AWS Provider

Deploy data products to Amazon Web Services — S3, Glue, Athena — using the same contract and CLI commands as every other provider.

Status: ✅ Production
Docs Baseline: CLI 0.10.0
Tested Services: S3, Glue Data Catalog, Athena, IAM

Why it matters Run the same contract on AWS (S3 + Athena / Glue) with no AWS-specific rewrite. Set binding.platform: aws and Forge compiles the contract to Glue / Athena DDL and OpenTofu — the contract itself doesn't change.

AWS quickstart — S3 + Glue + Athena in 30 seconds

Same Customer 360 contract as the local quickstart, with binding.platform swapped to aws. S3 bucket provisioned, Glue catalog auto-created, Athena made queryable — all from one fluid apply.

Compatibility note

Examples on this page use the current fluidVersion: 0.7.5 shape. Orchestration guidance now prefers fluid generate schedule --scheduler airflow over the older fluid generate-airflow.

Overview

The AWS provider turns a FLUID contract into real cloud infrastructure:

✅ Plan & Apply — S3 buckets, Glue databases/tables, Athena workgroups
✅ IAM Policy Compilation — fluid policy-compile generates S3, Glue, and Athena IAM bindings from accessPolicy grants
✅ Sovereignty Validation — Region allow/deny lists enforced before deployment
✅ Orchestration Generation — prefer fluid generate schedule --scheduler airflow for current docs and automation
✅ Lake Formation Governance — principal grants, column-level grants, LF-tags (TBAC), row filters, and location registration via binding.governance.lakeFormation
✅ Universal Pipeline — Same Jenkinsfile as GCP and Snowflake — zero provider logic

Working Example: Bitcoin Price Tracker

This is a production-tested example that runs end-to-end in Jenkins CI.

Contract

fluidVersion: "0.7.4"
kind: DataProduct
id: crypto.market_data.bitcoin_prices_aws_v1
name: Bitcoin Price Tracker (AWS Athena)
description: >
  Real-time Bitcoin price data stored in AWS Athena with S3 backend,
  with comprehensive governance
domain: Market Data

tags:
  - crypto
  - market-data
  - real-time
  - governed
  - gdpr-compliant

labels:
  team: data-engineering
  cost-center: analytics
  business_criticality: "high"
  compliance_gdpr: "true"
  platform: "aws"

metadata:
  layer: Gold
  owner:
    team: data-engineering
    email: data-eng@company.com

# ── Data Sovereignty ──────────────────────────────────────────
sovereignty:
  jurisdiction: "EU"
  dataResidency: true
  allowedRegions:
    - eu-central-1       # AWS Frankfurt (GDPR compliant)
    - eu-west-1          # AWS Ireland
  deniedRegions:
    - us-east-1
    - us-west-2
  crossBorderTransfer: false
  transferMechanisms:
    - SCCs
  regulatoryFramework:
    - GDPR
    - SOC2
  enforcementMode: advisory
  validationRequired: true

# ── Access Policy: AWS IAM Principals ─────────────────────────
accessPolicy:
  grants:
    - principal: "role:data-analyst"
      permissions: [read, select, query]

    - principal: "role:finance-team"
      permissions: [read, select]

    - principal: "role:trading-desk"
      permissions: [read, select, query]

    - principal: "role:data-engineer"
      permissions: [write, insert, update, delete, create]

    - principal: "role:pipeline-service"
      permissions: [read, write, insert]

# ── Expose: Athena Table ──────────────────────────────────────
exposes:
  - exposeId: bitcoin_prices_table
    title: Bitcoin Real-time Price Feed
    version: "1.0.0"
    kind: table

    binding:
      platform: aws
      format: parquet
      location:
        database: crypto_data
        table: bitcoin_prices
        bucket: "{{ env.S3_BUCKET }}"
        path: data/bitcoin/prices/
        region: "{{ env.AWS_REGION }}"

    # Governance policies
    policy:
      classification: Internal
      authn: iam
      authz:
        readers:
          - role:data-analyst
          - role:finance-team
          - role:trading-desk
          - role:pipeline-service
        writers:
          - role:data-engineer
          - role:pipeline-service
        columnRestrictions:
          - principal: "role:intern"
            columns: [market_cap_usd, volume_24h_usd]
            access: deny
      # NOTE: on AWS, policy.privacy.masking / rowLevelPolicy are declarative
      # metadata only — they emit no AWS infrastructure. Use
      # binding.governance.lakeFormation for enforced row/column governance.
      privacy:
        masking:
          - column: "ingestion_timestamp"
            strategy: "hash"
            params:
              algorithm: "SHA256"
        rowLevelPolicy:
          expression: >
            price_timestamp >= DATE_ADD('day', -30, CURRENT_TIMESTAMP)

