Unify the AWS example with CloudFront and durable Edge Cookie storage

.github/workflows/format.yml

@@ -143,10 +143,10 @@ jobs:
       - name: Run host-target OpenRTB codegen clippy
         run: cargo clippy --package trusted-server-openrtb-codegen --target x86_64-unknown-linux-gnu --all-targets -- -D warnings
 
-      # The build-digest tests are native-only, so clippy-fastly compiles them
-      # to an empty crate. Lint them on the host.
-      - name: Run host-target core build-digest test clippy
-        run: cargo clippy --package trusted-server-core --target x86_64-unknown-linux-gnu --test template_build_digest -- -D warnings
+      # These core tests are native-only, so clippy-fastly compiles them
+      # to empty crates. Lint them on the host.
+      - name: Run host-target core build-digest and AWS config test clippy
+        run: cargo clippy --package trusted-server-core --target x86_64-unknown-linux-gnu --test template_build_digest --test aws_example_config -- -D warnings
 
   format-typescript:
     runs-on: ubuntu-latest

.github/workflows/native-aws-workload.yml

@@ -0,0 +1,62 @@
+name: Native AWS deployment example
+
+on:
+  pull_request:
+    paths:
+      - 'deploy/examples/native-aws-workload/**'
+      - '.tool-versions'
+      - '.github/workflows/native-aws-workload.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'deploy/examples/native-aws-workload/**'
+      - '.tool-versions'
+      - '.github/workflows/native-aws-workload.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  offline-checks:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      AWS_EC2_METADATA_DISABLED: 'true'
+      TF_IN_AUTOMATION: 'true'
+      CHECKPOINT_DISABLE: '1'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Read pinned tooling
+        id: versions
+        run: |
+          terraform=$(awk '$1 == "terraform" { print $2 }' .tool-versions)
+          node=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)
+          test -n "$terraform"
+          test -n "$node"
+          printf 'terraform=%s\nnode=%s\n' "$terraform" "$node" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: ${{ steps.versions.outputs.node }}
+
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
+        with:
+          terraform_version: ${{ steps.versions.outputs.terraform }}
+          terraform_wrapper: false
+
+      - name: Check the offline workflow contract
+        run: node --test deploy/examples/native-aws-workload/test-workflow.mjs
+
+      - name: Validate schema and credential-free mock plans
+        run: |
+          terraform -chdir=deploy/examples/native-aws-workload fmt -check -recursive
+          terraform -chdir=deploy/examples/native-aws-workload init -backend=false -input=false -lockfile=readonly
+          terraform -chdir=deploy/examples/native-aws-workload validate
+          terraform -chdir=deploy/examples/native-aws-workload/retained init -backend=false -input=false -lockfile=readonly
+          terraform -chdir=deploy/examples/native-aws-workload/retained validate
+          env -u NODE_OPTIONS -u NODE_PATH node deploy/examples/native-aws-workload/test-draft.mjs
+          git diff --exit-code -- deploy/examples/native-aws-workload/.terraform.lock.hcl deploy/examples/native-aws-workload/retained/.terraform.lock.hcl

.github/workflows/test.yml

@@ -186,8 +186,8 @@ jobs:
           path: ${{ runner.temp }}/trusted-server-finalize-axum-*/
           if-no-files-found: ignore
 
-      - name: Test template build digest inputs (native)
-        run: cargo test -p trusted-server-core --test template_build_digest
+      - name: Test build digest inputs and AWS config envelopes (native)
+        run: cargo test -p trusted-server-core --test template_build_digest --test aws_example_config
 
       - name: Run HTML processor benchmarks (smoke)
         # -- --test runs each benchmark as a regular test (no timing harness) so CI stays fast

