Metadata-Version: 2.4
Name: labagent
Version: 0.1.0
Summary: Provision, audit and safely tear down ephemeral AWS sandboxes for workshops, bootcamps and shared training accounts.
Author: BeCloudReady
License-Expression: Apache-2.0
Project-URL: Homepage, https://github.com/becloudready/labagent
Project-URL: Source, https://github.com/becloudready/labagent
Project-URL: Issues, https://github.com/becloudready/labagent/issues
Project-URL: Documentation, https://github.com/becloudready/labagent/tree/main/docs
Keywords: aws,training,workshop,sandbox,cleanup,iam,terraform,finops,boto3
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Education
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Software Development :: Build Tools
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: boto3>=1.34
Requires-Dist: cryptography>=42
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == "dev"
Requires-Dist: moto[all]>=5; extra == "dev"
Requires-Dist: build>=1.2; extra == "dev"
Requires-Dist: twine>=5; extra == "dev"
Dynamic: license-file

# labagent

Provision, audit and **safely tear down** ephemeral AWS sandboxes for workshops, bootcamps and shared training accounts.

```bash
pip install labagent     # Python 3.9+; Terraform or OpenTofu >= 1.11 for the cohort IAM layer
labagent --version
```

## Commands

| Command | What it does |
|---|---|
| `provision` | Terraform creates a cohort's IAM users, group, sandbox policy and Lambda role. Passwords are issued afterwards and returned **encrypted** to your public key, so state holds no secrets |
| `inventory`, `sweep` | List and delete what learners created. Plan first, then apply exactly that reviewed plan |
| `reset`, `offboard` | Rotate a learner's password; destroy a cohort (refuses while resources remain) |
| `audit`, `cleanup` | Clean an untagged, long-lived account from an explicit **ruleset** ([docs](docs/account-cleanup.md)) |

## Safety

- Plan, then apply: the plan is bound to the account, its items, an age limit and the hash a human approved.
- Only a `delete` rule can delete. `keep` rules always win; anything unmatched is reported, never removed.
- Refuses to run in an account that is not on your allow-list. Re-running is always safe.
- No plaintext secrets or emails in output or logs, and no PII in this repo (enforced by tests).

## Use

```bash
cp examples/config.example.json lab.json     # set allowed_account_ids and the S3 state backend
labagent --config lab.json run --job job.json --output result.json
```

Job and result formats: [docs/job-contract.md](docs/job-contract.md). State and secrets: [docs/state-and-secrets.md](docs/state-and-secrets.md).
Run it from a **private** CI repo with GitHub OIDC (examples in [docs/examples](docs/examples)), never from a public one.
Keep real configs, rosters, rulesets and job/result files out of this repo; `.gitignore` blocks the usual names.

Early release (v0.1), tested against mocked AWS: try a throwaway account first. Apache-2.0; see [SECURITY.md](SECURITY.md) and [CONTRIBUTING.md](CONTRIBUTING.md).
