gen3-dataops-toolkit 2.0.0__py3-none-any.whl

g3dt/cli/_internal/safety.py

@@ -0,0 +1,110 @@
+"""Confirmation and environment guards for destructive / production operations.
+
+These mirror (and strengthen) the guards already baked into the shell scripts:
+the test-only ``synth deploy`` guard, the prod aborts in the bulk scripts, and
+the optional delete confirmation prompts.
+"""
+from __future__ import annotations
+
+import typer
+
+from g3dt.config import env_base
+
+
+def is_prod(env: str) -> bool:
+    """True if the environment name refers to production."""
+    return "prod" in env.lower()
+
+
+def require_test_env(env: str) -> None:
+    """Abort unless ``env`` is the test environment (``test`` or ``test_ec2``).
+
+    A hard guard for any command that must never run outside test. (The ``synth``
+    commands no longer use this — they allow any env and gate prod with
+    :func:`confirm_prod_strict` instead.)
+    """
+    if env_base(env) != "test":
+        typer.secho(
+            f"Refusing: this command is only allowed for the 'test' "
+            f"environment (got '{env}').",
+            fg=typer.colors.RED,
+            err=True,
+        )
+        raise typer.Exit(2)
+
+
+def abort_if_prod(env: str) -> None:
+    """Hard abort for bulk operations that must never touch production."""
+    if is_prod(env):
+        typer.secho(
+            f"Refusing bulk operation against a production environment "
+            f"('{env}').",
+            fg=typer.colors.RED,
+            err=True,
+        )
+        raise typer.Exit(2)
+
+
+def confirm_destructive(action: str, target: str, env: str, assume_yes: bool) -> None:
+    """Gate a destructive operation with an appropriate confirmation.
+
+    * Production: ALWAYS require typing the ``target`` exactly, even with
+      ``--yes`` (so automation can never silently delete prod data).
+    * Non-production: a simple y/N prompt, skippable with ``--yes``.
+
+    Confirmation always happens locally, before any EC2 dispatch (SSM has no
+    TTY), after which the remote job is invoked with ``--yes``.
+    """
+    if is_prod(env):
+        typer.secho(
+            f"PRODUCTION {action} targeting '{target}' (env={env}).",
+            fg=typer.colors.RED,
+            bold=True,
+        )
+        # default="" so an empty entry (just pressing Enter) returns immediately
+        # and aborts, instead of click re-prompting forever.
+        typed = typer.prompt(
+            f"Type '{target}' to confirm", default="", show_default=False
+        )
+        if typed.strip() != target:
+            typer.secho(
+                "Confirmation did not match. Aborting.",
+                fg=typer.colors.RED,
+                err=True,
+            )
+            raise typer.Exit(1)
+        return
+
+    if assume_yes:
+        return
+    if not typer.confirm(f"{action} targeting '{target}' (env={env}). Proceed?"):
+        typer.secho("Aborted.", fg=typer.colors.YELLOW)
+        raise typer.Exit(1)
+
+
+def confirm_prod_strict(action: str, env: str) -> None:
+    """Warn and require typing the env name before any action against production.
+
+    Production is any env whose name contains ``prod`` (see :func:`is_prod`).
+    Non-production environments return immediately (no prompt). The confirmation
+    cannot be bypassed, so automation can never silently act on prod.
+
+    Used by the ``synth`` commands, which may target any configured environment.
+    """
+    if not is_prod(env):
+        return
+    typer.secho(
+        f"PRODUCTION {action} targeting env '{env}'.",
+        fg=typer.colors.RED,
+        bold=True,
+    )
+    # default="" so an empty entry (just pressing Enter) returns immediately and
+    # aborts, instead of click re-prompting forever.
+    typed = typer.prompt(f"Type '{env}' to confirm", default="", show_default=False)
+    if typed.strip() != env:
+        typer.secho(
+            "Confirmation did not match. Aborting.",
+            fg=typer.colors.RED,
+            err=True,
+        )
+        raise typer.Exit(1)

