fufu-cloud-cli 0.10.0__tar.gz → 0.10.1__tar.gz

{fufu_cloud_cli-0.10.0/src/fufu_cloud_cli.egg-info → fufu_cloud_cli-0.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.10.0
+Version: 0.10.1
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -27,6 +27,10 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.10.1 新增官方 Terraform／OpenTofu／Pulumi 的 S3／GCS bucket 生命週期與
+S3 bucket tags。需配套 FUFU API；不支援 bucket versioning、retention、
+KMS、bucket IAM、GCS bucket labels 或 force destroy。
+
 0.10.0 新增 Compute Engine／EC2 VM 與 GKE／EKS 介面的實際運算命令。
 需要啟用相應 infrastructure backend 的 FUFU 服務端；VM 使用 KVM／KubeVirt，
 叢集使用獨立 Kubernetes API 與共用節點，均不是官方雲端資源。
@@ -131,7 +135,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.10.0'
+pip install 'fufu-cloud-cli==0.10.1'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/README.md

@@ -4,6 +4,10 @@
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.10.1 新增官方 Terraform／OpenTofu／Pulumi 的 S3／GCS bucket 生命週期與
+S3 bucket tags。需配套 FUFU API；不支援 bucket versioning、retention、
+KMS、bucket IAM、GCS bucket labels 或 force destroy。
+
 0.10.0 新增 Compute Engine／EC2 VM 與 GKE／EKS 介面的實際運算命令。
 需要啟用相應 infrastructure backend 的 FUFU 服務端；VM 使用 KVM／KubeVirt，
 叢集使用獨立 Kubernetes API 與共用節點，均不是官方雲端資源。
@@ -108,7 +112,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.10.0'
+pip install 'fufu-cloud-cli==0.10.1'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.10.0"
+version = "0.10.1"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.10.0"
+__version__ = "0.10.1"

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/src/fufu_cloud_cli/aws_errors.py

@@ -1,6 +1,6 @@
 """Only documented provider error codes may cross the public transport boundary."""
 AWS_ERRORS = frozenset('''ConditionalCheckFailedException ResourceNotFoundException ResourceInUseException ResourceAlreadyExistsException ValidationException
-NoSuchKey NoSuchBucket NotFound NotModified ParameterNotFound ParameterAlreadyExists ParameterVersionNotFound QueueDoesNotExist
+NoSuchKey NoSuchBucket NoSuchTagSet BucketAlreadyExists BucketAlreadyOwnedByYou BucketNotEmpty NotFound NotModified ParameterNotFound ParameterAlreadyExists ParameterVersionNotFound QueueDoesNotExist
 PreconditionFailed InvalidRange InvalidParameterException InvalidParameterValue InvalidAttributeName InvalidAttributeValue QueueNameExists
 PurgeQueueInProgress ReceiptHandleIsInvalid BatchEntryIdsNotDistinct EmptyBatchRequest BatchRequestTooLong InvalidBatchEntryId
 TooManyEntriesInBatchRequest InvalidMessageContents AWS.SimpleQueueService.NonExistentQueue TooManyRequestsException InvalidRequestContentException'''.split())

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/src/fufu_cloud_cli/capabilities.json

