Deployment
Serverless Rust on AWS Lambda with S3 as the system of record.
Because compute is stateless and storage is object storage, deployment is serverless by construction: the Rust engine runs as an AWS Lambda over an S3 Iceberg warehouse and scales to zero when idle. Three CLI commands drive it end to end.
Scaffold a repo, configure its deployment, and let CI ship the code:
1
rastack
init
# template .github/workflows + .rastack/deploy.json
2
rastack
deploy
# configure the deployment; print the one-time stack launch
3
rastack
ci
deploy
# what CI runs on every push: build + update-function-code
rastack init writes two thin workflows (ci.yml and deploy-backend.yml) that call rastack ci, plus a DeployConfig at .rastack/deploy.json — defaulting the GitHub coordinates from your origin remote. Run it again any time to reconfigure.
The deploy is split by what changes, and how often — which is also what makes it secure. All durable infrastructure is created once, by a human; CI does exactly one thing on every push.
every IAM role, the Cognito pool, the KMS key, the S3 warehouse, the Lambda and its config, SSM
a single call — aws lambda update-function-code — over GitHub OIDC, no stored keys
rastack deploy prints the one-time aws cloudformation deploy for app.yaml, the GitHub repo Variables to wire from the stack Outputs (AWS_DEPLOY_ROLE_ARN, AWS_REGION), and the Lambda's RASTACK_* runtime env — it configures that step, it does not silently mutate the cloud.
Each phase of rastack ci is a pure function of the config, so the workflow YAML stays one line and rastack ci --plan <phase> prints the exact commands without running them:
rastack compile + rastack check — the manifest/graph gate
cross-build the arm64 Lambda, bake the Cognito JWKS in, zip the bundle
build, then aws lambda update-function-code → wait → print the API URL
› Good to know
The function name and JWKS URL come from the config's stack outputs when wired, or are resolved live from CloudFormation at run time — so the same config works before and after the stack exists.
A resource with access: { scope: "owner" } partitions its rows under warehouse/tenants/{sub}/…, and a Cognito Identity Pool role fences each tenant to its own prefix with the ${cognito-identity.amazonaws.com:sub} IAM variable — the same partitioning enforced by access control in the engine. ✓ Tip
The canonical templates live in deploy/cloudformation/ (bootstrap.yaml + app.yaml); the full guide is docs/serverless-deploy.md.
Build with AI
Every page is available as clean Markdown for LLMs and coding agents. Point one at the files below to build on top of React API Stack.
React API Stack · alpha · built to scale to millions