g3dt/cli/config_cmds.py

@@ -0,0 +1,202 @@
+"""`g3dt config` — discover environments, studies, and resolved settings.
+
+Everything the toolkit uses at runtime is resolved from SSM
+(``/{project}/{env}/...``, published by ``cdk deploy`` in
+gen3-aws-data-pipeline). These commands make that tree browsable so an
+operator can answer "what environments exist?" and "what will this actually
+do?" without touching the AWS console. The only local file is the tiny
+``g3dt.yaml`` bootstrap marker (project/region/default_env, optional per-env
+``profiles:`` and ``studies:`` maps) — ``g3dt config set`` edits that marker,
+nothing else.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import typer
+
+from g3dt import config
+from g3dt.cli._internal.resolve import env_of, study_of
+
+app = typer.Typer(
+    no_args_is_help=True,
+    help="Inspect the resolved SSM config; edit the local bootstrap marker.",
+)
+
+
+@app.command()
+def envs() -> None:
+    """List the environments with a deployed SSM tree for this project."""
+    try:
+        for name in config.list_envs():
+            typer.echo(name)
+    except config.ConfigError as exc:
+        typer.secho(str(exc), fg=typer.colors.RED, err=True)
+        raise typer.Exit(1)
+
+
+@app.command()
+def studies(
+    env: str = typer.Option(
+        None,
+        "--env",
+        "-e",
+        help="Also check the env's S3 registry (s3://<metadata-bucket>/config/studies.yaml).",
+    ),
+) -> None:
+    """List the configured studies (bare names).
+
+    The registry comes from the marker's studies: block, or — pass --env —
+    from the env's S3 registry, which is what the EC2 job box uses.
+    """
+    names = config.list_studies(env=env)
+    if not names:
+        typer.secho(
+            "No studies configured. Add a studies: block to your g3dt.yaml "
+            "marker, or upload config/studies.yaml to the env's metadata "
+            "bucket (and pass --env).",
+            fg=typer.colors.YELLOW,
+        )
+        return
+    for name in names:
+        typer.echo(name)
+
+
+@app.command()
+def show(
+    env: str = typer.Option(..., "--env", "-e", help="Environment, e.g. test."),
+    study: str = typer.Option(
+        None, "--study", "-s", help="Optional study to resolve against the env."
+    ),
+    full: bool = typer.Option(
+        False, "--full", help="Also dump the raw SSM subtree (every parameter)."
+    ),
+) -> None:
+    """Print fully-resolved settings for an env (and optionally a study).
+
+    Use this before any job to confirm the exact names the tooling will use —
+    the staging-vs-prod safety check. Everything shown is read live from the
+    env's SSM tree; nothing is local except the marker's project/profiles.
+    """
+    e = env_of(env)
+    typer.secho(f"Environment: {e.name}", bold=True)
+    typer.echo(f"  is_ec2             : {e.is_ec2}")
+    typer.echo(f"  region             : {e.region}")
+    typer.echo(f"  aws_profile        : {e.aws_profile or '(ambient credentials)'}")
+    typer.echo(f"  aws_secret_name    : {e.aws_secret_name}")
+    typer.echo(f"  dictionary_version : {e.dictionary_version}")
+    typer.echo(f"  schema_s3_uri      : {e.schema_s3_uri}")
+    typer.echo(f"  schema_repo        : {e.schema_repo}")
+    typer.echo(f"  domain             : {e.domain}")
+    typer.echo(f"  app_name           : {e.app_name}")
+    typer.echo(f"  namespace          : {e.namespace}")
+    typer.echo(f"  cluster_name       : {e.cluster_name}")
+    typer.echo(f"  ec2_instance_id    : {e.ec2_instance_id}")
+    if study:
+        s = study_of(study, env)
+        typer.secho(f"Study: {study} -> {s.key}", bold=True)
+        typer.echo(f"  project_id       : {s.project_id}")
+        typer.echo(f"  program_id       : {s.program_id}")