@@ -27,11 +27,11 @@
       "backend": "api",
       "compatibility": "official-provider-subset",
       "providers": { "hashicorp/aws": "6.63.0", "hashicorp/google": "8.1.0" },
-      "resources": ["aws_iam_role", "aws_iam_role_policy", "aws_lambda_function", "aws_lambda_function_url", "aws_lambda_permission", "google_service_account", "google_cloud_run_v2_service", "google_cloud_run_v2_service_iam_member", "aws_sqs_queue", "aws_ssm_parameter", "google_pubsub_topic", "google_pubsub_subscription"],
+      "resources": ["aws_iam_role", "aws_iam_role_policy", "aws_lambda_function", "aws_lambda_function_url", "aws_lambda_permission", "google_service_account", "google_cloud_run_v2_service", "google_cloud_run_v2_service_iam_member", "aws_sqs_queue", "aws_ssm_parameter", "google_pubsub_topic", "google_pubsub_subscription", "aws_s3_bucket", "google_storage_bucket"],
       "operations": ["init", "plan", "saved-plan-apply", "refresh", "update", "import", "destroy"],
-      "engines": { "terraform": "1.16.1", "opentofu": "1.12.6" },
+      "engines": { "terraform": "1.16.2", "opentofu": "1.12.6" },
       "state": ["isolated-local", "tenant-remote-http", "context-binding"],
-      "limitations": ["Linux-amd64-verified", "terraform-extra-required", "root-default-providers-only", "OpenTofu-data-resources-verified-compute-not-retested", "no-full-cloud-IAM-or-runtime-equivalence", "no-Terraform-storage-or-Functions-Gen1-Gen2", "PubSub-requires-patched-emulator", "unsupported-APIs-and-fields-fail-explicitly"]
+      "limitations": ["Linux-amd64-verified", "terraform-extra-required", "root-default-providers-only", "OpenTofu-data-resources-verified-compute-not-retested", "no-full-cloud-IAM-or-runtime-equivalence", "no-VM-cluster-Functions-Gen1-Gen2-IaC", "storage-bucket-lifecycle-and-S3-tags-only", "no-force-destroy-retention-versioning-bucket-IAM-KMS", "PubSub-requires-patched-emulator", "unsupported-APIs-and-fields-fail-explicitly"]
     },
     "iac-remote-state": {
       "status": "implemented", "backend": "api", "mode": "simplified",
@@ -41,7 +41,7 @@
     "pulumi-data": {
       "status": "implemented", "backend": "api", "compatibility": "official-provider-subset",
       "providers": { "pulumi": "3.261.0", "aws": "7.45.0", "gcp": "9.36.1" },
-      "resources": ["aws:sqs/queue:Queue", "aws:ssm/parameter:Parameter", "gcp:pubsub/topic:Topic", "gcp:pubsub/subscription:Subscription"],
+      "resources": ["aws:sqs/queue:Queue", "aws:ssm/parameter:Parameter", "gcp:pubsub/topic:Topic", "gcp:pubsub/subscription:Subscription", "aws:s3/bucket:Bucket", "gcp:storage/bucket:Bucket"],
       "operations": ["preview", "up", "refresh", "update", "import", "destroy"],
       "limitations": ["Node.js-runtime", "default-providers", "separate-local-DIY-state", "external-passphrase-required", "secret-fields-encrypted-not-whole-state", "no-remote-backend", "no-compute-resource-acceptance", "trusted-programs-only"]
     },
@@ -197,7 +197,8 @@
         "metadata-describe-update-merge-delete",
         "paginated-object-list",
         "binary-cat",
-        "UTF8-preview"
+        "UTF8-preview",
+        "Terraform-OpenTofu-Pulumi-bucket-lifecycle"
       ],
       "limitations": [
         "object-5TiB-policy-subject-to-host-disk-capacity",
@@ -209,7 +210,8 @@
         "single-writer-per-volume",
         "no-signed-URLs",
         "no-versioning-retention-ACL-KMS",
-        "no-GCS-Terraform-or-Pulumi-resource-adapter"
+        "no-bucket-labels-IAM-PATCH-force-destroy",
+        "bucket-current-tenant-location-STANDARD-only"
       ]
     },
     "azure-catalog-api": {
@@ -270,7 +272,11 @@
         "rb",
         "ls",
         "cp-upload-download",
-        "rm"
+        "rm",
+        "get-bucket-tagging",
+        "put-bucket-tagging",
+        "delete-bucket-tagging",
+        "Terraform-OpenTofu-Pulumi-bucket-lifecycle"
       ],
       "limitations": [
         "object-10000-parts-of-up-to-5GiB-subject-to-host-disk-capacity",

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/src/fufu_cloud_cli/control.py

@@ -28,6 +28,7 @@ AWS_OPERATIONS = {
  },
  's3api': {
   'CreateBucket': 'Bucket CreateBucketConfiguration', 'DeleteBucket': 'Bucket', 'ListBuckets': '', 'HeadBucket': 'Bucket', 'GetBucketLocation': 'Bucket',
+  'GetBucketTagging': 'Bucket', 'PutBucketTagging': 'Bucket Tagging', 'DeleteBucketTagging': 'Bucket',
   'ListObjectsV2': 'Bucket Prefix MaxKeys ContinuationToken Delimiter StartAfter EncodingType', 'PutObject': 'Bucket Key Body ContentType Metadata',
   'GetObject': 'Bucket Key ChecksumMode Range IfMatch IfNoneMatch', 'HeadObject': 'Bucket Key ChecksumMode IfMatch IfNoneMatch', 'DeleteObject': 'Bucket Key',
  },
@@ -53,7 +54,7 @@ AWS_OPERATIONS = {
   'PutRetentionPolicy': 'logGroupName retentionInDays', 'DeleteRetentionPolicy': 'logGroupName',
  },
 }
-JSON_FIELDS = set('AssumeRolePolicyDocument PolicyDocument AttributeDefinitions KeySchema ProvisionedThroughput GlobalSecondaryIndexes LocalSecondaryIndexes StreamSpecification Item Key ExpressionAttributeNames ExpressionAttributeValues ExclusiveStartKey RequestItems CreateBucketConfiguration Metadata Attributes MessageAttributes Tags tags ParameterFilters Entries logEvents'.split())
+JSON_FIELDS = set('AssumeRolePolicyDocument PolicyDocument AttributeDefinitions KeySchema ProvisionedThroughput GlobalSecondaryIndexes LocalSecondaryIndexes StreamSpecification Item Key ExpressionAttributeNames ExpressionAttributeValues ExclusiveStartKey RequestItems CreateBucketConfiguration Metadata Attributes MessageAttributes Tags tags Tagging ParameterFilters Entries logEvents'.split())
 LIST_FIELDS = set('ActionNames ResourceArns Names AttributeNames MessageAttributeNames MessageSystemAttributeNames TagKeys logStreamNames'.split())
 BOOL_FIELDS = set('ConsistentRead ScanIndexForward WithDecryption Overwrite Enabled Recursive descending startFromHead'.split())
 INT_FIELDS = set('Limit MaxKeys MaxResults MaxNumberOfMessages VisibilityTimeout WaitTimeSeconds DelaySeconds BatchSize limit startTime endTime retentionInDays'.split())