crates/trusted-server-core/tests/aws_example_config.rs

@@ -0,0 +1,159 @@
+//! Verify the committed AWS examples through the native runtime config loader.
+
+#![cfg(not(target_arch = "wasm32"))]
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+use trusted_server_core::config_payload::VerifiedConfigBlob;
+use trusted_server_core::ec::storage::{EcRuntime, EcStorageSelection};
+use trusted_server_core::platform::{PlatformError, PlatformSecretStore, StoreId, StoreName};
+
+const ENVELOPES: [(&str, &str); 2] = [
+    (
+        "default",
+        include_str!("../../../deploy/examples/native-aws-workload/example-envelope.json"),
+    ),
+    (
+        "noindex",
+        include_str!("../../../deploy/examples/native-aws-workload/example-noindex-envelope.json"),
+    ),
+];
+
+struct FictionalSecrets;
+
+#[async_trait::async_trait(?Send)]
+impl PlatformSecretStore for FictionalSecrets {
+    fn get_bytes(
+        &self,
+        store_name: &StoreName,
+        key: &str,
+    ) -> Result<Vec<u8>, Report<PlatformError>> {
+        if store_name.as_ref() != "trusted_server_secrets" {
+            return Err(Report::new(PlatformError::SecretStore));
+        }
+        let value = match key {
+            "handler_password" => "fictional-reviewer-password",
+            "publisher_proxy_secret" => "fictional-publisher-proxy-secret-32-bytes",
+            "ec_passphrase" => "fictional-ec-passphrase-at-least-32-bytes",
+            _ => return Err(Report::new(PlatformError::SecretStore)),
+        };
+        Ok(value.as_bytes().to_vec())
+    }
+
+    async fn create(
+        &self,
+        _store_id: &StoreId,
+        _name: &str,
+        _value: &str,
+    ) -> Result<(), Report<PlatformError>> {
+        Err(Report::new(PlatformError::SecretStore))
+    }
+
+    async fn delete(&self, _store_id: &StoreId, _name: &str) -> Result<(), Report<PlatformError>> {
+        Err(Report::new(PlatformError::SecretStore))
+    }
+}
+
+#[test]
+fn committed_aws_envelopes_pass_runtime_integrity_and_settings_validation() {
+    let expected_keys = BTreeSet::from([
+        "handler_password".to_owned(),
+        "publisher_proxy_secret".to_owned(),
+        "ec_passphrase".to_owned(),
+    ]);
+    for (name, envelope) in ENVELOPES {
+        let blob = VerifiedConfigBlob::parse(envelope)
+            .unwrap_or_else(|error| panic!("should verify {name} envelope: {error:?}"));
+        assert_eq!(
+            blob.required_secret_keys()
+                .expect("should collect reference-only secret keys"),
+            expected_keys,
+            "should resolve only the three declared application secrets for {name}"
+        );
+        let settings = blob
+            .into_settings(
+                &FictionalSecrets,
+                &StoreName::from("trusted_server_secrets"),
+            )
+            .unwrap_or_else(|error| panic!("should validate {name} settings: {error:?}"));
+        assert_eq!(
+            settings.publisher.domain, "publisher.example.com",
+            "should preserve the operator-configurable publisher fixture"
+        );
+        assert_eq!(
+            settings.publisher.proxy_secret.expose(),
+            "fictional-publisher-proxy-secret-32-bytes",
+            "should resolve the proxy reference without using a real provider"
+        );
+        let Some(EcStorageSelection::DynamoDb(storage)) = settings
+            .ec
+            .resolve_storage(EcRuntime::Native)
+            .expect("should resolve native EC storage")
+        else {
+            panic!("should select DynamoDB for the {name} AWS envelope");
+        };
+        assert_eq!(
+            storage.region, "eu-west-2",
+            "should use the retained region"
+        );
+        assert_eq!(
+            storage.table, "example-retained-ec",
+            "should select the retained table"
+        );
+        assert_eq!(
+            storage.namespace, "example-staging",
+            "should preserve the stable retained namespace"
+        );
+        assert!(
+            storage.local_endpoint.is_none(),
+            "should not publish a local emulator endpoint"
+        );
+        assert_eq!(
+            settings
+                .response_headers
+                .get("X-Robots-Tag")
+                .map(String::as_str),
+            (name == "noindex").then_some("noindex"),
+            "should preserve the optional noindex configuration"
+        );
+    }
+}
+
+#[test]
+fn rewriting_cli_float_tokens_invalidates_the_aws_envelopes() {
+    for (name, envelope) in ENVELOPES {
+        let rewritten =
+            envelope.replacen("\"access_sample_rate\":0.0", "\"access_sample_rate\":0", 1);
+        assert_ne!(
+            rewritten, envelope,
+            "should exercise the original float-to-integer regression for {name}"
+        );
+        let error = VerifiedConfigBlob::parse(&rewritten)
+            .err()
+            .expect("should reject numeric normalization after CLI publication");
+        assert!(
+            error.to_string().contains("integrity verification"),
+            "should detect rewritten {name} config before startup: {error:?}"
+        );
+    }
+}
+
+#[test]
+fn tampered_aws_envelopes_fail_runtime_integrity_verification() {
+    for (name, envelope) in ENVELOPES {
+        let mut tampered: serde_json::Value =
+            serde_json::from_str(envelope).expect("should parse the committed envelope");
+        tampered["data"]["publisher"]["domain"] =
+            serde_json::json!("different.publisher.example.com");
+        let tampered =
+            serde_json::to_string(&tampered).expect("should serialize the tampered envelope");
+        let error = VerifiedConfigBlob::parse(&tampered)
+            .err()
+            .expect("should reject a data change without a matching checksum");
+        assert!(
+            error.to_string().contains("integrity verification"),
+            "should reject tampered {name} through the runtime integrity check: {error:?}"
+        );
+    }
+}

deploy/examples/native-aws-workload/.gitignore

@@ -0,0 +1,12 @@
+.terraform/
+*.tfstate
+*.tfstate.*
+*.tfplan
+*.tfvars
+*.tfvars.json
+*.auto.tfvars
+*.auto.tfvars.json
+*.backend.hcl
+crash.log
+crash.*.log
+.terraform.tfstate.lock.info