+        typer.echo(f"  s3_metadata_path : {s.s3_metadata_path}")
+    if full:
+        from g3dt import resolver
+
+        marker = config.load_marker()
+        project = config.require_project(marker)
+        rc = resolver.resolve(
+            project, config.env_base(env),
+            profile=config.aws_profile_for(env, marker),
+        )
+        typer.secho(
+            f"\n/{rc.project}/{rc.env}  ({len(rc.params)} parameters)", bold=True
+        )
+        for key in sorted(rc.params):
+            typer.echo(f"  {key:<32} {rc.params[key]}")
+
+
+@app.command()
+def diff(
+    env: str = typer.Option(..., "--env", "-e", help="Environment, e.g. test."),
+    file: Path = typer.Option(
+        ...,
+        "--file",
+        "-f",
+        help="The env's INPUT file in the CDK repo, e.g. "
+        "../gen3-aws-data-pipeline/config/etl.test.json.",
+    ),
+) -> None:
+    """Flag drift between SSM and the committed CDK INPUT file.
+
+    Compares the mirrored app facts (``app/*``) and the toolkit pin
+    (``meta/toolkitVersion``) in SSM against ``config/<project>.<env>.json``.
+    A difference means "someone edited the JSON but didn't `cdk deploy`" (or
+    vice-versa). Exits 1 on drift, so it can gate CI.
+    """
+    from g3dt import resolver
+
+    marker = config.load_marker()
+    project = config.require_project(marker)
+    try:
+        rc = resolver.resolve(
+            project, config.env_base(env),
+            profile=config.aws_profile_for(env, marker),
+        )
+    except config.ConfigError as exc:
+        typer.secho(str(exc), fg=typer.colors.RED, err=True)
+        raise typer.Exit(1)
+
+    inputs = json.loads(file.read_text())
+    gen3 = inputs.get("gen3", {})
+    # camelCase input field -> snake_case SSM leaf (the CDK's mirror contract)
+    camel_to_leaf = {
+        "dictionaryVersion": "dictionary_version",
+        "awsSecretName": "aws_secret_name",
+        "schemaS3Uri": "schema_s3_uri",
+        "domain": "domain",
+        "appName": "app_name",
+        "namespace": "namespace",
+        "clusterName": "cluster_name",
+        "schemaRepo": "schema_repo",
+    }
+    drift = False
+
+    def check(label: str, file_value, ssm_value) -> None:
+        nonlocal drift
+        if file_value != ssm_value:
+            drift = True
+            typer.secho(
+                f"  DRIFT {label}: file={file_value!r}  ssm={ssm_value!r}",
+                fg=typer.colors.YELLOW,
+            )
+
+    for camel, leaf in camel_to_leaf.items():
+        check(f"gen3.{camel}", gen3.get(camel), rc.get(f"app/{leaf}"))
+    check("toolkitVersion", inputs.get("toolkitVersion"), rc.get("meta/toolkitVersion"))
+
+    if not drift:
+        typer.secho(
+            f"No drift: SSM /{project}/{config.env_base(env)} matches {file}.",
+            fg=typer.colors.GREEN,
+        )
+    raise typer.Exit(1 if drift else 0)
+
+
+@app.command("set")
+def set_value(
+    key: str = typer.Argument(..., help="Bootstrap key: project, region, default_env."),
+    value: str = typer.Argument(..., help="New value, e.g. etl."),
+) -> None:
+    """Set one bootstrap key in the local g3dt.yaml marker.
+
+    Only the bootstrap (project/region/default_env) lives locally. Deployed
+    settings — dictionary_version, domain, buckets, ... — are CDK INPUTS: edit
+    config/<project>.<env>.json in gen3-aws-data-pipeline and `cdk deploy`;
+    the values flow to SSM, which is what every consumer reads.
+    """
+    try:
+        old, new, path = config.set_marker_value(key, value)
+    except config.ConfigError as exc:
+        typer.secho(str(exc), fg=typer.colors.RED, err=True)
+        raise typer.Exit(1)
+    typer.secho(f"Updated {key}: {old} -> {new} ({path})", fg=typer.colors.GREEN)