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/src/fufu_cloud_cli/pulumi_bridge.py

@@ -16,11 +16,12 @@ import yaml
 
 from .errors import FufuError, require
 from .terraform_bridge.common import Bridge
-from .terraform_bridge.runner import AWS_ENDPOINT_ALIASES, bind_context, child_environment, fcntl, private_directory, serve
+from .terraform_bridge.runner import AWS_ENDPOINT_ALIASES, bind_context, child_environment, fcntl, private_directory, serve, s3_control_environment
 
 SDK_VERSIONS = {'pulumi': '3.261.0', 'aws': '7.45.0', 'gcp': '9.36.1'}
 RESOURCE_TYPES = {'aws:sqs/queue:Queue', 'aws:ssm/parameter:Parameter',
-                  'gcp:pubsub/topic:Topic', 'gcp:pubsub/subscription:Subscription'}
+                  'gcp:pubsub/topic:Topic', 'gcp:pubsub/subscription:Subscription',
+                  'aws:s3/bucket:Bucket', 'gcp:storage/bucket:Bucket'}
 
 
 def read_mapping(path):
@@ -55,7 +56,7 @@ def provider_config(port, bridge, providers):
                 keys = [key for key in keys if key not in aliases[1:]]
             values = {'endpoints': [{key: f'http://127.0.0.1:{port}/aws/{key}' for key in keys}],
                       'region': bridge.identities['aws']['region'], 'maxRetries': 1,
-                      'skipCredentialsValidation': True, 'skipMetadataApiCheck': True, 'skipRegionValidation': True}
+                      'skipCredentialsValidation': True, 'skipMetadataApiCheck': True, 'skipRegionValidation': True, 's3UsePathStyle': True}
         else:
             values = {}
             versions = {'iam': 'v1/', 'iam_beta': 'v1/', 'cloud_run_v2': 'v2/', 'cloud_run': 'v1/',
@@ -164,6 +165,7 @@ def command(argv, Parser):
         port = adapter_port(work)
         server, thread = serve(bridge, port, key, secret, token)
         env = child_environment(root, work, key, secret, token)
+        if 'aws' in args.providers: env.update(s3_control_environment(port))
         for key_name in ['NODE_OPTIONS', 'NODE_PATH']: env.pop(key_name, None)
         env.update(PULUMI_HOME=str(work / 'home'), PULUMI_BACKEND_URL=(work / 'backend').as_uri(),
                    PULUMI_CONFIG_PASSPHRASE=passphrase, PULUMI_SKIP_UPDATE_CHECK='true', PULUMI_SKIP_CONFIRMATIONS='false',

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/src/fufu_cloud_cli/terraform_bridge/common.py

@@ -49,13 +49,17 @@ def signing_valid(method, target, headers, body, access_key, secret):
     if headers.get('x-amz-content-sha256', digest) != digest:
         return None
     path, _, query = target.partition('?')
+    s3_path = path
     parts = []
     for part in path.split('/'):
         if part == '..':
             if parts: parts.pop()
         elif part and part != '.': parts.append(part)
     path = '/' + '/'.join(parts) + ('/' if path.endswith('/') and parts else '')
-    canonical_path = quote(path, safe='/~')
+    # S3 and S3 Control use the transmitted path without normalization or
+    # double encoding. The official SDK signs encoded ARN path components this
+    # way; all services still require the actual payload digest and full HMAC.
+    canonical_path = s3_path if service == 's3' else quote(path, safe='/~')
     canonical_query = '&'.join(sorted(v if '=' in v else v + '=' for v in query.split('&') if v))
     canonical_headers = ''.join(n + ':' + ' '.join(headers[n].strip().split()) + '\n' for n in names)
     canonical = '\n'.join([method, canonical_path, canonical_query, canonical_headers, signed, digest])

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/src/fufu_cloud_cli/terraform_bridge/google.py

@@ -151,6 +151,9 @@ def run(bridge, method, path, query, body):
 
 def dispatch(bridge, service, method, path, query, data):
     body = json.loads(data) if data else {}
+    if service == 'storage':
+        from .storage import google as bucket
+        return bucket(bridge, method, path, query, body)
     if service == 'pubsub':
         from .google_pubsub import dispatch as pubsub
         return pubsub(bridge, method, path, query, body)

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/src/fufu_cloud_cli/terraform_bridge/runner.py

@@ -24,14 +24,14 @@ from urllib.parse import parse_qs, urlsplit
 from ..errors import FufuError, require
 from ..aws_errors import AWS_ERRORS
 from .common import Bridge, signing_valid
-from . import aws, aws_data, google
+from . import aws, aws_data, google, storage
 from .remote_state import StateProxy, state_name
 
