name: "s3aas"
description: "Install the s3 PaaS into the metapaas control plane: registers the Python package, IAM permissions and dataplane version. The metapaas element itself stays PaaS-agnostic."
schema_version: 1
version: "0.0.4-rc+20260629135045.48052dea"
api_version: "v1"

requirements:
  core:
    from_version: "0.0.0"
  metapaas:
    from_version: "0.0.0"

resources:

  # Register the s3 PaaS type in metapaas. The db-back core-agent
  # (em_metapaas_types) reconciles this into the metapaas_paas_types table;
  # the PluginReconciler then pip-installs the package at runtime.
  $metapaas.types:
    s3:
      name: "s3"
      element_name: "s3aas"
      package: "exordos_s3"
      index_url: ""
      project_id: "4d657461-0000-0000-0000-000000000002"

  # s3 IAM permissions bound to the metapaas project owner role.
  $core.iam.permissions:
    s3_instance_create:
      name: "exordos_s3.s3_instance.create"
    s3_instance_read:
      name: "exordos_s3.s3_instance.read"
    s3_instance_update:
      name: "exordos_s3.s3_instance.update"
    s3_instance_delete:
      name: "exordos_s3.s3_instance.delete"
    bucket_create:
      name: "exordos_s3.bucket.create"
    bucket_read:
      name: "exordos_s3.bucket.read"
    bucket_update:
      name: "exordos_s3.bucket.update"
    bucket_delete:
      name: "exordos_s3.bucket.delete"
    policy_create:
      name: "exordos_s3.policy.create"
    policy_read:
      name: "exordos_s3.policy.read"
    policy_update:
      name: "exordos_s3.policy.update"
    policy_delete:
      name: "exordos_s3.policy.delete"
    user_create:
      name: "exordos_s3.user.create"
    user_read:
      name: "exordos_s3.user.read"
    user_update:
      name: "exordos_s3.user.update"
    user_delete:
      name: "exordos_s3.user.delete"
    access_key_create:
      name: "exordos_s3.access_key.create"
    access_key_read:
      name: "exordos_s3.access_key.read"
    access_key_update:
      name: "exordos_s3.access_key.update"
    access_key_delete:
      name: "exordos_s3.access_key.delete"
    s3_version_read:
      name: "exordos_s3.s3_version.read"

  $core.iam.permissionbinding:
    s3_instance_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$s3_instance_create:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    s3_instance_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$s3_instance_read:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    s3_instance_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$s3_instance_update:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    s3_instance_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$s3_instance_delete:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    bucket_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$bucket_create:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    bucket_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$bucket_read:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    bucket_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$bucket_update:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    bucket_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$bucket_delete:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    policy_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$policy_create:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    policy_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$policy_read:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    policy_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$policy_update:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    policy_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$policy_delete:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    user_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$user_create:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    user_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$user_read:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    user_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$user_update:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    user_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$user_delete:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    access_key_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$access_key_create:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    access_key_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$access_key_read:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    access_key_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$access_key_update:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    access_key_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$access_key_delete:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"
    s3_version_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$s3_version_read:uuid
      project_id: "4d657461-0000-0000-0000-000000000002"

  # s3 dataplane version catalog entry. Lives in the s3aas element namespace so
  # client manifests import it from $s3aas (same path as the standalone s3aas
  # element, backward-compatible). `description` carries the metapaas project id
  # for the core-agent version filter (em_s3aas_types_s3_versions).
  $s3aas.types.s3.versions:
    rustfs_1:
      name: "rustfs_1"
      description: "4d657461-0000-0000-0000-000000000002"
      image: "https://repo.exordos.com/exordos-elements/s3aas/0.0.4-rc+20260629135045.48052dea/images/exordos-metapaas-s3-dp.raw.zst"

exports:
  rustfs_1:
    link: "$s3aas.types.s3.versions.$rustfs_1"