pulse-engine 0.2.44__tar.gz → 0.2.44.dev20260827140240__tar.gz

{pulse_engine-0.2.44 → pulse_engine-0.2.44.dev20260827140240}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pulse-engine
-Version: 0.2.44
+Version: 0.2.44.dev20260827140240
 Summary: Pulse Engine — Hybrid framework for building Pulse products
 Author: Pulse Team
 Requires-Python: >=3.11,<3.13
@@ -101,7 +101,8 @@ git clone <repo-url> && cd pulse-engine
 # Install deps and pre-commit hooks
 make install
 
-# Copy env and configure
+# Copy env and configure — or, if you have AWS access, pull a real one from
+# Secrets Manager instead: ./scripts/fetch-secrets.sh dev
 cp .env.example .env
 
 # Run database migrations
@@ -318,7 +319,15 @@ Runs on push to `dev`, `uat`, `prod`:
 
 The pipeline: test → publish to PyPI → build Docker → push ECR → deploy → health check.
 
-Terraform runs separately on `infra/terraform/**` changes: plan → apply → sync outputs to GitHub Secrets (pipeline infra vars auto-flow to `.env` on next deploy).
+For `dev`/`staging`, the deploy step fetches the app's `.env` from AWS Secrets Manager
+(`<env>/pulse_engine`) directly on the target VM over SSH, using that instance's IAM role —
+not GitHub Secrets. AWS API access (S3, Athena, etc.) also comes from the instance role via
+boto3's default credential chain; no static `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` are
+provisioned anywhere in this pipeline. `prod` deploys to ECS instead (see `deploy-ecs` job in
+`deploy.yml`); its task definition env vars are still populated by Terraform
+(`infra/terraform/**`), a separate mechanism not covered by the Secrets Manager fetch above.
+
+Terraform runs separately on `infra/terraform/**` changes: plan → apply.
 
 ### Required Secrets (per GitHub environment)
 
@@ -356,8 +365,11 @@ Products register additional tools via `mcp_tool_modules` in the manifest.
 | `APP_VERSION` | No | `0.1.0` | Application version |
 | `LOG_LEVEL` | No | `INFO` | Logging level |
 | `AWS_REGION` | Yes | `ap-south-1` | AWS region |
-| `AWS_ACCESS_KEY_ID` | No | — | AWS credentials (use IAM role in production) |
-| `AWS_SECRET_ACCESS_KEY` | No | — | AWS credentials (use IAM role in production) |
+
+AWS API access (S3, Athena, Cognito, Secrets Manager) is resolved via boto3's default
+credential chain — the EC2/ECS instance role in deployed environments, or your local
+`aws configure`/`AWS_PROFILE` for local dev. There is no `AWS_ACCESS_KEY_ID`/
+`AWS_SECRET_ACCESS_KEY` config; static keys are not supported.
 
 ### Authentication (Cognito)
 
@@ -390,10 +402,11 @@ Products register additional tools via `mcp_tool_modules` in the manifest.
 
 ### Athena
 
+Uses the same default credential chain / instance role as core AWS access above — no
+separate Athena credentials.
+
 | Variable | Required | Default | Description |
 |----------|----------|---------|-------------|
-| `ATHENA_AWS_ACCESS_KEY_ID` | No | — | Athena-specific AWS credentials |
-| `ATHENA_AWS_SECRET_ACCESS_KEY` | No | — | Athena-specific AWS credentials |
 | `ATHENA_OUTPUT_LOCATION` | Yes* | — | S3 URI for Athena query results |
 | `ATHENA_WORKGROUP` | No | `primary` | Athena workgroup |
 | `ATHENA_QUERY_TIMEOUT_SECONDS` | No | `60` | Athena query timeout |
@@ -440,7 +453,10 @@ Products register additional tools via `mcp_tool_modules` in the manifest.
 
 ### Pipeline Infrastructure (from Terraform)
 
-These are auto-synced from Terraform outputs to GitHub Secrets, then written to `.env` at deploy time:
+For `dev`/`staging`, these values live in the `<env>/pulse_engine` Secrets Manager secret
+(fetched into `.env` at deploy time — see CI/CD above); Terraform outputs must be synced into
+that secret by hand when infra changes. For `prod`, they're set directly on the ECS task
+definition by Terraform (`infra/terraform/environments/prod/main.tf`).
 
 | Variable | Description |
 |----------|-------------|

{pulse_engine-0.2.44 → pulse_engine-0.2.44.dev20260827140240}/README.md

@@ -47,7 +47,8 @@ git clone <repo-url> && cd pulse-engine
 # Install deps and pre-commit hooks
 make install
 
-# Copy env and configure
+# Copy env and configure — or, if you have AWS access, pull a real one from
+# Secrets Manager instead: ./scripts/fetch-secrets.sh dev
 cp .env.example .env
 
 # Run database migrations
@@ -264,7 +265,15 @@ Runs on push to `dev`, `uat`, `prod`:
 
 The pipeline: test → publish to PyPI → build Docker → push ECR → deploy → health check.
 