 SUPPORTED_PROVIDERS = {'aws': '6.63.0', 'google': '8.1.0'}
 SUPPORTED_RESOURCES = {'aws_iam_role', 'aws_iam_role_policy', 'aws_lambda_function', 'aws_lambda_function_url',
                        'aws_lambda_permission', 'google_service_account', 'google_cloud_run_v2_service',
                        'google_cloud_run_v2_service_iam_member', 'aws_sqs_queue', 'aws_ssm_parameter',
-                       'google_pubsub_topic', 'google_pubsub_subscription'}
+                       'google_pubsub_topic', 'google_pubsub_subscription', 'aws_s3_bucket', 'google_storage_bucket'}
 SUPPORTED_DATA = {'aws_caller_identity', 'aws_iam_policy_document', 'aws_region', 'aws_partition'}
 # Mutually exclusive aliases declared by the pinned official AWS provider.
 AWS_ENDPOINT_ALIASES = '''directoryservice ds;cognitoidentityprovider cognitoidp;amp prometheus prometheusservice;
@@ -69,6 +69,7 @@ def validate_provider_configuration(root, data_dir):
                     for kind in declaration:
                         require(not kind.startswith(('aws_', 'google_')) or kind in supported,
                                 'UNSUPPORTED_TERRAFORM_RESOURCE', '未支援的 Terraform 資源或 data source：' + kind)
+                        if category == 'resource': storage.validate_hcl(kind, declaration[kind])
             providers = document.get('provider', [])
             if isinstance(providers, dict): providers = [providers]
             for entry in providers:
@@ -127,7 +128,14 @@ def serve(bridge, port, aws_key, aws_secret, google_token, state=None):
             provider = 'state' if self.path.startswith('/state') else 'gcp' if self.path.startswith('/gcp/') else 'aws'
             headers = {k.lower(): v for k, v in self.headers.items()}
             try:
-                require(headers.get('host') == f'127.0.0.1:{port}' and 'origin' not in headers and 'transfer-encoding' not in headers,
+                parsed = urlsplit(self.path)
+                # S3 Control injects the account into custom endpoint hosts. A
+                # closed loopback HTTP proxy handles only this exact target;
+                # it never resolves the hostname or forwards network traffic.
+                control_host = str(bridge.identities.get('aws', {}).get('accountId', '')) + f'.127.0.0.1:{port}'
+                s3_control = (parsed.scheme == 'http' and parsed.netloc == control_host and
+                              parsed.path.startswith('/aws/s3control/') and headers.get('host') == control_host)
+                require((s3_control or not parsed.netloc and headers.get('host') == f'127.0.0.1:{port}') and 'origin' not in headers and 'transfer-encoding' not in headers,
                         'AUTHENTICATION_FAILED', 'Terraform adapter 僅接受目前 loopback 工作階段。')
                 if provider == 'state':
                     require(state is not None, 'ACCESS_DENIED', '此工作階段沒有啟用遠端 state。')
@@ -141,16 +149,23 @@ def serve(bridge, port, aws_key, aws_secret, google_token, state=None):
                 body = self.rfile.read(length)
                 require(len(body) == length, 'INVALID_TERRAFORM_REQUEST', 'Request 未完整傳送。')
                 require(provider == 'state' or provider in bridge.clients, 'AUTHENTICATION_FAILED', '目前未啟用此 provider。')
-                parsed = urlsplit(self.path)
                 query = parse_qs(parsed.query, keep_blank_values=True)
                 with bridge.lock:
                     if provider == 'state':
                         result = state.dispatch(self.command, self.path, headers, body)
                     elif provider == 'aws':
-                        signed = signing_valid(self.command, self.path, headers, body, aws_key, aws_secret)
+                        signed = signing_valid(self.command, parsed.path + ('?' + parsed.query if parsed.query else ''), headers, body, aws_key, aws_secret)
                         require(signed, 'AUTHENTICATION_FAILED', 'Terraform AWS 簽章無效。')
                         service, region = signed
                         require(service in {'iam', 'sts'} or region == bridge.identities['aws']['region'], 'ACCESS_DENIED', 'AWS region 與 FUFU scope 不符。')
+                        if s3_control:
+                            require(service == 's3', 'AUTHENTICATION_FAILED', 'S3 Control 簽章服務無效。')
+                            # The official provider explicitly falls back to
+                            # Get/Put/DeleteBucketTagging on MethodNotAllowed.
+                            # Actual access is checked by those native IAM APIs.
+                            self.respond(405, storage.xml('ErrorResponse', {'Error': {'Code': 'MethodNotAllowed',
+                                'Message': 'Use bucket tagging APIs for this S3-compatible backend.'}}), {'Content-Type': 'application/xml'})
+                            return
                         prefix = '/aws/' + service
                         queue_path = service == 'sqs' and re.fullmatch(r'/[0-9]{12}/[A-Za-z0-9_-]{1,80}', parsed.path)
                         require(queue_path or parsed.path == '/aws' or parsed.path.startswith(prefix + '/') or parsed.path == prefix,
@@ -160,6 +175,7 @@ def serve(bridge, port, aws_key, aws_secret, google_token, state=None):
                         elif service == 'lambda': result = aws.lambda_api(bridge, self.command, route, query, body)
                         elif service in {'sqs', 'ssm'}:
                             result = aws_data.dispatch(bridge, service, self.command, route, headers, body, f'http://127.0.0.1:{port}')
+                        elif service == 's3': result = storage.s3(bridge, self.command, route, query, headers, body)
                         else: raise FufuError('UNSUPPORTED_TERRAFORM_OPERATION', '此 AWS API 尚未列入 Terraform 支援範圍。')
                     else:
                         require(hmac.compare_digest(headers.get('authorization', ''), 'Bearer ' + google_token), 'AUTHENTICATION_FAILED', 'Terraform Google 工作階段無效。')
@@ -174,7 +190,7 @@ def serve(bridge, port, aws_key, aws_secret, google_token, state=None):
                 expected = isinstance(error, FufuError)
                 code = error.code if expected else 'TERRAFORM_ADAPTER_ERROR'
                 message = error.message if expected else 'Terraform adapter 無法處理此請求；未輸出設定或 credential。'
-                status = 404 if code in {'NOT_FOUND', 'RESOURCE_NOT_FOUND'} else 409 if code in {'RESOURCE_CONFLICT', 'ALREADY_EXISTS'} else 401 if code == 'AUTHENTICATION_FAILED' else 403 if code == 'ACCESS_DENIED' else 400 if expected else 500
+                status = 404 if code in {'NOT_FOUND', 'RESOURCE_NOT_FOUND'} else 409 if code in {'RESOURCE_CONFLICT', 'ALREADY_EXISTS'} else 401 if code == 'AUTHENTICATION_FAILED' else 403 if code == 'ACCESS_DENIED' else 412 if code == 'PRECONDITION_FAILED' else 400 if expected else 500
                 bridge.calls.append({'provider': provider, 'error': code})
                 if provider == 'aws':
                     aws_code = {404: 'ResourceNotFoundException', 409: 'ResourceConflictException', 401: 'UnrecognizedClientException', 403: 'AccessDeniedException'}.get(status, 'InvalidParameterValueException')
@@ -185,7 +201,13 @@ def serve(bridge, port, aws_key, aws_secret, google_token, state=None):
                     # Providers use these codes to recognize absent resources on refresh/destroy.
                     if code in AWS_ERRORS:
                         aws_code = code
-                    if '/iam' in self.path:
+                    if urlsplit(self.path).path.startswith(('/aws/s3/', '/aws/s3control/')) or self.path == '/aws/s3':
+                        aws_code = {404: 'NoSuchBucket', 409: 'BucketAlreadyExists', 401: 'SignatureDoesNotMatch', 403: 'AccessDenied'}.get(status, 'InvalidRequest')
+                        if code in AWS_ERRORS: aws_code = code
+                        value = {'Code': aws_code, 'Message': message}
+                        data = storage.xml('ErrorResponse', {'Error': value}) if '/aws/s3control/' in self.path else storage.xml('Error', value)
+                        self.respond(status, data, {'Content-Type': 'application/xml'})
+                    elif '/iam' in self.path:
                         aws_code = {404: 'NoSuchEntity', 409: 'EntityAlreadyExists', 403: 'AccessDenied'}.get(status, 'InvalidInput')
                         data = ('<ErrorResponse>' + aws.xml_value('Error', {'Type': 'Sender', 'Code': aws_code, 'Message': message}) + '</ErrorResponse>').encode()
                         self.respond(status, data, {'Content-Type': 'text/xml'})
@@ -198,7 +220,7 @@ def serve(bridge, port, aws_key, aws_secret, google_token, state=None):
                             error_headers['x-amzn-query-error'] = query_code + (';Receiver' if status >= 500 else ';Sender')
                         self.respond(status, json.dumps({'__type': aws_code, 'message': message}).encode(), error_headers)
                 else:
-                    google_status = {404: 'NOT_FOUND', 409: 'ALREADY_EXISTS', 401: 'UNAUTHENTICATED', 403: 'PERMISSION_DENIED'}.get(status, 'INVALID_ARGUMENT')
+                    google_status = {404: 'NOT_FOUND', 409: 'ALREADY_EXISTS', 401: 'UNAUTHENTICATED', 403: 'PERMISSION_DENIED', 412: 'FAILED_PRECONDITION'}.get(status, 'INVALID_ARGUMENT')
                     self.respond(status, json.dumps({'error': {'code': status, 'status': google_status, 'message': message}}).encode(), {})
         def respond(self, status, data, headers):
             try:
@@ -229,6 +251,16 @@ def child_environment(root, data_dir, key, secret, token):
     return env
 
