled ?? false,
+    };
+    const encryptionFingerprint = (
+      rule: s3.ServerSideEncryptionRule | undefined,
+    ) =>
+      JSON.stringify({
+        algorithm:
+          rule?.ApplyServerSideEncryptionByDefault?.SSEAlgorithm ?? null,
+        key: rule?.ApplyServerSideEncryptionByDefault?.KMSMasterKeyID ?? null,
+        bucketKey: rule?.BucketKeyEnabled ?? false,
+      });
+    if (
+      encryptionFingerprint(observedEncryption) !==
+      encryptionFingerprint(desiredEncryptionRule)
+    ) {
+      yield* s3.putBucketEncryption({
+        Bucket: bucket,
+        ServerSideEncryptionConfiguration: {
+          Rules: [desiredEncryptionRule],
+        },
+      });
+    }
+
+    const desiredPublicAccess: s3.PublicAccessBlockConfiguration = {
+      BlockPublicAcls: true,
+      IgnorePublicAcls: true,
+      BlockPublicPolicy: true,
+      RestrictPublicBuckets: true,
+    };
+    const observedPublicAccess = yield* s3
+      .getPublicAccessBlock({ Bucket: bucket })
       .pipe(
-        // Many callers race to create the shared default state bucket on first
-        // use. The loser sees the create already done
-        // (`BucketAlreadyOwnedByYou`/`BucketAlreadyExists`) or mid-flight
-        // (`OperationAborted` — "a conflicting conditional operation is in
-        // progress"). All mean "someone else is creating it" — fall through to
-        // the readiness wait.
-        Effect.catchTag(
-          [
-            "BucketAlreadyOwnedByYou",
-            "BucketAlreadyExists",
-            "OperationAborted",
-          ],
-          () => Effect.void,
+        Effect.map((result) => result.PublicAccessBlockConfiguration),
+        Effect.catchTag("NoSuchPublicAccessBlockConfiguration", () =>
+          Effect.succeed<s3.PublicAccessBlockConfiguration | undefined>(
+            undefined,
+          ),
         ),
       );
+    const publicAccessFingerprint = (
+      config: s3.PublicAccessBlockConfiguration | undefined,
+    ) =>
+      JSON.stringify({
+        blockAcls: config?.BlockPublicAcls ?? false,
+        ignoreAcls: config?.IgnorePublicAcls ?? false,
+        blockPolicy: config?.BlockPublicPolicy ?? false,
+        restrictBuckets: config?.RestrictPublicBuckets ?? false,
+      });
+    if (
+      publicAccessFingerprint(observedPublicAccess) !==
+      publicAccessFingerprint(desiredPublicAccess)
+    ) {
+      yield* s3.putPublicAccessBlock({
+        Bucket: bucket,
+        PublicAccessBlockConfiguration: desiredPublicAccess,
+      });
+    }
 
-    // Wait for the bucket to become available. Under a concurrent create the
-    // bucket is briefly not yet head-able (NotFound/NoSuchBucket) and object
-    // ops would race ahead of it — keep polling until HEAD succeeds.
-    yield* s3
-      .headBucket({ Bucket: bucket })
+    const desiredOwnership = "BucketOwnerEnforced";
+    const observedOwnership = yield* s3
+      .getBucketOwnershipControls({ Bucket: bucket })
       .pipe(
-        Effect.retry(
-          Schedule.max([Schedule.spaced("1 second"), Schedule.recurs(15)]),
+        Effect.map(
+          (result) => result.OwnershipControls?.Rules?.[0]?.ObjectOwnership,
+        ),
+        Effect.catchTag("OwnershipControlsNotFoundError", () =>
+          Effect.succeed<string | undefined>(undefined),
         ),
       );
+    if (observedOwnership !== desiredOwnership) {
+      yield* s3.putBucketOwnershipControls({
+        Bucket: bucket,
+        OwnershipControls: {
+          Rules: [{ ObjectOwnership: desiredOwnership }],
+        },
+      });
+    }
   }).pipe(
     // The whole observe→create→wait sequence races other first-callers of the
     // shared bucket; `OperationAborted` (conflicting create) and a transiently