| name | floe-aws-provider-testing |
| description | Use when setting up, validating, running, or cleaning up Floe AWS provider testing through infra/aws-provider-tests. Applies to AWS S3 plus AWS Glue provider compatibility work, OpenTofu scaffold operations, AWS readiness checks, and cleanup evidence. |
Floe AWS Provider Testing
Use this skill for Floe AWS provider test-account setup and cleanup.
Preconditions
- Work from the repository root unless the user gives another Floe checkout.
- Read
docs/contributing/aws-provider-testing.md.
- Use
infra/aws-provider-tests for OpenTofu.
- Confirm the AWS account is a sandbox or approved test account.
- Confirm region, owner, budget email, and AWS profile.
- Do not use production data.
- Do not create EKS, NAT Gateway, Glue jobs, Glue crawlers, Lake Formation, S3 Tables, or always-on EC2 unless the user explicitly approves a separate design.
Setup Workflow
- Run
aws sts get-caller-identity --profile <profile> and confirm the account with the user-provided target.
- Copy
infra/aws-provider-tests/terraform.tfvars.example to infra/aws-provider-tests/terraform.tfvars if no local tfvars exists.
- Fill only non-secret values: region, owner, budget email, and tags.
- Run:
cd infra/aws-provider-tests
AWS_PROFILE=<profile> tofu init
AWS_PROFILE=<profile> tofu fmt -check
AWS_PROFILE=<profile> tofu validate
AWS_PROFILE=<profile> tofu plan -out tfplan
- Review the plan for allowed resource classes only: S3, IAM policy/user attachment if enabled, Budget.
- Run
AWS_PROFILE=<profile> tofu apply tfplan only after the plan is acceptable.
- Export the non-secret outputs needed by validation:
export FLOE_AWS_REGION=<region>
export FLOE_AWS_TEST_BUCKET=<bucket>
export FLOE_AWS_TEST_PREFIX=<s3-run-prefix>
export FLOE_AWS_GLUE_DATABASE_PREFIX=<glue-database-prefix>
export FLOE_AWS_BUDGET_NAME=<budget-name>
export FLOE_AWS_BUDGET_EMAIL=<budget-email>
export FLOE_AWS_PROVIDER_TEST_POLICY_ARN=<provider-test-policy-arn>
- Run
scripts/aws-provider-test-readiness.sh.
Cleanup Workflow
For a live provider run, set the current run ID:
export FLOE_PROVIDER_SPIKE_RUN=floe-provider-YYYYMMDDTHHMMSSZ
Then run:
scripts/aws-provider-test-cleanup.sh
If the whole scaffold is no longer needed:
cd infra/aws-provider-tests
AWS_PROFILE=<profile> tofu destroy
After cleanup, report S3, Glue, and any optional DevPod/EC2 inventory separately.
Failure Classification
- Product failure: Floe resolver, binding, runtime translator, renderer, or plugin behavior is wrong.
- Provider failure: AWS auth, S3, Glue, IAM, region, endpoint, or API behavior rejects the test.
- Infrastructure failure: OpenTofu, DevPod, Kind, network, or CLI setup fails before product validation.
- Cleanup failure: current-run AWS resources remain after cleanup.