 
+def s3_control_environment(port):
+    """Route account-prefixed S3 Control requests to the closed local adapter.
+
+    All other non-loopback plaintext HTTP targets fail closed; HTTPS plugin
+    downloads are unaffected. No proxy forwarding or CONNECT is implemented.
+    """
+    return {'HTTP_PROXY': f'http://127.0.0.1:{port}', 'http_proxy': f'http://127.0.0.1:{port}',
+            'NO_PROXY': '127.0.0.1,localhost', 'no_proxy': '127.0.0.1,localhost'}
+
+
 def private_directory(path):
     require(not path.is_symlink(), 'INVALID_TERRAFORM_STATE', 'FUFU state 目錄不可為符號連結。')
     path.mkdir(mode=0o700, exist_ok=True)
@@ -282,7 +314,7 @@ def endpoints(port, providers, schemas=None):
                 aliases = [key for key in group.split() if key in keys]
                 keys = [key for key in keys if key not in aliases[1:]]
             result['aws'] = {'skip_credentials_validation': True, 'skip_metadata_api_check': True, 'skip_region_validation': True,
-                             'max_retries': 1, 'endpoints': [{key: base + '/aws/' + key for key in keys}]}
+                             'max_retries': 1, 's3_use_path_style': True, 'endpoints': [{key: base + '/aws/' + key for key in keys}]}
         else:
             keys = [key for key in schema.get('attributes', {}) if key.endswith('_custom_endpoint')] or ['iam_custom_endpoint', 'cloud_run_v2_custom_endpoint']
             versions = {'iam': 'v1/', 'iam_beta': 'v1/', 'cloud_run_v2': 'v2/', 'cloud_run': 'v1/', 'cloudfunctions2': 'v2/', 'cloud_functions': 'v1/', 'storage': 'storage/v1/', 'pubsub': 'v1/'}
@@ -332,6 +364,7 @@ def command(argv, Parser, engine='terraform'):
     key, secret, token = 'FUFUTF' + secrets.token_hex(10).upper(), secrets.token_urlsafe(32), secrets.token_urlsafe(32)
     port = 24000 + int(hashlib.sha256(str(root).encode()).hexdigest()[:8], 16) % 16000
     env = child_environment(root, data_dir, key, secret, token)
+    if 'aws' in args.providers: env.update(s3_control_environment(port))
     bridge = server = thread = owned_override = cli_config = lock_fd = child = None
     previous_signals = {}
     try:

