Implement real AWS infrastructure provisioner

[LahkLeKey]

Closes: #19

Summary

Implements AwsProvisioner to create actual cloud resources on AWS. This completes the infrastructure provisioning layer and enables real cloud deployments. Phase 4 of the implementation roadmap.

Changes

• src/aws/index.ts (170 lines) — AwsProvisioner class
  • RDS database creation with secure password generation
  • Route53 DNS record management
  • Secrets Manager credential storage
  • ALB ingress provisioning
  • Resource cleanup and error handling
• src/aws/index.test.ts (110 lines) — 4 tests
  • Database provisioning test
  • Password generation test
  • External references structure test
  • Optional field handling test
• src/aws/README.md — Comprehensive documentation
  • AWS setup and permissions
  • Configuration examples
  • IAM policy JSON for required permissions
  • Environment variables reference
• src/aws/aws.ts — Public exports

Architecture

• Uses modular AWS SDK v3 (@aws-sdk/client-rds, @aws-sdk/client-route-53, etc.)
• Implements InfrastructureService interface from src/infrastructure/index.ts
• Automatic resource tagging with DeploymentId
• Graceful error handling and cleanup

Features

• RDS PostgreSQL — Creates db.t3.micro instances with secure passwords
• Route53 — Manages DNS records for deployments
• Secrets Manager — Stores database passwords and API keys
• ALB — Configures application load balancers for ingress
• Teardown — Cleanup method with cascade deletion

Dependencies

Added minimal AWS SDK v3 modules:

• @aws-sdk/client-rds
• @aws-sdk/client-route-53
• @aws-sdk/client-secrets-manager
• @aws-sdk/client-elastic-load-balancing-v2

These are modular and small (only import what's needed).

Testing

npm test
# Output: 18 passing tests (14 existing + 4 new)

Usage

import {AwsProvisioner} from './src/aws/index.ts';

const provisioner = new AwsProvisioner({
  region: 'us-east-1',
  accountId: '123456789012',
  hostedZoneId: 'Z1234567890ABC',
});

const result = await provisioner.provision({
  deploymentId: 'customer-acme',
  target: {
    region: 'us-east-1',
    createDatabase: true,
    createIngress: true,
    createDns: true,
    createSecrets: true,
  },
});

console.log(result.externalReferences);
// {
//   database: 'kloak-db-xxx.rds.amazonaws.com',
//   database_port: '5432',
//   database_password: '...',
//   secrets_arn: 'arn:aws:secretsmanager:...',
//   dns_record: 'customer-acme.example.com',
//   ingress_type: 'ALB',
// }

AWS IAM Permissions Required

See src/aws/README.md for full IAM policy. Requires:

• rds:* on kloak-* database instances
• route53:* on hosted zones
• secretsmanager:* on kloak/* secrets

Next Steps

• Phase 5: Deployment pipeline (Docker, Kubernetes, CI/CD)

[Copilot]

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.