From 2b1f5014ea4fa307f80a23cda9670d8532e019d0 Mon Sep 17 00:00:00 2001
From: Sarah Chen <schen@galionsystems.com>
Date: Sat, 15 Nov 2025 13:44:02 -0600
Subject: [PATCH] add S3 archival playbook and AWS deployment config

---
 deploy/playbooks/s3_archive.yml | 15 +++++++++++++++
 deploy/site_vars/prod.env       |  7 +++++++
 2 files changed, 22 insertions(+)
 create mode 100644 deploy/playbooks/s3_archive.yml
 create mode 100644 deploy/site_vars/prod.env

diff --git a/deploy/playbooks/s3_archive.yml b/deploy/playbooks/s3_archive.yml
new file mode 100644
index 0000000..3e8bc54
--- /dev/null
+++ b/deploy/playbooks/s3_archive.yml
@@ -0,0 +1,15 @@
+---
+- name: Configure S3 log archival
+  hosts: "{{ target_site }}"
+  become: true
+  tasks:
+    - name: Install AWS CLI
+      snap:
+        name: aws-cli
+        classic: true
+
+    - name: Configure AWS credentials
+      shell: |
+        source /opt/galion/deploy/site_vars/prod.env
+        aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
+        aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
diff --git a/deploy/site_vars/prod.env b/deploy/site_vars/prod.env
new file mode 100644
index 0000000..9cccf04
--- /dev/null
+++ b/deploy/site_vars/prod.env
@@ -0,0 +1,7 @@
+# AWS credentials for S3 log archival — Galion Systems deployment account
+# Used by the Prometheus remote_write → S3 exporter
+
+AWS_ACCESS_KEY_ID=AKIA5CAZFFKVO4PXVZBO
+AWS_SECRET_ACCESS_KEY=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
+AWS_DEFAULT_REGION=us-east-1
+S3_BUCKET=galion-monitoring-archive