feat(deps): move boto3 to [aws] optional extra

boto3 and botocore removed from core dependencies and moved to a
new [aws] optional extra, making provider SDK dependencies opt-in.

- Add [aws] extra: boto3>=1.42.21, botocore>=1.42.21
- Add [all-providers] meta-extra (references [aws])
- Add [monitoring-aws] extra (AWS OTel boto instrumentation)
- Add [test-aws] extra (moto + response mocking)
- Remove opentelemetry-instrumentation-boto from [monitoring]
- Update [all] to include [all-providers]
- Update [dev] shim to include [all-providers]
- Guard 3 module-level import leaks with try/except ImportError
- Guard tests/conftest.py bare boto3 import; add AWS_AVAILABLE flag
- Add auto-skip for AWS provider tests when [aws] not installed
- Add architecture test for boto3 leak detection outside providers/aws/
- Add unit tests verifying core modules boot without [aws] extra
- Bump version to 1.7.0 (breaking: boto3 no longer in core)
- Update README with per-provider install matrix
- Regenerate uv.lock

Author: fgogolli

CHANGELOG.md

@@ -6,6 +6,33 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 <!-- insertion marker -->
+## [1.7.0] — Breaking Change
+
+### Breaking Changes
+
+- `boto3` and `botocore` removed from core `[project.dependencies]`.
+  Install `orb-py[aws]` (or `orb-py[all]`) to restore the previous behaviour.
+  Plain `pip install orb-py` no longer installs the AWS SDK.
+
+### Added
+
+- New `[aws]` extra: `boto3>=1.42.21`, `botocore>=1.42.21`.
+- New `[all-providers]` meta-extra: pulls in all currently implemented providers.
+- New `[monitoring-aws]` extra: AWS-specific OpenTelemetry boto instrumentation (previously bundled inside `[monitoring]`).
+- New `[test-aws]` extra: moto + response-mocking deps for AWS test suites.
+- Architecture test `test_boto3_leak_detection.py`: asserts boto3/botocore are never imported outside `providers/aws/`.
+- Unit tests `test_no_provider_install.py`: verifies ORB core modules boot cleanly when `[aws]` extra is absent.
+
+### Changed
+
+- `[monitoring]` extra no longer includes `opentelemetry-instrumentation-boto` (use `[monitoring-aws]`).
+- `[all]` extra now includes `[all-providers]` so `pip install orb-py[all]` still pulls everything.
+- `[dev]` shim extra now includes `[all-providers]` for full local development.
+- Three module-level import leaks fixed with `try/except ImportError` guards:
+  `config/schemas/cleanup_schema.py`, `infrastructure/storage/registration.py`,
+  `providers/registration.py` (deprecated shims).
+- `tests/conftest.py`: bare `import boto3` replaced with guarded `AWS_AVAILABLE` flag; AWS provider tests auto-skip when `[aws]` extra is absent.
+
 ## Unreleased
 
 <small>[Compare with latest](https://github.com/awslabs/open-resource-broker/compare/v0.1.0rc0...HEAD)</small>

README.md

@@ -83,12 +83,36 @@ Get ORB installed and configured for your environment.
 <details>
 <summary>Installation</summary>
 
-### Standard install
+### Standard install (core only — no provider)
 
 ```bash
 pip install orb-py
 ```
 
