AWS operator workspace · v0.3.5
Set the non-secret deployment context once. HayaSend turns it into version-pinned, plan-first commands from bootstrap through removal.
Your settings stay in this browser. This page cannot call AWS, HayaSend, or any third party.
Deployment context
One-time trust boundary
The CLI checks the authenticated account before it reads SES or CloudFormation. Bootstrap creates a service role, artifact bucket, and scoped operator policy; it does not attach the policy for you.
CloudFormation + SAM
Plan mode validates tools, identity, SES, the packaged template, and the exact change set. Apply enables termination protection and a retained-resource stack policy after deployment.
Domain + scoped credentials
Read the bootstrap token from an approved secret manager. Create
a dedicated sending subdomain, publish the returned DKIM records,
then issue an expiring application key with only
emails:send and emails:read.
Export HAYASEND_BASE_URL and an administrator key in your shell—never paste either into this page.
Run hayasend domains create, publish DNS, then run domains verify.
Run hayasend keys create with a mode-0600 token file and move it to your secret manager.
Real evidence
Use a controlled mailbox. Confirm the recipient ledger reaches a terminal state, the mailbox receives the message, alarms remain OK, and the job, DLQ, and scheduler DLQ return to zero.
The CLI test command sends real email against an AWS
deployment. Choose the sender and controlled recipient in your
terminal; this page intentionally does not collect them.
Routine operating loop
Run a fresh drift check after deployment, updates, and AWS incidents. The status result separates infrastructure health from SES send readiness and links the generated CloudWatch dashboard.
Safe change
Ordinary upgrades are plan-first and reject removals or possible replacements. Apply uses the configured canary strategy and rolls Lambda traffic back when deployment alarms fire.
Guarded removal
Cleanup first prints a deletion plan and every retained data resource. The browser cannot execute it. CloudFormation deletion still requires the exact stack name and a separate termination protection acknowledgement.
This removes the running CloudFormation stack. Retained tables, buckets, keys, and backup recovery points have a separate data lifecycle and are not purged automatically.
Need an accountable operator?
Haya can review migration, AWS hardening, deliverability, upgrades, rollback, and failure drills without moving message content into a Haya-hosted send path.