fufu_cloud_cli-0.10.1/src/fufu_cloud_cli/terraform_bridge/storage.py

@@ -0,0 +1,173 @@
+"""Bucket lifecycle over the existing tenant storage APIs.
+
+No metadata-only fallback for encryption, ACLs, retention or object versions.
+Unsupported S3 optional reads return the standard NotImplemented response;
+the official provider explicitly handles this for third-party S3 backends.
+"""
+import json
+import re
+import xml.etree.ElementTree as ET
+from urllib.parse import quote, unquote
+
+from ..errors import FufuError, require
+from .common import only, default
+
+S3_NS = 'http://s3.amazonaws.com/doc/2006-03-01/'
+OPTIONAL_S3_READS = {'acl', 'policy', 'cors', 'website', 'versioning', 'accelerate',
+    'requestPayment', 'logging', 'lifecycle', 'replication', 'encryption', 'object-lock'}
+META_ARGUMENTS = {'count', 'for_each', 'depends_on', 'provider', 'lifecycle', 'timeouts'}
+
+
+def validate_hcl(kind, configs):
+    """Reject unsupported bucket configuration before provider-side creation.
+
+    Runtime checks still validate the evaluated request. Client-only options
+    such as force_destroy must be explicit supported literals.
+    """
+    if kind not in {'aws_s3_bucket', 'google_storage_bucket'}: return
+    allowed = ({'bucket', 'bucket_prefix', 'tags', 'force_destroy', 'region'} if kind == 'aws_s3_bucket'
+        else {'name', 'location', 'project', 'storage_class', 'force_destroy'}) | META_ARGUMENTS
+    for config in configs.values():
+        only(config, allowed, kind)
+        require(config.get('force_destroy', False) is False, 'UNSUPPORTED_TERRAFORM_FIELD',
+            'Bucket force_destroy 尚未支援；先明確清除物件，再刪除 bucket。')
+
+
+def xml(root, values=None):
+    node = ET.Element(root, xmlns=S3_NS)
+    def add(parent, key, value):
+        for item in value if isinstance(value, list) else [value]:
+            child = ET.SubElement(parent, key)
+            if isinstance(item, dict):
+                for name, nested in item.items(): add(child, name, nested)
+            elif item is not None: child.text = str(item)
+    for key, value in (values or {}).items(): add(node, key, value)
+    return ET.tostring(node, encoding='utf-8', xml_declaration=True)
+
+
+def s3_error(code, status=400):
+    return status, xml('Error', {'Code': code, 'Message': 'S3 operation unavailable in this FUFU bucket contract.'}), {'Content-Type': 'application/xml'}
+
+
+def parse_xml(data, root):
+    require(len(data) <= 65536 and b'<!DOCTYPE' not in data.upper() and b'<!ENTITY' not in data.upper(),
+        'INVALID_TERRAFORM_REQUEST', 'S3 bucket XML 格式或大小無效。')
+    try: node = ET.fromstring(data)
+    except ET.ParseError: raise FufuError('INVALID_TERRAFORM_REQUEST', 'S3 bucket XML 格式無效。') from None
+    for element in node.iter():
+        require(not element.attrib, 'UNSUPPORTED_TERRAFORM_FIELD', 'S3 bucket XML 屬性尚未支援。')
+        if element.tag.startswith('{'):
+            require(element.tag.startswith('{' + S3_NS + '}'), 'INVALID_TERRAFORM_REQUEST', 'S3 XML namespace 無效。')
+            element.tag = element.tag.split('}', 1)[1]
+    require(node.tag == root, 'INVALID_TERRAFORM_REQUEST', 'S3 bucket XML root 無效。')
+    return node
+
+
+def s3(bridge, method, path, query, headers, data):
+    match = re.fullmatch(r'/([a-z0-9][a-z0-9.-]{1,61}[a-z0-9])/?', path)
+    require(match, 'UNSUPPORTED_TERRAFORM_OPERATION', 'S3 IaC 目前提供 bucket 生命週期。')
+    bucket = match[1]
+    require(not re.fullmatch(r'[0-9]+(?:\.[0-9]+){3}', bucket) and '..' not in bucket,
+        'INVALID_TERRAFORM_REQUEST', 'S3 bucket 名稱無效。')
+    for key, value in headers.items():
+        if key.startswith(('x-amz-grant-', 'x-amz-object-lock-', 'x-amz-server-side-encryption')):
+            raise FufuError('UNSUPPORTED_TERRAFORM_FIELD', 'Bucket ACL、Object Lock 與加密尚未支援。')
+    require(headers.get('x-amz-acl') in (None, 'private') and headers.get('x-amz-bucket-namespace') in (None, 'global'),
+        'UNSUPPORTED_TERRAFORM_FIELD', '目前只支援 private、global namespace bucket。')
+    require(headers.get('x-amz-expected-bucket-owner') in (None, bridge.identities['aws']['accountId']),
+        'ACCESS_DENIED', 'Bucket owner 與目前租戶不符。')
+    params = dict(query); params.pop('x-id', None)
+    require(len(params) <= 1 and all(v == [''] for v in params.values()),
+        'UNSUPPORTED_TERRAFORM_FIELD', 'S3 bucket query 尚未支援。')
+    operation = next(iter(params), '')
+    reply = {'Content-Type': 'application/xml', 'x-amz-bucket-region': bridge.identities['aws']['region']}
+    try:
+        if operation in OPTIONAL_S3_READS and method == 'GET':
+            # Check existence and authorization; do not report unverified config
+            # as an empty successful response to the official provider.
+            bridge.native('s3', 'HeadBucket', {'Bucket': bucket})
+            return s3_error('NotImplemented', 501)
+        if not operation and method == 'HEAD':
+            bridge.native('s3', 'HeadBucket', {'Bucket': bucket})
+            return 200, b'', reply
+        if not operation and method == 'PUT':
+            config = {}
+            if data:
+                document = parse_xml(data, 'CreateBucketConfiguration')
+                keys = [item.tag for item in document]
+                require(len(keys) == len(set(keys)) and set(keys) <= {'LocationConstraint', 'Tags'},