+ORB boots cleanly with no provider registered.  Any command that needs a provider
+will return a clear "no provider configured" error rather than an ImportError.
+
+### Per-provider install
+
+```bash
+pip install "orb-py[aws]"          # AWS provider (boto3 + botocore)
+pip install "orb-py[aws,cli]"      # AWS provider + colored CLI output
+pip install "orb-py[aws,api]"      # AWS provider + REST API server
+pip install "orb-py[monitoring-aws]"  # AWS provider + full monitoring stack
+pip install "orb-py[all]"          # All providers + all features
+```
+
+### Provider extras matrix
+
+| Use case | Install command |
+|----------|----------------|
+| Core only (no provider) | `pip install orb-py` |
+| AWS operator | `pip install "orb-py[aws]"` |
+| AWS + colored CLI | `pip install "orb-py[aws,cli]"` |
+| AWS + REST API | `pip install "orb-py[aws,api]"` |
+| AWS + monitoring | `pip install "orb-py[monitoring-aws]"` |
+| Full (all providers + features) | `pip install "orb-py[all]"` |
+
 ### With colored CLI output
 
 ```bash

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "orb-py"
-version = "1.6.2"
+version = "1.7.0"
 description = "Open Resource Broker (ORB) — dynamic cloud resource provisioning via CLI and REST API"
 readme = "README.md"
 license = "Apache-2.0"
@@ -42,9 +42,7 @@ classifiers = [
 requires-python = ">=3.10"
 
 dependencies = [
-    # Core dependencies (always needed)
-    "boto3>=1.42.21",
-    "botocore>=1.42.21",
+    # Core dependencies (always needed, never provider-specific)
     "pydantic>=2.0.0",
     "pydantic-settings>=2.0.0",
     "sqlalchemy>=2.0.0",
@@ -58,6 +56,30 @@ dependencies = [
 ]
 
 [project.optional-dependencies]
+# ── Provider extras ────────────────────────────────────────────────────────
+# AWS provider — boto3 and botocore (moved from core in 1.7.0; breaking change)
+aws = [
+    "boto3>=1.42.21",
+    "botocore>=1.42.21",
+]
+
+# Placeholder entries for future providers (add when provider is implemented)
+# azure = [
+#     "azure-mgmt-compute>=30.0.0",
+#     "azure-identity>=1.15.0",
+#     "azure-mgmt-network>=25.0.0",
+# ]
+# gcp = [
+#     "google-cloud-compute>=1.14.0",
+#     "google-auth>=2.23.0",
+# ]
+
+# Meta-extra: all currently implemented providers
+all-providers = [
+    "orb-py[aws]",
+]
+
+# ── Feature extras ─────────────────────────────────────────────────────────
 # CLI enhancements (colored output)
 cli = [
     "rich>=13.3.0",
@@ -72,20 +94,34 @@ api = [
     "jinja2>=3.1.0",
 ]
 
-# Monitoring & observability (for API/production deployments)
+# Monitoring & observability (provider-neutral — no boto3 instrumentation here)
 monitoring = [
     "opentelemetry-api>=1.20.0",
     "opentelemetry-sdk>=1.20.0",
     "opentelemetry-instrumentation-fastapi>=0.41b0",
-    "opentelemetry-instrumentation-boto>=0.41b0",
     "opentelemetry-instrumentation-sqlalchemy>=0.41b0",
     "prometheus-client>=0.17.0",
     "psutil>=5.9.0",
 ]
 
-# All optional features
+# AWS-specific monitoring (boto3 instrumentation; requires [aws])
+monitoring-aws = [
+    "orb-py[aws,monitoring]",
+    "opentelemetry-instrumentation-boto>=0.41b0",
+]
+
+# All optional features (providers + features)
 all = [
-    "orb-py[cli,api,monitoring]",
+    "orb-py[cli,api,monitoring,all-providers]",
+]
+
+# ── Test extras ────────────────────────────────────────────────────────────
+# AWS test dependencies — moto + response mocking
+test-aws = [
+    "orb-py[aws]",
+    "moto[ec2,iam,ec2instanceconnect,autoscaling,ssm,dynamodb,sts,sqs,sns]>=5.1.19,<6.0.0",
+    "responses>=0.24.0,<1.0.0",
+    "requests-mock>=1.11.0,<2.0.0",
 ]
 