g3dt/cli/delete_cmds.py

@@ -0,0 +1,101 @@
+"""`g3dt delete` — destructive metadata removal (data-plane).
+
+A single ``delete metadata`` command handles one or many studies, sequentially,
+in a single job. ``--version`` is required: pass a specific version (e.g.
+``0.9.8``) to remove just that version (resolved via an Athena GUID lookup), or
+``all`` to remove every version.
+
+Every command confirms before acting. Production always requires typing the
+target id, even with ``--yes``. Deleting ALL versions always prompts, even with
+``--yes``. Confirmation happens locally before any EC2 dispatch (SSM has no
+TTY), after which the remote job runs non-interactively.
+"""
+from __future__ import annotations
+
+import typer
+
+from g3dt.cli._internal import dispatch, safety
+from g3dt.cli._internal.dispatch import Target
+from g3dt.cli._internal.resolve import study_of
+
+app = typer.Typer(no_args_is_help=True, help="Delete metadata from Gen3 (destructive).")
+
+_DELETE_METADATA = "services/delete/delete_metadata.sh"
+
+
+@app.command()
+def metadata(
+    studies: str = typer.Option(
+        ..., "--studies", help="Comma-separated studies, e.g. ausdiab,caughtcad."
+    ),
+    env: str = typer.Option(..., "--env", "-e", help="Environment, e.g. test."),
+    version: str = typer.Option(
+        None,
+        "--version",
+        help="Metadata version to delete, e.g. 0.9.8, or 'all' for every version.",
+    ),
+    node: str = typer.Option(None, "--node", help="Delete only this node type."),
+    yes: bool = typer.Option(
+        False, "--yes", "-y", help="Skip the non-prod prompt (specific-version only)."
+    ),
+    on: Target = typer.Option(Target.local, "--on", help="Run local or on ec2."),
+) -> None:
+    """Delete study metadata for one or more studies, sequentially, in one job.
+
+    Studies are processed one at a time. A study that exists but has no data at
+    the requested version is skipped, and the job continues to the next study.
+    """
+    if version is None:
+        typer.secho(
+            "--version is required: specify a version (e.g. 0.9.8) or 'all' "
+            "to delete every version.",
+            fg=typer.colors.RED,
+            err=True,
+        )
+        raise typer.Exit(2)
+
+    names = [s.strip() for s in studies.split(",") if s.strip()]
+    keys = [study_of(name, env).key for name in names]
+    target = ",".join(keys)
+    all_versions = version.strip().lower() == "all"
+
+    if all_versions:
+        # Deleting every version is the most destructive path: always prompt
+        # (pass assume_yes=False so --yes can't bypass it; prod still types the
+        # target).
+        safety.confirm_destructive("deletion of ALL VERSIONS", target, env, False)
+    else:
+        safety.confirm_destructive(f"deletion of v{version}", target, env, yes)
+
+    def build_args(env_name):
+        a = [
+            "--studies",
+            target,
+            "--env",
+            env_name,
+            "--version",
+            "all" if all_versions else version,
+        ]
+        if node:
+            a += ["--node", node]
+        return a
+
+    def remote_cli(env_name):
+        # --yes: confirmation already happened locally; the remote job must
+        # not prompt (SSM has no TTY). The remote re-check is version-specific
+        # only, and 'all' was already confirmed above.
+        a = [
+            "delete", "metadata",
+            "--studies", studies,
+            "--env", env_name,
+            "--version", "all" if all_versions else version,
+            "--yes",
+        ]
+        if node:
+            a += ["--node", node]
+        return a
+
+    dispatch.run_or_dispatch(
+        on, env, _DELETE_METADATA, build_args, "delete-metadata",
+        interpreter="bash", remote_cli=remote_cli,
+    )

g3dt/cli/dict_cmds.py

@@ -0,0 +1,102 @@
+"""`g3dt dict` — data dictionary operations (pull / upload / deploy).
+
+All local: dictionary deploy restarts Gen3 schema microservices via the ArgoCD
+SSO browser flow, which only works interactively on the laptop.
+
+The schema repo is an env input (``app/schema_repo`` in SSM), so any project
+can point at its own dictionary repo. Downloads land in ``~/.g3dt/schemas/``
+(the toolkit is installable-only — nothing is written into the package).
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import typer
+
+from g3dt.config import script_env
+from g3dt.cli._internal import runner
+from g3dt.cli._internal.resolve import env_of
+
+app = typer.Typer(no_args_is_help=True, help="Data dictionary operations (local).")
+
+#: Raw-GitHub URL template; the trailing path is the schema repo's layout
+#: convention (see AustralianBioCommons/acdc-schema-json), not a project name.
+_DICT_URL_TMPL = (
+    "https://raw.githubusercontent.com/{repo}/"
+    "refs/tags/{version}/dictionary/prod_dict/acdc_schema.json"
+)
+
+SCHEMA_DIR = Path("~/.g3dt/schemas").expanduser()
+
+
+def _version(env_cfg, override):
+    return override or env_cfg.dictionary_version
+
+
+def dict_url(env_cfg, version: str) -> str:
+    return _DICT_URL_TMPL.format(repo=env_cfg.schema_repo, version=version)
+
+
+@app.command()
+def pull(
+    env: str = typer.Option(..., "--env", "-e", help="Environment, e.g. test."),
+    version: str = typer.Option(
+        None, "--version", help="Dictionary git tag (default: the env's version)."
+    ),
+) -> None:
+    """Download the dictionary JSON from the env's schema repo.
+
+    Examples:
+      g3dt dict pull --env test
+      g3dt dict pull --env staging --version v1.1.5
+    """
+    e = env_of(env)
+    url = dict_url(e, _version(e, version))
+    runner.run(
+        runner.bash_script("services/dictionary/pull_dict.sh", url),
+        env=script_env(e),
+    )
+
+
+@app.command()
+def upload(
+    env: str = typer.Option(..., "--env", "-e", help="Environment, e.g. test."),
+    version: str = typer.Option(
+        None, "--version", help="Dictionary git tag (default: the env's version)."
+    ),
+) -> None:
+    """Upload the (already pulled) dictionary JSON to the env's S3 location."""
+    e = env_of(env)
+    v = _version(e, version)
+    local_file = str(SCHEMA_DIR / f"acdc_schema_{v}.json")
+    s3_uri = f"s3://{e.schema_s3_uri}"
+    args = [local_file, s3_uri]
+    if e.aws_profile:
+        args.append(e.aws_profile)
+    runner.run(
+        runner.python_script("services/dictionary/upload_dictionary.py", *args),
+        env=script_env(e),
+    )
+
+
+@app.command()
+def deploy(
+    env: str = typer.Option(..., "--env", "-e", help="Environment, e.g. test."),
+) -> None:
+    """Pull + upload the dictionary and restart Gen3 schema microservices.
+
+    Wraps services/dictionary/deploy_dd.sh. Requires an interactive ArgoCD SSO
+    login, so it runs locally only.
+
+    The deployed version is the env's `dictionary_version` — a CDK INPUT. To
+    change it, edit config/<project>.<env>.json in gen3-aws-data-pipeline and
+    `cdk deploy` (the value flows to SSM), then re-run this command.
+
+    Examples:
+      g3dt dict deploy --env test
+    """
+    e = env_of(env)
+    runner.run(
+        runner.bash_script("services/dictionary/deploy_dd.sh", env),
+        env=script_env(e),
+    )

