region-remote-host

Provisions what an off-cloud CARLOS host needs when there is no EC2 instance profile to lean on: a region data bucket plus an IAM user carrying a scoped inline policy and access key, limited to this region's data bucket and nothing else (wrong-region-fails-at-IAM, the same residency property region-host gives cloud hosts).

Consumed by customer fleets (paulca/pi-fleet is the live example) and the platform's tito hq box. The module is reusable as-is for both — they differ only in account and variable values, not shape.

deployment_bucket_arn is optional (default ""). The fleet API surface (issue #73) means a fleet box no longer needs any IAM grant on the platform's deployment bucket at all: it reads releases and status, and writes heartbeats, through the console's edge (/store/o/...) using the same tunnel token it already dials with — the door authenticates and scopes the request, not a bucket-level AWS credential. That is the shape every new fleet-API consumer's tofu root should apply with: leave deployment_bucket_arn unset, and the module emits no deployment-bucket IAM statement at all.

The variable still exists for grandfathered direct-S3 boxes — ones still running the pre-#73 agent, or deliberately kept off the fleet API — which need RW straight on the deployment bucket exactly as before; set deployment_bucket_arn explicitly for those and the module emits the extra scoped statement (aws_iam_user_policy.host_deployment_bucket) on top of the always-present own-data-bucket grant.

The S3 action list in the inline policy is not independently chosen: it is copied verbatim from infra/modules/region-host/main.tf's aws_iam_role_policy.host_buckets (the authority for what this principal shape may do to S3), split the same way region-host splits it — object actions (GetObject/PutObject/DeleteObject) scoped to the object ARNs, and bucket-level actions (ListBucket/GetBucketLocation) scoped to the bucket ARNs. If region-host's action list changes, this module's should change with it.

The data bucket follows the same convention deployment-buckets uses for this class of bucket (see infra/modules/README.md): versioning, AES256 SSE, a full public-access block, and prevent_destroy, hard-coded the same way deployment-buckets hard-codes it (tofu can't take a variable in a lifecycle block). Boxes are disposable; this bucket is not — parked instance state has no other recovery story. A demo region like pi that needs to go away entirely is not a tofu destroy: empty the bucket first (S3 refuses to delete a non-empty bucket regardless of prevent_destroy), then either comment out the prevent_destroy line for that one apply or tofu state rm the bucket before removing the module instance — the same manual override deployment-buckets requires, not a mechanism specific to this module.