    # Schema contract
    contract:
      schema:
        - name: price_timestamp
          type: timestamp
          required: true
          description: UTC timestamp when price was recorded
          sensitivity: cleartext
          semanticType: "timestamp"

        - name: price_usd
          type: decimal(18,2)
          required: true
          description: Bitcoin price in USD
          sensitivity: cleartext
          semanticType: "currency"

        - name: price_eur
          type: decimal(18,2)
          required: false
          description: Bitcoin price in EUR

        - name: price_gbp
          type: decimal(18,2)
          required: false
          description: Bitcoin price in GBP

        - name: market_cap_usd
          type: decimal(20,2)
          required: false
          description: Total market capitalization in USD
          sensitivity: internal

        - name: volume_24h_usd
          type: decimal(20,2)
          required: false
          description: 24-hour trading volume in USD
          sensitivity: internal

        - name: price_change_24h_pct
          type: decimal(10,4)
          required: false
          description: 24-hour price change percentage

        - name: last_updated
          type: timestamp
          required: false
          description: Timestamp from CoinGecko API

        - name: ingestion_timestamp
          type: timestamp
          required: true
          description: When data was ingested into our system

# ── Build: API Ingestion ──────────────────────────────────────
builds:
  - id: bitcoin_price_ingestion
    description: Fetch Bitcoin prices from CoinGecko API
    pattern: hybrid-reference
    engine: python
    repository: ./runtime
    properties:
      model: ingest
    execution:
      trigger:
        type: manual
        iterations: 1
        delaySeconds: 3
      runtime:
        image: python:3.11-slim
        dependencies: [boto3, requests, pyarrow]
        env: [AWS_REGION, S3_BUCKET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY]
      retries:
        count: 3
        backoff: exponential
    outputs:
      - bitcoin_prices_table

Key Schema Patterns

The binding schema uses three fields to identify platform resources:

Field	Purpose	AWS Values
`binding.platform`	Cloud provider	`aws`
`binding.format`	Storage format	`parquet`, `s3_file`, `csv`, `json`
`binding.location`	Resource coordinates	`bucket`, `path`, `region`, `database`, `table`

This is identical to GCP (platform: gcp, format: bigquery_table) and Snowflake (platform: snowflake, format: snowflake_table).

CLI Commands

Every command is identical across providers. No --provider flag needed — the CLI reads the provider from the contract's binding.platform field.

# Validate contract against the bundled JSON schema
fluid validate contract.fluid.yaml --verbose

# Generate execution plan
fluid plan contract.fluid.yaml --env dev --out plans/plan-dev.json

# Deploy S3 bucket, Glue DB, Athena table
fluid apply contract.fluid.yaml --env dev --yes

# Compile IAM policies from accessPolicy grants
fluid policy-compile contract.fluid.yaml --env dev --out runtime/policy/bindings.json

# Apply IAM bindings (dry-run or enforce)
fluid policy-apply runtime/policy/bindings.json --mode check
fluid policy-apply runtime/policy/bindings.json --mode enforce

# Run the ingest script
fluid apply contract.fluid.yaml --mode amend-and-build

# Generate Airflow DAG
fluid generate-airflow contract.fluid.yaml --output airflow-dags/bitcoin_aws.py

# Export standards
fluid odps export contract.fluid.yaml --output standards/product.odps.json
fluid odcs export contract.fluid.yaml --output standards/product.odcs.yaml

IAM Policy Compilation

fluid policy-compile reads accessPolicy.grants from the contract and generates AWS IAM permission bindings:

{
  "provider": "aws",
  "bindings": [
    {
      "role": "role:data-analyst",
      "resource": "bitcoin_prices_table",
      "permissions": [
        "s3:GetObject",
        "s3:ListBucket",
        "glue:GetTable",
        "glue:GetDatabase",
        "athena:StartQueryExecution",
        "athena:GetQueryExecution",
        "athena:GetQueryResults"
      ]
    },
    {
      "role": "role:data-engineer",
      "resource": "bitcoin_prices_table",
      "permissions": [
        "s3:PutObject",
        "s3:DeleteObject",
        "glue:CreateTable",
        "glue:UpdateTable",
        "glue:DeleteTable"
      ]
    }
  ]
}

The permission mapping:

Contract Permission	AWS IAM Actions
`read`, `select`, `query`	`s3:GetObject`, `s3:ListBucket`, `glue:GetTable`, `glue:GetDatabase`, `athena:StartQueryExecution`, `athena:GetQueryResults`
`write`, `insert`, `update`, `delete`	`s3:PutObject`, `s3:DeleteObject`, `glue:CreateTable`, `glue:UpdateTable`, `glue:DeleteTable`

Credentials Setup

Jenkins CI (Recommended)

Create a Jenkins Secret File credential containing your AWS env vars:

# File contents (plain key=value, no 'export' prefix)
AWS_ACCESS_KEY_ID=AKIAxxxxxxxxxxxx
AWS_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
AWS_REGION=eu-central-1
S3_BUCKET=my-fluid-data-bucket

The Universal Pipeline auto-detects this format and sources it into every stage. No provider-specific credential logic.