g3dt/cli/ec2_cmds.py

@@ -0,0 +1,114 @@
+"""`g3dt ec2` — manage the env's EC2 job box (up / down / status).
+
+The box is created per environment by the CDK (ec2-job-runner stack) and is
+SSM-managed: no SSH key or bootstrap script is needed. Its instance id is
+resolved from the env's own SSM tree (``ec2/instanceId``), so targeting
+another environment's box is structurally impossible.
+"""
+from __future__ import annotations
+
+import time
+
+import typer
+
+from g3dt import config
+from g3dt.cli._internal.resolve import env_of
+from g3dt.upload.metadata_submitter import create_boto3_session
+
+app = typer.Typer(no_args_is_help=True, help="Manage the env's EC2 job box.")
+
+
+def _resolve(env: str):
+    """Return ``(auth_env, instance_id)`` for the env's box."""
+    e = env_of(config.env_base(env))
+    if not e.ec2_instance_id:
+        typer.secho(
+            f"No ec2/instanceId published for env '{e.name}'. Has the "
+            f"ec2-job-runner stack been deployed? (cdk deploy in "
+            f"gen3-aws-data-pipeline)",
+            fg=typer.colors.RED,
+            err=True,
+        )
+        raise typer.Exit(2)
+    return e, e.ec2_instance_id
+
+
+def _session(e):
+    return create_boto3_session(aws_profile=e.aws_profile, aws_region=e.region)
+
+
+@app.command()
+def up(
+    env: str = typer.Option(..., "--env", "-e", help="Environment, e.g. test."),
+    wait: bool = typer.Option(
+        True, "--wait/--no-wait", help="Wait until the box registers with SSM."
+    ),
+) -> None:
+    """Start the env's job box and print how to reach it.
+
+    Plain ``start_instances`` — the box was fully bootstrapped by CDK
+    user-data (toolkit installed, marker written), so there is nothing to
+    re-provision. Normal access is SSM (no SSH); a session command is printed
+    as soon as the box is reachable.
+    """
+    e, instance_id = _resolve(env)
+    session = _session(e)
+    session.client("ec2").start_instances(InstanceIds=[instance_id])
+    typer.secho(f"Start requested for {instance_id} ({e.name}).", fg=typer.colors.GREEN)
+    if not wait:
+        return
+
+    ssm = session.client("ssm")
+    typer.echo("Waiting for the box to register with SSM...")
+    for _ in range(60):  # up to ~5 minutes
+        info = ssm.describe_instance_information(
+            Filters=[{"Key": "InstanceIds", "Values": [instance_id]}]
+        ).get("InstanceInformationList", [])
+        if info and info[0].get("PingStatus") == "Online":
+            profile = f" --profile {e.aws_profile}" if e.aws_profile else ""
+            typer.secho(f"{instance_id} is reachable.", fg=typer.colors.GREEN)
+            typer.echo("  session : aws ssm start-session "
+                       f"--target {instance_id}{profile}")
+            typer.echo(f"  dispatch: g3dt <cmd> --env {config.env_base(env)} --on ec2")
+            return
+        time.sleep(5)
+    typer.secho(
+        f"{instance_id} started but has not registered with SSM yet; "
+        f"check `g3dt ec2 status --env {env}` in a minute.",
+        fg=typer.colors.YELLOW,
+    )
+
+
+@app.command()
+def down(
+    env: str = typer.Option(..., "--env", "-e", help="Environment, e.g. test."),
+) -> None:
+    """Stop the env's job box.
+
+    (An idle box also stops itself: the CDK auto-stop alarm fires after 24h
+    under 1% CPU.)
+    """
+    e, instance_id = _resolve(env)
+    _session(e).client("ec2").stop_instances(InstanceIds=[instance_id])
+    typer.secho(f"Stop requested for {instance_id}.", fg=typer.colors.GREEN)
+
+
+@app.command()
+def status(
+    env: str = typer.Option(..., "--env", "-e", help="Environment, e.g. test."),
+) -> None:
+    """Show the box's EC2 state and SSM reachability."""
+    e, instance_id = _resolve(env)
+    session = _session(e)
+    resp = session.client("ec2").describe_instances(InstanceIds=[instance_id])
+    state = "unknown"
+    for res in resp.get("Reservations", []):
+        for inst in res.get("Instances", []):
+            state = inst.get("State", {}).get("Name", "unknown")
+    ssm_state = "not registered"
+    info = session.client("ssm").describe_instance_information(
+        Filters=[{"Key": "InstanceIds", "Values": [instance_id]}]
+    ).get("InstanceInformationList", [])
+    if info:
+        ssm_state = f"ssm {info[0].get('PingStatus', 'unknown').lower()}"
+    typer.echo(f"{instance_id}: {state} ({ssm_state})")