-Terraform runs separately on `infra/terraform/**` changes: plan → apply → sync outputs to GitHub Secrets (pipeline infra vars auto-flow to `.env` on next deploy).
+For `dev`/`staging`, the deploy step fetches the app's `.env` from AWS Secrets Manager
+(`<env>/pulse_engine`) directly on the target VM over SSH, using that instance's IAM role —
+not GitHub Secrets. AWS API access (S3, Athena, etc.) also comes from the instance role via
+boto3's default credential chain; no static `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` are
+provisioned anywhere in this pipeline. `prod` deploys to ECS instead (see `deploy-ecs` job in
+`deploy.yml`); its task definition env vars are still populated by Terraform
+(`infra/terraform/**`), a separate mechanism not covered by the Secrets Manager fetch above.
+
+Terraform runs separately on `infra/terraform/**` changes: plan → apply.
 
 ### Required Secrets (per GitHub environment)
 
@@ -302,8 +311,11 @@ Products register additional tools via `mcp_tool_modules` in the manifest.
 | `APP_VERSION` | No | `0.1.0` | Application version |
 | `LOG_LEVEL` | No | `INFO` | Logging level |
 | `AWS_REGION` | Yes | `ap-south-1` | AWS region |
-| `AWS_ACCESS_KEY_ID` | No | — | AWS credentials (use IAM role in production) |
-| `AWS_SECRET_ACCESS_KEY` | No | — | AWS credentials (use IAM role in production) |
+
+AWS API access (S3, Athena, Cognito, Secrets Manager) is resolved via boto3's default
+credential chain — the EC2/ECS instance role in deployed environments, or your local
+`aws configure`/`AWS_PROFILE` for local dev. There is no `AWS_ACCESS_KEY_ID`/
+`AWS_SECRET_ACCESS_KEY` config; static keys are not supported.
 
 ### Authentication (Cognito)
 
@@ -336,10 +348,11 @@ Products register additional tools via `mcp_tool_modules` in the manifest.
 
 ### Athena
 
+Uses the same default credential chain / instance role as core AWS access above — no
+separate Athena credentials.
+
 | Variable | Required | Default | Description |
 |----------|----------|---------|-------------|
-| `ATHENA_AWS_ACCESS_KEY_ID` | No | — | Athena-specific AWS credentials |
-| `ATHENA_AWS_SECRET_ACCESS_KEY` | No | — | Athena-specific AWS credentials |
 | `ATHENA_OUTPUT_LOCATION` | Yes* | — | S3 URI for Athena query results |
 | `ATHENA_WORKGROUP` | No | `primary` | Athena workgroup |
 | `ATHENA_QUERY_TIMEOUT_SECONDS` | No | `60` | Athena query timeout |
@@ -386,7 +399,10 @@ Products register additional tools via `mcp_tool_modules` in the manifest.
 
 ### Pipeline Infrastructure (from Terraform)
 
-These are auto-synced from Terraform outputs to GitHub Secrets, then written to `.env` at deploy time:
+For `dev`/`staging`, these values live in the `<env>/pulse_engine` Secrets Manager secret
+(fetched into `.env` at deploy time — see CI/CD above); Terraform outputs must be synced into
+that secret by hand when infra changes. For `prod`, they're set directly on the ECS task
+definition by Terraform (`infra/terraform/environments/prod/main.tf`).
 
 | Variable | Description |
 |----------|-------------|

{pulse_engine-0.2.44 → pulse_engine-0.2.44.dev20260827140240}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "pulse-engine"
-version = "0.2.44"
+version = "0.2.44.dev20260827140240"
 description = "Pulse Engine — Hybrid framework for building Pulse products"
 authors = ["Pulse Team"]
 readme = "README.md"

{pulse_engine-0.2.44 → pulse_engine-0.2.44.dev20260827140240}/src/pulse_engine/config.py

@@ -9,9 +9,8 @@ class Settings(BaseSettings):
     debug: bool = False
     log_level: str = "INFO"
 
-    # AWS core credentials
-    aws_access_key_id: str = ""
-    aws_secret_access_key: str = ""
+    # AWS core credentials — resolved via boto3's default credential chain
+    # (env vars → shared config → EC2/ECS instance role). No static keys here.
     aws_region: str = "ap-south-1"
     cognito_user_pool_id: str = ""
     cognito_app_client_id: str = ""
@@ -29,9 +28,9 @@ class Settings(BaseSettings):
     prefect_api_url: str = ""
     prefect_database_url: str = ""
 
-    # Athena (separate credentials — product specifies which database)
-    athena_aws_access_key_id: str = ""
-    athena_aws_secret_access_key: str = ""
+    # Athena (product specifies which database). Credentials also come from
+    # boto3's default credential chain — same instance role as core AWS access,
+    # not a separate static key pair.
     athena_output_location: str = ""
     athena_workgroup: str = "primary"
     athena_query_timeout_seconds: int = 60

{pulse_engine-0.2.44 → pulse_engine-0.2.44.dev20260827140240}/src/pulse_engine/services/bootstrap.py

@@ -100,8 +100,6 @@ async def bootstrap_services(
         athena_client = boto3.client(
             "athena",
             region_name=settings.aws_region,
-            aws_access_key_id=settings.athena_aws_access_key_id or None,
-            aws_secret_access_key=settings.athena_aws_secret_access_key or None,
         )
         athena_connector = AthenaConnector(
             athena_client=athena_client,
@@ -129,8 +127,6 @@ async def bootstrap_services(
         s3_client = boto3.client(
             "s3",
             region_name=settings.aws_region,
-            aws_access_key_id=settings.aws_access_key_id or None,
-            aws_secret_access_key=settings.aws_secret_access_key or None,
         )
 
     # Job token issuer