From a849802e1a3b6a5a956305a5c78c7794e5377725 Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Fri, 28 Aug 2026 17:39:08 +1000 Subject: [PATCH] sam-4screen-desktop 2026-8-28:17:39:8 --- 200 projects/220 Web Host Migration/Migration Work Log.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/200 projects/220 Web Host Migration/Migration Work Log.md b/200 projects/220 Web Host Migration/Migration Work Log.md index 4ce69c9..1883463 100644 --- a/200 projects/220 Web Host Migration/Migration Work Log.md +++ b/200 projects/220 Web Host Migration/Migration Work Log.md @@ -42,6 +42,9 @@ id: 1848129023-LOG | P1 | **Credentials verified** via AWS STS (`get-caller-identity`) | Account `648879824522`, user `backup-offsite`, region `ap-southeast-2` | | P1 | Credentials stored local-only (`aws-credentials.local` 0600, .27) + copied to `.13` (`~/.aws-credentials.local.new` 0600). **Not in Obsidian.** | — | | P1 | Verified `.13` has no aws-cli/rclone; will use one-off `nix-shell awscli2` for imperative steps until `backup.nix` updated | verified | +| P1 | STS key check OK (Account `648879824522`, user `backup-offsite`); created env-helper `~/.aws-offsite-env.sh` on `.13` (0600, sources creds from file, no secrets echoed) | verified | +| P1 | **MFA**: root MFA enabled in console; Ente Auth as authenticator (phone). Ente recovery keyphrase stored in local `aws-credentials.local` (0600), NOT Obsidian | — | +| P1 | **Blocked on** expanded IAM policy attach (bucket-mgmt + object actions scoped to `sam-offsite-backup`) before bucket+lifecycle can be created | awaiting user | ## Pending next action - **Build:** create bucket `sam-offsite-backup` + lifecycle (S3→Glacier Flexible@30d→Glacier DA@90d), then wire local Borg/rclone→S3 on `.13`, seed, test restore.