From c545d08f399549de6527126a763e136b807f0450 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Fri, 14 Aug 2026 17:48:04 +0200
Subject: [PATCH] fix: apply lifecycle with boto3; require scw on PATH

aws CLI is not installed here. Create still needs Object Storage
permission on the bootstrap key.
---
 tools/create-platform-audit-bucket.sh | 59 +++++++++++++++++++--------
 1 file changed, 43 insertions(+), 16 deletions(-)

diff --git a/tools/create-platform-audit-bucket.sh b/tools/create-platform-audit-bucket.sh
index 7fdb44a..4ec8f35 100755
--- a/tools/create-platform-audit-bucket.sh
+++ b/tools/create-platform-audit-bucket.sh
@@ -15,8 +15,10 @@ PREFIX="${PREFIX:-platform-pg/}"
 ENDPOINT="https://s3.nl-ams.scw.cloud"
 
 need() { command -v "$1" >/dev/null || { echo "missing $1" >&2; exit 2; }; }
+export PATH="${HOME}/.local/bin:${PATH}"
 need python3
 need curl
+need scw
 
 TOKEN="${OPENBAO_TOKEN:-${VAULT_TOKEN:-}}"
 if [[ -z "$TOKEN" && -f "$HOME/.vault-token" ]]; then
@@ -60,26 +62,51 @@ PY
 )"
 
 export SCW_DEFAULT_REGION="$REGION"
-need scw
-need aws
 
 echo "creating private bucket $BUCKET in $REGION (versioning on)"
-scw object bucket create "$BUCKET" region="$REGION" acl=private enable-versioning=true
+scw object bucket create "$BUCKET" region="$REGION" acl=private enable-versioning=true -o json
 
 echo "applying 30-day lifecycle (current + noncurrent versions)"
-aws --endpoint-url "$ENDPOINT" s3api put-bucket-lifecycle-configuration \
-  --bucket "$BUCKET" \
-  --lifecycle-configuration '{
-    "Rules": [
-      {
-        "ID": "retain-30-days",
-        "Status": "Enabled",
-        "Filter": {"Prefix": ""},
-        "Expiration": {"Days": 30},
-        "NoncurrentVersionExpiration": {"NoncurrentDays": 30}
-      }
-    ]
-  }'
+VENV="${TMPDIR:-/tmp}/reef-storage-boto3"
+if [[ ! -x "$VENV/bin/python" ]]; then
+  python3 -m venv "$VENV"
+  "$VENV/bin/pip" -q install boto3
+fi
+BUCKET="$BUCKET" AWS_ACCESS_KEY_ID="$SCW_ACCESS_KEY" AWS_SECRET_ACCESS_KEY="$SCW_SECRET_KEY" \
+  "$VENV/bin/python" - <<'PY'
+import os
+import boto3
+client = boto3.client(
+    "s3",
+    region_name="nl-ams",
+    endpoint_url="https://s3.nl-ams.scw.cloud",
+    aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"],
+    aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"],
+)
+client.put_bucket_lifecycle_configuration(
+    Bucket=os.environ["BUCKET"],
+    LifecycleConfiguration={
+        "Rules": [
+            {
+                "ID": "retain-30-days",
+                "Status": "Enabled",
+                "Filter": {"Prefix": ""},
+                "Expiration": {"Days": 30},
+                "NoncurrentVersionExpiration": {"NoncurrentDays": 30},
+            }
+        ]
+    },
+)
+print("lifecycle applied")
+PY
+
+echo "creating a 20 EUR monthly budget alert if none exists"
+scw billing budget create consumption-limit=20 enabled=true -o json | python3 -c '
+import json,sys
+b=json.load(sys.stdin)
+print("budget_id", b.get("id") or b.get("budget",{}).get("id"))
+print("limit", b.get("consumption_limit") or b.get("budget",{}).get("consumption_limit"))
+' || echo "budget create skipped (permissions or API shape)"
 
 echo "writing non-secret attributes (no keys)"
 python3 - <<PY