g3dt/cli/indexd_cmds.py

@@ -0,0 +1,57 @@
+"""`g3dt indexd` — register S3 files with Gen3 indexd (data-plane).
+
+Long-running, so it supports ``--on ec2``.
+"""
+from __future__ import annotations
+
+from typing import List
+
+import typer
+
+from g3dt.cli._internal import dispatch
+from g3dt.cli._internal.dispatch import Target
+from g3dt.cli._internal.resolve import study_of
+
+app = typer.Typer(no_args_is_help=True, help="Register files with Gen3 indexd.")
+
+_REGISTER = "services/indexd/register_indexd.py"
+
+
+@app.command()
+def register(
+    s3_paths: List[str] = typer.Option(
+        ..., "--s3-paths", help="One or more S3 prefixes to scan (repeatable)."
+    ),
+    study: str = typer.Option(..., "--study", "-s", help="Study, e.g. edcad."),
+    env: str = typer.Option(..., "--env", "-e", help="Environment, e.g. test."),
+    dry_run: bool = typer.Option(
+        False, "--dry-run", help="Scan + write file_metadata only; skip indexd."
+    ),
+    on: Target = typer.Option(Target.local, "--on", help="Run local or on ec2."),
+) -> None:
+    """Scan S3 prefixes and register the files with Gen3 indexd.
+
+    Examples:
+      g3dt indexd register --s3-paths s3://bucket/edcad/ --study edcad --env staging
+      g3dt indexd register --s3-paths s3://b/a/ --s3-paths s3://b/c/ --study edcad --env staging --on ec2
+    """
+    s = study_of(study, env)
+
+    def build_args(env_name):
+        a = ["--s3-paths", *s3_paths, "--study", s.key, "--env", env_name]
+        if dry_run:
+            a.append("--dry-run")
+        return a
+
+    def remote_cli(env_name):
+        a: list = ["indexd", "register"]
+        for p in s3_paths:
+            a += ["--s3-paths", p]
+        a += ["--study", study, "--env", env_name]
+        if dry_run:
+            a.append("--dry-run")
+        return a
+
+    dispatch.run_or_dispatch(
+        on, env, _REGISTER, build_args, "indexd-register", remote_cli=remote_cli,
+    )