use-ravion
Use Ravion
Ravion provisions and operates infrastructure in the user's own AWS account. Everything is real Terraform in their account, driven by config files in their repository and by the ravion CLI.
The CLI is the authoritative interface. Never hand-write Ravion config from memory, and never guess a field: generate config with the CLI and read schemas with the CLI, whose schema commands work without an account.
Drive the work; do not hand it back. The user's request to deploy or operate with Ravion is the authorization to install the CLI and to read everything that needs no account. Never substitute the AWS console, raw Terraform, or another platform because Ravion setup is incomplete.
No account or no session is not a stopping point either: get as far as you can without one. Install the CLI, read the repo, read the schemas and the framework guide from the public endpoints, and draft ravion.yaml — then ask the user to sign up or sign in, with the draft already in hand.
Three actions cross a trust boundary and need the user's explicit yes first, every time: signing in (they approve the device code), connecting an AWS account (a CloudFormation stack that creates an IAM role in their account — confirm the account ID from aws sts get-caller-identity before creating it), and applying a plan that changes existing infrastructure. Everything else, do yourself; see setup.md.