Dogfooding lmctl-ai/lmaws on lmscript.io
How lmscript.io Is Provisioned & Published
Rather than maintaining brittle shell scripts or sprawling Terraform modules, lmscript.io uses
LMScript with embedded LMCode blocks targeting the native
lmctl-ai/lmaws host binary to provision its S3 bucket, ACM TLS certificate, CloudFront OAC distribution,
Route 53 DNS records, and SHA-256 verified static site uploads.
1. End-to-End AWS Infrastructure Stack
| Layer | AWS Resource | lmaws LMCode Method |
Details |
|---|---|---|---|
| DNS Zone | Route 53 Hosted Zone (lmscript.io) |
cloud.zones() |
Discovers the existing lmscript.io public hosted zone ID in Route 53. |
| IAM Policy | Scoped Stack & Deployer Policy | cloud.policy(name).static_site_stack(...) & .ci_bucket_deployer(...) |
Compiles and lints least-privilege IAM JSON policies scoped to the lmscript.io hosted zone and bucket prefix. |
| S3 Origin | Private S3 Bucket (Block Public Access) | web.step("bucket", json) & cloud.s3_bucket_create_exact(...) |
Creates private S3 bucket with PublicAccessBlock enabled on all 4 flags and tag lmaws_test=<run_id>. |
| TLS Certificate | AWS Certificate Manager (us-east-1) |
web.step("certificate", "{}") |
Requests ACM certificate, creates CNAME validation record in Route 53 lmscript.io zone, and awaits ISSUED. |
| CDN & OAC | CloudFront Distribution + OAC | web.step("distribution", "{}") |
Creates Origin Access Control (SigV4 signingBehavior=always), CloudFront distribution (PriceClass_100, DefaultRootObject=index.html, custom /404.html error responses), and S3 bucket policy conditioned on AWS:SourceArn. |
| DNS Alias | Route 53 A Alias Record |
web.step("dns_site", "{}") |
Upserts Route 53 Alias record targeting the CloudFront distribution (HostedZoneId Z2FDTNDATAQYW2) and waits for INSYNC. |
| HTTPS & Cache | Viewer Redirect & Cache Policy | web.step("https", "{}") & web.step("cache", json) |
Configures redirect-to-https with TLSv1.2_2021 SNI and sets TTLs. |
| Asset Upload | S3 Object Sync + SHA-256 Checksums | cloud.s3_put_file(bucket, key, path, opts) |
Uploads every HTML, CSS, JS, SVG, and .lms file with explicit content_type, cache_control, and SHA-256 checksums. |
| Edge Purge | CloudFront Cache Invalidation | web.step("invalidate", "{}") |
Creates a /* invalidation batch so updated pages are served immediately. |
2. Safe By Default: Preview, Simulator (awssim), and Live Modes
Following lmctl-ai/cloud-admin safety conventions, both scripts/setup-lmscript-io.lms
and scripts/deploy-site.lms run in deterministic offline preview mode
(aws.demo()) by default, can target a local awssim emulator via --sim, and only touch live AWS
when --live is explicitly passed:
Run Infrastructure & Deployment Scripts
# 1. Static check & lint the setup and deploy scripts
lmscript --check scripts/setup-lmscript-io.lms
lmscript --check scripts/deploy-site.lms
# 2. Offline preview (runs full lmaws DSLB v6 bytecode against aws.demo() backend)
lmscript scripts/setup-lmscript-io.lms --preview
lmscript scripts/deploy-site.lms --preview
# 3. Live AWS execution (requires AWS_PROFILE=lmaws or operator credentials)
AWS_PROFILE=lmaws lmscript scripts/setup-lmscript-io.lms --live --run-id=a1b2c3d4
AWS_PROFILE=lmaws lmscript scripts/deploy-site.lms --live --bucket=lmscript.io