jerboa-aws

jerboa-aws is an experimental AWS API client library and CLI for Jerboa. It supports SigV4-signed requests across S3, EC2, IAM, STS, Lambda, CloudWatch, CloudFormation, DynamoDB, SNS, SQS, SSM, RDS, ELBv2, and related services.

Status

This repository is not production-supported yet. Treat it as a private/preview tool until the release gates in ~/Release-plan.md and ~/mine/jerboa-production-readiness.md are complete.

Security

jerboa-aws handles AWS access keys, secret keys, session tokens, signed requests, resource metadata, and service responses. Use short-lived role or SSO credentials where possible, avoid long-lived IAM user keys, and do not pass secrets in argv on shared systems.

Custom S3 endpoints require HTTPS. Plain HTTP exists only for local integration tests and requires all three of a canonical 127.x.y.z literal, path-style addressing, and the explicit allow-insecure-loopback: constructor flag. The HTTP client returns redirects to the caller and never forwards signed headers or session tokens to a redirect target.

Use jerboa-aws ssm put-parameter --value-stdin for parameter values, especially SecureString; the legacy --value form warns for secure values. PSSM strips remote terminal controls in human output, supports --literal-controls for visible \xNN rendering, and honors --no-color. Use --json when lossless remote output is required.

jerboa-aws ssmcp and jerboa-aws ssm cp recursively copy with host:path syntax: host:~/save ./foo downloads and ./foo host:/tmp/foo uploads through SSM RunCommand using tar/base64 chunks. Targets must already have the SSM agent plus sh, tar, base64, mkdir, and find.

Credential handling, logging expectations, and release requirements are documented in docs/credential-handling.md. SigV4 signing uses Jerboa's bundled Rust-backed native crypto; see docs/crypto-dependencies.md.

Build And Test

make test
make binary
make release-evidence

The Makefile bootstraps a pinned Jerboa toolchain into .jerboa/bin if no usable jerbuild is available.

Release evidence is written to dist/release-evidence/ and includes tests, binary smoke output, SBOM/dependency manifests, cargo audit status when available, and repeated binary reproducibility checks.

License

Apache-2.0.