+                    'UNSUPPORTED_TERRAFORM_FIELD', 'S3 create bucket configuration 尚未支援。')
+                # The pinned provider retries without creation tags, then uses
+                # PutBucketTagging. Fail before creating any partial resource.
+                if 'Tags' in keys: return s3_error('UnsupportedArgument')
+                location = document.find('LocationConstraint')
+                if location is not None:
+                    require(not list(location), 'INVALID_TERRAFORM_REQUEST', 'Bucket location 格式無效。')
+                    config['CreateBucketConfiguration'] = {'LocationConstraint': location.text or ''}
+            bridge.native('s3', 'CreateBucket', {'Bucket': bucket, **config})
+            return 200, b'', {**reply, 'Location': '/' + bucket}
+        if not operation and method == 'DELETE':
+            bridge.native('s3', 'DeleteBucket', {'Bucket': bucket})
+            return 204, b'', reply
+        if operation == 'location' and method == 'GET':
+            value = bridge.native('s3', 'GetBucketLocation', {'Bucket': bucket}).get('LocationConstraint')
+            node = ET.Element('LocationConstraint', xmlns=S3_NS); node.text = value
+            return 200, ET.tostring(node, encoding='utf-8'), reply
+        if operation == 'tagging':
+            if method == 'GET':
+                value = bridge.native('s3', 'GetBucketTagging', {'Bucket': bucket})
+                return 200, xml('Tagging', {'TagSet': {'Tag': value.get('TagSet', [])}}), reply
+            if method == 'DELETE':
+                bridge.native('s3', 'DeleteBucketTagging', {'Bucket': bucket})
+                return 204, b'', reply
+            if method == 'PUT':
+                root = parse_xml(data, 'Tagging')
+                require(len(root) == 1 and root[0].tag == 'TagSet', 'INVALID_TERRAFORM_REQUEST', 'TagSet 必須唯一。')
+                tags = []
+                for tag in root[0]:
+                    require(tag.tag == 'Tag' and sorted(c.tag for c in tag) == ['Key', 'Value'] and all(not list(c) for c in tag),
+                        'INVALID_TERRAFORM_REQUEST', 'S3 tag 必須包含 Key／Value。')
+                    tags.append({c.tag: c.text or '' for c in tag})
+                bridge.native('s3', 'PutBucketTagging', {'Bucket': bucket, 'Tagging': {'TagSet': tags}})
+                return 200, b'', reply
+        raise FufuError('UNSUPPORTED_TERRAFORM_OPERATION', '此 S3 bucket 操作尚未支援。')
+    except FufuError as error:
+        codes = {'NoSuchBucket': 404, 'NoSuchTagSet': 404, 'NotFound': 404,
+                 'BucketNotEmpty': 409, 'BucketAlreadyExists': 409, 'BucketAlreadyOwnedByYou': 409}
+        if error.code in codes: return s3_error('NoSuchBucket' if error.code == 'NotFound' else error.code, codes[error.code])
+        if error.code in {'RESOURCE_NOT_FOUND', 'NOT_FOUND'}: return s3_error('NoSuchBucket', 404)
+        if error.code in {'ACCESS_DENIED', 'PERMISSION_DENIED'}: return s3_error('AccessDenied', 403)
+        raise
+
+
+def google(bridge, method, path, query, body):
+    match = re.fullmatch(r'/storage/v1/b(?:/([^/]+))?/?', path)
+    require(match, 'UNSUPPORTED_TERRAFORM_OPERATION', 'GCS IaC 目前提供 bucket 生命週期。')
+    only(query, ['project', 'alt', 'prettyPrint'], 'GCS bucket query')
+    require(all(len(v) == 1 for v in query.values()), 'INVALID_TERRAFORM_REQUEST', '重複的 GCS query。')
+    if 'project' in query: bridge.project(query['project'][0])
+    default(query.get('alt', [None])[0], 'json', 'GCS response format')
+    name = unquote(match[1]) if match[1] else None
+    if name is not None:
+        require(re.fullmatch(r'[a-z0-9][a-z0-9._-]{1,220}[a-z0-9]', name), 'INVALID_TERRAFORM_REQUEST', 'Bucket name 無效。')
+    target = '/storage/buckets' + ('/' + quote(name, safe='') if name else '')
+    if method == 'POST' and name is None:
+        require('project' in query, 'INVALID_TERRAFORM_REQUEST', 'GCS bucket create 需要 project。')
+        value = dict(body)
+        for key, expected in {'labels': {}, 'lifecycle': {'rule': []}, 'versioning': {'enabled': False},
+                'defaultEventBasedHold': False, 'billing': {'requesterPays': False}}.items():
+            default(value.pop(key, None), expected, 'GCS ' + key)
+        iam = only(value.pop('iamConfiguration', {}), ['uniformBucketLevelAccess', 'publicAccessPrevention'], 'GCS IAM')
+        default(iam.get('uniformBucketLevelAccess'), {'enabled': False}, 'GCS uniform bucket access')
+        default(iam.get('publicAccessPrevention'), 'inherited', 'GCS public access prevention')
+        only(value, ['name', 'location', 'storageClass'], 'GCS bucket')
+        result = bridge.request('gcp', 'POST', target, value)
+    elif name and method in {'GET', 'DELETE'}:
+        result = bridge.request('gcp', method, target)
+        if method == 'DELETE': return 204, b'', {}
+    else: raise FufuError('UNSUPPORTED_TERRAFORM_OPERATION', 'GCS bucket 的 labels／retention／IAM 更新尚未支援。')
+    # Stable resource identifiers; these URLs are identifiers, never a fallback
+    # destination for data traffic. Physical location comes from the backend.
+    result = {**result, 'kind': 'storage#bucket', 'id': result['name'],
+        'selfLink': 'https://storage.googleapis.com/storage/v1/b/' + quote(result['name'], safe='')}
+    return 200, result, {}