Local Development

# Option 1: AWS CLI profile
aws configure --profile fluid-dev

# Option 2: .env file (same format as Jenkins)
cat > .env << 'EOF'
AWS_ACCESS_KEY_ID=AKIAxxxxxxxxxxxx
AWS_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
AWS_REGION=eu-central-1
S3_BUCKET=my-fluid-data-bucket
EOF

# Source and run
set -a; . .env; set +a
fluid apply contract.fluid.yaml --env dev --yes

Infrastructure Created

When you run fluid apply on an AWS contract, the provider creates:

Resource	Details
S3 Bucket	`s3://{S3_BUCKET}/data/bitcoin/prices/` — Parquet data storage
Glue Database	`crypto_data` — Data Catalog database
Glue Table	`bitcoin_prices` — External table pointing to S3
Athena Workgroup	Query engine configured for the region

What the Pipeline Produces

After a successful run, the pipeline writes real data:

s3://my-fluid-bucket/data/bitcoin/prices/
  └── bitcoin_prices_20250130_143052.parquet   ← BTC at $104,809

Queryable immediately via Athena:

SELECT price_timestamp, price_usd, price_eur, market_cap_usd
FROM crypto_data.bitcoin_prices
ORDER BY price_timestamp DESC
LIMIT 5;

Governance Features

Data Sovereignty

The sovereignty block enforces region restrictions before any infrastructure is deployed:

sovereignty:
  jurisdiction: "EU"
  allowedRegions: [eu-central-1, eu-west-1]
  deniedRegions: [us-east-1, us-west-2]
  crossBorderTransfer: false
  regulatoryFramework: [GDPR, SOC2]
  enforcementMode: advisory  # or strict (blocks deployment)

Lake Formation — the AWS governance surface

On AWS, row- and column-level governance is implemented through Lake Formation, declared under binding.governance.lakeFormation (with account-level admins/tag definitions under the top-level governance.lakeFormation block). On the OpenTofu apply path Forge emits the full Lake Formation surface:

Contract field	AWS resource emitted
`governance.lakeFormation.admins`	`aws_lakeformation_data_lake_settings`
`governance.lakeFormation.tagDefinitions`	`aws_lakeformation_lf_tag`
`binding.governance.lakeFormation.registerLocation`	`aws_lakeformation_resource`
`binding.governance.lakeFormation.grants`	`aws_lakeformation_permissions` (column-scoped via `table_with_columns`)
`binding.governance.lakeFormation.tags`	`aws_lakeformation_resource_lf_tags` (TBAC)
`binding.governance.lakeFormation.rowFilter`	`aws_lakeformation_data_cells_filter` (row + optional column projection)

exposes:
  - exposeId: bitcoin_prices_table
    binding:
      platform: aws
      format: parquet
      governance:
        lakeFormation:
          registerLocation: true
          grants:
            - principal: "arn:aws:iam::123456789012:role/data-analyst"
              permissions: [SELECT]
              columns: [price_timestamp, price_usd]   # column-level grant
          rowFilter:
            name: recent_only
            expression: "price_timestamp >= DATE_ADD('day', -30, CURRENT_TIMESTAMP)"

Lake Formation column grants and data-cells-filter column projection control access to columns. Lake Formation does not provide dynamic data-value masking, and there is no AWS data-masking primitive in this layer.

policy.privacy.masking / rowLevelPolicy are declarative-only on AWS

The policy.privacy.masking, policy.privacy.rowLevelPolicy, and policy.authz.columnRestrictions fields are valid in the schema, but no AWS provider or IaC code reads them — they emit no AWS infrastructure. Use binding.governance.lakeFormation (above) for AWS row/column governance. The policy.privacy block records intent as contract metadata only.

CI/CD Pipeline

The AWS example uses the exact same Jenkinsfile as GCP and Snowflake — the Universal Pipeline. Key stages:

Stage	Command	What Happens
Validate	`fluid validate`	Contract checked against the bundled schema
Export	`fluid odps export` / `fluid odcs export`	Standards files generated
Compile IAM	`fluid policy-compile`	`accessPolicy` → IAM bindings JSON
Plan	`fluid plan`	Execution plan generated
Apply	`fluid apply`	S3 bucket + Glue DB/table created
Apply IAM	`fluid policy-apply`	IAM bindings enforced
Execute	`fluid apply --mode amend-and-build`	`ingest.py` runs, writes Parquet to S3
Airflow DAG	`fluid generate-airflow`	Production DAG generated