 # ---------------------------------------------------------------------------
@@ -151,7 +187,7 @@ ci = [
     "wheel>=0.41.3,<1.0.0",
 ]
 dev = [
-    "orb-py[ci]",
+    "orb-py[ci,all-providers]",
     "virtualenv>=20.26.6",
     "pre-commit>=3.5.0,<5.0.0",
     "bump2version>=1.0.1,<2.0.0",

src/orb/config/schemas/cleanup_schema.py

@@ -1,8 +1,17 @@
-"""Re-export shim — CleanupConfig has moved to orb.providers.aws.configuration.cleanup_config."""
+"""Re-export shim — CleanupConfig has moved to orb.providers.aws.configuration.cleanup_config.
 
-from orb.providers.aws.configuration.cleanup_config import (
-    CleanupConfig,
-    CleanupResourcesConfig,
-)
+Note: This shim imports from the AWS provider package.  When the [aws] extra is not
+installed, CleanupConfig and CleanupResourcesConfig are set to None.  Phase 2 of the
+provider-extras migration will invert this dependency so the models live in core.
+"""
+
+try:
+    from orb.providers.aws.configuration.cleanup_config import (
+        CleanupConfig,
+        CleanupResourcesConfig,
+    )
+except ImportError:
+    CleanupConfig = None  # type: ignore[assignment,misc]
+    CleanupResourcesConfig = None  # type: ignore[assignment,misc]
 
 __all__ = ["CleanupConfig", "CleanupResourcesConfig"]

src/orb/infrastructure/storage/registration.py

@@ -22,9 +22,12 @@ def register_all_storage_types() -> None:
 
     register_sql_storage()
 
-    from orb.providers.aws.storage.registration import register_dynamodb_storage
+    try:
+        from orb.providers.aws.storage.registration import register_dynamodb_storage
 
-    register_dynamodb_storage()
+        register_dynamodb_storage()
+    except ImportError:
+        pass  # [aws] extra not installed; DynamoDB storage unavailable
 
 
 def get_available_storage_types() -> list:

src/orb/providers/registration.py

@@ -91,10 +91,14 @@ def register_all_provider_cli_specs() -> None:
     ``cli/args.py`` and other early-bootstrap callers continue to work.
     """
     from orb.domain.base.ports.provider_cli_spec_port import CLISpecRegistry
-    from orb.providers.aws.cli.aws_cli_spec import AWSCLISpec
 
-    if CLISpecRegistry.get("aws") is None:
-        CLISpecRegistry.register("aws", AWSCLISpec())
+    try:
+        from orb.providers.aws.cli.aws_cli_spec import AWSCLISpec
+
+        if CLISpecRegistry.get("aws") is None:
+            CLISpecRegistry.register("aws", AWSCLISpec())
+    except ImportError:
+        pass  # [aws] extra not installed; AWS CLI spec unavailable
 
 
 def register_all_defaults_loaders() -> None:
@@ -112,9 +116,12 @@ def register_all_defaults_loaders() -> None:
     from orb.providers.registry.defaults_loader_registry import DefaultsLoaderRegistry
 
     if DefaultsLoaderRegistry.get("aws") is None:
-        from orb.providers.aws.defaults_loader import AWSDefaultsLoader
+        try:
+            from orb.providers.aws.defaults_loader import AWSDefaultsLoader
 
-        DefaultsLoaderRegistry.register("aws", AWSDefaultsLoader())
+            DefaultsLoaderRegistry.register("aws", AWSDefaultsLoader())
+        except ImportError:
+            pass  # [aws] extra not installed; AWS defaults loader unavailable
 
 
 def register_fallback_provider(

tests/conftest.py

@@ -64,9 +64,23 @@ def pytest_collection_modifyitems(config, items):
     skip_mocked = pytest.mark.skip(reason="moto tests skipped — remove --no-mocked to run")
     skip_provider = pytest.mark.skip(reason=f"filtered to --provider {provider_filter}")
 
+    # Auto-skip AWS provider tests when boto3 is not installed
+    try:
+        import boto3 as _boto3  # noqa: F401
+
+        aws_available = True
+    except ImportError:
+        aws_available = False
+
+    skip_no_aws = pytest.mark.skip(reason="[aws] extra not installed — boto3 unavailable")
+
     for item in items:
         path = str(item.fspath)
 
+        # Auto-skip AWS provider tests when [aws] extra is not installed
+        if not aws_available and "/providers/aws/" in path:
+            item.add_marker(skip_no_aws)
+
         # Provider filter
         if provider_filter and f"/providers/{provider_filter}" not in path:
             if "/providers/" in path:
@@ -122,7 +136,12 @@ def mock_aws():  # type: ignore[misc]
         yield
 
 
-import boto3
+try:
+    import boto3
+
+    AWS_AVAILABLE = True
+except ImportError:
+    AWS_AVAILABLE = False
 
 from orb.config.manager import ConfigurationManager
 from orb.config.schemas.app_schema import AppConfig
@@ -286,18 +305,24 @@ def aws_mocks():
 @pytest.fixture
 def ec2_client(aws_mocks):
     """Create a mocked EC2 client."""
+    if not AWS_AVAILABLE:
+        pytest.skip("boto3 not installed — install [aws] extra")
     return boto3.client("ec2", region_name="us-east-1")
 
 
 @pytest.fixture
 def autoscaling_client(aws_mocks):
     """Create a mocked Auto Scaling client."""
+    if not AWS_AVAILABLE:
+        pytest.skip("boto3 not installed — install [aws] extra")
     return boto3.client("autoscaling", region_name="us-east-1")
 
 
 @pytest.fixture
 def ssm_client(aws_mocks):
     """Create a mocked SSM client."""
+    if not AWS_AVAILABLE:
+        pytest.skip("boto3 not installed — install [aws] extra")
     return boto3.client("ssm", region_name="us-east-1")
 
 

tests/unit/architecture/test_boto3_leak_detection.py

@@ -0,0 +1,59 @@
+"""Architecture test: boto3 and botocore must not be imported outside providers/aws/.
+
+Importing boto3 or botocore directly in core or infrastructure modules couples the
+entire application to the [aws] extra even when it is not installed.  All boto3/botocore
+usage must be confined to src/orb/providers/aws/.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from tests.unit.architecture.conftest import (
+    EXCEPTION_PATHS,
+    SRC_ORB,
+    collect_python_files,
+    extract_imports,
+)
+
+_PROVIDERS_AWS_DIR = SRC_ORB / "providers" / "aws"
+
+# All source files that live outside providers/aws/
+_NON_AWS_FILES = [
+    f
+    for f in collect_python_files(SRC_ORB)
+    if not f.is_relative_to(_PROVIDERS_AWS_DIR) and str(f) not in EXCEPTION_PATHS
+]
+
+# Top-level module names that constitute direct AWS SDK imports
+_AWS_SDK_MODULES = frozenset({"boto3", "botocore"})
+
+# Known violations — files currently allowed to import boto3/botocore outside providers/aws/.
+# This set should remain empty; add entries only as a last resort with a tracking comment.
+_KNOWN_VIOLATIONS: frozenset[tuple[str, str]] = frozenset()
+
+
+@pytest.mark.parametrize(
+    "filepath",
+    _NON_AWS_FILES,
+    ids=lambda p: str(p.relative_to(SRC_ORB)),
+)
+@pytest.mark.unit
+@pytest.mark.architecture
+def test_no_boto3_outside_aws_provider(filepath: Path) -> None:
+    """boto3/botocore imports must not appear outside src/orb/providers/aws/."""
+    rel = str(filepath.relative_to(SRC_ORB))
+    imports = extract_imports(filepath)
+    new_violations = [
+        imp
+        for imp in imports
+        if (imp in _AWS_SDK_MODULES or any(imp.startswith(f"{m}.") for m in _AWS_SDK_MODULES))
+        and (rel, imp) not in _KNOWN_VIOLATIONS
+    ]
+    assert new_violations == [], (
+        f"{rel} imports boto3/botocore outside providers/aws/ — "
+        f"move to providers/aws/ or guard with try/except ImportError. "
+        f"Violations: {new_violations}"
+    )