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1/src/fufu_cloud_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.10.0
+Version: 0.10.1
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -27,6 +27,10 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.10.1 新增官方 Terraform／OpenTofu／Pulumi 的 S3／GCS bucket 生命週期與
+S3 bucket tags。需配套 FUFU API；不支援 bucket versioning、retention、
+KMS、bucket IAM、GCS bucket labels 或 force destroy。
+
 0.10.0 新增 Compute Engine／EC2 VM 與 GKE／EKS 介面的實際運算命令。
 需要啟用相應 infrastructure backend 的 FUFU 服務端；VM 使用 KVM／KubeVirt，
 叢集使用獨立 Kubernetes API 與共用節點，均不是官方雲端資源。
@@ -131,7 +135,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.10.0'
+pip install 'fufu-cloud-cli==0.10.1'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.10.1}/src/fufu_cloud_cli.egg-info/SOURCES.txt

@@ -55,6 +55,7 @@ src/fufu_cloud_cli/terraform_bridge/google.py
 src/fufu_cloud_cli/terraform_bridge/google_pubsub.py
 src/fufu_cloud_cli/terraform_bridge/remote_state.py
 src/fufu_cloud_cli/terraform_bridge/runner.py
+src/fufu_cloud_cli/terraform_bridge/storage.py
 src/fufu_cloud_cli/vendor/AWS-CLI-LICENSE.txt
 src/fufu_cloud_cli/vendor/__init__.py
 src/fufu_cloud_cli/vendor/aws_text.py