One-click AWS deploy: CloudFormation quick-start + Launch Stack button

[EdgarBabajanyan]

Problem

The "one-command deploy" badge linked to a markdown section — the reader still had to have kubectl and a cluster. There was no path where clicking a button opens AWS itself with Compass ready to create.

Fix

The classic orange Launch Stack button, in the README header next to the badges and leading the deploy section. It opens the CloudFormation console with deploy/cloudformation/compass-quickstart.yaml pre-loaded; one Create click provisions:

• a minimal self-contained VPC (zero required inputs)
• a private, encrypted S3 bucket with DeletionPolicy: Retain — deleting the stack never deletes the database
• a least-privilege task role with zero long-lived keys — object_store 0.13 natively picks up ECS task credentials (AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, verified in the vendored source)
• one Fargate task running ghcr.io/runcaptain/compass with CloudWatch logs; parameters for image tag, API key (NoEcho), allowed CIDR, and sizing

Scoped honestly as the evaluation/single-node path; the section steers fleets to the Kubernetes topology.

Tested

• cfn-lint clean.
• Deployed to CREATE_COMPLETE against a CloudFormation emulator — all 17 resources (VPC/subnets/routes, ECS cluster+service+taskdef, both IAM roles, log group, bucket) materialize.
• Stack deletion verified to retain the data bucket.

One-time setup after merge (repo admin)

CloudFormation quick-create links can only read templates from S3, so the button URL points at https://compass-cloudformation.s3.amazonaws.com/compass-quickstart.yaml. To make it live:

1. Create the compass-cloudformation bucket (us-east-1) with public s3:GetObject on *.yaml.
2. Add repo secrets CFN_PUBLISH_AWS_ACCESS_KEY_ID / CFN_PUBLISH_AWS_SECRET_ACCESS_KEY (an IAM user with PutObject on that bucket only); optionally variable CFN_TEMPLATE_BUCKET to use a different bucket name.
3. Run the "Publish CloudFormation template" workflow once (it also runs automatically on template changes and tags; without secrets it lints and skips upload, so forks stay green).

Until then the button 404s at the console's template-load step — the template itself ships in-repo either way.